DISAFY27LEGACY - SSN - Clean 06262026.docx

SOURCES SOUGHT NOTICE

Legacy Application Development and Sustainment Support Tracking ID: DISAFY27LEGACY

The Defense Information Systems Agency (DISA) is seeking sources to provide full life-cycle application management for their Legacy Systems.

CONTRACTING OFFICE ADDRESS:

DISA/DITCO-NCR

6910 COOPER AVENUE, FT. MEADE MD 20755

INTRODUCTION:

This is a SOURCES SOUGHT NOTICE (SSN) to determine the availability and technical capability of small businesses (including the following subsets: Small Disadvantaged Businesses, Certified 8(a), Service-Disabled Veteran-Owned Small Businesses, HUBZone Small Businesses, and Woman-Owned Small Businesses) to provide the required products and/or services.

This requirement is for full life-cycle application management of the Legacy System. The Legacy System primarily consists of Contract Support System (CSS), Contractual Online Procurement System (COPS), Financial Accounting and Budget System (FABS), and the Defense Information Technology Contracting Organization (DITCO) Web. This also includes other subsystems, such as: Rates and Tariffs File System (RTFS), Joint Hawaii Information Transfer System (JHITS), the Delivery Ticket Invoicing (DTI) process, Accounting & Audit Operations Office (CFA) Accounts Payable (A/P) Validation, Procurement Services (PS) A/P Validation, Information Technology (IT) Contract Closeout, Inquiry Quote Order (IQO) Contract Closeout, Telecom Voucher Management, and the European Voucher Module.

Anticipated Period of Performance: June 10, 2027 – June 9, 2032

Place of Performance: Contractor site with periodic Continental United States (CONUS) travel.

DISCLAIMER:

THIS SOURCES SOUGHT NOTICE IS FOR INFORMATIONAL PURPOSES ONLY. THIS IS NOT A REQUEST FOR PROPOSAL. IT DOES NOT CONSTITUTE A SOLICITATION AND SHALL NOT BE CONSTRUED AS A COMMITMENT BY THE GOVERNMENT. RESPONSES IN ANY FORM ARE NOT OFFERS AND THE GOVERNMENT IS UNDER NO OBLIGATION TO AWARD A CONTRACT AS A RESULT OF THIS NOTICE. NO FUNDS ARE AVAILABLE TO PAY FOR PREPARATION OF RESPONSES TO THIS NOTICE. ANY INFORMATION SUBMITTED BY RESPONDENTS IS STRICTLY VOLUNTARY.

CONTRACT/PROGRAM BACKGROUND:

Contract Number: HC104722C0009 Contract Vehicle: 8(a) Direct Award Incumbent and their size: Arlluk Technology Solutions LLC, 8(a) Method of previous acquisition: 8(a) Direct Award Period of performance: June 10, 2022 - June 9, 2027

REQUIRED TECHNICAL CAPABILITIES:

Refer to the attached draft Performance Work Statement (PWS) for additional details and descriptions of this requirement.

This requirement includes full lifecycle support, such as program management, development, cybersecurity, operations, maintenance and sustainment for the Legacy System. To demonstrate your company’s capabilities, please describe and provide a specific example of your experience in each of the following areas. If available, when citing experience, please include reference to contract/order numbers and your role (prime, sub, JV-partner).

1. COPS and FABS are 40+ year old mainframe applications. Please describe your company’s capabilities and experience in the following:

a. Performing code discovery, maintenance, and vulnerability remediation on dated legacy systems.

b. Navigating, analyzing, and modifying JCL, source code, Supra PDM, ROSCOE, and Mantis.

c. Troubleshooting dated legacy systems in cases where jobs run improperly, in the wrong order, or not at all.

2. FABS undergoes annual Information Technology Audits in support of Agency and Departmental Financial Statement Audits. Please describe your company’s capabilities and experience in the following:

a. Support as a system provider in delivering comprehensive audit readiness and technical audit defense for DoD financial management systems.

b. Managing the end-to-end Provided by Client (PBC) request lifecycle, executing complex data extractions while establishing the completeness and accuracy (C&A) of audit evidence, and facilitating technical system walkthroughs with external auditors (such as IPAs or the DoD OIG) to validate the effectiveness of IT General Controls (ITGCs) and Application Controls.

3. CSS is a web-based application backed by an Oracle database. The server-side code is written in .NET C# and the client-side, UI facing code is written using Angular. Please describe your company’s capabilities and experience in the following:

a. Managing, sustaining, and optimizing web-based applications, Oracle databases, and utilizing .NET C# and Angular code for an application with a customer prioritized backlog.

b. Supporting federal acquisition or contract management workflows, detailing how your technical support streamlined contract administration, improved system efficiency, or ensured the timely processing of awards and modifications.

4. The Legacy and Information Security System Officer (ISSO) support team must ensure the system maintains a rigorous cybersecurity posture while remaining operational. Please describe your company’s capabilities and experience in the following:

a. Executing Risk Management Framework (RMF) requirements, managing POA&M resolution, and applying security patches to legacy mainframe systems while managing system downtime.

5. The Legacy team supports DISA Business Systems in Portfolio Acquisition Executive Command, Control, Communications & Enterprise (PAE C3E), the Procurement Service Directorate (PSD), and the Office of the Chief Financial Officer (J8). The Legacy application supports CSS, COPS, FABS users including military, civilian, and contractor personnel totaling approximately about 700 employees. Please describe your company’s capabilities and experience in the following:

a. Providing Tier II/Tier III application support at an enterprise scale, including how you manage helpdesk ticket volume and maintain Service Level Agreements (SLAs) for a large user base.

6. DISA is in the process of modernizing many legacy applications. Please describe your company’s capabilities and experience in the following:

a. Sustaining a legacy system concurrently while a modernization effort is underway.

b. Conducting data extraction, maintaining legacy interfaces, and executing a safe decommissioning and transition plan.

SPECIAL REQUIREMENTS & REQUESTED INPUT

1. Work performed under this requirement is anticipated to be up to the Secret level. A final Secret Facility Clearance Level will be required. Please include the status/level of your company’s FCL, as well as whether the FCL is for your company or via partnership/JV.

2. Please cite any ambiguities in the draft PWS that would prevent you from providing a best value technical proposal.

3. Is there sufficient detail in the draft PWS to accurately provide a cost/price proposal (e.g., defined level-of-effort, scope, deliverables)? Please explain your stance.

4. Please share feedback related to the use of innovative contracting methodologies for this requirement such as the below examples.

a. Oral Proposals/Presentations

b. Technical/Management Confidence Ratings

c. Technical Challenge/Scenario/Demonstration

d. Best Suited Approach

e. Phased Proposals/Evaluations

f. Firm/Advisory Down Select

5. Please provide input/concerns with providing oral proposals vice-written proposals; providing technical proposals in addition to oral presentations; or solely providing written technical proposals for an effort such as this.

SOURCES SOUGHT:

The anticipated North American Industry Classification System Code (NAICS) for this requirement is 541512 with the corresponding size standard of $34,000,000. This Sources Sought Synopsis is requesting responses to the following criteria from small businesses that can provide the required services under the NAICS Code.

· To assist DISA in deciding the level of participation by small businesses in any subsequent procurement that may result from this Sources Sought, you are also encouraged to provide information regarding your plans to use joint venturing (JV) or partnering to meet each of the requirement areas contained herein. This includes responses from qualified and capable Small Businesses, Small Disadvantaged Businesses, Service Disabled-Veteran Owned Small Businesses, Women-owned Small Businesses, HUBZone Small Businesses, and 8(a) companies. You should provide information on how you would envision your company's areas of expertise and those of any proposed JV/partner would be combined to meet the specific requirements contained in this announcement.

· In order to make a determination for a small business set-aside, two or more qualified and capable small businesses must submit responses that demonstrate their qualifications. Responses must demonstrate the company’s ability to perform in accordance with the Limitations on Subcontracting clause (FAR 52.219-14).

SUBMISSION DETAILS:

To facilitate the review, the Government requests responses formatted as follows:

1. Business name, address, POC, CAGE, UEI, and small business socioeconomic status (if small)

2. Existing Contract Vehicles/Schedules to include ENCORE III, SETI, NIH CIO-SP4, NASA SEWP V, General Service Administration (GSA): OASIS, ALLIANT II, VETS II, STARS III, MAS (including applicable SIN(s), groups or pools), or any other Government Agency contract vehicle that allows for decentralized ordering. (This information is for market research only and businesses with a valid cage that lack prime contract vehicles are still encouraged to respond to this notice.). Please include number, ordering period expiration, business size reflected on award, whether prime/partnership/JV, NAICS/SIN

3. Technical Capabilities Response

4. Special Requirements & Requested Input Response

Vendors who wish to respond to this should send responses via email not later than July 14, 2026 at 1200 Eastern Standard Time (EST) to jeffrey.m.lopez5.civ@mail.mil and quinton.a.smith.civ@mail.mil. Interested businesses should submit the information listed above. There is no page limitation, but it is the respondent’s responsibility to ensure their email submission can be received.

Proprietary information and trade secrets shall NOT be submitted as part of a response. Please be advised that all submissions become Government property and will not be returned. All government and contractor personnel reviewing SSN responses will have signed non-disclosure agreements and understand their responsibility for proper use and protection from unauthorized disclosure of proprietary information as described 41 USC 423. The Government shall not be held liable for any damages incurred if proprietary information is submitted, as it is clearly stated this type of information shall NOT be submitted.

For information on DISA’s requirements, you can find current information on our home page: www.disa.mil – that includes current forecast and the current acquisition strategies. If there is no information regarding the requirement you may be inquiring about, then there is no additional publicly available information. Please continue to review www.disa.mil.

Page 2 of 4 Pages

Page 1 of 5 Pages