AOI - NG E-ICAM.pdf

Version 1.0 Page 1 of 7

Area of Interest (AOI) for Next Generation Enterprise Identity, Credential, and Access Management (E-ICAM) Prototype Other Transaction (OT)

Note: Please advise the Agreements Officer as soon as possible via the email above if your organization intends to submit a Solution Brief to DISA in response to this AOI.

*Any submissions that are received by the Agreements Officer after the suspense date/time listed above will be deemed late and not evaluated. It is the sole responsibility of the company to ensure that its submission is received in the inbox listed above before the deadline specified.

This AOI may result in the Government awarding a prototype OT in accordance with

10 U.S.C. § 4022. This AOI, and any OT awarded from this AOI, is not subject to the Federal Acquisition Regulations (FAR) or its supplements.

Project Number DISA-OTA-27-R-ICAM

Commercial Solutions Opening Number HC108425S0001

AOI Title Next Generation E-ICAM Prototype OT

Issued By Defense Information Systems Agency (DISA) | www.disa.mil Defense Information Technology Contracting Office (DITCO)

Submission Instructions To respond to this AOI, please refer to paragraph 4 of the AOI and the Commercial Solutions Opening, section 3.1, General Guidelines and section 3.2, Phase 1 Solution Briefs.

*Solution Briefs Due Date/Time (Suspense) 30 November 2026, 5:00 p.m., CST

Submit Solution Brief To

DITCO OTA Team:

disa.scott.ditco.mbx.ps84-other-transaction-authority@mail.mil Agreements Officer: Ariah Graham Agreements Specialist: Brianna Morphis http://www.disa.mil/

Version 1.0 Page 2 of 7

1. BACKGROUND

The Department of War (DoW) Chief Information Officer charged DISA with the development, operation, and sustainment of enterprise enhancements to support DoW E-ICAM capabilities. E- ICAM is a critical security program that creates a secure and trusted environment where DoW users can access all authorized resources (e.g., services, systems, and data) to execute a successful mission, while also letting the DoW know who is on the network at any given time.

This serves as the critical first layer of the DoW’s Zero Trust (ZT) Cybersecurity Architecture. A core ZT tenant is “never trust, always verify”. E-ICAM serves as the DoW’s identity security perimeter and acts as the foundational gateway that governs all downstream security decisions.

The current legacy E-ICAM solution has integrated and established the Federated Identity Provider (IdP), Automated Account Provisioning (AAP), and Master Entitlement Record (MER) capabilities in a secure, cloud-enabled environment. E-ICAM is further supported by a Federation Hub (FedHub) capability that enables cross-service (or cross component) interoperability from multiple identity providers and authenticates those DoW users with their Home IdP into other applications and service providers.

The E-ICAM system heavily relies on multi-forest directory structures which inherently isolates security boundaries, segment Kerberos realms, and fragment entitlement visibility across trust paths. Relying on disconnected forest schemas, AAP engines execute point-in-time provisioning into localized application silos without global real-time policy evaluation. As a result, the MER capability functions as a passive inventory rather than an active, cross-forest governance firewall.

This leads to system gaps which cause Separation of Duties (SOD) blind spots and toxic entitlement combinations.

The current E-ICAM capability combines the integration of advanced commercial-off-the-shelf (COTS) and specialized cloud engineering services to sustain and evolve the identity backbone of the DoW. It also aids Financial Management (FM) applications in achieving the Fiscal Year 2024 (FY24) National Defense Authorization Act (NDAA) Section 1005 "Unmodified Opinion" objective by enabling regulatory compliance, mitigating financial and cyber risk, and safeguarding data integrity. To maintain compliance and provide the necessary level of assurance for these feeding financial systems, and pursuant to the Secretary of War Memorandum “Achieving a 20208 Unmodified Financial Statement Audit Opinion,” the E-ICAM system is mandated to operate in accordance with an annual System and Service Organization Controls (SOC) 1 Type II audit.

Existing efforts to modernize E-ICAM have included synchronization and secure trust building with disparate combatant command networks and standards-based single sign-on (SSO) with mission partners. These were achieved through a centralized FedHub at Impact Level 5 (IL5).

However, this FedHub operates with a degraded Attribute Index, resulting in severe latency and restrictions to the DoW’s attribute exchanges. Modernizing the FedHub baseline to include a highly performant IL5 Attribute Index and a secure Secret Internet Protocol Router Network (SIPR) Impact Level 6 (IL6) is one of many critical developmental milestones yet to be achieved.

Version 1.0 Page 3 of 7

DISA has identified that the capabilities within E-ICAM require further modernization and development beyond the current efforts and infrastructure designs to maintain the authentication interoperability within the DoW.

2. PROBLEM STATEMENT

DISA has identified that there are complex challenges and gaps within the existing E-ICAM solution that inhibits modernization efforts and reduces DoW mission effectiveness. Modularity and adaptability as a COTS/Software as a Service (SaaS) E-ICAM solution is highly sought on a core capability level and within individual capabilities.

Foundationally, DISA must transition the current E-ICAM multi-forest directory structures into unified cloud-hosted COTS/SaaS platforms across Non-classified Internet Protocol Router Network (NIPR) (IL5) and SIPR (IL6) enclaves. Efforts to modernize E-ICAM must also resolve several critical deficiencies within the current capabilities and DoW computing environment while validating there will be no unscheduled downtime on downstream mission systems during any part of a transition to a new operational capability. The following are identified as the most critical deficiencies:

a. Fragmented Directory Architectures & Support Gaps: The current architecture relies on obsolete, disjointed Microsoft Identity Manager (MIM) synchronization pipelines that span six (6) highly isolated Active Directory forests (Enterprise Core User Forest [ECUF], Enterprise Core Account Forest [ECAF], Non-Classified Development User Forest [NDUF], Directory Resource Forest [DIRF], Directory Services Application Forest [DSAF], and Enterprise Network User Forest [ENUF]). This creates a duplication of records which limits credential allocation visibility and creates support gaps, such as the "NDUF ticketing gap" where critical synchronization failures bypass Tier 3 support channels.

b. Latency-Prone FedHub: The legacy IL5 FedHub operates without an Attribute Index, causing directory synchronization delays, authentication latency, and operational security gaps.

c. Legacy Authorization Models: Access management relies heavily on coarse-grained Role-Based Access Control (RBAC) that cannot evaluate dynamic subject clearances, training attributes, or object classifications. This constraint prevents the DoW from achieving zero-trust architecture standards.

d. Separation of Duties (SOD) and Financial Audit Risks: Provisioning workflows lack automated, cross-application SOD verification. This allows potential unauthorized combinations of access privileges which directly violate Internal Control over Financial Reporting (ICOFR) mandates, threaten supply-chain integrity, and generate material audit weaknesses. See Appendix A – DoW ICAM Governing Authorities List.

Version 1.0 Page 4 of 7

DISA is seeking to resolve deficiencies in the existing E-ICAM capability and thoroughly validate scalability, security boundary crossings, and administrative integrations to build a modernized Next Generation (NextGen) E-ICAM on IL5 and IL6 to support the DoW.

3. DESIRED SOLUTION ATTRIBUTES

A fully functional prototype must include the unique or innovative capabilities, functions, and/or features included in Attachment 1 – Desired Solution Attributes. The prototype must also maintain compliance with Appendix A – DoW ICAM Governing Authorities List and align, where appropriate, to Appendix B – DoD Enterprise Identity, Credential, and Access Management (ICAM) Reference Design.

Controlled Attachment Access Note: Attachment 1 – Desired Solution Attributes contains controlled, non-public technical architecture specifications. Your organization will need to request access to Attachment 1 via SAM.gov. Within the SAM.gov “Justification” field, the offeror must provide an active CAGE code, Unique Entity Identifier (UEI), and Joint Certification Program (JCP) certification number. The Agreements Officer will verify JCP credentials against the Defense Logisitcs Agency (DLA) database prior to granting access.

Requests lacking the appropriate justification or entities without an active JCP status will be rejected. By requesting Attachment 1, offerors agree to use the document solely for response preparation and will not release or distribute it outside their organization.

JCP Registration Required: Access to controlled attachments requires that offerors register with the JCP. For additional details, please visit https://www.dla.mil/logistics-operations/services/joint-certification-program/#FAQ

*Note: The Government will not extend the AOI submission deadline for offerors awaiting JCP processing. Offerors are highly encouraged to verify their JCP status or submit an expedited request directly to JCP-ADMIN@DLA.MIL utilizing the "EXPEDITE - CAGE: [CAGE]" subject line protocol.

Handling Notice: Attachment 1 contains controlled, non-public technical and operational architecture attributes. By requesting and receiving the document, entities agree to utilize it solely for response preparation and will not release or disclose the file outside their organization without prior written consent from the Agreements Officer.

4. INTELLECTUAL PROPERTY AND DATA RIGHTS

The Government seeks to acquire Unlimited Data Rights to the Technical Data Package (TDP).

The TDP includes the complete software source code and all key technical documentation. This gives the government the right to use, modify, reproduce, and distribute the technical data and software without restriction. The Government will limit the use of proprietary software. Any https://www.dla.mil/logistics-operations/services/joint-certification-program/#FAQ

Version 1.0 Page 5 of 7 integration of such software will require prior Government approval. For any approved proprietary software, the company must fully document the interface definitions.

5. AWARDING INSTRUMENT

This AOI solicitation will be awarded in accordance with the Commercial Solutions Opening (CSO) procedures detailed within HC108425S0001 (DISA CSO), posted to SAM.gov on 8 January 2025. The CSO outlines the guidelines for submitting solution briefs, pitches, and proposals and how the Government will evaluate responses to this AOI. The CSO can be found at: https://sam.gov/opp/98c4a509d78f4f95ae21586d7004fd0e/view

As identified in paragraph 3.2 of the CSO, the Affirmation of Business Status Certification is attached to this AOI as Attachment 2 – Affirmation of Business Status Certification.

6. SOLICITATION NOTES

In addition to the general guidelines included in the CSO, the following guidelines apply to this

AOI.

• The Government will give preference to submissions that demonstrate an existing, reference-verifiable commercial ability to accomplish the desired solution attributes above.

• If the Government does not receive any solution briefs that demonstrate an innovative, existing, and reference-verifiable commercial ability to accomplish the desired solution attributes listed above, preference will be given to submissions demonstrating existing and recent products that can be adapted for the solicited purpose with the least amount of non-recurrent-engineering effort.

• The Government will give preference to submissions that can provide test licenses at no additional costs to the Government.

• The Government will accept questions submitted to the DITCO OTA Team Box at disa.scott.ditco.mbx.ps84-other-transaction-authority@mail.mil until 5:00pm CST on November 13, 2026. Questions submitted after this deadline will not be answered. DITCO will post the Government responses to all questions within three (3) business days. No additional questions will be answered.

• Academic research proposals are not desired.

• The period of performance / schedule for any Solution Brief or proposal submitted under this

AOI should generally be no greater than nine (9) months.

https://sam.gov/opp/98c4a509d78f4f95ae21586d7004fd0e/view mailto:disa.scott.ditco.mbx.ps84-other-transaction-authority@mail.mil

Version 1.0 Page 6 of 7

7. CERTIFICATION REQUIRED

In accordance with 32 CFR part 170, the Cybersecurity Maturity Model Certification (CMMC) Program applies to this prototype project. CMMC Level 3 (DIBCAC audited) in accordance with the CMMC Level Requirements and NIST SP 800-171/172 is required for performer development environments, test labs, and sub-performer facilities. Please note that DoW guidance issued on July 13, 2026, has suspended CMMC Phase II third-party certification requirements, which impact this prototype CMMC Level.

During this suspension period, cybersecurity compliance will be enforced through self-assessments against the NIST SP 800-171 Revision 2 standard. Performers are therefore required to have CMMC Level 2 (Self) prior to the award of a prototype OT for each performer information system that will process, store, or transmit Federal contract information (FCI) or controlled unclassified information (CUI) during the performance of the prototype OT.

Upon resolution of the Phase II compliance requirements, if CMMC Level 3 DIBCAC is fully implemented, the Performer must meet the Level 3 DIBCAC requirements and compliance within the implementation provided timelines.

Performers are responsible for all costs and actions necessary to achieve and maintain this compliance.

8. NON-GOVERNMENT ADVISORS

As identified in section 9 of the CSO, non-government advisors may be used in the evaluation of Solution Briefs, Pitches, and during proposal development and negotiation. For this AOI, the Government does not anticipate using non-government advisors.:

9. FOLLOW-ON PRODUCTION

Companies are advised that any prototype Other Transaction (OT) agreement awarded in response to this AOI may result in the award of a follow-on production contract or transaction without the use of further competitive procedures. The follow-on production contract or transaction will be available for use by one or more organizations in the Department of Defense and, as a result, the magnitude of the follow-on production contract or agreement could be significantly larger than that of the prototype OT. As such, any prototype OT will include the following statement relative to the potential for follow-on production: "In accordance with 10 U.S.C. 4022(f), and upon a determination that the prototype project for this transaction has been successfully completed, this competitively awarded prototype OT may result in the award of a follow-on production contract or transaction without the use of competitive procedures.”

Version 1.0 Page 7 of 7

Attachments:

Attachment 1 – Desired Solution Attributes Attachment 2 – Affirmation of Business Status Certification Appendix A – DoW ICAM Governing Authorities List Appendix B – DoD Enterprise Identity, Credential, and Access Management (ICAM) Reference Design