Call for Solutions ECMA_26-02 Sentinel Overwatch for the Cloud.pdf

CALL FOR SOLUTIONS

SENTINEL – OVERWATCH FOR THE CLOUD

Project Number ECMA_26-02 Army Open Solicitation (AOS) Number W9128Z-25-S-A002 Call for Solution Title Sentinel – Overwatch for the Cloud Issued By Army Contracting Command – Rock Island

Arsenal (ACC-RIA), Strategic IT Directorate

Submission Instructions To respond to this Call for Solution, please refer to Section 7 of this Call for Solution

*Solution Briefs Due Date/Time (Suspense)

9 SEP 2026 at 1 p.m. Central Time

Point of Contracts (POCs) for Solution Brief Submission

Contracting Officer: Tim Volkert, timothy.w.volkert.civ@army.mil Contracting Specialist: Roxanne Schlue, roxanne.m.schlue.civ@army.mil

NOTE: Please advise the cognizant Contracting/Agreements Officer and Contract Specialist as soon as possible via the emails above if your organization intends to submit a Solution Brief in response to this Call for Solution.

*Any submissions that are received by the Contracting/Agreements Officer after the suspense date/time listed above will be deemed late and not evaluated. It is the sole responsibility of the company to ensure that its submission is received in the email inboxes listed above before the deadline specified.

This Call for Solution is issued under the authority of Revolutionary Federal Acquisition Regulation Overhaul (RFO) Defense Federal Acquisition Regulation Supplement (DFARS) 212.70 – Defense Commercial Solutions Opening and may result in the Government awarding Federal Acquisition Regulation (FAR) contracts or non-FAR agreements. Other Transactions (OT) that may be awarded from this Call for Solution are not subject to the RFO FAR or its supplements, as applicable.

1. BACKGROUND.

The Enterprise Cloud Management Activity (ECMA) provides enterprise-scale cloud services to the United States Army across Non-classified Internet Protocol Router (NIPR) Network and Secret Internet Protocol Router (SIPR) Network environments. A critical component of ECMA’s mission is measuring, monitoring, and securing cloud workload performance and cybersecurity health across all lifecycle phases.

ECMA’s operating environment continues to rapidly expand. ECMA currently supports nearly 200 customers distributed across over 1,600 individual cloud accounts, and the customer base is increasing 10-15% annually. Currently, ECMA processes between 100 and 200 change requests per week and supports technical exchange meetings with each new customer.

Challenges & Capability Gap: Historically, managing this distributed multi-cloud footprint has relied on disparate, manual, or siloed monitoring tools, resulting in fragmented telemetry, increased administrative burden, and potential blind spots in real-time threat posture. The core capability gap this requirement addresses is the lack of a unified, enterprise-wide observability and security platform capable of delivering automated, continuous host-level and cloud-native monitoring, compliance auditing, and proactive anomaly detection across multi-cloud IL5 boundaries without custom integration overhead.

2. PROBLEM STATEMENT.

ECMA currently lacks full, automated visibility into all cloud workloads across our environment and does not have a baseline cybersecurity “score” for its tenants or ECMA workloads.

ECMA requires a highly functional, standards-based approach to monitoring workloads, current configurations, service consumption, and cybersecurity posture.

With over 1,600 accounts and customer demand expected to double in the next few years, relying on fragmented tools or manual tracking is no longer sustainable. Without a single, automated way to monitor workloads, ECMA faces operational blind spots:

• Slower Incident Response: When outages or performance lags happen, troubleshooting across different clouds takes too long and disrupts mission operations.

• Security & Compliance Drift: Misconfigurations and security vulnerabilities can sit undetected across tenant accounts without a centralized, real-time compliance baseline.

• Cost Inefficiencies: ECMA lacks continuous tracking needed to catch idle resources or billing overages before they become major expenses.

Key Capabilities & Outcomes Needed:

ECMA needs a proven commercial solution that delivers:

• Complete Workload & Cloud Visibility: Automated, real-time discovery and metrics tracking across all virtual servers, containers, and cloud services without complex custom integrations.

• Automated Security Scoring: Continuous compliance scanning that maps workloads to defense security baselines and generates clear risk ratings.

• Tamper-Proof Audit Logging: Complete, centralized logging of administrative changes and user access for forensic reviews.

• Hands-on Technical Enablement: Expert-led training and dedicated support to help our engineering teams optimize usage and resolve severe system issues fast.

3. REQUIRED AND DESIRED SOLUTION ATTRIBUTES.

A successful solution must describe how you can successfully accomplish the following high-level functional needs and how you will maintain the services and features over time. Reaching optimal performance and streamlined operations rapidly is essential.

3.1 Required Attributes:

Operational Scale

• Up to 25K monitored host

• Up to 4 cloud service providers (e.g., Amazon Web Services [AWS], Azure, Google, Oracle)

• Up to 2 network domains (e.g., NIPR, SIPR)

• Approximately 1,600 accounts

• Approximately 250 tenants

• Expect 10-15% annual growth.

Telemetry

The platform must naturally ingest the four fundamental data pillars to provide full-stack context:

• Metrics: High-frequency numeric time series data (Central Processing Unit, memory, request rates) to detect system anomalies.

• Events: Distinct, timestamped occurrences (deployments, configuration changes, scale-ups) that correlate with service updates.

• Logs: Semi-structured or unstructured textual records containing deep debugging context and stack traces.

• Traces: End-to-end distributed transaction paths across complex microservice boundaries to surface execution latency.

Cybersecurity & Threat Monitoring

Modern observability must blur the lines between performance tracking and runtime protection:

• Runtime Threat Detection: Real-time analysis of system behaviors, file modifications, network traffic, and process executions to block live attacks (e.g., Structured Query Language (SQL) injections, remote code execution).

• Application & Application Programming Interface (API) Protection: Automated code-level scanning to discover open-source vulnerabilities (Software Composition Analysis) and exposed API endpoints.

• Security Telemetry Integration: Direct correlation of threat alerts with infrastructure logs and application traces, allowing teams to see the exact blast radius of a security event.

Continuous Compliance & Governance

• Automated Posture Management: Continuous scanning of cloud infrastructure (Cloud Security Posture Management [CSPM]) and container environments against industry benchmarks – Computer Information Systems (CIS), National Institute of Standards and Technology (NIST), International Organization for Standardization (ISO) 27001, System and Organization Control (SOC) 2, Health Insurance Portability and Accountability Act (HIPAA), and Payment Card Industry Data Security Standard (PCI DSS).

• Real-Time Audit Logging: Tamper-proof, immutable auditing of user activity, infrastructure state alterations, and access requests.

• Data Masking & Privacy: Inline pipeline controls that automatically identify and redact personally identifiable information (PII) or secrets (API keys) before ingestion.

Drift Detection & Remediation

• Infrastructure-as-Code (IaC) Drift Tracking: Continuous state evaluation to immediately catch differences between live cloud resources and your defined configuration files (Terraform, OpenTofu, Ansible).

• Automated Remediation Workflows: Triggering low-code/no-code automated action runbooks or webhooks (e.g., re-running an deployment pipeline or isolating a server) when drift or a critical vulnerability is detected.

• Golden Signals Baseline: Continuous learning engines that establish normal system thresholds and flag configuration changes that break those performance baselines.

Operational & Analytical Capabilities

• Unified Data Correlation: Automated mapping that links a failing trace to its corresponding container logs and underlying host metrics without manual searching.

• Intelligent Alerting: Dynamic thresholding and machine-learning-driven anomaly detection to suppress alert fatigue and surface true root causes.

• Open Standards Native: Support for open-source frameworks—primarily OpenTelemetry (OTel) APIs, SDKs, and agents—to prevent vendor lock-in.

• Real-time Querying & Dashboards: Low-latency parsing and search capabilities across terabytes of data alongside interactive visual layouts.

• User & Frontend Analytics: Real user monitoring (RUM) and synthetic test simulations to track actual customer experience against backend performance.

Platform Governance & Scale

• Cost & Data Volume Control: Granular pipeline controls to sample, filter, or route data before expensive ingestion occurs.

• Scalability: A multi-tenant Software as a Service (SaaS) architecture capable of handling massive telemetry spikes during traffic surges.

3.2 Desired Attributes:

Financial Operations and Reporting

• Consumption and Budgeting: Highly configurable service consumption integration with each cloud service provider (AWS, Azure, Google, Oracle).

• Prediction and Optimization: Predict future spend and make optimization recommendations.

4. AWARDING INSTRUMENT

The Call will be awarded in accordance with (IAW) the Army Open Solicitation procedures detailed within Solicitation W9128Z-25-S-A002, and the below link:

https://sam.gov/workspace/contract/opp/7df4b9bdf5cd4b58ba63a32c407382d1/view.

The Government intends to award a RFO FAR Part 12, Firm-Fixed-Price (FFP) type contract resulting from this Call for Solutions.

The anticipated Period of Performance (PoP) will consist of a 12-month Base Period and four (4) 12-month Option Periods.

This Call provides instructions to companies and how the Government will evaluate submissions.

5. CALL INSTRUCTIONS AND NOTES

5.1 Overview of Submission Phases

The response process for this Call will generally consist of the following phases:

Phase 1: Solution Brief Offerors will submit a high-level summary of their proposed solution, addressing the Government’s objectives and requirements.

Phase 2: Pitch (unless bypassed) Selected offerors may be invited to present and discuss their solution in a live or virtual setting.

Phase 3: Solution Proposal Offerors advancing to this phase will be invited to submit a detailed proposal for final evaluation and potential award. Detailed submission requirements for Phase 1 are provided in Section 6. Evaluation criteria for Phase 1 are outlined in Section 7. Phase 2 https://sam.gov/workspace/contract/opp/7df4b9bdf5cd4b58ba63a32c407382d1/view and/or Phase 3 submission requirements and evaluation criteria will be provided via subsequent invitation letters.

5.2 General Notes

Offerors are reminded that all awards are subject to the availability of funds and the

Government reserves the right to make multiple awards, a single award, or no award as a result of this Call.

Only a Contracting or Agreements Officer has the authority to enter into, modify, or execute a binding instrument on behalf of the United States Government. All payment obligations are subject to Congressional appropriations.

In order to be eligible for award, Offerors must:

o Possess a Unique Entity Identifier (UEI), be registered in the System for

Award Management (SAM) prior to award and maintain active registration throughout the period of performance.

o Register in the prescribed Government invoicing system (e.g., Wide Area Work Flow).

o Accurately represent their small business size and status as required.

o Be determined responsible by the Contracting/Agreements Officer and not be suspended, debarred, or otherwise prohibited from receiving an award.

o Disclose any actual or potential Organizational Conflicts of Interest (OCIs) to the Contracting/Agreements Officer prior to award.

Offerors are responsible for monitoring SAM.gov for any amendments or updates to this Call.

Notice to Offeror(s): The Government reserves the right to cancel this open Call, either before or after the closing date. If the Government cancels this open Call, the Government has no obligation to reimburse an offeror for any costs.”

The Government may down-select potential awardees under this Call for Solution The Government reserves the right to award more than one award resulting from this Call for Solution or to make no award.

The Government will inform all Offerors whether they have or have not been selected to move forward based on their submitted Solution Brief.

Visible Text & Document Formatting Compliance: All proposal content must be presented as visible text using a standard, readable font (i.e., not requiring magnification), as readability directly impacts the Government's ability to assess the merits of the proposed solution. The inclusion of any concealed text (including micro text, white text on a white background, or text hidden within images/graphics/metadata) is strictly prohibited and will render the submission non-compliant. While companies are encouraged to use diagrams, graphics, and concise text to effectively convey complex information (landscape-oriented 11 x 8.5-inch pages are permissible for visuals), these will count toward the total page limits, which are strictly enforced. Any pages submitted beyond the maximum allowed for any phase will be removed by the Government and will not be evaluated.

Resellers and academic research proposals are not desired.

Companies that currently hold an Enterprise Agreement (EA)/Enterprise Contract

(EC) with the Army or DoD are required to identify and propose in accordance with those existing agreements.

All Solution Briefs will be valid for 180 calendar days after the submission date.

The Government may utilize internal Artificial Intelligence (AI) tools to assist in the administrative review and analysis of proposals, such as by summarizing content or verifying compliance with solicitation requirements. However, the use of AI is strictly for support purposes; all final evaluation judgments, all final evaluation judgments and the ultimate selection decision are inherently governmental functions. The Government is committed to protecting all offeror proprietary and source selection sensitive information, and any AI tool used will operate in a secure environment, consistent with all applicable data protection regulations, and will not transmit data to external systems.

The Government's objective is that all requirements be met, either by a single vendor or by a team of vendors under a single submission. The Army places no restrictions on how Primes/Teams are organized. While only one proposal is permitted per Prime/Team, Offerors may cross-team; for example, an Offeror may submit as a Prime and also serve as a Team Member under another Prime, and Team Members may participate in multiple teams. Teaming agreements must be outlined in Phase 1 Solution Briefs. The Army cannot and will not manage Offeror Teaming Arrangements.

6. SOLUTION SUBMISSION REQUIREMENTS

6.1 Phase 1 – Solution Brief

Companies responding to this call shall submit a Solution Brief for evaluation.

Submissions are to be sent via email only to the Contracting Officer and Specialist (POCs) listed in this Call for Solution. The email subject line must strictly read: ECMA_26-02 Submission - [Company Name].

Solution Briefs shall not exceed 5 written pages using 12-point Times New Roman font. The Government will not consider inserted (floating) textboxes/pop-ups or internet links to additional information as part of the Solution Brief and will not consider such information in its evaluation. Solution Briefs are intended to be clear and concise.

Solution Briefs shall include the following at a minimum:

a. Title Page (one page, does not count against 5-page limit)

i. Company Name, Title, Date, Point of Contact Name, E-Mail Address, Phone, Address, and Call reference number. If registered in SAM.gov, include the Commercial and Government Entity (CAGE) code and Unique Entity Identification code. Note: SAM registration is required for any award.

ii. Ensure the Call for Solutions reference number and topic (e.g., Sentinel) is clearly identified.

b. Executive Summary (one page, counts against 5-page limit)

i. Provide an executive summary of the Offeror and its solution.

c. High-Level Solution/Concept (counts against 5-page limit)

i. Describe the unique aspects of your solution/concept and its relevance to the Call and how the solution addresses the problem statement and solution objectives. Describe how the proposed solution/concept fulfills the requirement, its scalability, and the specific benefits it offers in relation to the objectives of this Call.

ii. Explain whether the solution/concept is innovative and/or a potential capability.

iii. Explain how the proposed technical approach is feasible, achievable, and supported by a technical team with the expertise and experience to accomplish the proposed solution/concept.

iv. Provide a proposed schedule aligned with a 12-month Base Period and (4) 12-month Option Periods and describe how the proposed schedule is achievable for the proposed solution/concept.

v. Provide a summary of product/solution commercialization and go-to-market strategy.

vi. Confirm the proposed SaaS cloud platform holds an active or in-process DoD Cloud Computing Security Requirements Guide (SRG) Impact Level 5 (IL5) Provisional Authorization (PA) to operate across Army enterprise boundaries.

d. Rough Order of Magnitude (ROM). (one page, does not count against the 5-page limit)

i. Provide a Rough Order of Magnitude (ROM) that delineates costs for key components, including but not limited to, software licensing modules, host/ingest volume assumptions based on the scale described in Section 3.1, and any technical onboarding support.

e. Past Performance and Experience: (one page, does not count against 5-page limit)

i. Provide three (3) specific examples of solutions completed within the last three (3) years that explicitly satisfy similar observability and security monitoring needs at a similar-sized organization (i.e., supporting at least 1,500 cloud accounts or 200+ distinct customer tenants). The submission must ensure the examples provide a verifiable account of executing relevant services at the required scale.

f. Intellectual Property Statement/Agreement/Disclosures (does not count against 5-page limit)

i. Identify any intellectual property involved in the effort.

ii. Clearly state any associated restrictions on the Government’s use of that intellectual property, proposed licensing models, and data rights assertions.

Include a separate disclosure for each partnering company, if applicable.

RFO DFARS subpart 252.227-7017(d) may be used for formatting.

The Government may be unable to evaluate the Solution Brief if a company fails to submit the required contents for Phase 1.

6.2 Phase 2 – Pitch

Phase 2 submission requirements and evaluation criteria will be outlined in the invitation to this phase, if selected and unless bypassed.

6.3 Phase 3 – Proposal

Phase 3 submission requirements and evaluation criteria will be outlined in the invitation, if selected, for this phase.

7. EVALUATION PROCESS & CRITERIA

The Government will evaluate Phase 1 Solution Briefs using a Two-Stage Review

Process:

Stage 1: Compliance Gate Review (Pass/Fail)

Stage 2: Technical Merit and Feasibility Assessment

7.1 Stage - Compliance Gate Review (Pass/Fail)

All Solution Briefs will be vetted against the gate criteria in Table 1. Submissions must receive a PASS on all five (5) gates to advance to Stage 2 merit evaluation. A failure on any single gate will result in disqualification without further review.

Table 1. Stage 1 Compliance Gate Criteria Gate Description Pass Fail 1 Submission

Formatting and Completeness

The Solution Brief must be submitted according to the specified format limits. The submission must clearly and comprehensively address all required criteria in Section 6 for the initial compliance review, ensuring no essential elements are missing or ambiguous.

The Solution Brief will be disqualified if it exceeds the specified format limits.

Additionally, the submission will be disqualified if it lacks clear and comprehensive details addressing all required criteria in Section 6, or if essential elements necessary for the initial compliance review are missing or ambiguous.

2 Rough Order of Magnitude

(ROM)

The Solution Brief must provide a complete, one page ROM that delineates software licensing modules, host/ingest volume assumptions, and technical onboarding support in adherence with specified submission instructions.

The Solution Brief will be disqualified if the one-page ROM is omitted, incomplete, unbundled, or fails to provide pricing details for the proposed software and support components.

3 Commercial Availability and Efficiency

The Solution Brief must demonstrate a proven, reference-verifiable capability that is foundationally built on Commercial Off-The-Shelf (COTS) technologies The submission must explicitly detail how any necessary

The Solution Brief will be disqualified if it fails to demonstrate an existing and reference-verifiable capability and if it relies on custom development, substantial non-recurrent engineering, or otherwise fails to

Gate Description Pass Fail adaptations will be accomplished with minimal non-recurrent engineering (NRE).

provide sufficient evidence of its reliance on COTS components.

4 Technical Merit & Innovation

The Solution Brief must clearly demonstrate innovative solution that integrates the requirements into a single, holistic platform capable of scaling to Army needs using both agentless and agent-based monitoring.

The Solution Brief will be disqualified if (a) its proposed methodology relies on custom developed software, human intensive processes, manual data entry, or labor-intensive workflows; (b) requires the integration of multiple independent solutions by the Government; (c) fails to provide both agentless and agent-based monitoring.

5 Past Performance and Experience

The Solution Brief must provide three specific examples of solutions completed within the last three years that explicitly satisfies similar needs and requirements at a similar sized organization. The submission must ensure the examples provide a verifiable account of executing relevant services at the required scale.

Valid points of contact for each example are required.

The Solution Brief will be disqualified if it fails to include the mandatory three examples, if any example falls outside the three-year timeframe, or if the experience does not demonstrate direct fulfillment of similar requirements expressed herein.

The submission will also be disqualified if the examples are generically scoped, lack verifiable details, lack a valid point of contact, or fail to reflect the necessary technical complexity.

7.2 Stage 2 – Technical and Feasibility Assessment

Submissions that pass all Stage 1 Gates will be evaluated by the Government evaluation panel across the following factors in descending order of importance:

Factor Factor Title Evaluation Description 1 Technical Merit &

Innovation The degree to which the proposed commercial platform natively ingests all four telemetry pillars (Metrics, Events, Logs, Traces), provides real-time runtime threat detection, delivers automated CSPM / NIST compliance mapping, and automates Infrastructure as Code (IaC) drift remediation.

2 Scalability & Operational Feasibility

The feasibility of deploying across ECMA’s 1,600+ multi-cloud accounts (AWS, Azure, GCP, Oracle) within DoD IL5 boundaries, minimizing vendor lock-in via OpenTelemetry standards, and the achievability of the proposed schedule.

Factor Factor Title Evaluation Description 3 Viability The commercial maturity, corporate stability, and risk associated with the proposed licensing models and data rights assertions.

7.3 Solution Brief Selection Process

Based on the Stage 1 Gate Review and Stage 2 Merit Evaluation, the Contracting Officer will categorize Solution Briefs as “Selected for Further Consideration” or “Not Selected for Further Consideration.”

Selected for Further Consideration: The submitted Solution Brief has been determined to be of technical merit, represents a feasible and viable solution, and included all required submittals IAW the Call. As such, the Government intends to invite the company to Phase 2 (Pitch) (unless bypassed), or Phase 3 (Proposal), subject to funding.

Not Selected for Further Consideration: The submitted Solution Brief did not pass all Stage 1 gates or does not represent the necessary degree of technical merit, does not represent a feasible and viable solution and/or did not include all required submittals IAW the Call.

Offerors ‘Selected for Further Consideration’ may be invited to participate in subsequent phases, subject to the availability of funds. The Government reserves the right to limit the number of Offerors invited to Phase 2 – Pitch Session (unless bypassed) and/or Phase 3 – Solution Proposal. As such, an Offeror’s solution may be evaluated as ‘Selected for Further Consideration’, however, not invited to Phase 2 and/or Phase 3.

The Government reserves the right to limit the number of offerors invited to subsequent phases, and to bypass Phase 2 directly into Phase 3.

Solution Briefs, whether selected or not selected for subsequent Phases, will be notified in writing as soon as practicable of their evaluation results.

The Army anticipates Topics may routinely receive more Solution Briefs than resources to award. All submissions will be fairly evaluated, however, only select Solution Briefs will be invited to Phase 2 and/or Phase 3. As such, an Offeror’s solution may be evaluated to be of merit but not invited to Phase 2 and/or Phase 3.

8. ORGANIZATIONAL CONFLICT OF INTEREST (OCI) (no page limit) The Offeror shall perform an OCI analysis and submit the results of that analysis in addition to the Solution Brief submission. Specifically, the Offeror shall analyze the details of the Call and the implementation of their proposed Solution for actual or potential OCI situations associated with the performance of the Offeror, or any of the Offeror’s proposed teammates or subcontractors, under any contract or agreement the Offeror or the Offeror’s teammates or subcontractors have been or may be awarded by any federal agency or other entity. The Offeror shall describe in detail the methodology used to identify actual or potential OCI issues. The level of detail for OCI analysis may not be the same for all vendors. RFO FAR 9.5 may be used as guidance for OCI analysis. If no conflicts are identified, a risk mitigation plan is not required; however, a description of the analysis methodology, and an affirming statement that no conflicts are identified shall be included. This section will not count against submission page limits.

If the Offeror identifies any actual or potential OCIs with respect to the performance of the Offeror or the Offeror’s subcontractors or teammates, the contractor shall provide an OCI Mitigation Plan to be incorporated as an attachment to any resulting contract or agreement. Any proposed avoidance or mitigation techniques shall be consistent with RFO FAR 9.5 and the most recent decisions of the Government Accountability Office (GAO) and the U.S. Court of Federal Claims.

8. ORGANIZATIONAL CONFLICT OF INTEREST (OCI) (no page limit)