EM5 Recompete Sources Sought Notice.docx

CUI

SOURCES SOUGHT NOTICE

622675558

The Defense Information Systems Agency (DISA) is seeking sources for Enterprise Messaging Modernization and Engineering Support (EMM-ES). This requirement will support DISA Portfolio Acquisition Executive Services (PAE Services) Service Directorate (SD), Command and Control (C2) Portfolio Management Office (SD4). The portfolio provides critical enterprise services to the Warfighter, Business, and Intelligence end-users to meet current mission requirements, but remains agile and mobile-enabled to meet real-world events and shifts in department mission sets.

CONTRACTING OFFICE ADDRESS:

Defense Information Technology Contracting Organization (DITCO) National Capital Region (NCR) P.O. Box 549 Fort Meade, Maryland 20755-0549

INTRODUCTION:

This is a SOURCES SOUGHT NOTICE to determine the availability and technical capability of large and small businesses (including the following subsets: Small Disadvantaged Businesses, certified 8(a), Service-Disabled Veteran-Owned Small Businesses, HUBZone Small Businesses and Woman-Owned Small Businesses) to provide the required products and/or services.

DISA is seeking information, industry insights, and technical capability statements from potential, qualified vendors to support the comprehensive lifecycle requirements of a modernized EM capability.

EM is a critical capability driving the Department of Defense (DoD) information-sharing initiatives and Joint Information Environment (JIE) goals. As part of the Net-Centric Enterprise Services portfolio, the anticipated effort will require continuous 24/7/365 contractor support to ensure a resilient, scalable, and highly secure infrastructure aligned with DISA’s operational standards and joint-warfighter requirements.

The Government is seeking industry partners with proven expertise in sustaining systems that distribute information efficiently between decoupled users and applications within a Community of Interest (COI). The EM infrastructure relies on standardized mechanisms to exchange data between applications and machines, utilizing a publish-subscribe messaging pattern based on a service-oriented architecture (SOA). Interested parties must demonstrate proficiency in supporting environments where producers and consumers invoke services via a Web Services Description Language (WSDL) file, allowing clients and servers to communicate natively without forcing end-users to drastically modify their software base or convert to web-based languages.

Capable sources must also possess the technical ability to manage diverse, hierarchically organized messaging topics and channels that govern EM data flow. The sustained solution must seamlessly support authorized publishers transmitting unaddressed messages—such as special reports, alerts, and briefs—while enabling authorized consumers to create synchronous or asynchronous subscriptions to these topics. Respondents to this notice are requested to submit capability statements that clearly demonstrate the specialized technical expertise, personnel, and management framework necessary to successfully deliver and sustain this critical DoD infrastructure.

The contractor shall achieve interoperability certifications and information assurance accreditations, while providing the support required to sustain the fielded solution. The Government shall provide hosting for the fielded solution at the agency’s direction. Additionally, the scope of this contract shall require the use of a DevSecOps methodology. The DevSecOps processes shall incorporate the Design Activity and inform both Preliminary Design Reviews (PDR) and Critical Design Reviews (CDR). The respective unclassified and classified DevSecOps environments shall provide full end-to-end functionality. Finally, all activities shall comply with Risk Management Framework (RMF), cybersecurity requirements and industry security best practices.

PERIOD OF PERFORMANCE:

The anticipated Period of Performance will be one, 12-month base period and four, 12- month option years (to be exercised at the discretion of the Government).

PLACE OF PERFORMANCE:

The anticipated place of performance for this Task Order will be at DISA Headquarters located at Fort Meade, MD and any DISA approved Contractor Secure Facility at the convenience of the Contractor.

Travel in and around the primary place of performance may be required throughout the period of performance. Additional travel within CONUS may be required to support the requirements of the performance work statement. Access to Secret Internet Protocol Router Network will be available at DISA Headquarters 6910 Cooper Ave, Fort Meade, MD 20755

DISCLAIMER:

THIS SOURCES SOUGHT NOTICE IS FOR INFORMATIONAL PURPOSES ONLY. THIS IS NOT A REQUEST FOR PROPOSAL. IT DOES NOT CONSTITUTE A SOLICITATION AND SHALL NOT BE CONSTRUED AS A COMMITMENT BY THE GOVERNMENT. RESPONSES IN ANY FORM ARE NOT OFFERS AND THE GOVERNMENT IS UNDER NO OBLIGATION TO AWARD A CONTRACT AS A RESULT OF THIS NOTICE. NO FUNDS ARE AVAILABLE TO PAY FOR PREPARATION OF RESPONSES TO THIS NOTICE. ANY INFORMATION SUBMITTED BY RESPONDENTS IS STRICTLY VOLUNTARY.

CONTRACT/PROGRAM BACKGROUND:

The EM5 requirement is a recurring requirement currently being executed under the following contract:

Contract Number: HC104718D2004/ HC104722F0052 Contract Vehicle: SETI Incumbent and their size: BAH, Large Business Method of previous acquisition: Task Order under Single Award Blanket Purchase Agreement Period of performance: 15 August 2022 – 14 August 2027

REQUIRED CAPABILITIES:

Capability Area 1: Machine-to-Machine Messaging the Enterprise Message 5 (EM5) platform is a machine-to-machine, publish-subscribe messaging service built on a foundation of Azure Platform as a Service at Impact Level (IL) 2, IL5, and IL6. The core broker is a highly customized Rabbit Message Queue (RabbitMQ) cluster that supports Advanced Message Queuing Protocol, Message Queuing Telemetry Transport, and Wireless Sensor Network protocols with a complex, policy-driven authorization model.

Describe and provide an example of your company's experience managing, sustaining, and troubleshooting a large-scale, multi-tenant messaging system using RabbitMQ, detailing your expertise with its core concepts (e.g., vhosts, exchanges, federated queues/exchanges) and support various messaging protocols.

Capability Area 2: Kubernetes AKS Containers the EM5’s architecture is deeply integrated with Azure Kubernetes Service (AKS) for container orchestration, Azure Firewall for network security, and Application Gateway with Web Application Firewall for Layer 7 ingress control. The entire infrastructure is managed as a cohesive platform, not as individual components.

Describe and provide an example of your company’s experience sustaining a containerized PaaS environment using AKS, including your capabilities in managing the associated networking, security, and monitoring services like Azure Firewall, Application Gateway, Azure Monitor, and Microsoft Defender for Cloud.

Capability Area 3: Cloud Native Applications and Security the EM5 system operates across multiple (DoD) ILs, including IL6 (Secret). This requires a contractor to manage distinct but related environments with differing security controls, network boundaries, and compliance requirements, while ensuring the platform remains stable and secure. Comment by Taitano, Korrina L CIV DISA PSD (USA): PMO - I believe this is still DoD. Comment by Butler, Troy A CIV (USA): resolved

Describe and provide an example of your company's experience deploying and sustaining cloud-native applications in a DoD IL6 Azure Government environment, specifically highlighting your ability to manage the unique security, identity, and operational constraints associated with classified systems. Comment by Taitano, Korrina L CIV DISA PSD (USA): PMO - I believe this is still DoD. Comment by Butler, Troy A CIV (USA): Resolved

Capability Area 4: Custom Software Management A critical component of EM5 is its custom-built RabbitMQ authorization plugin, which enforces a sophisticated Role-Based Access Control (RBAC) model based on hierarchical topics and resource permissions. This plugin is central to the system's Zero Trust security posture.

Describe and provide an example of your company’s experience developing, testing, or sustaining custom software plugins for open-source platforms like RabbitMQ. Focus on your ability to work with complex, policy-driven security and authorization logic.

Capability Area 5: Security EM5 enforces a strict security model requiring mutual Transport Layer Security (mTLS) for all client connections, using only valid, DOD-issued Non-Person Entity (NPE) or server certificates for authentication. This requires a deep understanding of Public Key Infrastructure (PKI) within a DoD context.

Describe and provide an example of your company's experience supporting systems that rely exclusively on DoD PKI and mTLS for machine-to-machine authentication, including your process for troubleshooting connection and certificate validation issues for mission partners. Comment by Taitano, Korrina L CIV DISA PSD (USA): PMO - See comment above Comment by Butler, Troy A CIV (USA): resolved

Capability Area 6: High Availability, Active-Active The platform is designed for high availability using active-active, multi-region architecture. This involves managing complex data and message flows, such as RabbitMQ federation, to ensure service continuity during regional outages.

Describe and provide an example of your company's experience managing and sustaining active-active, multi-region applications in a cloud environment. Please detail your expertise in ensuring the stability, recovery, and performance of distributed systems during failover scenarios.

SPECIAL REQUIREMENTS: The work to be performed under this contract/order is up to the Secret level. To be considered qualified and capable, Contractors must have a final Secret Facility Clearance from the Defense Counterintelligence and Security Agency Facility Clearance Branch at the time of proposal submission. Submit a copy of your current security clearance level.

SOURCES SOUGHT:

The North American Industry Classification System Code (NAICS) for this requirement is 541512 with the corresponding size standard of $34,000,000.00 Comment by Tran, Hung CIV DISA PAE SERVICES (USA): We need help to fill this in. Thanks!

To make a determination for a small business set-aside, two or more qualified and capable small businesses must submit responses that demonstrate their qualifications. Responses must demonstrate the company’s ability to perform in accordance with FAR clause 52.219-14, Limitations on Subcontracting.

To assist DISA in determining the level of participation by small business in any subsequent procurement that may result from this Sources Sought Notice, provide information regarding any plans to use joint ventures (JVs) or partnering. Please outline the company's areas of expertise and those of any proposed JV/partner who combined can meet the specific requirements contained in this notice.

SUBMISSION DETAILS:

Responses should include:

1) Responses to the Required Capabilities and Special Requirements above;

2) Business name and address;

3) Name of company representative and their business title;

4) Small Business Socio-economic status (if small);

5) Commercial and Government Entity (CAGE) Code;

6) Prime contract vehicles; to include ENCORE III, SETI, NIH CIO-SP4, NASA SEWP V, GSA: OASIS, ALLIANT II, VETS II, STARS III, MAS (including applicable SIN(s), groups or pools), or any other Government Agency contract vehicle that allows for decentralized ordering. (This information is for market research only and businesses with a valid CAGE code that lack prime contract vehicles are still encouraged to respond to this notice.)

Businesses who wish to respond shall send a response via email no later than 4:00 PM Eastern Standard Time on October 2, 2026 to elizabeth.a.bono.civ@mail.mil and stephanie.h.chapman2.civ@mail.mil. Interested businesses should submit a brief capabilities statement package addressing the specific questions above (no more than seven pages), demonstrating the ability to perform the services listed under Required Capabilities.

Proprietary information and trade secrets, if any, shall be clearly marked on all materials. All information received that is marked Proprietary will be handled accordingly. All submissions become Government property and will not be returned. All Government and contractor personnel reviewing submitted responses will have signed non-disclosure agreements and understand their responsibility for proper use and protection from unauthorized disclosure of proprietary information as pursuant to 41 USC 423. The Government shall not be held liable for any damages incurred if proprietary information is not properly identified.

For information on DISA’s requirements, you can find current information on our home page: www.disa.mil – that includes current forecast and the current acquisition strategies. If there is no information regarding the requirement you may be inquiring about, then there is no additional publicly available information. Please continue to review www.disa.mil.

Page 2 of 4 Pages

Page 1 of 5 Pages