MES Sources_Sought_SAMgov_842571048_31 Oct 2024.docx

SOURCES SOUGHT NOTICE

Tracking Number: 842571048

The Defense Information Systems Agency (DISA) is seeking sources for the Mobile Enterprise Services (MES) capability in support of DISA’s Department of Defense (DoD) Enterprise Mobility Division (S5). The MES objective is to provide support for the DoD Mobility Unclassified Capability (DMUC) and DoD Mobility Classified Capability (DMCC) service offerings current capability and integrate new capabilities across these platforms.

CONTRACTING OFFICE ADDRESS:

DISA/Defense Information Technology Contracting Organization (DITCO)/PS8414 2300 East Drive, Building 3600 Scott Air Force Base, Illinois 62225-5406

INTRODUCTION:

This is a SOURCES SOUGHT NOTICE to determine the availability and technical capability of large and small businesses (including the following subsets: Small Disadvantaged Businesses, Certified 8(a), Service-Disabled Veteran-Owned Small Businesses, HUBZone Small Businesses and Woman-Owned Small Businesses) to provide the required products and/or services.

DISA S5, hereafter referred to as the Mobility Portfolio Management Office (PMO), operates three separate mobility systems: DMUC, DMCC-Secret (DMCC-S), and DMCC-Top Secret (DMCC-TS). Below is a summary of the systems.

a. DMUC is DoD’s mobile managed enterprise service that enables approved Government-furnished commercial mobile devices (CMDs) and operating system (OS) access to the unclassified DoD Information Network (DoDIN) and commercial information services. DMUC utilizes commercial transport (cellular and Wi-Fi) and DoD Wi-Fi in select locations for access to email, numerous approved mobile applications, Office 365, and Non-classified Internet Protocol Router Network access via an enterprise level virtual private network (VPN). Customers provide their own Government-furnished CMDs (approved models are identified in the DoD Enterprise Mobility Authorized Devices and Peripherals for DMUC) to connect to the DMUC service.

b. DMCC is DoD’s mobile managed enterprise service that enables approved DISA-furnished customer purchased CMDs, both Android and Windows for access to the classified DoDIN Secret Internet Protocol Router Network to obtain access for voice and Enterprise services, both applications, Office 365, and web. DMCC is based on the National Security Agency Commercial Solutions for Classified (CSfC) Mobile Access Capability Package (MA CP) as well as other required CSfC documents. DMCC utilizes commercial transport (cellular and Ethernet) via hotspot to connect to CSfC designed gateways. DMCC is an ever-evolving capability keeping up with the changing of the mobile devices landscape and the request for new capabilities.

The Mobility PMO is seeking information from potential sources for: Continued support for DMUC and DMCC service offerings current capability and integrate new capabilities across these platforms. The MES Contractor, herein Contractor, shall provide unclassified and classified integration and management, development, engineering, testing, mobile application management, product support, cybersecurity, and Tier III engineering support within a complex unclassified and classified environment. Engineering activities include design and impact assessment of new required capabilities, as well as new equipment and/or software for addressing new and/or updated commercial solutions supporting DMUC and DMCC. Maintaining and improving the user experience is imperative for this fee-for-service offering; utilizing technology (automation) fully is paramount versus placing a manual function or action on the user to execute. Processes that take days or hours should strive to be accomplished in minutes or seconds. Continual service improvement is vital in the ever-evolving mobile space.

The anticipated Period of Performance: July 20, 2025 – July 19, 2030, consisting of a 1-year base period with 4, 1-year option periods.

The anticipated Place of Performance: Work may be performed on-site, at all CONUS and OCONUS facilities or at the Contractor’s facility, sub-vendor facility, supplier, or other designated locations (e.g., corporate, third party, or sub-vendor). DISA has allocated on-site workspaces that will provide this support at a Government site. On-site spaces at Government facilities may be revoked at any time per Government requirements.

Places of Performance shall include the following, at a minimum, and subject to change based on requirements:

A draft copy of the Performance Work Statement is included as an additional attachment.

DISCLAIMER:

THIS SOURCES SOUGHT NOTICE IS FOR INFORMATIONAL PURPOSES ONLY. THIS IS NOT A REQUEST FOR PROPOSAL. IT DOES NOT CONSTITUTE A SOLICITATION AND SHALL NOT BE CONSTRUED AS A COMMITMENT BY THE GOVERNMENT. RESPONSES IN ANY FORM ARE NOT OFFERS AND THE GOVERNMENT IS UNDER NO OBLIGATION TO AWARD A CONTRACT AS A RESULT OF THIS NOTICE. NO FUNDS ARE AVAILABLE TO PAY FOR PREPARATION OF RESPONSES TO THIS NOTICE. ANY INFORMATION SUBMITTED BY RESPONDENTS IS STRICTLY VOLUNTARY.

CONTRACT/PROGRAM BACKGROUND:

MES-Unclassified for DMUC Engineering and Support Services Contract Number: HC102818D0006/HC108421F6105 Contract Vehicle: ENCORE III Full & Open Suite Incumbent and their size: Booz Allen Hamilton/Large Method of previous acquisition: competed fair opportunity Period of performance: April 4, 2021 – April 3, 2025

MES-Classified for DMCC Engineering and Support Services Contract Number: HC108420D0004/HC108420F0242 Contract Vehicle: Mobility Enterprise Services - Classified: DISA Single Award Indefinite Delivery Indefinite Quantity Incumbent and their size: Booz Allen Hamilton/Large Method of previous acquisition: single award delivery order Period of performance: July 20, 2020 – July 19, 2025

The Government is considering combining the two DMUC and DMCC requirements into one acquisition. The following is the information being sought. Each required capability is identified if supporting DMUC, DMCC (DMCC-S/DMCC-TS), or both mobility systems. When responding, the company should identify if they can meet one or both mobility systems.

REQUIRED CAPABILITIES:

1. Requirements Process (Both) As an Enterprise Service, the Mobility PMO engages stakeholders, including the operational community, the Capability and Service Requirements Office (CSRO), and the Mission Partner Engagement Office for determination and delineation of the overall DMUC, DMCC-S and DMCC-TS operational requirements. The Mobility PMO needs to determine how and when each new Mobility requirement should be verified, the tasks required to do so, as well as the necessary resources (i.e., test plan) to produce the verification matrix and supporting documentation to become part of the Mobility program’s functional and allocated baselines. Describe and provide an example of your company’s experience in the following:

a) Elicit and document operational needs and objectives into defined requirements that are cohesive, traceable, unambiguous, and testable;

b) Decompose and maintain traceability between high-level operational requirements to project or system-level requirements;

c) Design, develop and execute the management and tracking of DMUC, DMCC-S and DMCC-TS requirements through the entire engineering life cycle.

2. Systems Engineering Plan (SEP) (Both) The SEP provides the foundation upon which everything else is built and supports the Mobility PMO program success. SEP ensures the effective development and delivery of Mobility capabilities through the implementation of a balanced approach with respect to cost, schedule, performance, and risk using integrated, disciplined, and consistent SEP activities and processes regardless of when a program/project enters the acquisition life cycle. Describe and provide an example of your company’s experience in the following:

a) Develop, maintain, and execute a major program/Acquisition Category III program’s SEP;

b) Developing Test and Evaluation Strategy for inclusion into as well as create and maintain the program Test and Evaluation Master Plan.

3. Mobility Testing (Both) For the three mobility systems, the Mobility PMO conducts end-to-end testing including delivery of test plans, test readiness reviews, test execution, test reports, and technical action plans for integration capabilities into the production environment. Testing is conducted in appropriate unclassified Research, Development, Test, and Evaluation labs as well as representative pre-production environments. Describe and provide an example of your company’s experience in the following:

a) Developing, planning, and executing Government Acceptance Testing , limited integration testing, and pre-production stress and scalability testing with operational data sets, preferably with mobile systems.

4. Mobility Technical Insertion Activities (Both) The Mobility PMO must update the mobility systems, especially DMUC, in keeping up with technological advancements. New technology and solutions are constantly available in the commercial market space and the program needs to assess new technology and insert/integrate the technology/capability into the existing mobility system baseline to bring upgraded and/or new capabilities. Describe and provide an example of your company’s experience in the following:

a) Future device integrations against enterprise mobility management (EMM) including new iOS and Android devices and Windows devices with System Center Configuration Manager (SCCM);

b) Mobile Threat Defense (MTD) requirements analysis, design, testing, and deployment (Current DISA MTD requirements provided);

c) EMM enhancements and policy adjustments based on mobile device enhancements (e.g., artificial intelligence, etc.).

5. Tier III Support (Both) The Mobility PMO “outsources” Tier I and Tier II but retains Tier III support. This Tier III support is not just for troubleshooting mobile devices, iOS, Android, and Windows, but for the supporting network infrastructure at an Enterprise scale such as DMUC and DMCC-S operating at 250K+ and 12K+ devices, respectively. The network infrastructure varies not just with Enterprise scale VPNs and EMMs but includes routers, firewalls, High Assurance Internet Protocol Encryptor, switches, Network Storage Arrays, Domain Name Server, Splunk, Cisco Unified Communications Manager, messaging servers, etc. This also includes software such as Linux, Windows, VMware, Active Directory, Ping Federation, SCCM, Structured Query Language database, Windows Jump Host, Certificate Revocation List Distribution Point, Knox License Management, Domain Name System, etc. Lastly, engineering, ordering, and installation support for network copper and fiber circuits. All of this and more is maintained, upgraded, enhanced, and replaced as needed. For systems of such diversity, describe and provide your company’s experience for a mobility system at this operational level for the following:

a) Trouble Analysis;

b) Incident Handling and Reporting;

c) Implementation Testing and Acceptance.

6. Next Generation EMM Analysis & Requirements (DMUC) The Mobility PMO’s current DMUC Ivanti EMM contract will end in 2025. A replacement contract will need to be awarded. Based upon that contract award, a new original equipment manufacturer EMM may need to be installed to support more than an estimated 300K+ DMUC devices. Describe and provide your company’s experience in completing the following EMM analysis elements:

a) Mobile Device Management (MDM) policy controls and settings;

b) Mobile Application Management;

c) Cybersecurity (Security Technical Implementation Guide, National Information Assurance Partnership MDM, DoD Host Based Security System, Assured Compliance Assessment Solution scanning).

7. CSfC Integrator Experience (DMCC) The Mobility PMO utilizes the support of a certified CSfC Integrator in supporting the DMCC capability. To the extent possible, describe and provide your company’s qualified CSfC Integrator experience:

a) Requirements analysis, designed (end user device (EUD), gateway hardware/software, redundancy, continuous monitoring (CONMON), etc.), tested, deployed and/or supported a CSfC MA CP system(s) along with user base size and time period;

b) Experience in deploying a CSfC dual Internet Protocol Security VPN deployment;

c) Integrating Samsung and/or Windows EUDs meeting the MA CP and annexes.

SPECIAL REQUIREMENTS:

1. Facility Security Clearance Work performed is up to the TS level and will require Sensitive Compartmented Information access eligibility for some personnel. Therefore, the company must have a final TS Facility Clearance from the Defense Counterintelligence and Security Agency Facility Clearance Branch. Please provide your current Facility Clearance level.

2. Security Clearance All personnel performing on or supporting a DISA contract/order in any way shall be United States citizens. Contractor personnel must possess the interim or final security clearance when performance starts.

SOURCES SOUGHT:

The North American Industry Classification System Code for this requirement is 541512, Computer Systems Design Services, with the corresponding size standard of $34 million.

In order to make a determination for a small business set-aside, two or more qualified and capable small businesses must submit responses that demonstrate their qualifications. Responses must demonstrate the company’s ability to perform in accordance with FAR clause 52.219-14, Limitations on Subcontracting.

To assist DISA in determining the level of participation by small business in any subsequent procurement that may result from this Sources Sought Notice, provide information regarding any plans to use joint ventures (JVs) or partnering. Please outline the company's areas of expertise and those of any proposed JV/partner who combined can meet the specific requirements contained in this notice.

SUBMISSION DETAILS:

Responses should include:

1) Business name and address;

2) Name of company representative and their business title;

3) Small Business Socio-economic status (if small);

4) CAGE Code;

5) Prime contract vehicles; to include ENCORE III, SETI, NIH CIO-SP4, NASA SEWP V, General Service Administration (GSA): OASIS, ALLIANT II, VETS II, STARS III, MAS (including applicable SIN(s), groups or pools), or any other Government Agency contract vehicle that allows for decentralized ordering. (This information is for market research only and businesses with a valid cage that lack prime contract vehicles are still encouraged to respond to this notice.)

Businesses who wish to respond must send a response via email no later than 4:00 PM Eastern on November 14, 2024 to angela.k.zang.civ@mail.mil and derek.j.urscheler.civ@mail.mil. Interested businesses should submit a brief capabilities statement package addressing the specific questions above (no more than 15 pages) demonstrating the ability to perform the services listed under Required Capabilities.

Proprietary information and trade secrets, if any, must be clearly marked on all materials. All information received that is marked Proprietary will be handled accordingly. All submissions become Government property and will not be returned. All government and contractor personnel reviewing submitted responses will have signed non-disclosure agreements and understand their responsibility for proper use and protection from unauthorized disclosure of proprietary information as pursuant to 41 USC 423. The Government shall not be held liable for any damages incurred if proprietary information is not properly identified.

Page 2 of 4 Pages

Page 1 of 5 Pages