Sources_Sought_CMATS.docx

SOURCES SOUGHT NOTICE

832674365

The Defense Information Systems Agency (DISA) is seeking sources for Continuous Monitoring Analytical Tool Set (CMATS)

CONTRACTING OFFICE ADDRESS: DISA/DITCO/ IT CONTRACTING DIVISION - PS83

INTRODUCTION:

This is a SOURCES SOUGHT NOTICE to determine the availability and technical capability of small businesses (including the following subsets: Small Disadvantaged Businesses, Certified 8(a), Service-Disabled Veteran-Owned Small Businesses, HUBZone Small Businesses and Woman-Owned Small Businesses) to provide the required services.

The Defense Information Systems Agency is seeking information from potential sources for: Cloud development and sustainment support. DISA is focused on modernizing legacy system integrations by migrating several applications to an Azure environment, supporting ongoing development of new functionality to meeting stakeholder requirements, and ongoing sustainment of all the applications within the CMATS portfolio.

The anticipated Period of Performance is 15 July 2027 – 14 July 2032

The anticipated Place of Performance is DISA Headquarters, 6914 Cooper Avenue, Fort Meade, MD 20755-7090

DISCLAIMER:

THIS SOURCES SOUGHT NOTICE IS FOR INFORMATIONAL PURPOSES ONLY. THIS IS NOT A REQUEST FOR PROPOSAL. IT DOES NOT CONSTITUTE A SOLICITATION AND SHALL NOT BE CONSTRUED AS A COMMITMENT BY THE GOVERNMENT. RESPONSES IN ANY FORM ARE NOT OFFERS AND THE GOVERNMENT IS UNDER NO OBLIGATION TO AWARD A CONTRACT AS A RESULT OF THIS NOTICE. NO FUNDS ARE AVAILABLE TO PAY FOR PREPARATION OF RESPONSES TO THIS NOTICE. ANY INFORMATION SUBMITTED BY RESPONDENTS IS STRICTLY VOLUNTARY.

CONTRACT/PROGRAM BACKGROUND:

The CMATS requirement is a new requirement. However, portions of this requirement are currently being executed under the following:

· Continuous Monitoring Risk Scoring Development and Sustainment

· Contract Number: HC1028-23-F-0003

· Contract Vehicle: GSA MAS

· Incumbent and their size: Foxhole Technology, Small Business

· Method of previous acquisition: Small business set-aside

· Period of performance: November 2022 – September 2027

· Secure Configuration Management Development and Operations

· Contract Number: HC1028-22-F-0276

· Contract Vehicle: GSA MAS

· Incumbent and their size: Superlative Technologies, Small Business

· Method of previous acquisition: Small business set-aside

· Period of performance: April 2022 - March 2027

· Device Attribute Tagging Tool (DATT) Maintenance and Implementation Support

· Contract Number: HC1028-25-F-0166

· Contract Vehicle: eMASS BPA

· Incumbent and their size: Booz Allen Hamilton, Large Business

· Method of previous acquisition: Call order on Single-Award Blanket Purchase Agreement

· Period of performance: March 2022 – February 2027

REQUIRED CAPABILITIES:

1) Experience with the software development lifecycle to include Agile software development, requirements capture and decomposition, testing, configuration management and deployment of new capabilities in a production environment.

a. Describe your organization’s experience working with commercial off-the-shelf (COTS) / Government off-the-shelf (GOTS) capabilities and the required configurations / customizations needed based on customer needs, part of Agile software development efforts, and as required by updates in Department of Defense policies.

b. Describe your organization’s experience managing multiple software development teams, up to five teams, at one time.

2) Experience with data integration across various data types and sources.

a. Describe your organization’s experiences with ingesting various data types, normalizing the data, processing the data and providing results consumable by the end users. Provide an example of how your organization has resolved the challenge of normalizing new data types so it can be ingested and processed with all other data types. Explain how your organization has dealt with incoming data from various data sources such as on-premises, cloud, and hybrid technology stacks.

3) Experience with business intelligence (BI) tools.

a. Describe your organization’s experience with generating various views for end users.

b. Describe what business intelligence tools your organization has used in the past and how the reports were made available to end users, considering cloud environments, on-premises environments, and hybrid environments. Explain where the data displayed in the reports was pulled from and how the reports are updated.

4) Experience in generating new and maintaining existing data analytics.

a. Explain your organization’s current capabilities in building and maintaining data analytics from a data set that changes on a daily basis.

b. Explain the architecture surrounding the capture and storage of the data used to create all analytics. Provide examples of trending analytics your organization has created.

5) Experience with cloud migration / modernization of a legacy Microsoft system.

a. Describe a Cloud migration your organization has supported that moved a Microsoft platform to a cloud environment, detailing the cloud environment used, any data ingress or egress fees associated with the move and the timeline for full migration.

b. Explain what steps your organization took to take advantage of cloud services that were not available in an on-premises system but provide benefits to the end result in either cost, performance or schedule.

SPECIAL REQUIREMENTS:

1) All personnel performing must be U.S. citizens with a Secret security clearance.

2) The overall Facility Clearance Level (FCL) must be at the Secret level or higher.

SOURCES SOUGHT:

The North American Industry Classification System Code (NAICS) for this requirement is 541519 https://www.census.gov/naics/, with the corresponding size standard of $34M. (https://www.sba.gov/document/support--table-size-standards).

In order to make a determination for a small business set-aside, two or more qualified and capable small businesses must submit responses that demonstrate their qualifications. Responses must demonstrate the company’s ability to perform in accordance with FAR clause 52.219-14, Limitations on Subcontracting.

To assist DISA in determining the level of participation by small business in any subsequent procurement that may result from this Sources Sought Notice, provide information regarding any plans to use joint ventures (JVs) or partnering. Please outline the company's areas of expertise and those of any proposed JV/partner who combined can meet the specific requirements contained in this notice.

SUBMISSION DETAILS:

Responses should include:

1) Business name and address;

2) Name of company representative and their business title;

3) Small Business Socio-economic status (if small);

4) CAGE Code;

5) Prime contract vehicles; to include ENCORE III, SETI, NIH CIO-SP4, NASA SEWP V, General Service Administration (GSA): OASIS, ALLIANT II, VETS II, STARS III, MAS (including applicable SIN(s), groups or pools), or any other Government Agency contract vehicle that allows for decentralized ordering. (This information is for market research only and businesses with a valid cage that lack prime contract vehicles are still encouraged to respond to this notice.)

Businesses who wish to respond must send a response via email NLT 2:00 PM CT on April 23, 2026 to carly.a.youngless.civ@mail.mil and kenric.l.phillips.civ@mail.mil. Interested businesses should submit a brief capabilities statement package addressing the specific questions above (no more than seven pages) demonstrating the ability to perform the services listed under Required Capabilities.

Proprietary information and trade secrets, if any, must be clearly marked on all materials. All information received that is marked Proprietary will be handled accordingly. All submissions become Government property and will not be returned. All government and contractor personnel reviewing submitted responses will have signed non-disclosure agreements and understand their responsibility for proper use and protection from unauthorized disclosure of proprietary information as pursuant to 41 USC 423. The Government shall not be held liable for any damages incurred if proprietary information is not properly identified.

For information on DISA’s requirements, you can find current information on our home page: www.disa.mil – that includes current forecast and the current acquisition strategies. If there is no information regarding the requirement you may be inquiring about, then there is no additional publicly available information. Please continue to review www.disa.mil.

Page 2 of 4 Pages

Page 1 of 5 Pages