Sources_Sought_for DoD365 Operations and Maintenance_clean.docx

SOURCES SOUGHT NOTICE

622673622

The Defense Information Systems Agency (DISA) is seeking sources for Defense Enterprise Office Solution (DEOS) Department of Defense (DoD) Office 365 Operations and Maintenance. This requirement will support DISA Portfolio Acquisition Executive Services (PAE Services) (SD), Enterprise Collaboration Services Division (SD3).

CONTRACTING OFFICE ADDRESS:

DISA/DITCO-NCR

6910 COOPER AVE,

FT. MEADE, MD 20755

INTRODUCTION:

This is a SOURCES SOUGHT NOTICE to determine the availability and technical capability of large and small businesses (including the following subsets: Small Disadvantaged Businesses, Certified 8(a), Service-Disabled Veteran-Owned Small Businesses, HUBZone Small Businesses and Woman-Owned Small Businesses) to provide the required products and/or services.

DISA SD / SD3 is seeking information from potential sources for: providing engineering, operations and cybersecurity support for the sustainment of and engineering of the DEOS DoD Office 365 Non-classified Internet Protocol Router Network (NIPRNet) and Secret Internet Protocol Router Network (SIPRNet) Tenants and potentially a Top-Secret Office-365 Tenant.

DoD selected Microsoft Office 365 (M365) as the solution to provide common communication, collaboration, and productivity capabilities that are mission-effective, efficient, widely accessible, and facilitate DoD operations worldwide. DISA, in support of the Deputy Secretary of Defense’s direction to accelerate DoD’s adoption of cloud computing technology, plans to continue to build on its seamlessly integrated enterprise M365 as a replacement for disparate DoD legacy enterprise information technology services, such as individual voice, video, collaboration, email, content management, information management, and productivity suites.

DEOS PMO operates the DoD365-Joint tenant (IL5) with approximately 137k users across Defense Agencies and Field Activities (DAFA) and Combatant Commands (CCMD) organizations; and the DoD365-Sec tenant (IL6) with approximately 350k users across the Department’s DAFAs, CCMDs, and MILDEPs. Additionally, at IL6, DEOS PMO operates two Five Eyes (FVEY) tenants for United Kingdom and Australia with the potential to add additional FVEY partner nations. Planning estimates for an IL7 environment are at approximately 150k users across DoD. DEOS PMO continuously evolves DoD365 capabilities as Microsoft 365 service offerings are enhanced and mission requirements emerge.

The anticipated period of performance is a one-year base period and four one-year optional periods.

The anticipated period of performance is:

The anticipated place of performance is at DISA Headquarters (6910 Cooper Ave, Fort Meade, MD, 20755), DISA Columbus, Ohio (3990 E. Broad St., Bldg. 23 Columbus, OH 43218-1152), and any DISA-approved contractor Secure Facility at the convenience of the contractor.

DISCLAIMER:

THIS SOURCES SOUGHT NOTICE IS FOR INFORMATIONAL PURPOSES ONLY. THIS IS NOT A REQUEST FOR PROPOSAL. IT DOES NOT CONSTITUTE A SOLICITATION AND SHALL NOT BE CONSTRUED AS A COMMITMENT BY THE GOVERNMENT. RESPONSES IN ANY FORM ARE NOT OFFERS AND THE GOVERNMENT IS UNDER NO OBLIGATION TO AWARD A CONTRACT AS A RESULT OF THIS NOTICE. NO FUNDS ARE AVAILABLE TO PAY FOR PREPARATION OF RESPONSES TO THIS NOTICE. ANY INFORMATION SUBMITTED BY RESPONDENTS IS STRICTLY VOLUNTARY.

CONTRACT/PROGRAM BACKGROUND:

The DEOS DoD365 Operations and Maintenance requirement is a recurring requirement currently being executed under the following contract:

Contract Number: 47QTCA21A0001 / 47QFSA21F0023 Contract Vehicle: General Services Administration (GSA) Single-Award Blanket Purchase Agreement (BPA) Incumbent: General Dynamics Information Technology, Large Business Method of previous acquisition: Task Order under Single Award Blanket Purchase Agreement Period of performance: 05 Mar 2021 - 4 May 2026

The DISA DEOS also requires optional tasks to be incorporated into the follow-on contract for an IL7 (Top-Secret) solution. Therefore, in addition to the recurring requirements being performed in the existing Task Order above, the IL7 optional task requirements will also be included.

Additionally, the DISA anticipates awarding an additional one-year task order under the above single-award BPA, Contract Number 47QTCA21A0001, for a period of performance of 05 May 2026 - 04 May 2027.

REQUIRED CAPABILITIES:

The DISA DEOS DoD 365 team requires a contractor to sustain, operate, engineer, and provide common communication, collaboration, and productivity capabilities to facilitate DoD operations worldwide. The Government is seeking contractors capable of providing subject matter expertise in support of this effort.

1. Microsoft 365 (M365) Engineering and Operational Expertise (IL5, IL6, & IL7): Responses shall demonstrate experience and technical expertise in providing engineering, operations, and cybersecurity support for M365 environments at Impact Level 5 (IL5 – NIPRNet), Impact Level 6 (IL6 - SIPRNet), and Impact Level 7 (IL7 – Top-Secret) including integrated third-party products. Describe and provide an example of your company’s experience, successful M365 deployments, troubleshooting complex issues, and optimizing configurations for large-scale DoD environments. Specific experience with Azure Government Unclass (IL5) and Secret (IL6) infrastructure is highly desirable.

2. Cybersecurity and Risk Management: Responses shall demonstrate experience providing comprehensive cybersecurity services within DoD cloud environments (Azure preferred), including experience with Risk Management Framework (RMF) implementation, security control assessments, incident response, cyber threat hunting, and compliance with DISA Security Technical Implementation Guides, Information Assurance Vulnerability Management, and other DoD security policies and procedures. The ability to contribute to and maintain an Authority to Operate is critical. Describe and provide an example of your company’s experience providing comprehensive Cybersecurity and RMF Compliance in Cloud Environments (specifically M365, IL5 at a minimum) and DoD cloud environments.

3. Knowledge Management and Training Capabilities: Given the need to create and maintain knowledge repositories and potentially develop training materials, responses shall demonstrate capabilities in knowledge management best practices, content creation, and online and virtual instructor-led training development. Describe and provide an example of improving user adoption and satisfaction through effective knowledge sharing and user engagement.

4. Staffing and Transition Management: Requires a smooth transition-in demanding rapid staffing. Responses shall showcase the ability to rapidly mobilize qualified personnel, manage staffing plans effectively, and execute seamless transitions. Describe and provide an example of your company’s experience managing staffing and transition for large-scale efforts (75-100 people) within 15-30 days of period of performance start date.

SPECIAL REQUIREMENTS:

1. Facility Clearance Level. The work to be performed under this contract is up to the Top-Secret level. Therefore, responses shall demonstrate an interim or final Top Secret Facility Clearance from the Defense Security Service Facility Clearance Branch, which will be required at time of proposal submission. Please include your company’s current facility clearance level in your reply to this notice.

2. Personnel Security. The work to be performed under this contract is up to the Top-Secret level. All contractor staff are required to have a minimum of a Secret clearance and a Top Secret clearance will be required as needed to support specific DEOS projects. Describe and provide an example of your company’s experience managing security clearance requirements.

3. Key contractor personnel shall be Microsoft 365 Administrator Expert Certified and the vendor shall be authorized to provide Enterprise Cloud Service Offering certified staff support.

4. Capability Maturity Model Integration (CMMI) Certification: Because of the complexity of the integration and operational management of the DEOS effort and ongoing requirements to develop and integrate new collaboration capabilities, prime contractors shall be at least CMMI Services V3.0 Maturity Level 5 for all contract work and supporting subcontractors shall be at least CMMI Services V3.0 Maturity Level 3 for the life of the contract. Please include your company’s current CMMI level in your reply to this notice and demonstrate the ability to have this certification at time of proposal submission.

SOURCES SOUGHT:

The North American Industry Classification System Code (NAICS) for this requirement is 541511 (https://www.census.gov/naics/), with the corresponding size standard of $34 million. In order to make a determination for a small business set-aside, two or more qualified and capable small businesses shall submit responses that demonstrate their qualifications. Responses shall demonstrate the company’s ability to perform in accordance with FAR clause 52.219-14, Limitations on Subcontracting.

To assist DISA in determining the level of participation by small business in any subsequent procurement that may result from this Sources Sought Notice, provide information regarding any plans to use joint ventures (JV) or partnering. Please outline the company's areas of expertise and those of any proposed JV/partner who combined can meet the specific requirements contained in this notice.

SUBMISSION DETAILS:

Responses should include:

1) Responses to the Required Capabilities and Special Requirements above;

2) Business name and address;

3) Name of company representative and their business title;

4) Small Business Socio-economic status (if small);

5) Commercial and Government Entity (CAGE) Code;

6) Prime contract vehicles; to include ENCORE III, SETI, NIH CIO-SP4, NASA SEWP V, GSA: OASIS, ALLIANT II, VETS II, STARS III, MAS (including applicable SIN(s), groups or pools), or any other Government Agency contract vehicle that allows for decentralized ordering. (This information is for market research only and businesses with a valid CAGE code that lack prime contract vehicles are still encouraged to respond to this notice.)

Businesses who wish to respond shall send a response via email no later than 4:00 PM Eastern Standard Time on April 29, 2026 to elizabeth.a.bono.civ@mail.mil and michelle.l.rand.civ@mail.mil . Interested businesses should submit a brief capabilities statement package addressing the specific questions above (no more than seven pages), demonstrating the ability to perform the services listed under Required Capabilities.

Proprietary information and trade secrets, if any, shall be clearly marked on all materials. All information received that is marked Proprietary will be handled accordingly. All submissions become Government property and will not be returned. All Government and contractor personnel reviewing submitted responses will have signed non-disclosure agreements and understand their responsibility for proper use and protection from unauthorized disclosure of proprietary information as pursuant to 41 USC 423. The Government shall not be held liable for any damages incurred if proprietary information is not properly identified.

For information on DISA’s requirements, you can find current information on our home page: www.disa.mil – that includes current forecast and the current acquisition strategies. If there is no information regarding the requirement you may be inquiring about, then there is no additional publicly available information. Please continue to review www.disa.mil.

Page 2 of 4 Pages

Page 1 of 5 Pages