Sources_Sought_Notice_842673639 1.pdf

Page 1 of 4 Pages

SOURCES SOUGHT NOTICE

842673639

The Defense Information Systems Agency (DISA) is seeking sources for mainframe and legacy system modernization services.

CONTRACTING OFFICE ADDRESS:

Defense Information Systems Agency (DISA) Defense Information Technology Contracting Organization (DITCO)/PS8415 2300 East Drive, Building 3600 Scott Air Force Base, Illinois 62225-5406

INTRODUCTION:

This is a SOURCES SOUGHT NOTICE to determine the availability and technical capability of certified 8 (a) small businesses to provide the required products and services. A draft statement of objectives is attached to this notice.

The DISA J-9 Mainframe Line of Business is seeking information from potential sources to support the modernization of a wide variety of mainframe and legacy systems. DISA’s mainframe and legacy computing systems are essential in providing enterprise-level IT services for the Department of Defense (DoD) and its agencies. These systems are used for many critical tasks, including managing logistics, finances, personnel, and command and control. DISA’s mainframe and legacy systems host and manage critical applications, handle large amounts of data, are reliable, and meet strict DoD security requirements, making them essential for the DoD's operations.

DISA recognizes that aging IT systems create problems, and modernization is required to keep critical operations running smoothly. It is becoming more expensive to maintain these legacy systems and fewer people have the technical skills to operate and maintain them. There are also limitations in using modern tools like cloud computing, AI, and advanced analytics with these systems. This limits how well they can scale, innovate, and meet the latest federal cybersecurity and data standards. Modernizing these systems will improve efficiency, allow for secure data sharing, and align with the DoD’s strategic goals.

To address these challenges, DISA is streamlining operations, reducing costs, and aligning mainframe and legacy systems with the DoD's strategic goals. DISA is responsible for maintaining legacy systems while also exploring new technologies and ways to modernize them.

By connecting legacy systems with modern IT practices, DISA can ensure the DoD maintains its technological edge in defense communications and operations.

The anticipated Period of Performance is 1 December 2026 – 30 November 2031

Page 2 of 4 Pages

The anticipated Place of Performance for services will be agreed upon by all parties and must be pre-approved in writing by the Contracting Officer (KO). With KO approval, work may be performed remotely at a DISA location, or at location provided by a strategic partner. Secret or Top Secret/SCI work will have to be done at a DISA location. Remote work cannot be done on Top Secret/SCI workloads.

DISCLAIMER:

THIS SOURCES SOUGHT NOTICE IS FOR INFORMATIONAL PURPOSES ONLY. THIS

IS NOT A REQUEST FOR PROPOSAL. IT DOES NOT CONSTITUTE A SOLICITATION

AND SHALL NOT BE CONSTRUED AS A COMMITMENT BY THE GOVERNMENT.

RESPONSES IN ANY FORM ARE NOT OFFERS AND THE GOVERNMENT IS UNDER

NO OBLIGATION TO AWARD A CONTRACT AS A RESULT OF THIS NOTICE. NO

FUNDS ARE AVAILABLE TO PAY FOR PREPARATION OF RESPONSES TO THIS

NOTICE. ANY INFORMATION SUBMITTED BY RESPONDENTS IS STRICTLY

VOLUNTARY.

CONTRACT/PROGRAM BACKGROUND: This is a new requirement and there is no prior acquisition history.

REQUIRED CAPABILITIES:

Capability #1 Code Modernization. Describe and provide a detailed example of your company's experience transforming complex legacy IBM Mainframe application code (e.g., COBOL, Assembler) into high-performing, maintainable, and scalable modern languages (e.g., Java, Python) on IBM z architecture. Your response should specifically address your use of deep code analysis, refactoring techniques, and the application of AI-enabled tools for code comprehension and the extraction of business rules.

Capability #2 Mainframe Data Ecosystem Transformation. Describe and provide a detailed example of your company’s experience in transforming legacy IBM Mainframe data environments, including the storage, access, sharing, and governance of data. Your response should address your approach to migrating legacy databases to modern platforms, integrating data into a centralized data lake, and implementing robust DataOps pipelines to enable a scalable and secure data ecosystem for real-time analytics and AI/ML.

Capability #3 Mainframe to Hybrid Cloud Transformation. Describe and provide a detailed example of your company's experience transforming legacy IT infrastructure into a hybrid cloud environment by integrating on-premises systems with cloud platforms. Your response should address your methodologies for re-platforming applications, implementing Infrastructure-as- Code (IaC), establishing DevSecOps pipelines, and optimizing workload distribution.

Capability #4 DoD Security Accreditation and Authority to Operate (ATO). Describe and provide a detailed example of your company's experience ensuring that large-scale IBM Mainframe modernization efforts comply with the highest cybersecurity standards. Your response should detail your processes for integrating Identity, Credential, and Access

Page 3 of 4 Pages

Management (ICAM) frameworks, evolving legacy security models to a Role-Based Access Control (RBAC) system, ensuring Federal Information Processing Standards (FIPS) compliance, and successfully navigating the System and Network Authorization Process (SNAP).

Capability #5 Legacy System API Enablement. Describe and provide a detailed example of your company’s experience in exposing data and functionality from legacy IBM Mainframe systems through the implementation of secure and scalable Application Programming Interfaces (API). Your response should detail your approach to designing, deploying, and managing API gateway solutions that enable real-time interaction between legacy platforms and modern applications.

Capability #6 Mainframe AI/ML Implementation. Describe and provide a detailed example of your company’s experience in embedding Artificial Intelligence (AI), Machine Learning (ML), and automation directly into the IBM Mainframe environment. Your response should address your approach to deploying and optimizing AI/ML models on IBM Mainframe platforms, leveraging on-chip accelerators for performance, and implementing AIOps for proactive system management.

Capability #7 Testing and Transition Management: Describe and provide a detailed example of your company's experience ensuring modernized IBM Mainframe systems are both reliable and secure through a rigorous testing and transition process. Your response should address your approach to developing a comprehensive testing strategy using modern frameworks and automation, and the meticulous planning and execution of a system cutover.

SPECIAL REQUIREMENTS:

All contractor personnel must have a Secret level clearance to be granted authorized access to the DISA network, which is mandatory for all contractor personnel to perform under this contract.

Contractor personnel requiring authorized but not elevated network privileges (such as application developers) do not require 8570 IA certifications to perform their duties.

Some labor categories on this contract will require Top Secret clearance since they can potentially configure, modify, or delete system or security configurations. Depending upon network and role, elevated IAT levels and 8570 IA certifications may be required for these positions.

Please provide your current Facility Clearance level.

SOURCES SOUGHT:

The North American Industry Classification System Code (NAICS) for this requirement is 541519 Other Computer Related Services (https://www.census.gov/naics/), with the corresponding size standard of $34 million.

In order to determine if this requirement can be awarded on the basis of competition limited to eligible 8(a) participants, there must be a reasonable expectation that two or more eligible and responsible 8(a) will submit offers and that an award can be made at fair market prices.

Page 4 of 4 Pages

To help support the Government’s determination that an award can be made at fair market prices, please submit a commercial price list for labor categories or services that your company would use under this requirement.

Responses must demonstrate the company’s ability to perform in accordance with FAR clause 52.219-14, Limitations on Subcontracting.

To assist DISA in determining the level of participation by small businesses in any subsequent procurement that may result from this Sources Sought Notice, provide information regarding any plans to use joint ventures (JVs) or partnering. Please outline the company's areas of expertise and those of any proposed JV/partner who combined can meet the specific requirements contained in this notice.

SUBMISSION DETAILS:

Responses should include:

1) Business name and address;

2) Name of company representative and their business title;

3) Small Business Socio-economic status (8(a) entity type);

4) CAGE Code

5) General Service Administration (GSA) Multiple Award Schedules (MAS) or contract vehicles, such as STARS III or OASIS, that your company has and are available to place orders or establish blanket purchase agreements.

Businesses who wish to respond must send a response via email no later than 4:00 PM Central Daylight Time (CDT) on March 13, 2026 to shaun.m.bright.civ@mail.mil and amber.d.lindauer.civ@mail.mil. Interested businesses should submit a brief capabilities statement package no greater than 6 pages that demonstrates the ability to perform the services listed under “Required Capabilities” and addresses any specific questions in this notice.

Proprietary information and trade secrets, if any, must be clearly marked on all materials. All information received that is marked Proprietary will be handled accordingly. All submissions become Government property and will not be returned. All government and contractor personnel reviewing submitted responses will have signed non-disclosure agreements and understand their responsibility for proper use and protection from unauthorized disclosure of proprietary information as pursuant to 41 USC 423. The Government shall not be held liable for any damages incurred if proprietary information is not properly identified.

For information on DISA’s requirements, you can find current information on our home page:

www.disa.mil – that includes current forecast and the current acquisition strategies. If there is no information regarding the requirement you may be inquiring about, then there is no additional publicly available information. Please continue to review www.disa.mil.