Sources Sought Notice_J6 S3 - 832673670.docx

SOURCES SOUGHT NOTICE

Tracking Number: 832673670

The Defense Information Systems Agency (DISA) is seeking sources for the DISA Command, Control, Communications, and Computers Enterprise (J6 C4E) Directorate – Pentagon (J6P) Security Support Services (J6 S3) requirement.

CONTRACTING OFFICE ADDRESS:

DISA/Defense Information Technology Contracting Organization (DITCO)/PS8331 DISA Services Section 2300 East Drive, Building 3600 Scott Air Force Base, Illinois 62225-5406

INTRODUCTION:

This is a SOURCES SOUGHT NOTICE to determine the availability and technical capability of small businesses (including the following subsets: Small Disadvantaged Businesses, Certified 8(a), Service-Disabled Veteran-Owned Small Businesses, HUBZone Small Businesses and Woman-Owned Small Businesses) to provide the required products and/or services.

The DISA J6 C4E is seeking information from potential sources to provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to perform Physical Security (PHYSEC), Personnel Security (PERSEC), Operations Security (OPSEC), Industrial Security (INDUSEC), and Special Access Program (SAP) Program Protection Plan (PPP) Services. The contractor must meet the security requirements and guidance as defined in the DoDM 5200v1-4; DoD 5220.22-M; DoD 5105.21; and other applicable federal regulations to ensure the security of J6 personnel, facilities, and programs to meet customer requirements.

The anticipated Period of Performance (PoP) is a 12-month base period. The estimated PoP date is as follows:

Base Period: December 01, 2026 to November 30, 2027

The anticipated Place of Performance is at multiple government locations. The locations below require onsite support within Government facilities across the National Capital Region (NCR), as defined in 10 USC 2674.

Site visits may be required periodically to the DISA/J6 spaces outside of the NCR. Normal workdays are Monday through Friday (except for US Federal Holidays), and normal business hours of work are from 0700 to 1700 daily. The contractor must ensure each section is staffed during the normal business hours to meet the requirements.

Pentagon 7010 Defense Pentagon Washington, DC 20301-7010 Ft. Belvoir, 9800 Belvoir Rd.

Fort Belvoir, VA 22060

Mark Center 4800 Mark Center Drive Arlington, VA 22350

Ft. McNair, 300 A St.

Washington, DC 20319

A&M Building 1500 Wilson Blvd Suites 101, 110, and 120 Arlington, VA 22209

Ft. Myer 239 Sheridan Ave.

Fort Myer, VA 22211

Crystal Gateway 1 (CG1) 2515 Crystal Drive Arlington, VA 22202 Naval Support Group (Mechanicsburg, PA) 5450 Carlisle Pike Mechanicsburg, PA 17050

Taylor Building 2530 Crystal Drive Arlington, VA 22202 Hampton Roads (HR) locations:

Naval Support Activity-Hampton Roads Norfolk 1320 Northwest Blvd, 7 Chesapeake, VA 23322

Fort Meade 6910 Cooper Ave Fort Meade, MD 20755

Norfolk Naval Base 1530 Gilbert St. #2000 Norfolk, VA 23511

Raven Rock Complex (RRMC) Harbaugh Valley Rd Fairfield, PA 17320 Suffolk DoD Complex (Suffolk, VA) 100-198 Lake View Pkwy Suffolk, VA 23435

Ft. Detrick, 810 Schreider St.

Fort Detrick, MD 21702 Warrenton Bear Wallow Rd Warrenton, VA 20186

DISCLAIMER:

THIS SOURCES SOUGHT NOTICE IS FOR INFORMATIONAL PURPOSES ONLY. THIS IS NOT A REQUEST FOR PROPOSAL. IT DOES NOT CONSTITUTE A SOLICITATION AND SHALL NOT BE CONSTRUED AS A COMMITMENT BY THE GOVERNMENT. RESPONSES IN ANY FORM ARE NOT OFFERS AND THE GOVERNMENT IS UNDER NO OBLIGATION TO AWARD A CONTRACT AS A RESULT OF THIS NOTICE. NO FUNDS ARE AVAILABLE TO PAY FOR PREPARATION OF RESPONSES TO THIS NOTICE. ANY INFORMATION SUBMITTED BY RESPONDENTS IS STRICTLY VOLUNTARY.

CONTRACT/PROGRAM BACKGROUND: The DISA J6 S3 requirement is a new requirement; however, portions of this requirement are currently being executed under the below contract:

Contract Number: HC101324P0002 Contract Vehicle: Open Market Incumbent and their size: Kaiva Tech, LLC / Small Business Method of previous acquisition: 8(a) Direct Award Period of performance: 9/1/2024 – 2/28/2027

Prior contract iterations and background include the following:

Contract Number: HC102822P0028 Contract Vehicle: Open Market Incumbent and their size: ARTTRA Inc. / Small Business Method of previous acquisition: 8(a) Direct Award Period of performance: 5/1/2022 – 8/31/2024

Contract Number: HC102820P0048 Contract Vehicle: Open Market Incumbent and their size: LBO Technology, LLC / Small Business Method of previous acquisition: 8(a) Direct Award Period of performance: 6/1/2020 - 4/30/2022

Contract Number: HC102818P0050 (WHS Transfer of HQ003417C0046) Contract Vehicle: Open Market Incumbent and their size: True Information Assurance, LLC / Small Business Method of previous acquisition: Set-Aside – Competitive 8(a) Period of performance: 5/8/2017 - 5/7/2020

REQUIRED CAPABILITIES:

1) PHYSICAL SECURITY: The PHYSEC team delivers Tier 3 (Operational) and Tier 4 (Strategic Governance & Integration) advanced support across enterprise physical security ecosystems. This scope encompasses managing complex incident escalations, performing architectural root-cause analyses, executing system integrations, and facilitating direct Original Equipment Manufacturer engineering engagements. To guarantee the safe operation of all supporting IT systems, the team strictly applies DoD Information Assurance Certification and Accreditation Process (DIACAP) controls. The PHYSEC team’s core mission is to assist Government stakeholders in inspecting and securing Standard, Sensitive Compartmented Information (SCI), and collateral secure spaces. Additionally, the PHYSEC team safeguards the critical IT cabling infrastructure that interconnects network equipment, the vast majority of which supports Mission Assurance Category (MAC) I systems. Describe and provide an example of your company’s experience providing physical security support services, managing these types of enterprise-level physical security programs, and integrating PHYSEC with cyber and emergency response plans (EAPs) at the execution levels of Tier 3 and Tier 4, to include your company’s experience working with TS/SCI Ecosystem requirements.

2) PERSONNEL SECURITY: The PERSEC team delivers Tier 3 (Operational) and Tier 4 (Strategic Governance & Integration) advanced support across enterprise security ecosystems. This scope encompasses supporting enterprise stakeholders in ensuring that all J6 personnel possess the verified clearance levels required to access classified and sensitive IT equipment IAW DoD Regulations. Operating in strict adherence to applicable mandates (such as DoDM 5105.21) the PERSEC team must evaluate and monitor personnel vetting status and security clearance eligibility relative to enterprise IT infrastructure access standards. Describe and provide an example of your company’s experience providing personnel security support services, managing the end-to-end clearance lifecycle for thousands of personnel concurrently, fully operating and integrating with the Defense Information System for Security (DISS), the National Industrial Security System (NISS), and Continuous Vetting (CV) pipelines, and integrating PERSEC data into an active Insider Threat Program (DoDM 5200.02) to proactively flag risks at the execution levels of Tier 3 and Tier 4, to include your company’s experience working with TS/SCI Ecosystem requirements.

3) OPERATIONS SECURITY: The OPSEC team delivers Tier 3 (Operational) and Tier 4 (Strategic Governance & Integration) advanced support across enterprise security ecosystems. This scope encompasses protecting unclassified evidence and Controlled Unclassified Information (CUI) associated with sensitive operations and activities. The OPSEC team conducts OPSEC inspections across J6 manned spaces to ensure full compliance with applicable DISA and DoD guidance, denying adversaries the ability to collect, analyze, and exploit critical information that could compromise personnel, readiness, or mission success. In coordination with Government personnel, OPSEC must evaluate operational workflows, data aggregation vectors, and information systems to safeguard critical information often pieced together from public or seemingly harmless indicators. Describe and provide an example of your company’s experience providing OPSEC support services, integrating OPSEC into live mission planning under DoDD 5205.02, and conducting active signature assessments to identify leaks at the execution levels of Tier 3 and Tier 4, to include your company’s experience working with TS/SCI Ecosystem requirements.

4) INDUSTRIAL SECURITY: The INDUSEC team delivers Tier 3 (Operational) and Tier 4 (Strategic Governance & Integration) advanced support across enterprise security ecosystems. This focus encompasses ensuring compliance with the National Industrial Security Program (NISP) and all applicable instructions, manuals, and directives. The INDUSEC team provides quality reviews of DD254s in coordination with the Government in accordance with DISA physical security and DD254 guides, conducts quarterly INDUSEC training with J6 staff, and maintains alignment with the DISA HQ INDUSEC Program and DISAI 240-38. Periodically, INDUSEC must evaluate program guidelines, accounts, and documentation to recommend strategic updates to Government and DISA HQ INDUSEC program documents. Describe and provide an example of your company’s experience providing INDUSEC support services, managing multi-facility, multi-vendor industrial security portfolios under 32 CFR Part 117 (NISPOM), working with complex DD Form 254s across diverse programs, and interfacing directly with the Defense Counterintelligence and Security Agency (DCSA) to maintain facility clearances (FCLs) at levels of Tier 3 and Tier 4, to include your company’s experience working with TS/SCI Ecosystem requirements.

5) PROGRAM PROTECTION PLAN (PPP): The PPP team delivers Tier 3 (Operational) and Tier 4 (Strategic Governance & Integration) advanced support across enterprise security ecosystems. This focus encompasses developing, implementing, and maintaining PPP capabilities. Occasionally, the Program Protection team must evaluate hardware or software products' integration with program protection, technology preservation, and systems engineering infrastructure components. Describe and provide an example of your company’s experience providing PPP support services, drafting, executing, and updating comprehensive PPPs for major defense programs, conducting deep-dive, multi-tier projects from raw materials to final integration, and identifying and safeguarding Critical Program Information (CPI) and mission-critical functions throughout the system lifecycle at Tier 3 and Tier 4 levels, to include your company’s experience working with SAP Ecosystem requirements.

SPECIAL REQUIREMENTS:

The J6 S3 requires the contractor possess a final Top Secret (TS)/Sensitive Compartmented Information (SCI) Facility Clearance. Please provide your current Facility Clearance Level.

The respondent must be able to support all the following types of security programs:

1. Standard security programs.

2. Collateral security programs (Secret, Top Secret, SCI).

3. Special Access Programs (SAP).

SOURCES SOUGHT:

The North American Industry Classification System Code for this requirement will be 541690 – Other Scientific and Technical Consulting Services, with the corresponding size standard of $19.0M.

In order to make a determination for a small business set-aside, two or more qualified and capable small businesses must submit responses that demonstrate their qualifications. Responses must demonstrate the company’s ability to perform in accordance with FAR clause 52.219-14, Limitations on Subcontracting.

To assist DISA in determining the level of participation by small business in any subsequent procurement that may result from this Sources Sought Notice, provide information regarding any plans to use joint ventures (JVs) or partnering. Please outline the company's areas of expertise and those of any proposed JV/partner who combined can meet the specific requirements contained in this notice.

SUBMISSION DETAILS:

Responses should include:

1) Business name and address;

2) Name of company representative and their business title;

3) Small Business Socio-economic status (if small);

4) CAGE Code;

5) Prime contract vehicles; to include ENCORE III, SETI, NIH CIO-SP4, NASA SEWP V, General Service Administration (GSA): OASIS, ALLIANT II, VETS II, STARS III, MAS (including applicable SIN(s), groups or pools), or any other Government Agency contract vehicle that allows for decentralized ordering. (This information is for market research only and businesses with a valid cage that lack prime contract vehicles are still encouraged to respond to this notice.)

Businesses who wish to respond must send a response via email NLT 4:00 PM Eastern Daylight Time (EDT) on October 28, 2026 to Contracting Officer, Mallory A. Moss, and Contract Specialist, Catilin Haselhorst, at mallory.a.moss.civ@mail.mil and caitlin.n.haselhorst.civ@mail.mil. Interested businesses should submit a brief capabilities statement package addressing the specific questions above (no more than seven pages) demonstrating the ability to perform the services listed under Required Capabilities.

Proprietary information and trade secrets, if any, must be clearly marked on all materials. All information received that is marked Proprietary will be handled accordingly. All submissions become Government property and will not be returned. All government and contractor personnel reviewing submitted responses will have signed non-disclosure agreements and understand their responsibility for proper use and protection from unauthorized disclosure of proprietary information as pursuant to 41 USC 423. The Government shall not be held liable for any damages incurred if proprietary information is not properly identified.

For information on DISA’s requirements, you can find current information on our home page: www.disa.mil – that includes current forecast and the current acquisition strategies. If there is no information regarding the requirement you may be inquiring about, then there is no additional publicly available information. Please continue to review www.disa.mil.