Sources Sought Notice - PKI Sustainment Follow-On_FINAL.docx

SOURCES SOUGHT NOTICE

Tracking Number 832675110

The Defense Information Systems Agency (DISA) is seeking sources for Portfolio Acquisition Executive (PAE) Cyber’s Public Key Infrastructure (PKI) Sustainment requirement.

CONTRACTING OFFICE ADDRESS: Defense Information Technology Contracting Organization - National Capital Region (DITCO-NCR / PS6)

INTRODUCTION:

This is a SOURCES SOUGHT NOTICE to determine the availability and technical capability of small businesses (including the following subsets: Small Disadvantaged Businesses, Certified 8(a), Service-Disabled Veteran-Owned Small Businesses, HUBZone Small Businesses and Woman-Owned Small Businesses) to provide the required products and/or services.

DISA PAE Cyber, PKI Division is seeking information from potential sources for: sustainment and sustainment-engineering support of the existing PKI platform, and continued program management and sustainment support. This will include operational monitoring and reporting support, multi-tiered support, training support, and system integration/deployment support.

The anticipated Period of Performance is 4 May 2027 – 3 May 2032.

The anticipated Place of Performance is DISA, Ft. Meade, MD, and the contractor facility located within the National Capital Region.

DISCLAIMER:

THIS SOURCES SOUGHT NOTICE IS FOR INFORMATIONAL PURPOSES ONLY. THIS IS NOT A REQUEST FOR PROPOSAL. IT DOES NOT CONSTITUTE A SOLICITATION AND SHALL NOT BE CONSTRUED AS A COMMITMENT BY THE GOVERNMENT. RESPONSES IN ANY FORM ARE NOT OFFERS AND THE GOVERNMENT IS UNDER NO OBLIGATION TO AWARD A CONTRACT AS A RESULT OF THIS NOTICE. NO FUNDS ARE AVAILABLE TO PAY FOR PREPARATION OF RESPONSES TO THIS NOTICE. ANY INFORMATION SUBMITTED BY RESPONDENTS IS STRICTLY VOLUNTARY.

CONTRACT/PROGRAM BACKGROUND:

PKI Sustainment is a follow-on requirement, with current contract details listed below. A portion of the existing contract’s requirement is being removed and competed through a separate acquisition. The enablement support within the existing contract will not be included in this recompete action.

Contract Number: HC104719D2035 / HC102823F2002 Contract Vehicle: SETI Small Business Suite Incumbent and their size: Riverside Engineering LLC; Small Business Joint Venture Method of previous acquisition: SETI, Small Business Period of performance: 4 October 2023 – 3 December 2026

REQUIRED CAPABILITIES:

1) Registration Authority (RA). The Department of Defense (DoD) PKI team supports RA requirements for the DoD and its Federal Partners, managing the end-to-end lifecycle (issuance, renewal, and revocation) of both User credentials, and Non-Person Entity (NPE) certificates. Describe and provide an example of your company’s experience providing RA and Local Registration Authority (LRA) support services within the DoD or other Federal agencies. What was the size and scope of the user and device base supported?

2) Secure Testing Lab Operation and Maintenance. The DoD PKI team operates an Operations & Maintenance (O&M) lab, and Compliance lab for the purpose of testing enhancements, and maintaining compliance with application and security updates to maintain compliance of PKI systems. Describe and provide an example of your company’s experience establishing, operating, and maintaining a secure testing lab designed to support PKI O&M and Compliance. Specifically, detail your structured process for ensuring a baselined configuration, analyzing and tracking Information Assurance Vulnerability Alerts (IAVAs), Bulletins (IAVBs), and third-party software updates from initial identification through to operational deployment. Describe all tools used for these processes.

3) Commercial Off the Shelf (COTS) Technology. The DoD PKI team maintains support at operational PKI sites that are heavily reliant upon Commercial Off the Shelf (COTS) technology. Describe and provide an example of your company’s experience with using Red Hat (RH) Products (RH Enterprise Linux, RH Directory Server, RH Certificate System), Hardware Security Modules (HSMs), F5 BigIP’s, and any other directory service technologies.

4) Enterprise PKI Customer Support. DoD PKI exists to support our customers; therefore, customer support and outreach are the PKI program’s top priorities. Describe and provide an example of your company’s support functions with respect to deploying systems related to enterprise PKI. This support should include a focus on help desk operations, development and updates to technical guides, on-site visits, and ServiceNow/ITSM+/Helix support.

SPECIAL REQUIREMENTS:

Must have final Secret Facility Clearance. Please provide your current Facility Clearance level.

Must be CMMC Level II Self Certified. Please provide your current CMMC level.

SOURCES SOUGHT:

The North American Industry Classification System Code (NAICS) for this requirement is 541512 – Computer Systems Design Services, with the corresponding size standard of $34M.

In order to make a determination for a small business set-aside, two or more qualified and capable small businesses must submit responses that demonstrate their qualifications. Responses must demonstrate the company’s ability to perform in accordance with FAR clause 52.219-14, Limitations on Subcontracting.

To assist DISA in determining the level of participation by small business in any subsequent procurement that may result from this Sources Sought Notice, provide information regarding any plans to use joint ventures (JVs) or partnering. Please outline the company's areas of expertise and those of any proposed JV/partner who combined can meet the specific requirements contained in this notice.

SUBMISSION DETAILS:

Responses should include:

1) Business name and address;

2) Name of company representative and their business title;

3) Small Business Socio-economic status (if small);

4) CAGE Code;

5) Prime contract vehicles; to include ENCORE III, SETI, NASA SEWP V, General Service Administration (GSA): OASIS, ALLIANT II, VETS II, STARS III, MAS (including applicable SIN(s), groups or pools), or any other Government Agency contract vehicle that allows for decentralized ordering. (This information is for market research only and businesses with a valid cage that lack prime contract vehicles are still encouraged to respond to this notice.)

6) Responses to Required Capabilities section;

7) Current Facility Security Clearance level; and

8) Current CMMC level.

Businesses who wish to respond must send a response via email NLT 4:00 PM Eastern Daylight Time (EDT) on 30 July 2026 to jonathan.r.chattler.civ@mail.mil and aubri.e.dubose.civ@mail.mil. Interested businesses should submit a brief capabilities statement package addressing the specific questions above (no more than five pages) demonstrating the ability to perform the services listed under Required Capabilities.

Proprietary information and trade secrets, if any, must be clearly marked on all materials. All information received that is marked Proprietary will be handled accordingly. All submissions become Government property and will not be returned. All government and contractor personnel reviewing submitted responses will have signed non-disclosure agreements and understand their responsibility for proper use and protection from unauthorized disclosure of proprietary information as pursuant to 41 USC 423. The Government shall not be held liable for any damages incurred if proprietary information is not properly identified.

For information on DISA’s requirements, you can find current information on our home page: www.disa.mil – that includes current forecast and the current acquisition strategies. If there is no information regarding the requirement you may be inquiring about, then there is no additional publicly available information. Please continue to review www.disa.mil.

Page 2 of 4 Pages

Page 1 of 5 Pages