(U)_CIO-7_ICAM Market Research RFI Questionnaire_21Aug26.xlsx
XLSX spreadsheet 31 KB Posted
- Attached to
- RFI - ICAM and AD Services
- Solicitation number
- Not on record
- Issued by
-
Defense Intelligence Agency
About this file
This is a Request for Information (RFI) questionnaire designed to conduct market research on Enterprise Identity, Credential, and Access Management (ICAM) and Active Directory (AD) services for the Defense Intelligence Agency (DIA). The RFI seeks to identify capable industry sources to provide implementation and sustainment of advanced ICAM and AD solutions across multiple secure networks, including modernization of legacy systems, integration with enterprise services, and evaluation of emerging technologies. The submission deadline is Wednesday, 15 September 2026 at 4:00 PM (EST), with unclassified responses submitted to ~DIA_CFOAC3-Submissions@dodiis.mil and classified responses to ~DIA-CFO-AC2C-OfferSubmissions@coe.ic.gov.
The questionnaire collects company information, business size and socio-economic categories, and facility clearance details, including whether respondents maintain existing contractor Secure Compartmented Information Facilities (SCIFs) with government accreditation. The core of the questionnaire addresses five technical competency areas: ICAM experience in multi-domain or multi-forest environments; enterprise cybersecurity operations and engineering services; Zero Trust design and implementation aligned with NIST SP 800-207; technology modernization of identity infrastructure; and deployment, integration, and sustainment of ICAM services across hybrid infrastructures including on-premises, cloud, edge, disconnected, or tactical environments. For each competency area, respondents must provide specific examples including role, technical scope, complexity addressed, and measurable outcomes. The questionnaire also solicits information on teaming interests, estimated percentages of work requiring subcontractors, and recommendations for refining the Performance Work Statement and government objectives.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| RFI Memorandum - ICAM and AD Services.pdf | ||
| ICAM and AD Services - SOR.pdf |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Tab 1 Questionnaire
| Market Research Form | Response |
| Enterprise Identity Credential and Access Management (ICAM) and Active Directory Services Market Survey Questionnaire | |
| Company Information | |
| Name | |
| Address | |
| Point of Contact | |
| Email Address | |
| Telephone Number | |
| NAICS Code | |
| Entity Identification Number (EID) | |
| Facility Clearance Level | |
| Defense Counterintelligence and Security Agency (DCSA) Facility Clearance Level (Secret (S), Top Secret (TS), Top Secret/Sensitive Compartmented Information (TS/SCI)? | Select One |
| CAGE Code | |
| SCIF | |
| Do you have an existing Contractor SCIF that is Government Accredited? | Select One |
| If yes, is it owned, leased? | Select One |
| What is the seating capacity available for this requirement? | |
| What is the average cost per square foot of space? | |
| If no, do you have existing arrangements (e.g., partnerships, pre-negotiated leases, or accreditation pipelines) that would enable you to acquire accredited SCIF space sufficient for contract performance within 60 days of award? If yes, briefly describe these arrangements and any associated timelines or costs. | |
| Business Size | |
| Business Size and Socio-Economic category | Select One |
| Experience | |
| Do you have experience providing Enterprise Identity Credential and Access Management (ICAM) and Active Directory (AD) Services operating concurrently across segregated security domains and classification levels? If so, please provide the following: | Select One |
| Performed as a prime, first tier contractor, joint venture (JV)? | Select One |
| Agency/Company | |
| Contract Type (Firm Fixed Price (FFP)| Time & Materials (T&M) | Cost| Hybrid FFP and T&M | Select One |
| Years of contiguous experience | |
| Year of most recent performance | |
| Total Contract FTE | |
| How many FTE did your company performed as the prime, first tier contractor, joint venture, or subcontractor? | |
| What percentage of the work did your Company perform? | Select One |
| Was the core expertise "in house" or acquired from a subcontractor | |
| Geographic location(s) supported | Select One |
| Please complete Tab 2 to address questions pertaining to your experience. | See Tab 2 |
| Potential Teaming Arrangements | |
| Are you interested in submitting a proposal for this requirement? | Select One |
| If yes, would you submit a proposal as a prime, teaming arrangement, or joint venture? | Select One |
| If Prime, what is the estimated percentage of work you would need for teaming? | Select One |
| What area of the work would you use for teaming? | |
| Recommendation(s)/Comments | |
| Please complete Tab 3 to provide any additional comments/recommendations | See Tab 3 |
Tab 2 Questions
| # | Subject | Questions | Response | |
| Yes/No | Description | |||
| 1 | ICAM | Does your company have relevant experience within the past three (3) years serving as a prime or major subcontractor in implementing, operating, sustaining, or modernizing enterprise ICAM and Microsoft Active Directory services in a multi-domain or multi-forest environment? |
| If yes, provide one (1) example and include your role (architecture, engineering, migration, operations, sustainment, enhancement); number of domains/forests, trusts, tenants, identity stores, users/accounts, privileged accounts, and sites; whether the environment was on-prem, cloud, or hybrid; capabilities delivered (e.g., AD DS/AD LDS, Entra ID/Azure AD, federation, SSO, MFA, PKI, PIV/CAC, identity lifecycle management, provisioning/deprovisioning, PAM, directory synchronization); technical complexity addressed (e.g., cross-domain synchronization, mergers/migrations, delegated administration, schema constraints, zero-downtime requirements, compliance/security mandates); and measurable outcomes (e.g., reduced provisioning time, improved account reconciliation, reduced orphaned accounts, improved audit performance, improved availability/security posture). | Select One | ||
| 2 | Cyber Security Services | Does your company have relevant experience within the past three (3) years providing enterprise cybersecurity operations and engineering services across multi-domain or distributed environments, including continuous monitoring, security control implementation, enterprise reporting, vulnerability management, incident support, and risk management? |
| If yes, provide one (1) example and include whether support involved SOC operations, cyber engineering, RMF compliance, vulnerability management, incident response, or multiple functions; number of domains, enclaves, systems, assets/endpoints, and users covered; tools/platforms used (e.g., SIEM, SOAR, EDR, HBSS, Splunk, Elastic, Tenable, Defender, ACAS); frameworks supported (e.g., NIST 800-53, NIST CSF, RMF, ICD 503, CNSSI); technical complexity addressed (e.g., cross-domain visibility limitations, classified/unclassified integration, false-positive reduction, disparate log sources, hybrid infrastructure); whether your company managed the tools, integrated the tools, or used government-furnished tools; and measurable outcomes (e.g., vulnerability reduction, reduced MTTD/MTTR, improved POA&M closure, audit/compliance improvements, risk reduction). | Select One | ||
| 3 | Zero Trust | Does your company have relevant experience within the past three (3) years designing, implementing, or operationalizing Zero Trust capabilities in a production enterprise environment aligned in whole or in part to NIST SP 800-207, Federal Zero Trust guidance, or equivalent frameworks? |
| If yes, provide one (1) example and include whether your work involved strategy/roadmap, engineering, deployment, and/or operational sustainment; pillars addressed (identity, device, network/environment, application/workload, data, visibility/analytics, orchestration/automation); capabilities implemented in production (e.g., MFA/phishing-resistant auth, conditional access, device posture validation, micro-segmentation, least privilege, JIT/JEA, application proxying, continuous diagnostics/monitoring, policy decision/enforcement points); scale (users, applications, domains, enclaves, cloud tenants); technical complexity addressed (e.g., legacy apps, non-modern authentication, disconnected/edge environments, cross-domain policy enforcement); and measurable outcomes (e.g., reduced attack surface, improved identity assurance, increased policy coverage, segmentation gains, compliance alignment). | Select One | ||
| 4 | Technology Modernization | Does your company have relevant experience within the past three (3) years planning and executing modernization of identity infrastructure or related enterprise access technologies, including migration from legacy platforms, implementation of modern identity services, and refresh activities to improve resilience, interoperability, scalability, and mission alignment? |
| If yes, provide one (1) example and include the legacy environment replaced or modernized and target architecture implemented; whether work included discovery/assessment, migration planning, pilot, production cutover, coexistence, decommissioning, and training/change management; number of users, domains, applications, and systems affected; downtime constraints and cutover strategy; technologies modernized (e.g., AD, ADFS, Entra ID, identity governance, LDAP directories, PKI integration, federation infrastructure); whether modernization was performed while maintaining mission operations with minimal disruption; and measurable outcomes (e.g., reduced technical debt, performance/resilience gains, reduced admin overhead, cost avoidance, improved interoperability/security). | Select One | ||
| 5 | Deployment Services | Does your company have relevant experience within the past three (3) years deploying, integrating, and sustaining ICAM services across hybrid infrastructures that include two or more of the following: on-premises, cloud, edge, disconnected, or tactical environments? |
If yes, provide one (1) example and include ICAM capabilities deployed (e.g., SSO, MFA, federation, provisioning, directory synchronization, RBAC/ABAC, privileged access, identity governance); number of environments, enclaves, nodes, users, and applications integrated; whether deployments supported low-bandwidth/disconnected operations, edge synchronization, delegated administration, or resilient authentication; technical complexity addressed (e.g., interoperability constraints, data replication, certificate/authentication issues, secure hybrid migration); define “edge” as used in your example if applicable; and measurable outcomes (e.g., reduced access incidents, increased service availability, improved provisioning times, successful hybrid identity posture). Select One
Tab 3 Recommendations
| Recommendations | |
| Provide address the following questions and provide any additional recommendations and/or comments | Response |
| What additional information, if any, should the Government consider incorporating into the PWS to further refine the requirement, eliminate potential ambiguities, and clearly communicate the Government's performance objectives and expectations? |
Additional Recommendations
File details come from the government source that posted it. Updated .