Assured Compliance Assessment Solution (ACAS) for the Program Acquisition Executive (PAE) Cyber Sensing Portfolio Management Office

The Defense Information Systems Agency is preparing to solicit a next-generation Assured Compliance Assessment Solution (ACAS) for the Program Acquisition Executive Cyber Sensing Portfolio Management Office, with a capabilities statement due by June 11, 2026. The incumbent is FCN, INC, a women-owned small business; the government indicates potential for small business set-asides if two or more qualified small businesses respond.

The solution must scan approximately 11 million Department of War devices across DODIN/DOWIN using network-based, host-based agent, and agentless capabilities, with scan results collected at minimum every 72 hours. Place of performance includes CONUS and OCONUS locations. Required capabilities span multiple operating systems (Windows Server 2016–2025, UNIX/Linux, macOS, Cisco IOS), device types (servers, workstations, IoT, operational technology, containers, cloud assets across AWS, Azure, OCI, GCP), web applications, and network infrastructure devices. The solution must achieve FedRAMP High certification at Impact Level 5 for cloud deployment, comply with federal standards (SCAP 1.4, CVE, CPE, XCCDF, OVAL, NIST USGCB, DoD STIGs), support role-based access controls leveraging DoD CAC PKI, and integrate with ticketing and SIEM systems. Personnel must possess appropriate security clearances up to TS/SCI on day one and maintain Information Assurance certifications per DoDD 8140.03-M.

Period of performance runs January 1, 2029 through October 31, 2033 (base year plus four option years). Anticipated NAICS codes are 541519 or 513210. Eligible prime contract vehicles include ENCORE III, SETI, NASA SEWP V, GSA OASIS, ALLIANT II, VETS II, STARS III, and MAS. Capabilities statements must not exceed five pages and address company background, socio-economic status, CAGE code, and relevant contract vehicle experience.