CIO Microsoft Sentinel Implementation FY26

The Department of the Army Materiel Command Mission and Installation Contracting Command Fort Eustis seeks design, implementation, and operationalization of Microsoft Sentinel as a centralized SIEM/SOAR platform for the U.S. Army War College, with proposals due September 10 and questions due September 1. The procurement is a Women-Owned Small Business 100% set-aside, foreclosing competition outside that pool.

Place of performance is Carlisle Barracks, Pennsylvania. The contractor must onboard approximately 350 Intune-managed endpoints and all specified Microsoft 365 data sources, achieving at least 98% data ingestion success rate, and deliver the system compliant with NIST SP 800-53 and OMB M-21-31 event logging mandates. Deliverables include a Solution Design Document (requiring formal Government written approval before implementation), platform deployment, analytics rule configuration, incident response automation, and comprehensive knowledge transfer and administrator training to ensure Government self-sufficiency. All work is performed remotely from the contractor's facilities. The NAICS code is 541512, Computer Systems Design Services, with PSC DA10. Period of performance runs September 15, 2026 through September 14, 2027.

Key personnel requirements include a Contract Manager with minimum three years of IT/cybersecurity project management experience (PMP certification desired but not required) and a Lead Sentinel Architect with a bachelor's degree in cybersecurity or related field, minimum five years of enterprise SIEM/SOAR hands-on experience, minimum two years of direct Microsoft Sentinel experience in cloud or hybrid environments, demonstrated federal event logging experience meeting OMB M-21-31 standards, and at least one active industry certification (SC-100, SC-200, or CISSP). All contractor personnel must complete OPSEC Level I training within 30 days and DoD Information Assurance training before network access, with annual refresher requirements, and submit signed non-disclosure agreements no later than 10 days prior to work commencement.

Submission format requires three volumes: Volume 1 (General, 10 pages maximum) with acknowledgments and certifications; Volume 2 (Technical Capability & Past Performance, 15 pages maximum) demonstrating understanding of the Performance Work Statement and including three current examples of relevant past performance from the past three years; Volume 3 (Price, 5 pages maximum) on a Government-supplied Excel template. The Government intends to award without discussions based on technical capability, past performance, and price. The contractor must be a Microsoft Solution Partner and Tier-1 Direct-Bill Cloud Solution Provider with demonstrated DoD, NIST, and federal compliance experience, registered and active in SAM.gov. Azure consumption is limited to $4,000 per month under CLIN 0001, with the Government providing existing MS 365 A5 licensing including Defender, Entra, and Intune; additional licensing, if required, will be procured by the Government through their Microsoft support partner.