Continuous Monitoring Analytical Tool Set (CMATS) Development and Sustainment

The Defense Information Systems Agency (DISA) is seeking sources for the development and sustainment of the Continuous Monitoring Analytical Tool Set (CMATS), a Government off-the-shelf software suite that provides cybersecurity visualization, risk management, and device attribution capabilities across the Department of Defense. The procurement requires expertise in software development lifecycle and Agile methodologies, management of multiple software development teams, data integration across diverse sources, business intelligence tools, data analytics, and cloud migration of legacy Microsoft systems to Azure environments. All contractor personnel must be U.S. citizens holding Secret security clearances, with the contractor's facility clearance level at Secret or higher, and compliance with DoD cybersecurity requirements including CMMC Level 2 and NIST SP 800-53 controls. This is a sources sought notice with responses due by 2:00 PM Central Time on April 23, 2026, submitted as a capabilities statement not exceeding seven pages to designated DISA personnel via email. Respondents should identify their small business socio-economic status, CAGE code, and existing prime contract vehicles such as GSA MAS, ENCORE III, SETI, or ALLIANT II.

This opportunity is designated as a Total Small Business set-aside with a $34 million small business size standard under NAICS code 541519 (Other Professional, Scientific, and Technical Services). The anticipated contract period of performance runs from July 15, 2027, through July 14, 2032, with a base period from July 1, 2027, to June 30, 2028, followed by four optional renewal periods. Work will be performed primarily at the contractor's facilities with periodic on-site support at DISA Headquarters in Fort Meade, Maryland, with seven maximum seats available on-site. The contractor must establish four concurrent development teams delivering one major release and up to six minor releases annually per team, support enterprise-scale capabilities including five terabytes of daily data ingestion and 10 million endpoints, maintain Tier III help desk support during business hours plus 24x7 emergency coverage with four-hour response time, and deliver 65 comprehensive contract deliverables. The notice consolidates three current related service contracts and indicates that if two or more qualified small businesses respond, the requirement will proceed as a small business set-aside.