Defense Contract Management Agency Cyber Security Services

The Defense Information Systems Agency (DISA) is seeking skilled contract labor support for the Defense Contract Management Agency (DCMA) Cyber Security Directorate to advance DoD and DCMA cybersecurity objectives. The procured services encompass cybersecurity management, compliance, and engineering support, including program management, enterprise risk management, compliance auditing, plan of action and milestone (POA&M) management, privacy, cyberspace operations management, systems access controls, training, policy development, cyber incident analysis and investigations, forensic analysis, vulnerability assessment management, and insider threat support. Key contract requirements include a minimum Secret clearance with Top Secret clearance required as needed, a Top-Secret Facility Clearance, and expertise across multiple specialized areas such as Cybersecurity Vulnerability Management (CVM), 24/7/365 incident response capabilities, Security Architecture Engineering Program (SAEP) support, Risk Management Framework (RMF) support, and Cyberspace Resilience Evaluation audits readiness. The government is accepting sources sought responses from small businesses, including Small Disadvantaged Businesses, HUBZone Small Businesses, Certified 8(a) contractors, Service-Disabled Veteran-Owned Small Businesses, and Woman-Owned Small Businesses, with responses due by May 1, 2026, at 12:00 PM Eastern Daylight Time to aubri.e.dubose.civ@mail.mil and tammy.l.smith234.civ@mail.mil. No specific evaluation criteria have been detailed in this pre-solicitation notice, as this is a sources sought announcement rather than a formal solicitation.

This procurement is not designated as a set-aside and may be open to all qualified contractors. The incumbent contractor is Crest Security Assurance LLC, a small business, currently performing under contract 47QTCA18D002A/HC104723F4060. The anticipated contract value is $34 million, representing the size standard for the applicable NAICS code 541519 (Other Computer Related Services). The period of performance spans three years, from February 8, 2027 through February 7, 2030, structured as a base year with two option years. Primary performance locations are DCMA Atlanta near Smyrna, Georgia and DCMA Headquarters at Fort Gregg-Adams, Virginia, with hybrid work arrangements permitting up to two days per week telework for eligible personnel within the Continental United States. Prospective contractors should identify whether they operate under relevant government contracting vehicles such as GSA OASIS, ALLIANT II, ENCORE III, or other authorized contracts.