Enterprise Data Management(EDM) Solutions Services, Data Inventory and Tagging

The Internal Revenue Service is seeking Enterprise Data Management (EDM) Solutions Services focused on Data Inventory and Tagging to enhance cybersecurity and data protection capabilities across its hybrid and multi-cloud environment. This is a Sources Sought notice (market research) issued on November 19, 2025, with responses due by November 24, 2025, at 12:00 PM EST—representing a compressed five-day response window. The primary objective is to catalog and tag sensitive data including personally identifiable information (PII), federal tax information (FTI), controlled unclassified information (CUI), and sensitive but unclassified (SBU) data while implementing Zero Trust cybersecurity principles. Respondents must demonstrate CMMI Level 3 and ISO/IEC certifications, along with proven experience in cloud services, software development, cybersecurity, and data management. The agency will use responses to determine small business feasibility, evaluate competition adequacy for potential small business set-asides, and inform the final acquisition strategy, with evaluation criteria emphasizing technical capabilities, compliance expertise, and relevant corporate experience examples.

No set-asides have been designated for this opportunity, though the IRS is actively assessing whether adequate small business competition exists to implement one in future procurement phases. The contract is structured as a Firm Fixed Price engagement under NAICS code 541512 (Computer Systems Design Services) with a small business size standard of $30 million, and no incumbent contractor has been identified in the sources sought materials. The performance period will span 12 months from January 11, 2026, to January 10, 2027, with a projected award date of January 11, 2026, and an anticipated RFP release in the second quarter of FY2026. While specific contract values are not disclosed in the pre-solicitation notice, the scope includes developing a Data Management Framework, Alternative Solutions Design Report, Integration and Governance Plan, and supporting strategic documents for the Cybersecurity Information Protection Enhancement Controls (CIPEC) program. Large businesses are not precluded from responding to this Sources Sought notice, and the government will not be responsible for any costs incurred by interested parties in responding.