Assured Compliance Assessment Solution (ACAS) for the Program Acquisition Executive (PAE) Cyber Sensing Portfolio Management Office

The Defense Information Systems Agency is conducting market research through a Sources Sought Notice to identify qualified sources for the next-generation Assured Compliance Assessment Solution (ACAS) under the Program Acquisition Executive’s Cyber Sensing Portfolio Management Office. This initiative aims to modernize the current ACAS platform to support comprehensive scanning of approximately 11 million devices across the Department of Defense Information Network, incorporating network-based, host-based agent, and agentless capabilities. The solution must extend beyond traditional on-premises environments to include cloud platforms such as AWS, Azure, OCI, and GCP; containerized environments like Docker and Kubernetes; IoT and OT systems including Siemens and Rockwell devices; and web applications such as ServiceNow. It must enforce compliance with security controls, configuration standards, and patch management policies across Windows, UNIX/Linux, macOS, and Cisco IOS systems while utilizing standardized frameworks like SCAP, CVE, CPE, XCCDF, and OVAL. Cloud deployments are required to meet at least FedRAMP High Impact Level 5 (IL5) security requirements, and the architecture must be scalable to serve the entire Department. The anticipated contract period spans from January 1, 2029, through October 31, 2033, with a base year and four option years. Performance is expected across both CONUS and OCONUS locations, with administrative oversight based in Mt Zion, Illinois. Offerors must provide detailed information about their business structure, including CAGE codes, Small Business socio-economic status, and proof of compliance with FAR clause 52.219-14 regarding limitations on subcontracting if applicable. Personnel supporting the contract must hold current Information Assurance certifications per DoDD 8140.03-M and possess security clearances up to Top Secret/Sensitive Compartmented Information (TS/SCI) upon contract start, with offerors required to disclose their Facility Clearance Level. Proprietary information submitted in response must be clearly marked and protected under 41 USC 423, and all reviewers will be bound by non-disclosure agreements. The solicitation number is 842674622, with a NAICS code of 541519, and responses are due by June 18, 2026. This notice is strictly for market research purposes and does not constitute a solicitation, commitment, or request for proposals.