DISA Legacy Systems Application Management

The Defense Information Systems Agency (DISA) is conducting market research through a Sources Sought notice for the full lifecycle application management of its Legacy Systems, which include critical, decades-old mainframe applications such as the Contract Support System (CSS), Contractual Online Procurement System (COPS), Financial Accounting and Budget System (FABS), and DITCO Web, along with multiple interconnected subsystems including RTFS, JHITS, DTI, A/P validation modules, IT and IQO contract closeout, and telecom voucher management. The requirement is a sole source 8(a) set-aside under NAICS code 541512, targeting qualified small disadvantaged businesses with a size standard of $34 million, and responses are due by July 14, 2026. The anticipated period of performance spans five years, from June 10, 2027, through June 9, 2032, structured as one base year with four one-year options that may be exercised by the Contracting Officer, with a potential six-month extension permitted under FAR 52.217-8. Performance will be primarily executed from the contractor’s site with occasional CONUS travel, and alternate locations such as remote work setups may be required during contingencies like pandemics or government closures. Contractors must possess a final Secret Facility Clearance and ensure all personnel are U.S. citizens with appropriate security clearances—SECRET clearance for Tasks 6.3 and 6.4, and interim SECRET for other tasks—with mandatory Tier 3 investigations maintained every ten years via Tier 3R. All work involves handling classified and controlled unclassified information, requiring strict adherence to DoDM 5200.01 Vol. 3, DoDI 5200.48, and DoDM 5400.07 for security and FOIA marking. The contractor must support the full software development lifecycle for legacy systems written in JCL, ROSCOE, Mantis, and Supra PDM, maintain EOD, EOM, EOY, and bill pay job schedules, and ensure compliance with DISA’s cybersecurity program including RMF, FISMA, FIPS, and whitelist policies. Deliverables include a Transition-In Plan, TOMP, System Administration Documentation, and biannual user documentation for COPS and FABS, all subject to monthly performance measurements with targets of 95% on-time, complete, and accurate delivery and minimum acceptable