DoD NIPRNet and SIPRNet eDiscovery Software as a Service

SOURCES SOUGHT NOTICE 842571644 The Defense Information Systems Agency (DISA) is seeking sources for DoD NIPRNet (Impact Level (IL) 5) and SIPRNet (Impact Level 6) eDiscovery Software as a Service (SaaS), a web-based platform that is fully integrated into the Department of Defense Information Network (DoDIN) and has DISA's authorization to operate on both IL5 and IL6. CONTRACTING OFFICE ADDRESS: DISA/DITCO-Scott/PL8413 2300 East Drive Scott AFB IL 62225-5406 INTRODUCTION: This is a SOURCES SOUGHT NOTICE to determine the availability and technical capability of small or - other than small businesses (including the following subsets: Small Disadvantaged Businesses, Certified 8(a), Service-Disabled Veteran-Owned Small Businesses, HUBZone Small Businesses and Woman-Owned Small Businesses) to provide the required products and/or services. The Department of Defense (DoD) Office of General Counsel (OGC) is seeking information from potential sources for a cloud based (Gov/Mil Cloud) eDiscovery SaaS that is Federal Risk and Authorization Management Program (FedRAMP) approved at High Impact Levels 5 and 6 (IL5 and IL6) and has or has the ability to achieve DISA's Authorization to Operate (ATO) on both NIPRNet and SIPRNet. This IL5/IL6 eDiscovery SaaS must meet the requirements in this document and have the required security controls and data protection functions to comply with all Federal and DoD requirements. OGC requires two distinct systems, (1) a system certified at IL5 (UNCLASSIFIED) level and accessible on the NIPRNet with a .mil domain; and (2) a system certified at IL6 (SECRET) level and accessible on the SIPRNet with a .scloud or .smil.mil domain. Both the IL5 and the IL6 systems must be fully operational at the time of contract award. The anticipated Period of Performance is base year with four, one year options. Base Year: January 4, 2026, through January 3, 2027 Option Year 1: January 4, 2027, through January 3, 2028 Option Year 2: January 4, 2028, through January 3, 2029 Option Year 3: January 4, 2029, through January 3, 2030 Option Year 4: January 4, 2030, through January 3, 2031 The anticipated Place of Performance is Arlington, Virginia. DISCLAIMER: THIS SOURCES SOUGHT NOTICE IS FOR INFORMATIONAL PURPOSES ONLY. THIS IS NOT A REQUEST FOR PROPOSAL. IT DOES NOT CONSTITUTE A SOLICITATION AND SHALL NOT BE CONSTRUED AS A COMMITMENT BY THE GOVERNMENT. RESPONSES IN ANY FORM ARE NOT OFFERS AND THE GOVERNMENT IS UNDER NO OBLIGATION TO AWARD A CONTRACT AS A RESULT OF THIS NOTICE. NO FUNDS ARE AVAILABLE TO PAY FOR PREPARATION OF RESPONSES TO THIS NOTICE. ANY INFORMATION SUBMITTED BY RESPONDENTS IS STRICTLY VOLUNTARY. CONTRACT/PROGRAM BACKGROUND: Contract Number: HC108421C0002 Contract Vehicle: GSA Incumbent and their size: Casepoint, LLC (small business at the time of contract award) Method of previous acquisition: Full and open competition Period of performance: Base Year with four, one-year options Base Year: January 4, 2021, through January 3, 2022 Option Year One: January 4, 2022, through January 3, 2023 Option Year Two: January 4, 2023, through January 3, 2024 Option Year Three: January 4, 2024, through January 3, 2025 Option Year Four: January 4, 2025, through January 3, 2026 REQUIRED CAPABILITIES: 1. DoD OGC requires an eDiscovery SaaS that has DISA Risk Management Executive (RME) cybersecurity accreditation and Authorization to Operate (ATO) on NIPRNet at FedRAMP IL5, on an authorized .mil website, at the time of contract award. Provide your company's current: DITPR ID for your NIPR eDiscovery SaaS: DISA RME ATO Authorization Date: Whether this ATO is a - Type Authorization (Yes/No/In-progress): DISA RME ATO Authorization Termination Date: .mil website domain: OR Provide your company's anticipated date of obtaining a DISA RME ATO; DITPR ID; and .mil website domain, for your NIPR eDiscovery SaaS. 2. DoD OGC requires an eDiscovery SaaS that has DISA RME cybersecurity accreditation and ATO on SIPRNet at FedRAMP IL6, on an authorized .scloud or .smil.mil website, at the time of contract award. Provide your company's current: DITPR ID for your SIPR eDiscovery SaaS: DISA RME ATO Authorization Date: Whether this ATO is a - Type Authorization (Yes/No/In-progress): DISA RME ATO Authorization Termination Date: .scloud or .smil.mil website domain: OR Provide your company's anticipated date of obtaining a DISA RME ATO; DITPR ID; and .scloud or .smil.mil website domain, for your SIPR eDiscovery SaaS. 3. DoD OGC requires that the eDiscovery SaaS have integrated (on NIPRNet and/or SIPRNet) Legal Hold management tools, with capability to manage legal holds and data preservation efforts using correspondence templates, alerts, email notifications, custodian response tracking, reporting, and audit features. The Legal Hold functionality must be able to connect directly to Microsoft Office DoD365-J email accounts, to send email notifications to recipients from DoD OGC email accounts (that is, from @mail.mil accounts). Describe the Legal Hold management capabilities of your company's eDiscovery SaaS, including whether your tools are capable of sending email notifications from Microsoft Office DoD365-J (@mail.mil) email accounts. 4. DoD OGC requires that the eDiscovery SaaS have integrated (on NIPRNet and/or SIPRNet) Freedom of Information Act (FOIA) case management tools, with capability to manage FOIA requests, track progress of FOIA processing tasks, and generate case activity reports. Describe the FOIA case management capabilities of your company's eDiscovery SaaS. 5. DoD OGC requires that the company be able to share unclassified data generated from its IL5 eDiscovery SaaS on a secure website or portal that exists outside the NIPRNet (e.g., via a .com domain accessible by non-DoD users). Describe your company's ability to receive data generated from your IL5 eDiscovery SaaS, and store and present data securely on a website or portal external to the DoD NIPRNet. 6. DoD OGC requires the ability to log into the eDiscovery SaaS, over both NIPRNet and SIPRNet, via single sign-on access utilizing DoD Common Access Cards (CACs) or SIPR tokens (i.e, using DoD Enterprise Identity, Credential, and Access Management (DoD E-ICAM) and Microsoft Active Directory Federation Services (ADFS) as an Identity Provider (IdP) to authenticate users through the Security Assertion Markup Language (SAML) standard (DoD E-ICAM ADFS via SAML). Can DoD users access your eDiscovery SaaS on both NIPRNet and SIPRNet by using their DoD CACs or SIPR tokens for single sign-on login? 7. DoD OGC requires that the eDiscovery SaaS have capability to extract embedded and attached files from compound files (e.g., PDF portfolios, email attachments, .rar, .zip, or .pst files); create a separate record for each extracted file; and de-duplicate files by multiple methods and - deNIST files using current National Institute of Standards and Technology (NIST) lists. Describe the capability of your eDiscovery SaaS to process compound files, extract individual files, and de-duplicate files. 8. DoD OGC requires an eDiscovery SaaS with integrated, secure, scalable, and effective cloud data management and storage on both NIPRNet (at IL5) and SIPRNet (at IL6). Can your company's eDiscovery SaaS provide integrated, secure, scalable, and effective cloud data management and storage on both NIPRNet (at IL5) and SIPRNet (at IL6)? SPECIAL REQUIREMENTS: Must have Secret Facility Clearance. Please provide your company's current Facility Clearance level, and the current number of your employees with active Secret-level federal government security clearance. SOURCES SOUGHT: The North American Industry Classification System Code (NAICS) for this requirement is 518210, with the corresponding size standard of $40,000,000. In order to make a determination for a small business set-aside, two or more qualified and capable small businesses must submit responses that demonstrate their qualifications. Responses must demonstrate the company's ability to perform in accordance with FAR clause 52.219-14, Limitations on Subcontracting. To assist DISA in determining the level of participation by small business in any subsequent procurement that may result from this Sources Sought Notice, provide information regarding any plans to use joint ventures (JVs) or partnering. Please outline the company's areas of expertise and those of any proposed JV/partner who combined can meet the specific requirements contained in this notice. SUBMISSION DETAILS: Responses should include: Business name and address; Name of company representative and their business title; Small Business Socio-economic status (if small); CAGE Code; Prime contract vehicles; to include ENCORE III, SETI, NIH CIO-SP3, NASA SEWP V, General Service Administration (GSA): OASIS, ALLIANT II, VETS II, STARS III, MAS (including applicable SIN(s), groups or pools), or any other Government Agency contract vehicle that allows for decentralized ordering. (This information is for market research only and businesses with a valid cage that lack prime contract vehicles are still encouraged to respond to this notice.) Businesses who wish to respond must send a response via email NLT 4:00 PM Eastern Daylight Time (EDT) on March 12, 2025 to: joseph.m.nichols27.civ@mail.mil, melyssa.d.lafontaine.civ@mail.mil, and carmelynanne.bryan.civ@mail.mil. Interested businesses should submit a brief capabilities statement package addressing the specific questions above (no more than eight pages) demonstrating the ability to perform the services listed under Required Capabilities. Proprietary information and trade secrets, if any, must be clearly marked on all materials. All information received that is marked Proprietary will be handled accordingly. All submissions become Government property and will not be returned. All government and contractor personnel reviewing submitted responses will have signed non-disclosure agreements and understand their responsibility for proper use and protection from unauthorized disclosure of proprietary information as pursuant to 41 USC 423. The Government shall not be held liable for any damages incurred if proprietary information is not properly identified.