Endpoint Security Event Management

The Defense Information Systems Agency (DISA) is conducting market research through a Sources Sought notice to identify qualified sources for an Endpoint Security Event Management System to support Project Manager Command & Control Infrastructure and Network Enterprise Technology Command. The requirement centers on delivering a comprehensive cybersecurity solution for the Department of War Information Network – Army, with a focus on enabling Zero Trust Architecture through Endpoint Detection and Response, Security Incident and Event Management, Comply to Connect, asset management, advanced analytics, network visualization, and integration with the Army’s Big Data Platform and Identity Credentialing and Access Management services. The system must leverage Microsoft Defender for Endpoint and Elastic Defend to manage EDR across Army Unified Directory Services endpoints, enforce default-deny application controls, automate malware response, restrict removable media, collect behavioral telemetry, ingest STIX/TAXII threat data, and prepare infrastructure for post-quantum cryptography migration. The solution must support global fielding across CONUS and OCONUS locations, including contingency theaters and hazardous duty areas, with simultaneous on-prem and cloud deployments. The contract is anticipated to be a single-award IDIQ with a ceiling value of $850 million and a potential performance period of up to ten years, consisting of a two-year base period followed by eight one-year option periods beginning March 29, 2027. Primary performance will be centered at Fort Huachuca, Arizona, with oversight from Aberdeen Proving Ground, Maryland, and support delivered through four regional cyber centers covering Army installations worldwide. All contractors must hold a Top Secret facility clearance and be capable of providing personnel with at least Secret-level clearances, with the ability to assign Top Secret-cleared individuals for mission-critical tasks. Compliance with DoD cybersecurity standards including RMF, STIGs, IAVAs, and Authorization to Operate is mandatory. Subcontracting is limited under FAR 52.219-14, and companies must demonstrate small business status if applicable, adhere to the NAICS code 541519 with a $34 million size standard, and list qualifying prime contract vehicles such as ENCORE III, SETI, GSA OASIS, ALLIANT II, VETS II, STARS III, MAS, NIH CIO-SP4, and NASA SEWP V. Responses must be submitted via email by 12:30 PM EDT on June 29, 2026, and include business information, CAGE code, socio-economic designation, and a capabilities