Cloud Based Internet Isolation Service

Quick Summary

The Defense Information Systems Agency (DISA) is soliciting proposals for a Cloud Based Internet Isolation (CBII) Service to provide a secure, cloud-based browsing solution for up to 3.4 million Department of War (DoW) users. This requirement includes the renewal and procurement of new subscription licenses for Menlo Security, Inc.’s Cloud Browser product as a managed service, incorporating AI/ML capabilities for enhanced cybersecurity. This is an Unrestricted competition. Proposals are due March 16, 2026.

Scope of Work

The contractor will provide a managed service utilizing the Menlo Security, Inc. solution, encompassing:

• Program Support: Management, reporting, and administrative tasks.
• Managed Services: Contract and schedule management, reporting (Weekly Activity Reports), documentation, and financial oversight.
• Cloud Service Offering (CSO): Delivery, deployment, and sustainment of an unclassified CSO, ensuring internet traffic isolation, threat mitigation, and compliance with FedRAMP+ Level 2.
• Operational Service Support: Tiered service desk infrastructure (Tier 0, I, II, III) for end-user support, incident management, and request fulfillment.
• Accreditation & Authorization (A&A): Support for all phases of the Risk Management Framework (RMF) and A&A lifecycle, including security engineering and compliance with DoD 8500 series.
• Migration, Readiness Assessments, and Sustainment: User migration strategy development and execution, technical support for upgrades.
• Training: Development and delivery of training materials for subscribers, administrators, and instructors.
• Engineering Support: Systems, architecture, network, configuration management, test, cybersecurity, and mobility engineering services.

Contract Details

• Contract Type: Firm-Fixed-Price (FFP) for managed service, Cost-Reimbursable for travel.
• Duration: One base year (April 15, 2026 - April 14, 2027) and four one-year option periods, plus a potential 6-month extension.
• Set-Aside: Unrestricted
• NAICS Code: 541519 (Other Computer Related Services) with a $34,000,000 size standard.
• Place of Performance: Primarily remote/on-site at contractor facilities; classified work may require performance at government facilities (e.g., DISA Ft. Meade, MD).

Key Requirements

• Security: Personnel must possess Final Secret clearance. Compliance with DoD 8500 series, FedRAMP+ Level 2, and CMMC Level 2 is mandatory.
• Technology: Proprietary Menlo Security, Inc. Cloud Browser product, with emphasis on AI/ML for threat detection (HEAT Shield).
• Data Management: All data must reside in servers located in the United States.
• Compliance: Section 508 Accessibility, Supply Chain Risk Management (SCRM) plan, and Non-Disclosure Agreements (NDAs) for personnel.

Submission & Evaluation

• Questions Due: March 2, 2026, at 3:00 PM CST.
• Proposals Due: March 16, 2026, at 5:00 PM CST.
• Evaluation: Award will be made to the responsible offeror whose proposal represents the overall best value using a Lowest Price Technically Acceptable (LPTA) process.
• Proposal Submission: Technical and price proposals are required. Oral presentations will be conducted virtually via MS Teams.

Important Attachments

• Attachment 1 CBII PWS: Details the full scope of work and performance standards.
• Attachment 2 QASP: Outlines how contractor performance will be monitored and evaluated.
• Attachment 3 CLIN Pricing Worksheet: Mandatory template for cost proposals.
• Attachment 8 Subcontracting Plan Review Checklist: Guide for developing a compliant subcontracting plan (if applicable).
• Attachment 9 RFP Questions and Answers Template: Required format for submitting inquiries.