Joint Planning and Execution Services (JPES) and Joint Capabilities Requirements Manager (JCRM) Software Sustainment and Maintenance

Sources Sought Notice

This notice is for informational purposes to determine the availability and technical capability of large and small businesses (including various small business subsets) to provide sustainment and maintenance for the Joint Planning and Execution Services (JPES) and Joint Capabilities Requirements Manager (JCRM) software. The Defense Information Systems Agency (DISA) Global Force Management (GFM) Program Management Office (PMO) is seeking this information.

The scope of this effort includes:

• Project Management
• Configuration and Release Management
• Risk Management
• JPES & JCRM Software Sustainment
• Tier 3 Help Desk Support
• Testing and Evaluation
• Information Assurance (IA) and Cybersecurity Support
• System Administration

Potential contractors are asked to describe their experience in:

• Agile software development methodologies (Scrum, Kanban, sprint planning, etc.)

• Information Assurance and Cybersecurity, including Risk Management Framework, POA&Ms, COTS patch releases, and STIG compliance.

• DevSecOps principles, Infrastructure as Code (IaC), and policy-as-code.

• Managing heterogeneous hardware environments and VMWare ESXi system administration.

• Migrating on-premises applications to classified cloud environments (e.g., IL5, IL6).

• Integrating Artificial Intelligence (AI) into software products.

• Anticipated Period of Performance: July 2026 through July 2027, with four, 12-month option periods, ending July 2031.

• Anticipated Place of Performance: Contractor's facility for unclassified work and on-site at DISA Headquarters (Ft Meade, MD) for classified work.

• Security Requirement: Work is up to the Secret level. Contractors must possess a final Secret Facility Clearance.

• This is not a Request for Proposal (RFP); it is for market research only.

• Responses are voluntary and not offers.

• Interested businesses should submit a brief capabilities statement package (no more than ten pages) addressing the "Required Capabilities" by 4:00 PM Eastern Daylight Time on July 7, 2025.

• Submission emails: Sebrina.A.Lewis.civ@mail.mil and Michelle.L.Rand.civ@mail.mil.

• NAICS Code: 541512 (Size Standard: $34,000,000.00).

• DISA will consider small business set-aside if two or more qualified small businesses respond.

• Responses must demonstrate ability to perform in accordance with FAR clause 52.219-14, Limitations on Subcontracting.

• Information regarding plans to use joint ventures (JVs) or partnering is requested.

• Existing contracts and orders may be extended to avoid breaks in service.

• Information is for market research only; businesses without prime contract vehicles are encouraged to respond.

• For information on DISA's requirements, visit www.disa.mil.

Statement of Work (SOW) / Performance Work Statement (PWS)

This PWS aims to provide maintenance and sustainment support for the DISA Global Force Management (GFM) Program Management Office (PMO), ensuring the availability, stability, and interoperability of the Joint Planning & Execution Services (JPES) and Joint Capabilities Requirements Manager (JCRM) systems. This includes sustainment, maintenance, project management, lab support, configuration management, cybersecurity, information assurance, software development, integration, Tier 3 helpdesk support, and system administration.

The scope is divided into three main task areas:

• Task Area 1 – Project Management: Focuses on managing the project, including planning, risk management, quality management, and schedule adherence.
• Task Area 2 - JPES & JCRM Development & Sustainment: Involves agile development, continuous integration/continuous development (CI/CD) pipeline processes, building, deploying, and maintaining an unclassified First Look Site (FLS), and providing Tier 3 help desk support.
• Task Area 3 - Infrastructure Support: Covers supporting, maintaining, and operating the JPES & JCRM infrastructure and environments for sustainment, development, and production, including system administration, integration, and maintenance of software and hardware.

Performance is evaluated based on meeting objectives, accuracy, clarity, conciseness, and completeness of deliverables. Specific metrics include:

• Deliverables and work products should not exceed three revisions.

• 95% of tasks and deliverables must meet identified suspense dates.

• Key personnel must be filled within 15 business days of Task Order start date or vacancy.

• Software functionality delivered must align with the Software Release Plan (SRP).

• 90% of planned stories must meet the Definition of Done.

• Software delivered must be free of Priority 1 and 2 defects before Government Acceptance Testing (GAT).

• Tier 3 help desk response times are defined for Priority 1 (≤ 2 hours), Priority 2 (≤ 2 hours), Priority 3 (≤ 48 hours), and Priority 4 (≤ 48 hours).

• 95% of POA&Ms must be met.

• Period of Performance: Base period from August 2026 to August 2027, with four option periods extending to August 2031, plus a six-month extension option (FAR Clause 52.217-8).

• Place of Performance: Primarily at DISA Headquarters, Ft. Meade, MD 20755-7088. Unclassified work may be performed at contractor-provided facilities, while classified work and RMF execution will be at DISA facilities. Alternate work sites require COR approval.

• Security: Requires a Final SECRET clearance for personnel working with classified data or production systems on SIPRNet. Personnel must undergo a Tier 3 investigation. Coordination for site access and visits requires advance notice (72 hours).

• Key Personnel: Program Manager, Lead IA/Security Specialist, and Chief Engineer/Lead Architect are designated as Key Personnel with specific experience and qualification requirements.

• Data Rights: The Government retains rights to all GOTS computer software, source and object code, and documentation provided by the Government.

• Supply Chain Risk Management (SCRM): The contract is subject to federal SCRM policies, requiring a SCRM plan and adherence to specific controls.