DISA delays $11B IT contract, removes CMMC requirements for now

Written by Jackson Barnett
OCT 26, 2020 | FEDSCOOP

The Defense Information Systems Agency needs a few more months to issue a final request for proposal on its $11.7 billion Defense Enclaves Services IT contract.

DISA planned to publish the RFP by September, but now it says it will release it in “mid-late” quarter one of fiscal 2021. DISA didn’t explain what caused the delay of the contract, which will consolidate the IT networks of the so-called fourth estate — the non-warfighting agencies that support the DOD.

The final RFP will also not include previously anticipated criteria for the Cybersecurity Maturity Model Certification (CMMC), the Department of Defense’s new contractor cyber standards. Since the standards for the program “are still in development,” DISA removed them as an initial judgment factor.

Initially, DISA included requirements for levels three and four of CMMC, which will have five levels of security requirements that will need to be assessed by independent inspectors, with most DOD contractors needing to meet only level one standards. But so far, there are only a few dozen provisionally accredited assessors, making it difficult for companies to earn a fully credentialed CMMC assessment. Levels three and four will have extensive security controls targeted on contracts that contain “controlled unclassified information.”

Nevertheless, CMMC will be a requirement in all DOD contracts by the end of fiscal 2025, so DISA’s removal of the standards is only delaying their inevitable at a later time.

Under the contract, DISA will “migrate these Defense Agencies from their legacy commodity IT networks to a single network we’re calling DoDNet, which DISA will operate,” Col. Chris Autrey, the program manager for the Defense Enclaves Services contract, said during a pre-solicitation meeting in August.

The single-award contract will function as an indefinite-delivery, indefinite-quantity vehicle with task orders issued for specific work. The agency anticipates a 10-year work period, but the contract will have an initial four-year base with three optional two-year extensions.