The Defense Information Systems Agency (DISA) is seeking industry proposals for a next-generation enterprise identity, credential, and access management (ICAM) prototype to address fragmented directories, authentication delays, and access control gaps that the agency says create cybersecurity and financial audit risks.
DISA issued the solicitation Nov. 6 and amended it Nov. 9. Solution briefs are due Nov. 30 at 6 p.m. ET.
The agency wants a modular, cloud-hosted commercial off-the-shelf or software-as-a-service solution spanning unclassified Impact Level 5 and secret Impact Level 6 environments.
The effort targets a foundational part of the Pentagon’s zero trust architecture: establishing who is accessing its networks and what resources they are authorized to use. DISA describes enterprise ICAM as the department’s “identity security perimeter” and says the transition to a new ICAM solution must avoid unscheduled downtime for downstream mission systems.
DISA targets fragmented directories and access risks
The solicitation identifies four core capabilities for the prototype: a federated identity provider, automated account provisioning, a master entitlement record, and a federation hub.
DISA says the current architecture relies on outdated Microsoft Identity Manager synchronization pipelines spanning six isolated Active Directory forests. Those separate directory environments create duplicate records, limit visibility into credential allocation, and leave gaps in technical support.
The agency also identifies delays in the existing federation hub, which allows users to authenticate through their home identity provider when accessing other applications and services. DISA wants to modernize that capability across both unclassified and secret environments.
Access controls pose another challenge. According to the solicitation, the current system relies heavily on broad, role-based permissions that cannot evaluate changing information such as a user’s clearance, training, or the classification of a resource. DISA says that limitation prevents the department from achieving zero trust architecture standards.
The agency links identity modernization to financial accountability as well. Existing account provisioning workflows lack automated checks across applications to identify conflicting privileges that should be kept separate. DISA says those gaps can permit unauthorized combinations of access, threaten supply chain integrity, and generate material audit weaknesses.
A June 2020 Defense Department enterprise ICAM reference design included with the solicitation provides the architectural background for the effort. It calls for centralized identity and credential management and standardized authentication and authorization processes, while preserving access decisions informed by mission needs. The solicitation directs the prototype to align with that design where appropriate.
Prototype could lead to a larger production award
The procurement follows plans DISA outlined earlier this year to revisit enterprise authentication technology and expand identity federation with mission partners.
In June, Brian Hermann, DISA’s portfolio acquisition executive for cyber, said the agency planned an ICAM other transaction agreement by the end of 2026. He said the effort would help determine whether the department pursued a new commercial off-the-shelf platform or a software-as-a-service model for enterprise ICAM.
That earlier discussion emphasized secure access for partners who do not hold department-issued common access cards, including contractors, other federal agencies, and international partners. The new solicitation addresses the enterprise infrastructure supporting authentication and access governance.
DISA says proposed prototype schedules should generally run no longer than nine months. The agency will favor submissions that demonstrate existing, commercially proven capabilities that can be verified through references, and it is seeking unlimited government data rights to a technical data package that includes source code and key technical documentation.
A successful prototype could lead to a follow-on production contract or transaction without another competition. The solicitation says that follow-on effort could serve multiple defense organizations and be significantly larger than the prototype agreement.
The Nov. 9 amendment clarifies requirements for accessing a controlled attachment that contains detailed desired solution attributes. Vendors must have active Joint Certification Program status to obtain it, and DISA says it will not extend the submission deadline for companies awaiting that processing.
Questions are due Nov. 13 at 6 p.m. ET.