Status: Open. 6-page or 15-slide solution briefs due November 30, 2026, 5:00 p.m. CST, by email to DITCO.
Executive Summary
The Defense Information Systems Agency (DISA) is the Pentagon's IT and communications agency. It runs the military's shared networks, cloud and identity systems. DISA posted an Area of Interest (AOI DISA-OTA-27-R-ICAM) under its Commercial Solutions Opening (CSO HC108425S0001), a standing way to buy commercial technology, for a Next Generation Enterprise Identity, Credential, and Access Management (E-ICAM) prototype.
E-ICAM controls who is on Department of War networks and what they can reach, and it is the first layer of the department's zero trust architecture. DISA wants to replace six separate Active Directory forests with one cloud-hosted commercial or software-as-a-service (COTS/SaaS) platform on its unclassified (NIPR, Impact Level 5) and secret (SIPR, Impact Level 6) networks. The first step is a solution brief, due November 30, 2026, 5:00 p.m. CST. DISA prefers products already sold commercially with customers who can vouch for them.
Solicitation at a Glance
- Agency: Defense Information Systems Agency (DISA), Department of War; issued by the Defense Information Technology Contracting Office (DITCO)
- Opportunity: Next Generation Enterprise Identity, Credential, and Access Management (E-ICAM) Prototype Other Transaction (OT)
- AOI number: DISA-OTA-27-R-ICAM (Version 1.0), under DISA CSO HC108425S0001
- Award vehicle: Prototype Other Transaction (OT) agreement, a flexible contract type, under 10 U.S.C. 4022; not subject to the FAR
- Funding: Not stated in the AOI. A successful prototype can lead to a follow-on production contract or transaction without further competition.
- Period of performance: Generally no more than 9 months
- Questions due: November 13, 2026, 5:00 p.m. CST (answers posted within 3 business days)
- Solution briefs due: November 30, 2026, 5:00 p.m. CST
Think your company qualifies? Talk with BW&CO before the November 30 deadline.
What Is E-ICAM?
E-ICAM is the Department of War's enterprise identity backbone. It lets authorized users reach the services, systems and data they need, and tells the department who is on its networks at any time. It acts as the identity security perimeter that governs downstream zero trust security decisions. It also supports financial systems that must pass an annual SOC 1 Type II audit.
What Problem Is DISA Trying to Solve?
- Fragmented directories: legacy Microsoft Identity Manager sync pipelines span six isolated Active Directory forests, which duplicates records and creates support gaps.
- Slow Federation Hub: the IL5 Federation Hub runs without an Attribute Index, causing sync delays and authentication latency.
- Coarse access rules: role-based access control cannot evaluate dynamic clearances, training attributes or object classifications, which blocks zero trust goals.
- Audit risk: provisioning lacks automated cross-system separation of duties (SOD) checks, an Internal Control over Financial Reporting concern.
- No downtime: any transition must avoid unscheduled downtime for downstream mission systems.
Priority Capability Areas: What DISA Is Looking For
- Federated Identity Provider (IdP): secure sign-in across many systems and services.
- Automated Account Provisioning (AAP): creating and managing user accounts with real-time policy evaluation.
- Master Entitlement Record (MER): an active, cross-system record of user entitlements.
- Federation Hub (FedHub): interoperability across identity providers, with a high-performance IL5 Attribute Index and a secure IL6 (SIPR) capability.
- Modularity: COTS/SaaS solutions that are modular at the core-capability level and within each capability.
Funding and Terms
- Money: DISA has not posted a dollar amount for the prototype. The AOI says a follow-on production award could be significantly larger than the prototype and usable by one or more DoD organizations.
- Data rights: DISA seeks Unlimited Data Rights to the technical data package, including complete source code. Proprietary software needs prior approval and documented interfaces.
- Preferences: existing, reference-verifiable commercial products first; otherwise existing products that need the least non-recurring engineering; free test licenses preferred.
Eligibility and Requirements
- Controlled attachment: Attachment 1 (Desired Solution Attributes) is released only on request through the federal contracting site (SAM) with an active CAGE code, UEI and Joint Certification Program (JCP) number. DISA will not extend the deadline for JCP processing.
- Cybersecurity: CMMC Level 2 (self-assessment against NIST SP 800-171 Rev 2) before award; CMMC Level 3 (DIBCAC) may be required once the current Phase II suspension ends.
- Business status: an Affirmation of Business Status Certification (Attachment 2) for each participating company.
- Not desired: academic research proposals.
How to Submit
- Tell DISA early: notify the Agreements Officer at the DITCO OTA mailbox named in the AOI if you plan to submit.
- Get Attachment 1: request it on SAM with your CAGE, UEI and JCP number.
- Write the brief: up to 6 pages (11-point font or larger, 1-inch margins) or 15 slides. Include a title page (company, point of contact, CAGE, UEI, AOI title and number), a one-page executive summary, the technology concept (commercial pilot or development, path to maturity, proprietary aspects) and company viability (funding raised or revenue, commercialization and go-to-market).
- Send it: email it to the DITCO OTA mailbox before 5:00 p.m. CST on November 30, 2026. Links and pop-ups in the brief are not evaluated.
What Happens After You Submit?
- Phase 1: DISA evaluates solution briefs.
- Phase 2: selected companies give an in-person or virtual pitch, with estimated price, schedule and data rights assertions.
- Phase 3: if selected and funded, a request for prototype proposal (technical and price volumes), then negotiation of a prototype OT.
Is This Opportunity a Good Fit for Your Company?
It fits identity and access management software companies, zero trust and privileged access startups, identity governance and entitlement analytics firms, directory, federation and single sign-on specialists, and cloud integrators with Impact Level 5 or 6 experience. Companies without a commercial identity product, a JCP number or a path to CMMC Level 2 by award may do better teaming with a prime or vendor that has them.
How BW&CO Can Help
BW&CO has helped deep-tech and dual-use founders secure more than $350M in non-dilutive funding. For commercial solutions openings like DISA's E-ICAM AOI, we help you:
- Check fit and gates quickly (JCP, CMMC, data rights).
- Frame your product against the four core capabilities.
- Write the 6-page solution brief or 15-slide deck.
- Prepare the Phase 2 pitch with price, schedule and data rights assertions.
- Build the prototype proposal if DISA invites you.
Plan Your E-ICAM Solution Brief
Frequently Asked Questions
When is it due?
November 30, 2026, 5:00 p.m. CST, by email to the DITCO OTA mailbox. Questions close November 13, 2026, 5:00 p.m. CST.
How much money is available?
DISA has not posted an amount. A successful prototype can lead to a follow-on production award without a new competition.
Can a startup lead?
Yes. DISA prefers existing commercial products with customer references, whatever the company size.
What is JCP and why do I need it?
The Joint Certification Program, run by the Defense Logistics Agency, certifies companies to receive export-controlled technical data. You need an active JCP number to get Attachment 1, the detailed requirements.
Do I need CMMC?
Performers need CMMC Level 2 (self-assessment) before award. Level 3 may be required later.
Who owns the software?
DISA seeks unlimited data rights to the technical data package, including source code. Proprietary components need approval and documented interfaces.
How long is the prototype?
Generally no more than nine months.
Can BW&CO help with an E-ICAM solution brief?
Yes. We can help you check fit and gates, frame your product against the four capabilities and write the solution brief with your team. Book a call with our team.
Source: SAM: DISA-OTA-27-R-ICAM, Area of Interest for Next Generation E-ICAM Prototype OT; DISA CSO HC108425S0001