Sources Sought
Enterprise Modernization of the Diversion Control Division’s Information Technology Systems
Department of Justice · Drug Enforcement Administration
AI summaryThis is a request for information (RFI), a market research notice, not a solicitation. The Drug Enforcement Administration (DEA) wants ideas and rough cost estimates to replace the siloed computer systems of its Diversion Control Division with one modern platform. The platform would be software as a service (SaaS) or commercial off-the-shelf (COTS) software, and the product itself must hold FedRAMP High, the highest federal cloud security approval, when a later contract is awarded. Responses are due by the response due date, November 5, 2026, 6:00 PM Eastern, which Amendment 0001 moved from October 20, 2026 (passed). More in the summary
Market research, not a bid. Replying is free and tells Drug Enforcement Administration who could do this work. Send a short reply to the contracting contact; no price is needed. See the contact
AI summary Beta
This summary may miss requirements: 2 of 8 attachments weren't read (Attach 4. NARA Universal ERM Requirements.xlsx, Attach 5. 260818_DC_Applications_Appendix REV A.xlsx). Check the attachments on SAM.gov.
This is a request for information (RFI), a market research notice, not a solicitation. The Drug Enforcement Administration (DEA) wants ideas and rough cost estimates to replace the siloed computer systems of its Diversion Control Division with one modern platform. The platform would be software as a service (SaaS) or commercial off-the-shelf (COTS) software, and the product itself must hold FedRAMP High, the highest federal cloud security approval, when a later contract is awarded. Responses are due by the response due date, November 5, 2026, 6:00 PM Eastern, which Amendment 0001 moved from October 20, 2026 (passed).
Who can bid (4)
- The proposed cloud solution itself must be FedRAMP High authorized when a contract is awarded; a product only hosted on a FedRAMP High platform will not be considered
- Solutions must be commercial off-the-shelf (COTS); DEA will consider hybrid designs
- Solutions must meet Criminal Justice Information Services (CJIS) Security Policy compliance requirements
Show all 4Show fewer
- The vendor pays for its own FedRAMP certifications and authorizations; DEA and the Department of Justice will not sponsor FedRAMP High work
How to submit: Email to Alicia Thomas (Alicia.n.thomas@dea.gov) and FAC.Proposal.Submission@dea.gov; telephone calls are not entertained. What to include is under Full summary below. Check the solicitation's instructions on SAM.gov.
Things to watch (10)
From the version posted Oct 21, 2026.
- Serious: FedRAMP High on the product itself, at award. A small business without its own FedRAMP High authorized cloud product cannot be considered, and DEA says it will not sponsor a vendor seeking the authorization.
- Serious: Very large, complete-solution scope. DEA expects full solutions covering all of its applications, SSO, data migration, website administration and a physical mailroom with staffing, so a small business would likely need partners.
- Worth checking: Scope is wider than the single sign-on wording. The RFI overview speaks of single sign-on, but DEA says the identity, RICS, registrant platform and wider portfolio efforts are all in scope.
Show all 10Show fewer
- Worth checking: No set-aside decided. SAM.gov shows no set-aside, and DEA says it has not decided on small business set-asides or participation, so a later contract may be open to all firms.
- Worth checking: Data migration terms differ. The supplemental document expects all data imported with 100% fidelity, while a Q&A answer says archive-with-access may be acceptable for older records; ask DEA which applies.
- Worth checking: State licensing links with no existing agreements. The platform must cover every state board and license type, and DEA has no agreements with them today.
- Worth checking: High availability and 24/7 support baselines. The performance baselines call for 99.9% availability and 24-hour recovery objectives, and critical incidents need a response around the clock.
- Minor: 40-page limit includes the cost estimate and all answers. The page limit covers the technical overview, the 12 industry question answers and the ROM together.
- Minor: Legacy operations stay under a separate contract. Operations and maintenance of today's systems during the changeover will be a separate contract, so this work does not include it.
- Minor: Possible vendor demonstrations after responses. DEA may ask for demonstrations, which would be for market research only and not a formal evaluation.
Read from the notice and 6 attachments. 2 of 8 not read. Show which files.
- Attach 2. D-27-DC-91626 QA.pdf (read)
- Attach 1. 261008_RFI Supplemental Information_v1_1.pdf (read)
- AMENDMENT 0002 D-27-DC-91626.pdf (read)
- AMENDMENT 0001 D-27-DC-91626.pdf (read)
- Request for Information D-27-DC-91626-Diversion Control Divisions (DC) Information Technology (IT) Systems.pdf (read)
- Attach 3. 630 - Drug Control Records.pdf (read)
- Attach 4. NARA Universal ERM Requirements.xlsx: not read (the AI doesn't read this file type yet): open it on SAM.gov
- Attach 5. 260818_DC_Applications_Appendix REV A.xlsx: not read (the AI doesn't read this file type yet): open it on SAM.gov
Full summary
What they want
- Replace or consolidate the Diversion Control Division's siloed applications (the RICS suite of 20+ applications, ARCOS, CTRANS) into one platform with single sign-on, keeping CSOS (the controlled substance ordering certificate system) and the DC3 contact center and DC4 chatbot and integrating them
- Registration lifecycle and a registrant self-service portal: new registrations, renewals, modifications, status tracking and fee payment through Pay.gov
- Configurable workflows, dashboards, reporting and analytics, plus links to outside data such as First Databank, Customs and Border Protection's ACE system, state licensing sources and the HHS-OIG Exclusions List
- Move the existing data (about 8 TB; 4,747,744 RICS registrations and 1,568,017,457 ARCOS transactions) into the new system
- Run print-on-demand and the mailroom (more than 3.5 million mailed communications a year), including staffing and training
- Website administration, security and maintenance for the Diversion Control Division site
- Propose performance measures and service level agreements (SLAs: promised uptime and response levels) under outcomes-based contracting, where pay is tied to measurable results
- Keep the design ready for future artificial intelligence (AI) features, which cannot be turned on without DEA and Department of Justice approval; Amendment 0002 renames AI as Super Intelligence (SI)
- Contract type
- Not decided. DEA intends outcomes-based contracting (OBC) and says its acquisition strategy and contract structure are not final.
- Period of performance
- Multi-year, not yet set. For rough cost estimates only, DEA asks for a 12-month base period plus four 12-month option periods.
- Place of performance
- VA, USA (as SAM.gov gives it); the documents name no work site
- Estimated value
- Not stated
- Offers due
- November 5, 2026, 6:00 PM Eastern Time
- How to submit
- Email to Alicia Thomas (Alicia.n.thomas@dea.gov) and FAC.Proposal.Submission@dea.gov; telephone calls are not entertained
- Page limits
- Whole response: 40 pages, covering the substantive response, the answers to the industry questions and the rough order of magnitude (ROM) cost estimate, not counting the cover page and table of contents. Each industry question: two 8.5 x 11 sheets at 12-point font; 10-point is allowed in tables, graphs and charts.
What to include when you submit
- Give company name, CAGE code (the company's federal facility code), point of contact (name, phone, email), UEI (unique entity ID from SAM.gov) and FedRAMP number
- Answer each of the 12 industry questions in Section 6 of the RFI, including your NAICS codes, existing similar contracts and whether the agency allows ordering from them, data rights clause (unlimited, limited or restricted rights under FAR 52.227-14), recommended SaaS or COTS approach, SLAs, implementation timeline, contract structure, hosting models and FedRAMP and security history
- Include a technical overview and approach covering the functional areas in Sections 3, 4 and 5
- Send a rough order of magnitude (ROM) cost estimate with licensing, cloud and software, implementation and operations labor, training and documentation, data migration or egress, costs between FedRAMP environments, and AI-related costs
- Base the ROM on a 12-month base period plus four 12-month option periods; show one-time implementation costs and recurring annual costs separately, and list assumptions
- Show AI-ready architecture and any AI options as separate ROM line items; range-based ROMs are accepted if assumptions, exclusions and dependencies are stated
- Mark platform-specific items not applicable only if you propose a non-cloud solution
Current contractor
No incumbent is named. A separate contract is expected to keep running operations and maintenance of the legacy applications, and DEA did not name the current contractors when asked. No count of responses, capable small businesses or planned awards is given.
Not in the notice text
- Attachment 4 (NARA Universal ERM Requirements.xlsx) and Attachment 5 (260818_DC_Applications_Appendix REV A.xlsx, the updated list saying which applications are replaced, retained or retired) are attached but not read; the middle of the Q&A document (roughly questions 79 to 175) and part of the records schedule were also not read
- The Government's estimate or budget is not stated
- Contract type, contract length, award timing, contract vehicle and any small business set-aside are not decided
- Which applications are replaced first and the deployment phases are left for a later discovery stage
- No NAICS code is shown on SAM.gov, and the RFI asks respondents for theirs
- Where the work would be done is not stated beyond VA, USA in the SAM.gov fields
Eligibility and how to respond
- No set-aside. Any business can reply: this is market research, and no bid is being taken yet.
- To respond, send a short reply to the contracting contact near the top of this page. No price is needed.
Notice details
- Posted
- Oct 21, 2026
- Notice type
- Sources Sought
- Office
- Headquaters, Springfield, VA
- Versions
3 versions have been posted, newest first.
- Oct 21, 2026 · Amendment 0002 (this version)Due Nov 5, 2026
- Oct 16, 2026 · Amendment 0001Due Nov 5, 2026 (changed)
- Sep 21, 2026 · Sources SoughtDue Oct 20, 2026
- Attachments
Past awards and competition
Who has won work like this before, the likely incumbent, and what similar contracts paid, from USAspending.gov.
Before you respond
Terms on this notice: Sources sought notice