Sources Sought
Web Sustainment/Content Management/Cloud Hosting
Department of Defense · Defense Human Resources Activity
More open Defense Human Resources Activity contracts
AI summaryThis is a sources sought notice (market research), not a request for proposals: the Defense Human Resources Activity, for the Personnel and Readiness Management Agency (PRMA) and its Defense Civilian Personnel Advisory Service (DCPAS), wants to know which firms can run two Drupal websites, dcpas.osd.mil and dodciviliancareers.com. The work is website upkeep, content management, security updates and hosting in a FedRAMP-approved cloud (a federally approved cloud security program). Firms send a capability statement of up to five pages by the response due date of November 3, 2026, 12:00 PM Eastern. More in the summary
Market research, not a bid. Replying is free and tells Defense Human Resources Activity who could do this work. Send a short reply to the contracting contact; no price is needed. See the contact
A newer version of this notice was posted Oct 21, 2026. See the latest version.
AI summary Beta
Summary of another version of this notice: check what changed on SAM.gov.
This is a sources sought notice (market research), not a request for proposals: the Defense Human Resources Activity, for the Personnel and Readiness Management Agency (PRMA) and its Defense Civilian Personnel Advisory Service (DCPAS), wants to know which firms can run two Drupal websites, dcpas.osd.mil and dodciviliancareers.com. The work is website upkeep, content management, security updates and hosting in a FedRAMP-approved cloud (a federally approved cloud security program). Firms send a capability statement of up to five pages by the response due date of November 3, 2026, 12:00 PM Eastern.
Who can bid (4)
- Registered in the System for Award Management (SAM)
- Contractor holds a Defense Information Systems Agency (DISA) Authority to Operate (ATO) or Provisional-ATO for the cloud services at the impact level DHRA requires, with evidence shown to the Government
- Information systems have an Authority to Operate (ATO) or, if the Government accepts it, an Interim Authority to Operate (IATO) by contract award, under the DoD Risk Management Framework
Show all 4Show fewer
- All contractor personnel are United States citizens
How to submit: Email to the PRMA Acquisition Management Directorate: Contract Specialist Tameka Laws at tameka.j.laws.civ@mail.mil and Contracting Officer Matthew C. Poole (his email address is not given in the text read). What to include is under Full summary below. Check the solicitation's instructions on SAM.gov.
Things to watch (7)
From the version posted Oct 21, 2026.
- Serious: DISA cloud authorization required. The draft PWS says the contractor must already hold a DISA Authority to Operate or Provisional ATO at the right impact level for the cloud services, which many small web firms do not have.
- Serious: System authorization by contract award. Information systems must have an ATO, or an interim one if accepted, by contract award, backed by DoD Risk Management Framework documents.
- Worth checking: U.S. citizens with Tier 3 background checks. Every worker must be a U.S. citizen and obtain a CAC through a Tier 3 investigation, and the draft asks about moving these over in a 30-to-60-day transition.
Show all 7Show fewer
- Worth checking: Set-aside strategy not yet decided. The Government will use the responses to choose among an 8(a), service-disabled veteran-owned, HUBZone, women-owned, small business set-aside or full and open competition.
- Worth checking: Must keep the current cloud host relationship. The draft PWS names ProjectHost as the current cloud hosting provider and tells the contractor to keep that relationship while ensuring FedRAMP compliance.
- Minor: Cyber incidents reported within one hour. Any cyber incident must be reported to the DMDC incident response team within one hour of discovery, with further reports every 24 hours.
- Minor: Section 508 audit work may be added. The Government is considering folding dedicated 508 accessibility audit and remediation into the main web sustainment work, which could widen the labor mix.
Read from the notice and 2 attachments. Show which files.
- Draft PWS_Web Development Services.pdf (read)
- Sources Sought_ Web Development Services (Final).pdf (read)
Full summary
What they want
- Act as technical webmaster for both websites, with core Drupal development, maintenance and security patching
- Keep the sites running in an established FedRAMP-approved cloud environment and keep that hosting provider relationship current
- Install Drupal core and module updates, run backups and restores, and manage servers and accounts such as Google API
- Add a content management tool so DCPAS staff can post routine updates on their own, and build event landing pages and custom modules when asked
- Keep the sites Section 508 accessible (federal accessibility rules) and send bi-annual compliance reports
- Provide current and historical page reports and analytics, and monthly status reports
- Write a Book of Knowledge (BoK) of sustainment steps for a future transition, and hand all code to the Department of Defense (DoD)
- Place of performance
- The contractor's own facility, with infrequent meetings at Government facilities as required; SAM.gov lists Alexandria, VA
- Estimated value
- Not stated
- Offers due
- November 3, 2026, 12:00 PM Eastern
- How to submit
- Email to the PRMA Acquisition Management Directorate: Contract Specialist Tameka Laws at tameka.j.laws.civ@mail.mil and Contracting Officer Matthew C. Poole (his email address is not given in the text read)
- Page limits
- Capability statement: 5 pages (single-spaced, 12-point font minimum, 1-inch margins; cover page and table of contents excluded)
What to include when you submit
- Send an unclassified capability statement with company name, address, email, phone, website, point of contact, Unique Entity Identifier (UEI), CAGE Code and company structure
- Give type of business and small business socio-economic category; 8(a), HUBZone and women-owned firms say whether certified or self-certified
- Small businesses state any teaming arrangement; other-than-small businesses address subcontracting opportunities
- List any GSA or multiple-award IDIQ contract number, and say whether you are interested as a prime or a subcontractor
- Describe your expertise for the draft performance work statement (PWS) functions: Drupal webmaster work, FedRAMP cloud sustainment, event pages and modules, Google API, Section 508 testing, and monitoring and transition documentation
- Give industry feedback on the draft PWS and answer the three listed questions (legacy Drupal on shared FedRAMP cloud, adding 508 audit work, and a 30-to-60-day transition)
- Give two similar projects completed in the last two years in a DoD environment, as prime or subcontractor: name and value, point of contact, description with challenges and successes, and your role
- Mark proprietary information clearly
After award, you must have
- Contractor gets staff Common Access Card (CAC) or Personal Identity Verification (PIV) ready by submitting Tier 3 vetting packages and keeping a favorable FBI fingerprint check From Draft PWS_Web Development Services.pdf:
Be responsible for obtaining CAC or PIV ready status and submit completed Tier 3 vetting package for processing.
Current contractor
Eminent IT LLC is the current contractor under contract H9821021C0009. No competition numbers are given.
Not in the notice text
- The contract type, period of performance, estimated value and set-aside are not stated.
- Whether a solicitation will follow is not stated; the notice says it does not guarantee one.
- Contracting Officer Matthew C. Poole's email address is not in the text read.
- The cybersecurity workforce table the draft PWS refers to is not in the text read.
Eligibility and how to respond
- No set-aside. Any business can reply: this is market research, and no bid is being taken yet.
- To respond, send a short reply to the contracting contact near the top of this page. No price is needed.
Notice details
- Posted
- Oct 20, 2026
- Notice type
- Sources Sought
- Office
- Defense Human Resources Activity, Alexandria, VA
- Business type
- IT, software & telecom (FedReady's grouping, from NAICS 541511)
- Versions
2 versions have been posted, newest first.
- Oct 21, 2026 · Amendment 0001Due Nov 3, 2026
- Oct 20, 2026 · Sources Sought (this version)Due Nov 3, 2026
- Attachments
Past awards and competition
Who has won work like this before, the likely incumbent, and what similar contracts paid, from USAspending.gov.
Before you respond
Terms on this notice: Sources sought notice
Full notice text from SAM.gov
Similar open opportunities
- AF-PLM Capability Integration, Sustainment & LicensesSolicitation FA8770-26-R-B009-SS2 is a sources sought notice (a request for information, or RFI) from the Department of the Air Force (office FA8770 AFLCMC GBK) for market…
- F-35 JPO Enterprise Data Science and Analytics Support
- RFI VHA Radiology and Cardiology Enterprise ImagingVeterans Affairs (Technology Acquisition Center NJ) posted an update to its request for information (RFI) 36C10B26Q0453 on a single enterprise imaging system for radiology and…
- U.S. Coast Guard Augmented Reality and Virtual Reality Training DevicesThe U.S. Coast Guard (CG-AIR-COCO-1) posted sources sought / request for information (RFI) 70ZA0127AIRC12001 on augmented reality (AR) and virtual reality (VR) training devices…
- CenTAM Special Notice Acquisition Update