Sources Sought
Enterprise Modernization of the Diversion Control Division’s Information Technology Systems
Department of Justice · Drug Enforcement Administration
AI summaryThe Drug Enforcement Administration (DEA), part of the Justice Department, is asking industry for information about a modern, centralized software platform for its Diversion Control Division. This is a request for information, not a solicitation. The Division wants to replace many separate applications serving about 2.2 million registrants. The response due date is November 5, 2026, 6:00 PM Eastern (Amendment 0001; was October 20, 2026 (passed), 10:00 AM Eastern). More in the summary
Market research, not a bid. Replying is free and tells Drug Enforcement Administration who could do this work. Send a short reply to the contracting contact; no price is needed. See the contact
A newer version of this notice was posted Oct 21, 2026. See the latest version.
AI summary Beta
Summary of the version posted Oct 16, 2026. The notice was amended Oct 21, 2026. Check what else changed on SAM.gov.
The Drug Enforcement Administration (DEA), part of the Justice Department, is asking industry for information about a modern, centralized software platform for its Diversion Control Division. This is a request for information, not a solicitation. The Division wants to replace many separate applications serving about 2.2 million registrants. The response due date is November 5, 2026, 6:00 PM Eastern (Amendment 0001; was October 20, 2026 (passed), 10:00 AM Eastern).
Who can bid
- FedRAMP High authorization is a baseline requirement for the solution, and respondents are asked to confirm their current FedRAMP authorization level and number.
How to submit: Email to Alicia.n.thomas@dea.gov and FAC.Proposal.Submission@dea.gov; telephone calls will not be entertained. What to include is under Full summary below. Check the solicitation's instructions on SAM.gov.
Things to watch (7)
- Serious: FedRAMP High is required. A solution must already meet the Federal Risk and Authorization Management Program (FedRAMP) High level, a costly security approval a small business may not hold.
- Worth checking: Information request, not a solicitation. Replying does not lead to an award by itself; DEA uses answers for acquisition planning only.
- Worth checking: Very large system. The current system handles over 3 million transactions a year and about 8 TB of data, so a bidder needs proven large-scale experience.
Show all 7Show fewer
- Worth checking: Pricing estimate required with the response. Respondents must give a detailed rough order of magnitude cost estimate, which takes real effort for an information request.
- Worth checking: Existing ordering vehicles are asked about. The notice asks about ordering vehicles DEA can use, and one question asks about a Department of Justice BPA, so firms without a vehicle may be at a disadvantage.
- Minor: AI needs DEA and Department of Justice approval. Any AI feature cannot be turned on until documentation is reviewed and approved.
- Minor: Scope wording is mixed. The overview asks for single sign-on (one login for many applications) solutions, while the rest of the RFI describes a full registration platform, so confirm the scope.
Read from the notice and 2 attachments. Show which files.
- AMENDMENT 0001 D-27-DC-91626.pdf (read)
- Request for Information D-27-DC-91626-Diversion Control Divisions (DC) Information Technology (IT) Systems.pdf (read)
Full summary
What they want
- Describe a modern, unified platform, such as SaaS (software hosted and run by the provider) or COTS (commercial off-the-shelf software), to replace the Division's siloed applications.
- Handle the full registration lifecycle (new, renewal, modification, transfer, surrender) with fee collection through Pay.gov and a registrant self-service portal.
- Let DEA staff change forms, rules, workflows and notifications without heavy custom coding, with dashboards, reporting and analytics.
- Connect to current systems (RICS, ARCOS, CTRANS, the DC3 call center on Salesforce, CSOS) and outside data such as State licensing, the Death Master File and the HHS-OIG exclusions list; migrate data from RICS.
- Meet FedRAMP High, Section 508 accessibility, NIST Special Publication 800-53 and the CJIS (Criminal Justice Information Services) Security Policy.
- Offer an AI-ready design; no AI may be turned on until DEA and Department of Justice approve it.
- Propose performance measures and service-level agreements for an outcomes-based contract, meaning pay tied to measured results.
- Also cover website management, high-volume print-on-demand, mapping, public tip and event forms, and mobile access.
- Place of performance
- VA, USA (as listed on SAM.gov); the RFI does not name a site
- Estimated value
- Not stated
- Offers due
- November 5, 2026, 6:00 PM Eastern (from the version posted Oct 16, 2026; amended since)
- How to submit
- Email to Alicia.n.thomas@dea.gov and FAC.Proposal.Submission@dea.gov; telephone calls will not be entertained
- Page limits
- Substantive response: 40 pages (8.5 x 11), excluding the cover page, table of contents, requested appendices and supplemental materials. Each answer to the 12 industry questions: no more than two pages, font no smaller than 12-point.
What to include when you submit
- Include company information: company name, CAGE code, point of contact (name, phone, email), UEI and FedRAMP number.
- Include rough order of magnitude (ROM) pricing, a non-binding cost estimate, covering licensing, cloud and software, implementation and integration labor, training, data migration, FedRAMP environment differences and AI costs.
- Answer the 12 industry questions: NAICS codes, similar existing contracts, data rights clauses, AI data boundary, API and data flow approach, recommended approach, service levels, similar federal deployments, timeline, contract structure, hosting, and compliance and security.
- Say whether you have a Department of Justice BPA (blanket purchase agreement) or other ordering vehicle DEA could use.
Current contractor
No incumbent is named. The RFI describes the current systems (RICS, ARCOS, CTRANS, DC3 on Salesforce, CSOS) but not who runs them. No count of responses or planned awards is given.
Not in the notice text
- Answers to industry questions will come in a later amendment and are not in the text.
- Appendix A (DC_Applications_Appendix.xlsx), the application descriptions, is named in the RFI but its contents are not in the text.
- The NAICS code, set-aside, contract type, contract value and award timeline are not stated; the RFI asks respondents to recommend contract structure and timeline.
Eligibility and how to respond
- No set-aside. Any business can reply: this is market research, and no bid is being taken yet.
- To respond, send a short reply to the contracting contact near the top of this page. No price is needed.
Notice details
- Posted
- Oct 16, 2026
- Notice type
- Sources Sought
- Office
- Headquaters, Springfield, VA
- Versions
3 versions have been posted, newest first.
- Oct 21, 2026 · Amendment 0002Due Nov 5, 2026
- Oct 16, 2026 · Amendment 0001 (this version)Due Nov 5, 2026 (changed)
- Sep 21, 2026 · Sources SoughtDue Oct 20, 2026
- Attachments
Past awards and competition
Who has won work like this before, the likely incumbent, and what similar contracts paid, from USAspending.gov.
Before you respond
Terms on this notice: Sources sought notice