DISA Seeks Cloud ICAM Prototype Across Unclassified and Secret Networks

The Defense Information Systems Agency (DISA) issued a commercial solutions opening solicitation on November 6, 2026, seeking an industry partner to develop a Next Generation Enterprise Identity, Credential, and Access Management (E-ICAM) prototype. The modular, cloud-hosted solution is intended to operate across Impact Level 5 (IL5) environments handling sensitive unclassified defense information and Impact Level 6 (IL6) environments authorized for Secret information. DISA is seeking commercial off-the-shelf or software-as-a-service capabilities to modernize identity infrastructure and support the Department of Defense’s (DoD) zero-trust cybersecurity architecture. The agency has not disclosed a prototype value. It anticipates that schedules generally should not exceed nine months, and the solicitation describes the possibility of a substantially larger production follow-on without a new competition.

The requirement addresses shortcomings in the current enterprise architecture that DISA says inhibit modernization and mission effectiveness. The solicitation identifies fragmented identity directories, synchronization and account-management gaps, authentication latency, legacy authorization models, and workflows that do not reliably detect conflicting privileges. Reporting on the solicitation says the existing environment uses Microsoft Identity Manager synchronization pipelines across six isolated Active Directory forests, contributing to duplicate records, limited visibility into credential allocation, and support challenges. DISA also identifies delays in its Federation Hub, which allows users to authenticate through their home identity provider when reaching services beyond their organization’s boundaries.

The prototype is expected to validate four core capabilities: a Federated Identity Provider, Automated Account Provisioning, a Master Entitlement Record, and a Federation Hub. Together, these capabilities would support identity synchronization, credential and account management, and access decisions across unclassified and classified enclaves. DISA wants the solution to address security-boundary crossings and administrative integration while enabling a transition to unified cloud-hosted platforms across NIPR (IL5) and SIPR (IL6). The agency’s stated objective is to avoid unscheduled downtime for downstream mission systems during modernization, so bidders need to explain how they will test, integrate, and transition capabilities without disrupting operations.

The requirement also has acquisition and compliance implications beyond technical modernization. DISA links weaknesses in current authorization and provisioning workflows to risks involving role separation, supply-chain integrity, and material financial audit findings. Existing broad role-based permissions reportedly cannot dynamically account for attributes such as a user’s clearance or training and a resource’s classification. The solicitation’s controlled solution attributes are not publicly viewable, and access to the controlled attachment requires Joint Certification Program status. Prospective offerors should verify solicitation instructions and deadlines directly: solution briefs are due November 30, 2026, at 6 p.m. ET, while the source material reports conflicting question deadlines of November 13 at 6 p.m. ET and November 15. DISA’s reported existing production agreement with General Dynamics Information Technology (GDIT) runs through December 31, 2026; the new prototype competition creates an opportunity for other vendors to demonstrate performance ahead of a possible follow-on.

• Solicitation: DISA issued the commercial solutions opening on November 6, 2026, and amended it November 9, according to source reporting.
• Submission deadline: Solution briefs are due November 30, 2026, at 6 p.m. ET.
• Deadline discrepancy: Reported question deadlines differ—November 13 at 6 p.m. ET and November 15—so offerors should verify the controlling notice.
• Operating environments: The target solution spans IL5 sensitive-unclassified and IL6 Secret environments, including NIPR and SIPR enclaves.
• Prototype scope: DISA identifies a Federated Identity Provider, Automated Account Provisioning, Master Entitlement Record, and Federation Hub as core capabilities.
• Schedule and value: Proposed prototype schedules generally should not exceed nine months; DISA has not stated a prototype value.
• Technical focus: Proposals should address cloud-hosted COTS/SaaS deployment, scalability, security-boundary crossings, administrative integration, and transition without unscheduled mission-system downtime.
• Architecture gap: The existing system reportedly uses synchronization pipelines across six isolated Active Directory forests, with associated identity-management and support limitations.
• Access and compliance risks: DISA cites authorization and provisioning weaknesses tied to conflicting privileges, role separation, supply-chain integrity, and financial audit concerns.
• Competitive positioning: GDIT’s reported production agreement runs through December 31, 2026; prototype performance could matter if DISA pursues a larger follow-on without a new competition. Controlled attachment access requires Joint Certification Program status.