DISA shops for modernized identity prototype to support shift to zero-trust security 

The Defense Information Systems Agency is looking for an industry partner to build an enterprise identity, credential and access management prototype — a critical first layer of defense as the Pentagon moves to a zero-trust model for cybersecurity.

DISA issued a commercial solutions opening solicitation Friday with the intent of awarding an Other Transaction Agreement for a “next generation E-ICAM prototype” that would “modernize legacy identity infrastructure with a modular, cloud-hosted commercial off-the-shelf/software-as-a-service solution operating across IL5 and IL6 environments.”

In 2025, the Pentagon’s Office of the CIO delegated responsibility to DISA to develop and maintain an enterprise ICAM capability for the wider department up to the secret classification level, known as IL-6, by September 2027.

The Department of Defense’s current legacy enterprise ICAM capability faces “complex challenges and gaps” that “inhibit modernization efforts and reduces DoW mission effectiveness,” the solicitation explains. 

Among those challenges are a fragmented directory architecture for managing identities, an interoperability solution called FedHub that allows users to navigate beyond their service’s boundaries but that produces “severe latency,” legacy authorization models that prevent dynamic evaluation of identity attributes, and workflows that introduce issues for role separation that “directly violate Internal Control over Financial Reporting (ICOFR) mandates, threaten supply-chain integrity, and generate material audit weaknesses.”

“E-ICAM is a critical security program that creates a secure and trusted environment where DoW users can access all authorized resources (e.g., services, systems, and data) to execute a successful mission, while also letting the DoW know who is on the network at any given time,” the solicitation says, referencing the Department of War, the Trump administration’s preferred name for the department. “This serves as the critical first layer of the DoW’s Zero Trust (ZT) Cybersecurity Architecture. E-ICAM serves as the DoW’s identity security perimeter and acts as the foundational gateway that governs all downstream security decisions.”

While DISA’s “desired solution attributes” under this effort are controlled and not viewable at the public level, it does briefly share in the solicitation that it wants to “resolve deficiencies in the existing E-ICAM capability and thoroughly validate scalability, security boundary crossings, and administrative integrations to build a modernized Next Generation (NextGen) E-ICAM on IL5 and IL6 to support the DoW.”

DISA said it must transition its current system “into unified cloud-hosted COTS/SaaS platforms across Non-classified Internet Protocol Router Network (NIPR) (IL5) and SIPR (IL6) enclaves. Efforts to modernize E-ICAM must also resolve several critical deficiencies within the current capabilities and DoW computing environment while validating there will be no unscheduled downtime on downstream mission systems during any part of a transition to a new operational capability.”

DISA will accept solutions briefs from interested vendors through Nov. 30. Vendors also have until Nov. 15 to submit any questions to DISA. 

The E-ICAM prototype procurement comes as the DOD, its components and the military services face a self-imposed deadline to reach “target level” zero-trust maturity by the end of fiscal 2027.