Joint Cyber Intelligence Suite (JCITS) Malware Intelligence Triage Tool (JMITT) Platform

This combined synopsis/solicitation (HS002126QE046) issued by the Defense Counterintelligence and Security Agency (DCSA) announces a sole-source Request for Quotation (RFQ) for the Joint Cyber Intelligence Suite (JCITS) Malware Intelligence Triage Tool (JMITT) Platform. The contract is slated for the Georgia Tech Applied Research Corp (GTARC) under the statutory authority of having only one responsible source. The requirement is for a Software as a Service (SaaS) supply contract to support the DCSA Cyber Mission Center. The JMITT platform automatically ingests and analyzes suspicious email attachments from cleared contractors in real time to detect malicious content. The solution must integrate the "Apiary" SaaS malware analysis tool—which features a repository of over 288 million malware samples—and utilize the Malware Relationship Triage Tool (MReTT) to enhance threat detection capabilities for DCSA Counterintelligence Agents. The unrestricted procurement consists of a six-month base period (August 1, 2026 – January 31, 2027) followed by four one-year option periods extending through January 31, 2031. Although targeted as a sole-source action, DCSA will consider capability statements, proposals, or quotations from any responsible sources submitted electronically by July 27, 2026, at 10:00 a.m. EST.

This federal contract document consists of six Contract Data Requirements Lists (CDRLs) on DD Form 1423-1. These forms establish the tracking and deliverable requirements for the Georgia Tech Research Institute (GTRI) under a contract supporting the Cyber Mission Center's Joint Cyber Intelligence Tool Suite (JCITS) and the JCITS Malware Intelligence Triage Tool (JMITT). The six required data deliverables (A001 through A006) include: - **A001: Quality Control Plan tracking:** Must be submitted in Word format within 30 days of award, with a PDF final version, and updated within 5 business days of any subsequent changes. - **A002: Information Security Analytics and Trending report tracking:** Submitted "as required" per mission parameters in Word and PDF, allowing a maximum of one revision request. - **A003: Training Certificates tracking:** Annual submission of government-required training certificates. - **A004: Help Desk Incident Bugs Log and Report tracking:** Incident logs must be maintained daily, with formal reports submitted monthly in Word and PDF formats. - **A005: Phase-In Plan tracking:** Due within 90 days of contract award in Word and PDF, with updates required within 10 business days of changes. - **A006: Phase-Out Plan tracking:** Due 30 calendar days prior to the contract's lifecycle end date, with updates required within 10 business days of changes. All deliverables reference Statement of Work (SOW) Paragraph 7 and are routed to the Contracting Officer's Representative (COR), Contracting Officer (KO), and Technical Point of Contact (TPOC).

This Statement of Work (SOW) outlines the requirements for a Software-as-a-Service (SaaS) solution to support the Defense Counterintelligence and Security Agency’s (DCSA) Joint Cyber Intelligence Suite (JCITS) Malware Intelligence Triage Tool (JMITT) platform. The primary objective is to ingest, analyze, and triage suspicious emails and attachments submitted by cleared contractors in real time, preventing malware from entering DCSA networks. The Contractor must deliver SaaS support, maintenance, and an Information Security Analysis Trend Report (ISATR). Key technical requirements include integrating the Malware Relationship Triage Tool (MReTT) and the Apiary malware repository, maintaining isolated on-premises infrastructure in Atlanta, Georgia, and scaling to process up to 10,000 daily submissions with response times under 30 minutes. The contract features a six-month base period starting August 1, 2026, followed by four 12-month option periods. Performance standards mandate 99.9% system availability during defined business hours, backed by specified support desk response times and service credits for SLA breaches. Required deliverables include a Quality Control Plan, Training Certificates, monthly Help Desk logs, and structured Phase-In/Phase-Out plans to ensure seamless transition management. Crucially, the Government retains ownership and unlimited rights to all generated data and reports. The Contractor must also adhere to strict operational security (OPSEC) policies, data deletion protocols, and Section 508 accessibility standards.

This federal contract document (Document Number HS002126QE046) establishes the standard legal, financial, and administrative clauses incorporated by reference and in full text. It combines both Defense Federal Acquisition Regulation Supplement (DFARS) and Federal Acquisition Regulation (FAR) provisions, many of which feature recent 2026 deviations. Key administrative components include Wide Area WorkFlow (WAWF) electronic payment instructions, incremental funding limits under the Limitation of Government's Obligation clause, and options to extend services or the overall contract term for up to five years. The document mandates critical compliance representations and certifications for potential offerors. These cover prohibitions on acquiring covered defense telecommunications equipment or services, restrictions on business operations with the Maduro regime, and restrictions on contracting with inverted domestic corporations. Additionally, it outlines the two-percent tax on certain foreign procurements, requiring applicable foreign entities to submit IRS Form W-14. Finally, it details post-award small business program rerepresentation requirements, directing contractors to validate or update their socioeconomic status in the System for Award Management (SAM) under specific triggers such as mergers, acquisitions, or long-term contract milestones.