Sources Sought: Cloud Hosting, Provisioning, and Management for Indian Health Service (IHS)

Pursuant to 48 CFR Part 326, Subpart 326.603-3 and IHM 5.5-6, Indian Health Service must use the negotiation authority of the Buy Indian Act, 25 U.S.C. 47, to give preference to Indian Economic Enterprises (IEE), when authorized and practicable. 

HHS/OMAS does not intend to award a contract on the basis of responses nor otherwise pay for the preparation of any information submitted. HHS/OMAS may utilize responses to this notice to inform development a solicitation. Should such a requirement materialize, no basis for claims against HHS shall arise as a result of a response to this notice or HHS’s use of such information as either part of our evaluation process or in developing specifications for any subsequent requirement.

Disclaimer and Important Notes.

This notice does not obligate the Government to award a contract or pay for the information provided in response. The Government reserves the right to use information provided by respondents for any purpose deemed necessary and legally appropriate. Thus, respondents should not include any sensitive or proprietary information in their submissions. Any organization responding to this notice should ensure that its response is complete and sufficiently detailed to allow the Government to determine the organization’s qualifications to perform the work. Respondents are advised that the Government is under no obligation to acknowledge receipt of the information received or provide feedback to respondents with respect to any information submitted. 

Brief Decription of Requirement:

IHS intends to establish a Secure Cloud Center of Excellence (CCoE) requiring a FedRAMP High-authorized Infrastructure-as-a-Service (IaaS) cloud platform as the foundational element. At the core, the platform must provide a FedRAMP High-Authorized IaaS Platform with a minimum of 170 compliant services, enabling the full spectrum of cloud computing, storage, networking, security, and analytics capabilities required for federal healthcare operations. The infrastructure must support multi-region deployment with U.S.-only operations specifically designed to maintain tribal data sovereignty requirements mandated by IHS's trust responsibility to federally recognized tribes. At a minimum, solution must meet the following criteria, where relevant:

1. FedRAMP authorized for High impact level
2. Physical infrastructure for all all compute, storage, and networking resources located within the continental United States (CONUS).
3. All personnel with access to tribal health data must be U.S. persons subject to federal oversight and background investigation requirements.
4. IaaS or PaaS solutions must have documented integration with
   • Palo Alto Cortex XSIAM and Cortex XSOAR, which form the foundation of IHS's current Security Operations Center.
   • Splunk Enterprise Security toenable continued use of IHS's SIEM investment and established security workflows.
   •  Voltage SecureData integration required for Zero Trust Architecture Data Pillar implementation mandated under federal cybersecurity directives.
5. Agentic AI capabilities which enable the automation objectives central to the SCCoE's mission of reducing manual effort by 60-70%.

Additional details can be found in the Draft Statement of Work (SOW) included with this notice.

Submission Instructions: 

Interested parties who consider themselves qualified to perform the above-listed services are invited to submit a response by the date specified in this notice to the Contract Specialist, Renee Jones-Chuang, at [email protected] with the subject line “ACQ-OMAS-2026-ORC-0014_Sources".  Your submission must include the following information, at a minimum:

1. Company Profile that includes: 
   • UEI
   • Name and Address
   • Primary POC information
   • Business size and type of ownership
   • Socio-economic status/participation such as 8(a), WOSB/EDWOSB, SDVOSB and HUBZone
   • Identification of Native American ownership (if applicable)
2. A brief statement of the company’s capability that relates to the described government requirement.  Additional demonstration of capability may include current and past performance history for the same or similar requirement
3. Information on existing governmentwide contract vehicles including:
   • GSA
   • NASA SEWP
   • Governmentwide acquisition contracts (GWACs) maintained by HHS or its Divisions and available for ordering.
4. If claiming Indian-owned Small Business Economic Enterprise (ISBEE) or Indian-owned Economic Enterprise (IEE), submit completed IHS IEE Representation Form (attached).

Automated responses or other responses that do not provide the requested information specified in this Sources Sought Notice will be noted as non-responsive and not considered in this Market Research.

Interested parties may also provide the following optional information:

1. Non-binding pricing information, such as:
   • Commercial price lists
   • Pricing under GWACs or other governmentwide vehicles
   • An informal quote
   • A rough order of magnitude
2. Information on which services the respondent The suggested NAICS code for this requirement and rationale, if different from the one proposed in this notice.

Telephone inquiries will not be accepted or acknowledged, and the Government does not anticipate providing feedback or evaluations to companies regarding their submissions. Interested parties may submit questions regarding the requirement; however, the Government does not anticipate providing feedback or responses to questions. All questions may be used to inform market research.