The Defense Information Systems Agency (DISA) is seeking information from industry to assist with the development and planning of the next generation of the Assured Compliance Assessment Solution (ACAS). The ACAS team within the Program Office identifies and implements scalable enterprise scanning solutions, provides engineering consultation, provides troubleshooting and other support, provides training, and continuously assesses emerging technologies and solutions to enhance capabilities. The Program Office is seeking a solution that can scan an estimated 11 million devices, sustain what the DoD already has on-premises, and allow for expansion into areas such as Internet of Things (IoT), Operational Technology (OT), and the cloud. The solution should cover the full range of network-based scanning, host-based agent and agentless scanning, log correlation, and passive traffic analysis capabilities. It should also assess compliance with security controls, configuration best practice guidelines, network and data segmentation, network architecture, and patch management. Some key features of the solution include: • Standards-based support for NIST compliance solutions • Agent/agentless scanning capabilities • Network discovery and assessment • Asset identification and characterization • Automated network vulnerability/compliance scanning • Application vulnerability scanning • Configuration assessment • Remote and peripheral device configuration • Performance and scalability The target period of performance for the next generation ACAS contract/order is 1 November 2025 through 31 October 2030, set up as a firm fixed price order with a base year and 4 option years.