NCATS Cybersecurity Services Program
SMALL BUSINESS SOURCES SOUGHT NOTICE
Solicitation Number: 75N95020R00009
Title: NCATS Cybersecurity Program
PSC: D310, IT and Telecom - Cyber Security and Data Backup.
NAICS Code: 541519, Other Computer-Related Services
Description:
This is a Small Business Sources Sought notice. This is NOT a solicitation for proposals, proposal abstracts, or quotations. The purpose of this notice is to obtain information regarding: (1) the availability and capability of qualified small business sources; (2) whether they are small businesses; HUBZone small businesses; service-disabled, veteran-owned small businesses; 8(a) small businesses; veteran-owned small businesses; woman-owned small businesses; or small disadvantaged businesses; and (3) their size classification relative to the North American Industry Classification System (NAICS) code for the proposed acquisition. Your responses to the information requested will assist the Government in determining the appropriate acquisition method, including whether a set-aside is possible. An organization that is not considered a small business under the applicable NAICS code should not submit a response to this notice.
This notice is issued to help determine the availability of qualified companies technically capable of meeting the Government requirement and to determine the method of acquisition. It is not to be construed as a commitment by the Government to issue a solicitation or ultimately award a contract. Responses will not be considered as proposals or quotes. No award will be made as a result of this notice. The Government will NOT be responsible for any costs incurred by the respondents to this notice. This notice is strictly for research and information purposes only
Project Description:
The National Center for Advancing Translational Sciences (NCATS) requires dedicated cybersecurity services support to apply information security, privacy, and risk managment measures to safeguard the confidentiality, integrity, and availability of its information and information systems.
Purpose and Objectives:
Background: NCATS Information Technology Resources Branch (ITRB) recently established a Cybersecurity Services (CSS) section as a separate function from its general scientific research support and IT support section. The Cybersecurity Section has two groups. The Information Security and Privacy group focuses on the user side, providing training, user support, program support, audit management, regulatory and policy compliance, etc. The Cybersecurity Integration Center focuses on the technical side, providing security engineering, infrastructure protection, penetration testing, incident detection/management/response, and threat identification.
Project requirements: This requirement involves day-to-day on site and off site information security support to provide (1) user-side support (training, program support, audit management, regulatory compliance, etc.) and (2) technical services (security engineering, infrastructure protection, penetration testing, incident detection/management/response). NCATS anticipates conducting the work through task orders under an IDIQ contract, probably using (1) a fixed-price task order providing for a level of effort equivalent to 2-3 full-time subject matter specialists to provide the day-to-day services, and (2) additional fixed-price completion-based task orders for discrete tasks (for instance, preparing an authority to operate package).
Anticipated period of performance: This is expected to be a one-year contract with two option years.
Other important considerations: The NCATS CSS Program supports the security requirements of the unique NCATS biomedical research enterprise and its diverse hybrid IT (both cloud and on-premises) resources that it relies on each day to fulfill its mission. The program is committed to balancing mission needs and risk; reducing NCATS high risk areas; improving protections for data, infrastructure and staff; and working to increase visibility into IT assets, operations, threats and risks. These goals will be achieved via NCATS-specific initiatives and federal-wide directives and compliance requirements to promote IT management best practices of the full life-cycle of NCATS IT investments, including configuration and patch management, system administration, and change and operations management. These activities will also be accomplished via implementation of DHS Continuous Diagnostic and Mitigation (CDM) guidance and technologies and other NCATS, NIH and HHS information security projects intended to protect and serve the NCATS mission, patients and staff. The requirements placed upon the NCATS CSS Program to protect NCATS against cybersecurity threats, including the need to quickly modernize the NCATS information security infrastructure and improve capabilities, have dramatically increased.
It is incredibly important for respondants to recognize that we are looking for a comprehensive security strategy that accounts for the complexity and diversity of the entire NCATS scientific and IT portfolio, not simply a piecemeal approach on a case by case basis.
REQUESTED RESPONSE:
Interested contractors are requested to provide a capability statement describing their ability to provide cybersecurity services as described in the project requirements above. In particular, provide information regarding (a) staff expertise, including their availability, experience, and formal and other training; (b) current in-house capability and capacity to perform the work; (c) prior completed projects of similar nature; (d) corporate experience and management capability; and (e) examples of prior completed Government contracts, references, and other related information;
Please provide your DUNS number, organization name, address, point of contact, and size and type of business (e.g., 8(a), HubZone, etc.), pursuant to the applicable NAICS code and any other information that may be helpful in developing or finalizing the acquisition requirements.
Responses:
Responses must be submitted by email to Stuart Kern, Contract Specialist, at stuart.kern@nih.gov. Responses must be received on or before 11:00 a.m. Eastern Time on Thursday, March 26, 2020.
Disclaimer and Important Notes:
This notice does not obligate the Government to award a contract or otherwise pay for the information provided in response. The Government reserves the right to use information provided by respondents for any purpose deemed necessary and legally appropriate. Any organization responding to this notice should ensure that its response is complete and sufficiently detailed to allow the Government to determine the organization’s qualifications to perform the work.
Respondents are advised that the Government is under no obligation to acknowledge receipt of the information received or provide feedback to respondents with respect to any information submitted. After a review of the responses received, this requirement may be published on SAM.gov Contracting Opportunities. However, responses to this notice will not be considered adequate responses to a solicitation.
Confidentiality: No proprietary, classified, confidential, or sensitive information should be included in your response. The Government reserves the right to use any non-proprietary technical information in any resultant solicitation(s).
75N95020R00009 Department of Health and Human Services National Institutes of Health National Institute on Drug Abuse
3/13/20, 2:05 PM