1-2-1-ICAM-ES 3 SNN-RFI_20241218.pdf

70SBUR25I00000009

Sources Sought Notice (SSN)/Request for Information (RFI) –

Department of Homeland Security (DHS) U.S. Citizenship and Immigration Services (USCIS)

Office of Information Technology (OIT) Information Security Division (ISD)

Identity, Credentials, and Access Management - Enterprise Services 3 (ICAM-ES 3) Notice to all Small Business Vendors

This notice is issued solely to conduct market research following Federal Acquisition Regulation (FAR) Part 10 and does not constitute an Invitation for Bids, Request for Proposal, or Request for Quotations. No solicitation is being issued at this time, and the Government does not assert that a solicitation will be issued. Per FAR 15.201(e), responses to this notice are not offers and cannot be accepted by the Government to form a binding contract, nor do they affect a potential offeror's ability to respond to any future synopsis/solicitation, which may or may not follow or restrict the U.S. Government's eventual acquisition approach. Additionally, the U.S. Government is not obligated to and will not provide reimbursement for any information submitted in response to this notice. Respondents are solely responsible for all expenses associated with responding.

Background and Overview:

U.S. Citizenship and Immigration Services (USCIS) administers the nation's lawful immigration system, safeguarding its integrity and promise by efficiently and adjudicating requests for immigration benefits while protecting Americans, securing the homeland, and honoring our values.

The USCIS Office of Information Technology (OIT), Information Security Division (ISD) is seeking technical and program management support requirements necessary to maintain the USCIS Identity, Credential, and Access Management (ICAM) enterprise information technology services program. These services include, but are not limited to, the design, architecture, engineering, documentation, quality assurance and maintenance of the enterprise implementation of the USCIS ICAM environment, as well as the program management support services required to successfully manage the ICAM program. Contractors will participate in team-based Agile environments that will be aligned in accordance with the ICAM Roadmap and implementation guidance and USCIS Agile DevOps development methodologies, such as the creation of a mature Continuous Integration/Continuous Delivery (CI/CD) model with a high level of automated testing integration.

The USCIS ICAM Program operates under the Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance and consists of several traditionally segregated functional areas (Identity, Credential, Access and Federation) that, when managed collectively, provide security, privacy and process efficiency benefits that would not be achieved if managed individually. The Office of Management and Budget (OMB) has also released other directives that outline specific ICAM-related requirements and delivery timelines for federal civilian agencies that USCIS ICAM follows.

Due to the breadth and depth of the ICAM scope, a successful implementation requires multiple distinct projects—all of which must integrate across business and technology disciplines to achieve the expected outcomes. For this reason, the USCIS ICAM Program was established to provide over-arching management and oversight to ensure ICAM mission success.

The USCIS ICAM Program defines, plans, promotes, and coordinates the enterprise implementation of the USCIS ICAM environment in accordance with best practices. The ICAM Program staff work with the different stakeholders within and outside the USCIS environment to determine existing initiatives and how they align to the ICAM Architecture and required functionality. The ICAM Program is responsible for integrating all of the USCIS ICAM initiatives through a common vision and strategy that promotes interoperability and reuse.

Organizationally, the ICAM Program is managed by the Identity Access Management (IAM) Branch Chief within the ISD.

The primary purpose of this SS-RFI is to identify sources that currently have staff and capabilities that can meet the technical requirements to deliver requirements described in the Description section.

Response Instructions:

All responses shall be in Adobe Portable Document Format (PDF). Interested parties are requested to respond to this SSN-RFI, with responses to the questions in following sections below. Responses should be no more than ten (10) pages (excluding the one (1) page cover letter). No phone calls related to this RFI will be accepted.

Respond by providing the information sought not later than Friday, January 17, 2025, at 1:00 PM EST via email to Sylwia Salkic at Sylwia.Salkic@uscis.dhs.gov. The subject of the email shall read “RESPONSE TO ICAM-ES 3 SSN-RFI – 70SBUR25I00000009 - [YOUR

COMPANY NAME]”.

The one (1) page cover letter shall, at a minimum, include the following information:

1. SSN-RFI 70SBUR25I00000009.

2. Vendor’s Company Name, Address, Contact Person Information (including telephone number and email address).

3. Vendor’s Unique Entity ID Number.

4. Business Size and Size Standard / Classification relative to North American Industry

Classification System (NAICS) code of 541512 or 541519.

5. Identify whether your organization is a small business that has been certified by the Small

Business Administration (SBA).

6. If a small business, provide the most recent date your organization qualified/re-qualified as a small business and certified by the SBA to ensure small business thresholds have not been exceeded.

7. All Contract vehicles you currently have, and the contract numbers associated with those vehicles (ex: GSA Schedule 874 GS-00X-1234Z). Include whether or not you are a small business; HUBZone small business; service-disabled, veteran-owned small businesses;

8(a) small business; women-owned small business; or small disadvantaged business in mailto:Sylwia.Salkic@uscis.dhs.gov order to assist the government in determining the appropriate acquisition method, including whether a set-aside is possible.

8. What is your organizational experience with projects of similar scope, size and complexity?

Information sought:

Interested business, Government, and non-profit organizations are encouraged to respond to this notice. In responding to the questions and areas below:

• Limit your responses to instances where your organization provided the majority (50% or greater) of the labor associated with the task (prime contractor). Do not include tasks performed as part of a larger contract for which your organization was the prime contractor; however, your organization did not provide the majority (50% or greater) of the labor.

• Indicate past performance contract numbers and points of contact.

ICAM program areas to address:

• Role, Policy or Attribute Based Controls and Authorization

• Single Sign-On / Login Authentication (AuthN)

• Role-Based Access Management Authorization (AuthZ)

• Access Governance

• Privileged Access Management

• PKI/Certificate Management (PIV, Device, Non-Person Entity, and Non-PIV Person

Entity)

• Account Management

• Identity Provider (IdP) Management

• System Account Management

• API and Microservices Authentication (OAuth/OIDC)

• Secrets Management

• Enterprise Physical Access Control (ePACS)

• PACS (physical access control system)/VMS (video management system) network O&M

• Technical Architecture, Engineering and Infrastructure Support for multiple platforms

• Program Management

• Approval Workflow with Policy Enforcement

• Online Self-Service

• Fully and Semi-Automated Account Provisioning/De-provisioning

• Self-Service Password Management

• Electronic Audit (all access-related actions stored in central database)

• Personal Identity Verification (PIV) Authentication

• Access Federation

• Section 508 Compliance

• 24 x 7 x 365 Support

1. Contract Type and Structure:

1.1. Identify contract vehicles your organization believes would be suitable for this requirement. Identify which contract vehicle is preferred and discuss why the recommended vehicle is optimal for the government to acquire these services.

1.2. Provide minimum labor category requirements to ensure that personnel have the skillsets, knowledge, and experience required to provide effective support.

1.3. Please share your experience and process of identifying and onboarding personnel for this type of contract and how long it took to staff up for the project?

1.4. Provide your retention plan.

2. Program Management

2.1. Explain your experience in providing 24x7x365 support functions for similar agencies of similar size, scope and complexity.

2.2. Provide information on your experience innovating ICAM program improvements.

2.3. Provide information and/or examples about how you efficiently and effectively communicate with the customer and user base.

2.4. Provide information on how you integrated into new programs/companies to acclimate to the environment and quickly become productive.

3. Program structure:

ICAM program in USCIS utilizes open-source applications for customized solutions as well as customized off-the-shelf products to fulfill ICAM needs. Share your experience with the following:

3.1. Identify the product(s)/technology, size, and scope of your experience in implementing

ICAM products in cloud environments.

3.2. Identify the stakeholders/consumers of the deliverable.

3.3. Describe the agile team(s) composition and roles based on your experience to have a high-functioning program.

4. ICAM Solutions Research and Development:

4.1. Provide information of any security solution Analysis of Alternatives (AoA) conducted in the past year. Describe your experience in researching, evaluating, and piloting new Identity Access Management (IAM) functionality and technologies.

5. Security Integration:

5.1. Explain your experience in integrating data from disparate systems/sources, and your experience in evaluating new functionalities and technologies and subsequent implementation of those functionalities and technologies. (ensure to provide size and scope of the work performed).

6. Zero Trust Implementation:

6.1. Provide information of any IAM integrated Zero Trust implementations completed in the last year and what was the outcome? (specifics about what methodology, how and where implemented).

6.2. Share your experience with implementing Zero Trust models, identifying and onboarding personnel to support the effort, and how long it took to staff up for the project?

7. Application Design:

7.1. Describe your experience with User Experience Design (UXD) in an agile-based environment utilizing Lean software development practices and DevSecOps principles.

7.2. Describe your experience with integrating data analytics into your experience design process to create aesthetically pleasing, intuitive, and functionally responsive products and services.

8. Collaboration:

8.1. ICAM operates within the Information Security Division ecosystem of federal and contractor staff, often with multiple contractor teams working in parallel and with constant interaction with USCIS employees. Provide an example on task(s) or contracts where you had to exercise willingness, effort, and ability to work collaboratively with others.

9. Logical Access Control Systems (LACS):

9.1. ICAM provides Single-Sign On (SSO) to the entire agency and supports external agency access. Describe your experience with the open-source Shibboleth product as an Identity Provider (IdP) for both internal network and external internet authentication. Include experience with SAML and OIDC assertion methods, and OAuth for authentication.

9.2. Describe your experience with Attribute Based Access Control. List what methods and/or products you have experience with that supports this initiative.

9.3. Systems and network integration with ICAM’s access and account control management system is central to providing access controls. Describe experience you have in creating and/or working with a system to provide role integration, access and account lifecycle management to include recertification, self-service requests, and other functions or features developed from customer requirements.

10. Privileged Access Management (PAM):

10.1. Describe your experience with supporting CyberArk and providing Subject Matter Experts to support the CyberArk product and surrounding scripting.

10.2. Describe your experience with supporting HashiCorp secrets management vault and providing Subject Matter Expertise to support stakeholder/user system teams needs and how they utilize the vault.

10.3. Describe your experience with providing Privileged Access Management governance functionality with increasing levels of innovation.

11. Enterprise Physical Access Control Systems (ePACS):

11.1. Describe your experience with physical security technologies including support of specific physical security systems products. (e.g. Gallagher, Milestone Systems, Genetec, Software House C-Cure, Axis, Avigilon etc.).

11.2. USCIS ICAM develop custom applications to support physical access request and provisioning. Describe your experience in development and support of a complex

Java/Spring Boot application including creation and use of a DevOps CD pipeline, database management/backup, AWS hosted servers, security groups, and key management.

11.3. USCIS provides support and management to on-network physical security systems from a central team. Describe your experience with providing PACS/VMS engineering support for customers across multiple time zones.

11.4. The USCIS ePACS team provide Windows/Linux O&M and device O&M (IP cameras) to include monthly patching, database backups, firmware updates, vulnerability mitigation, PACS/VMS application O&M and updates/upgrades, control panel firmware management etc. Describe your experience providing this O&M and vulnerability mitigation for a large number of servers/virtual machines/physical security applications in a hybrid cloud and on-premise environment.

12. Public Key Infrastructure (PKI)/Certificate Management:

12.1. ICAM uses internal Certificate Authorities (CA) to support USCIS’s mission.

Describe your experience with supporting Federal PKI (FPKI) and DHS CA4.

12.2. ICAM uses external Certificate Authorities (CA) to support USCIS’s mission.

Describe your experience with supporting Commercial Certificate Authorities (i.e. Entrust, DigiCert, GeoTrust etc.).

12.3. ICAM operates both custom built and Commerical Off the Shelf (COTS) tools to manage device certificate lifecycle. Describe your experience with integration and development of software tool that manages device certificate lifecycle (COTS and/or custom code).

12.4. ICAM operates internal CA to automate network certificate lifecycle management. Describe your experience with designing and implementing Internal CA (i.e.

Entrust Security Manager, Microsoft ADCS, Thales, AWS Private CA etc,) to automate issuing, renewing, revoking certificates for the network devices (Router, Load Balancer, Domain controller, RDP, Wireless devices, Printers, iDRAC etc.) in the enterprise.

12.5. ICAM operates internal CA along with COTS Certificate Lifecycle Management (CLM) product to automate device certificate lifecycle management. Describe your experience with designing and implementing Internal CA (i.e. Entrust Security Manager, Microsoft ADCS, Thales, AWS Private CA etc,) with COTS CLM middleware such as Venafi, AppViewX, Keyfactor to automate issuing, renewing, revoking of device certificates (Web server. App server, Kubernetes etc.) in the enterprise.

12.6. ICAM operates internal CA to automate person centric certificate lifecycle management with Multi-Factor Authentication (MFA) tool. Describe your experience with designing and implementing Internal CA (i.e. Entrust Security Manager, Microsoft ADCS, Thales, AWS Private CA etc,) along with MFA tools such as Yubikey, RSA SecureID to automate issuing, renewing, revoking person centric certificates in the enterprise.

12.7 ICAM operates above internal CAs and Hardware Security Module (HSM) within the Cloud Service Provider. Describe your experience with implementing and operating Certificate Authorities (CA) and HSM within the cloud environment.

12.8. ICAM provides PKI/Certificate Management support as well as continuous training to our customers and System Admins. Describe your experience with providing customer service in PKI realm and training program to enhance customer experience dealing with PKI tasks.

Proprietary information should not be included in the responses. To the maximum extent possible, submit Non-Proprietary Information. All information received in this SSN-RFI that is appropriately marked "Proprietary" will be handled accordingly. Please be advised that all submissions become Government property and will not be returned nor will receipt be confirmed.

Related information We may ask specific questions after reading your responses to this request. We may use other market research tools to develop and implement the most efficient and economical method of soliciting and awarding the prospective Identity Access Management contract. This is a request for information and is used for determining the suitability of various contract vehicles to fulfill the requirements described in this request. This request for information is not a solicitation. It will not result in the award of a contract. Your responses are voluntary, and the Government will not compensate or reimburse you for responding.

The primary purpose of this SS-RFI is to identify sources that currently have staff and capabilities that can meet the technical requirements to deliver requirements described in the Description section.