NIDSP RFI Revised 08132025.pdf

SENSITIVE BUT UNCLASSIFIED

U.S. DEPARTMENT OF STATE

BUREAU OF DIPLOMATIC TECHNOLOGY (DT)

OFFICE OF INFORMATION TECHNOLOGY ACQUISITIONS (ITA)

REQUEST FOR INFORMATION (RFI) FOR

NATIVELY INTEGRATED DIGITAL SECURITY PLATFORM (NIDSP)

ISSUED BY:

U.S. Department of State Global Acquisitions IT Professional Services Division

RFQ No. 19AQMM25N0258

August 4, 2025

19AQMM25N0258

Sensitive But Unclassified

SENSITIVE BUT UNCLASSIFIED

U.S. DEPARTMENT OF STATE

BUREAU OF DIPLOMATIC TECHNOLOGY (DT)

OFFICE OF INFORMATION TECHNOLOGY ACQUISITIONS (ITA)

REQUEST FOR INFORMATION (RFI) FOR

NATIVELY INTEGRATED DIGITAL SECURITY PLATFORM (NIDSP)

PART 1: REQUEST FOR INFORMATION BACKGROUND AND OBJECTIVES

1.1 PURPOSE

This Request for Information (RFI) is issued as market research to determine industry’s capabilities to provide a proven Commercial-Off-the-Shelf (COTS) natively integrated digital security platform (NIDSP), inclusive of physical, software-defined, and cloud-based firewall and digital security solutions. The solution must provide a commercially proven base platform with an integrated suite of add-on products that allow State to maintain network and digital device security in various forms and use cases.

State requires a reliable, effective, and proven NIDSP solution that provides secure internal and external network connections, robust security, and continuous monitoring, which is vital for effective execution of State’s diplomatic mission objectives. Additional specific capability requirements are enumerated below in

Part 2.

The Government does not commit to award a contract on the basis of this RFI or reimburse any costs associated with the preparation of responses. This RFI is issued solely for information and planning purposes and does not constitute a solicitation. All information received in response to this RFI that is marked

“Proprietary” will be handled accordingly. Responses to the RFI will not be returned. In accordance with FAR 15.201(e), responses to this RFI are not offers and cannot be accepted by the Government to form a binding contract.

Responses to this RFI will assist State in determining the potential level of interest, competition adequacy, and technical capabilities of commercial vendors to

SENSITIVE BUT UNCLASSIFIED

provide the required products and/or services. The Government does not guarantee any action beyond this RFI.

The result of this market research will contribute to determining the acquisition plan and the method of procurement. The anticipated North American Industry

Classification System (NAICS) code assigned is 541519, with the below noted associated small business size standards, and the product service code is 7A21.

NAICS Code Industry

Description

Small Business Size Standard

Gross Receipts ($M)

Number of Employees

541519 Other Computer Related Services

$34.0

541519 (Exception)

Information Technology Value Added Resellers

1.2 BACKGROUND

State’s mission is to advance the interests of the American people, their safety, and economic prosperity by leading America’s foreign policy through diplomacy, advocacy, and assistance. The mission of the Bureau of Diplomatic Technology

(DT) is to rapidly and securely deliver, anytime and anywhere, the knowledge resources and Information Technology (IT) services needed to support the over

300 sites and 275 missions it services worldwide.

DT is seeking input from industry regarding their capability to provide market-leading solutions capable of meeting the full breadth of functional requirements outlined in this RFI. State requires access to a platform that is compliant with current Federal security requirements, is easy to use, flexible, scalable, customizable, and configurable to meet specific State requirements as further detailed below.

1.3 RFI OVERVIEW

As further detailed in Part 2, State is seeking to identify capable and interested partners able to provide the products and/or services required to meet the full range of functional capabilities outlined in this RFI. Viable partners shall have

SENSITIVE BUT UNCLASSIFIED

demonstrated experience deploying the solutions and delivering the ongoing support required to maintain, expand, and upgrade the solution over time for an organization of similar size, global scope, and mission complexity as State.

Information requested in this RFI includes the following categories:

• Company Information (Section 2.1) – Identification of interested vendors, socio-economic status, and potential acquisition vehicles to inform State’s potential acquisition strategy options.

• Capability Assessment Against Functional Requirements (Section 2.2) –

Description of vendor’s proposed technical solution and ability to fully meet all stated functional requirements.

• Past Experience (Section 2.3) – Past project example(s) demonstrating vendor’s experience implementing their proposed solution to address the needs of an organization of similar size, global scope, and mission complexity to State.

1.4 SUBMISSION INSTRUCTIONS

All written responses should be submitted in Microsoft compatible formats (e.g., Word or PDF).

Responses must use 12-point font and 1-inch margins, including all text, tables, and graphics. Additional attachments, brochures, or other marketing materials are not requested and will not be considered as part of the response. Response page limit(s) by section are noted below.

• Section 2.1 – Company Information – (1 page)

• Section 2.2 – Capability Assessment Against Functional Requirements – (15 pages)

• Section 2.3 – Past Experience – (5 pages)

Please submit all materials to Ms. Berneta B. Ellis at EllisBB@state.gov by:

08/22/2025 at 3:00pm/ET. Please include the title, Natively Integrated Digital Security Platform, in the subject line of your email.

UNDER NO CIRCUMSTANCES SHALL ANY RESPONDENT CONTACT ANY

STATE PERSONNEL REGARDING THIS NOTICE.

SENSITIVE BUT UNCLASSIFIED

PART 2: REQUESTED INFORMATION

Respondents are asked to provide the information requested below in accordance with the instructions outlined in Part 1, Section 1.4 above.

Submissions not adhering to the submission instructions may be deemed non-responsive and may receive no further consideration.

2.1 COMPANY INFORMATION

Please provide the following details regarding your organization:

1) Company name.

2) Company point of contact (POC) name.

3) Company POC phone number.

4) Company POC email address.

5) Company URL/web address.

6) Company Cage Code.

7) Company (Unique Entity ID) number.

8) Company business size in terms of revenue and number of employees.

9) Company Federal socioeconomic classification(s), if any, based on North

American Industry Classification (NAICS) Code 541519.

10) List GSA schedule(s), Government wide acquisition contracts (GWACs), or other Federal IDIQs or contracts the Respondent holds that are relevant to this requirement and accessible by State, including corresponding schedule number or contract number.

2.2 CAPABILITY ASSESSMENT AGAINST FUNCTIONAL REQUIREMENTS

State’s functional requirements for the solution are outlined below. Respondents are asked to provide a structured response that meets the following format requirements:

• Response shall be structured and annotated to clearly map the detailed description of the proposed solution’s capabilities to the numbered

SENSITIVE BUT UNCLASSIFIED

requirements captured in the sections below. Responses should clearly map to the information detailed in the requirements below.

• Response narrative content should provide sufficient details regarding the proposed solution’s specific technical capabilities to demonstrate that the solution is capable of fully satisfying State's requirements.

2.2.1 Baseline Qualifications

The following qualifications and capabilities are mandatory baseline requirements for any potential solution addressing the needs outlined in this notice.

Respondents should assess these “Go/No-Go” requirements carefully, as solutions unable to meet these requirements will not be considered as viable options by

State and will not receive further consideration:

a) The solution must offer a proven COTS platform – State is not seeking custom-developed solutions that have not yet been successfully deployed at other federal agencies of similar size and scope to State.

b) The solution must possess significant out-of-the-box functionality, enabling it to be deployed on day one of the project, while also supporting custom configuration within expedited timelines.

c) The solution must incorporate comprehensive in-house professional and configuration services supported by a cohesive and specialized team of experts.

d) The solution must allow for native integration of hardware, software, and platform components.

e) The solution must be able to comply with State’s Cybersecurity Supply

Chain Risk Management (C-SCRM) policy.

o Please review Attachments (C-SCRM Questionnaire and Attestation forms) and note whether your company is able to provide the requested information and attestations for your proposed solution.

o Note: If your company has previously submitted these forms and they are archived in either the State or CISA RSAA repositories, it is

SENSITIVE BUT UNCLASSIFIED

unnecessary to submit these, however, it is essential that this is clearly indicated in the company response to this RFQ.

2.2.2 Firewall

State is seeking a solution that provides network security through monitoring of incoming and outgoing traffic through physical and digital firewall components.

a) The solution must be capable of providing network monitoring through standalone physical devices and digital means that can operate independently and jointly through integration.

b) The solution must utilize single-pass parallel architecture to enable accelerated content inspection while minimizing lag.

c) The solution must be capable of identifying applications traversing the network at the Open Systems Interconnection (OSI) Layer 7 level, regardless of port, protocol, or evasive technique, enabling granular policy control based on application identity.

d) The solution must be capable of applying policies through all, and a combination of, the following responses:

o Allow or deny.

o Allow, but scan for exploits, malware, and other threats.

o Allow based on schedule, users, devices, groups, or Dynamic Address

Groups (DAGs).

o Control file or sensitive data transfer.

o Decrypt and inspect.

o Apply traffic shaping through quality of service (QoS).

o Apply policy-based forwarding.

o Allow a subset of application functions.

e) The solution must be capable of inspecting network traffic to identify and control malicious files and data patterns by examining both signatures and the actual data being transmitted and leveraging those inspection capabilities to identify and block malware, prevent data leakage, and enforce acceptable use policies. The solution must apply these capabilities at the OSI Layer 7 level.

SENSITIVE BUT UNCLASSIFIED

f) The solution must meet the Federal Information Processing Standards (FIPS)

140-2 and 140-3 compliance standards.

g) The solution must meet post-quantum security standards including:

o RFC 9242 o RFC 9370 o RFC 8784

h) The solution must be Department of Defense Information Network (DoDIN) approved for:

o Data firewalls o Virtual Private Network (VPN) o Intrusion Detections Systems (IDS) o Intrusion Prevention Systems (IPS)

i) The solution must be manageable from a central device.

j) The solution must be capable of scanning and stopping zero-day threats using integrated machine and deep learning capabilities.

k) The solution must be capable of identifying host machines that try to connect malicious domains.

l) The solution must provide real-time analysis services to provide advanced threat analysis.

m) The solution must be capable of generating Domain Name System (DNS) signatures using advanced predictive analysis and machine learning.

n) The solution must be capable of processing traffic once for all functions to include:

o Networking o Policy lookup o Content inspection o Logging

o) The solution must have a unified policy model that can be utilized across physical, virtual, and cloud firewalls.

p) The solution must have a 1.5 Tbps throughput with all features enabled.

SENSITIVE BUT UNCLASSIFIED

q) The solution must support DNS security inspection without requiring query resolution.

2.2.3 Cloud Delivered Security Services

State is seeking a solution able to provide network security through cloud-based capabilities able to be deployed alone or in conjunction with the physical-digital components described above. Respondents should detail cloud-specific solutions that meet the requirements below:

a) The solution must be capable of inspecting, detecting, classifying, and blocking malware and vulnerability exploits in a single pass, and not require additional scanning engines or multiple rule bases.

b) The solution must be capable of detecting and blocking threats on all ports, and not on invoking signatures based on a limited set of predefined ports.

c) The solution must be capable of real-time traffic inspection via inline deep learning detection models.

d) The solution must be capable of scaling to any customer demand level.

e) The solution must be capable of deploying deep learning capabilities to support analysis of C2 threats over HyperText Transfer Protocol (HTTP), Hypertext Transfer Protocol version 2 (HTTP2), Secure Sockets Layer (SSL), and unknown User Datagram Protocol (UDP) and Tool Command Language

(TCL) applications.

f) The solution must be capable of cloud-delivered updates, without requiring updates through firewalls or agents.

g) The solution must be capable of identifying and defending against Artificial

Intelligence (AI) driven or assisted threats to cloud networks.

h) The solution must be capable of signature delivery in under 10 seconds.

i) The solution must deliver protection from the Open Web Application

Security Project (OWASP) Top 10 Continuous Integration/Continuous

Delivery (CI/CD) risks across multi-cloud environments.

SENSITIVE BUT UNCLASSIFIED

j) The solution must deliver cloud stack visibility across the code, build, deploy, and run stages.

k) The solution must provide a natively integrated combination of threat protection, vulnerability scanning, and compliance monitoring features that assess the security posture of cloud workloads, identify vulnerabilities in container images and serverless functions, and automatically prevent threats from executing in real-time.

l) The solution must be capable of seamlessly extending firewall policies to cloud based firewalls.

m) The solution must be capable of supporting all of the following file types:

o Portable Execution o Flash o Java o MS Office (DOC/DOCX, XLS/XLSX, PPT/PPTX) o Portable Document Format (PDF) o APK (Android Package Kit) o HTTP URLs within files o macOS o Dalvik Executable file (DEX) o Perl o Javascript o VBScript o PowerShell o Batch o Shell scripts o Roshal Archive (RAR) o 7-Zip archives o Linux Executable and Linkable Format (ELF)

2.2.4 Supply Chain Security

State is seeking a solution able to provide visibility and support across its software supply chain and any associated risks and vulnerabilities. State is also seeking a

SENSITIVE BUT UNCLASSIFIED

solution that is then able to actively manage and address those risks and vulnerabilities.

a) The solution must be capable of providing an inventory of the software supply chain and CI/CD pipelines and code risks from across State’s engineering ecosystem.

b) The solution must be capable of generating a software bill of materials that provides insight on sources of application risks and the potential attack surface.

c) The solution must be capable of hosting a unified inventory of the following in a single view with their associated security risks:

a. Languages

b. Frameworks

c. Tools

d. Executables

d) The solution must be capable of tracing vulnerabilities in an application back to the code.

e) The solution must be capable of allowing users to visualize their code dependencies on a per-repository basis as well as generate an SBOM that includes infrastructure-as-code (IAC) assets, open-source packages, and images located in the repository.

2.3 PAST EXPERIENCE

State is seeking a solution that has a proven track record in the U.S. federal space with demonstrated experience supporting agencies of similar size, global scope, and mission complexity as State. Such experience is critical to ensure that the solution has been proven to be secure and reliable under the required IT security, data management, privacy, and other federal regulations that govern information technology implementations within the federal environment.

Please provide the following information regarding your experience deploying your proposed solution for federal customers. Please list all federal agencies of a similar size where you have successfully deployed the proposed original

SENSITIVE BUT UNCLASSIFIED

equipment manufacturer (OEM) solution in the last five years. For each experience noted, in no more than one paragraph, please provide:

• Agency and Organization Name

• Period of Performance

• Solution(s) provided to the Agency

For at least one, and not more than three, of the federal implementations provided above, please provide the additional detailed information requested below to further demonstrate your relevant past experience.

• Contract and task order number

• Contract type

• Dollar value of contract (across full period of performance)

• Period of performance dates

• State whether your company was a prime or subcontractor

• Customer point of contact (Name, Title, Email, Phone) that State may reach out to for more information

• Description of the scope of the work your company performed and its relevance and applicability to demonstrating your solution’s ability to deliver the full set of capabilities outlined in Part 2

Disclaimer: This Request for Information is for information gathering purposes only as a means to identify interested and capable sources that can provide a solution that fully meets all requirements outlined in Part 2 of this notice. The information provided in this RFI is subject to change and is not binding on the

Government. State has not made a commitment to procure any of the items/services discussed, and release of this RFI should not be construed as such a commitment or as authorization to incur costs for which reimbursement would be required or sought.

State will not publicly disclose proprietary information obtained as a result of this

RFI. To the full extent that it is protected by law and regulations, information identified by a respondent as Proprietary or Confidential will be kept confidential. All submissions become Government property and will not be returned.