140R8123R0003_Risk_Management_IDIQ_Sources_Sought_1.pdf

THIS IS A SOURCES SOUGHT. THIS IS NOT A REQUEST FOR QUOTE.

The Department of Interior / Bureau of Reclamation (BOR) in Denver, CO is performing market research to help determine acquisition strategy.

The Bureau of Reclamation is anticipating awarding one or more Risk Management, Indefinite Delivery, Indefinite Quantity (IDIQ) contracts. The total contract term shall not exceed 60 months. The Government will use responses to this notice to make the appropriate acquisition decision.

Vendors shall be able to meet all the required labor areas listed below:

Specialized Subject Matter Expert (SME): Subject matter expertise and experience for specialized tasks may include the following:

CDM: Expert level knowledge of and experience with CDM activities related to Hardware Asset Management, Software Asset Management, Configuration Setting Management, Vulnerability Management and Operational Security Management. Mastery of and skill in applying the configuration, implementation, managing and monitoring of security event correlation tools (e.g., BigFix, Tenable, , Splunk, Defender etc.), performing data reduction and assessing the robustness of security systems and designs. Expert knowledge interpreting and incorporating data from multiple tool sources and identifying systemic security issues based on the analysis of vulnerability and configuration data. Expert knowledge of intrusion detection tools, applications and techniques for detecting host and network-based intrusions

Cyber Assessment and Engagement: Expert knowledge of red/purple/blue team engagements to include preparation, assessment development, and security assessment reporting for enterprise and ICS assets. Expert-level knowledge of tool analysis and assessing systems, tools, or platforms against guidelines and requirements. Working knowledge of security boundaries and associated documentation (diagrams, security plans, risk assessments, etc.).

FISMA: Expert level knowledge of and experience with NIST Risk Management Framework (RMF) and FISMA-related activities to include all steps of the RMF authorization process, familiarization with the use oof online Governance, Risk, and Compliance (GRC) tools, the development and review of system security plans, contingency plans, incident response plans, continuous monitoring plans, configuration management plans, security control requirements and conducting security control assessments, Plan of Action and Milestones (POA&M) management, and cybersecurity training requirements.

OT and ICS: Expert knowledge and experience with configuring and operating OT, including ICS technology components (Remote Terminal Units (RTU), Programmable Logic Controllers (PLCs), relays, sensors, switches etc.), ICS protocols (Modbus, Profibus, Common Industrial Protocol etc.) and OT systems (Supervisory Control and Data Acquisition (SCADA), Physical Access Control Systems (PACS), Building Automation Systems (BAS) etc.) components.

ISSO: Expert knowledge and experience with performing all ISSO-related tasks to include the following for all assigned systems; ensuring that the appropriate operational security posture and Authorization to Operate (ATO is maintained in accordance with Department of the Interior (DOI) and Reclamation requirements; serving as a principal security advisor on all matters, technical and otherwise; developing and maintaining an authorization boundary portfolio with an online GRC tool; developing security procedures; continuous monitoring of security controls to ensure that they continue to be implemented correctly, operating as intended and producing the desired outcome with respect for meeting the security requirements; developing and maintaining the system security plan and all relevant components; conducting security impact analyses when information system changes occur;

conducting annual security control assessments ; managing the POA&M process; providing the required system access, information and documentation to security control assessors; and leading all steps of the NIST RMF process.

Privacy: Expert knowledge and experience with Privacy Act-related activities to include Privacy Impact Assessments (PIA), privacy plans, personally identifiable information (PII), PII breach procedures and recovery methods, knowledge and understanding of system of records notices (SORNs), privacy control requirements and assessments and training requirements.

Network security: Expert knowledge of network security architecture concepts to include topology, protocols, components, and principles (e.g., application of Defense-in-Depth) and the common attack vectors on the network layer. Skill in network mapping and recreating network topologies, protecting a network against malware, detecting host and network-based intrusions, reading and interpreting signatures, performing packet-level analysis and network traffic analysis. Knowledge and skills to configure, use and monitor network protection components (e.g., Firewalls, VPNs, network intrusion detection systems, cloud architecture).

Vulnerability management: Expert knowledge of system and application security threats and vulnerabilities (e.g., buffer overflow, mobile code, cross-site scripting, PL/SQL and injections, race conditions, covert channel, replay, return-oriented attacks, session integrity and malicious code) and malware analysis concepts and methodology. Skill in conducting vulnerability/penetration scans, recognizing vulnerabilities and preparing technical vulnerability, risk and security impact analyses. Expert knowledge of new and emerging technologies, programming language structures and logic, Linux/Windows command line, ports and services and penetration testing principles, tools, and techniques (e.g., Metasploit, Cobalt Strike, etc.). Knowledge of different classes of attacks (e.g., passive, active, insider, close-in, distribution, etc.) and different operational threat environments (e.g., first generation [script kiddies], second generation [non-nation state sponsored], and third generation [nation state sponsored]). Knowledge of different types of network and general attack stages (e.g., fingerprinting and scanning, enumeration, gaining access, escalation of privileges, maintaining access, network exploitation, covering tracks, etc.).

System Administration: Expert knowledge of Windows, Linux and Unix system configuration and administration, anti-virus software, patch management, optimization techniques, common protocols (SNMP, HTTP, HTTPS, SMTP, NTP, LDAP, KERBEROS, RADIUS, SFTP etc.), mobile device management, and scripting techniques.

INTERESTED CONTRACTORS AND QUESTIONNAIRE

A. The intent of this notice is to identify potential offerors for the Risk Management IDIQ.

Interested offerors are invited to submit the following information:

1. Capability statement

2. Point of contact information and SAM UEI.

3. Size status and/or SBA certification program for NAICS 541519 Other Computer Related Service.

4. Provide GSA Schedule if applicable

5. Firms capability to successfully manage complex requirements

6. Recent projects similar in size and scope

B. This market research is for informational purposes only. This announcement does not constitute a commitment, implied or otherwise, that a procurement action will be issued, and shall not be construed as a RFP or IFB, or as an obligation on the part of the Government. No entitlement to payment will arise as a result of the submission of contractor information.

C. All interested contractors who can meet the requirements stated above should respond, in writing, with information the above requested information to Contracting Specialist, Christina Mohamed at cmohamed@usbr.gov, no later than 1:00 p.m. (Eastern Time), December 7, 2022. THIS IS NOT A REQUEST FOR QUOTE. Phone calls will not be accepted.

Interested firms are reminded that in accordance with FAR 4.12, prospective contractors shall complete electronic annual representations and certifications in conjunction with FAR

4.11 , required registration in the System Award Management System (SAM) database prior to award of a contract.

THIS IS A SOURCES SOUGHT. THIS IS NOT A REQUEST FOR QUOTE.