2024 Secure Portable Data Storage (SPDS) Sources Sought Notice.docx

Sources Sought Notice for US Department of State Secure Portable Data Storage (SPDS)

PURPOSE: This Sources Sought Notice (SSN) is issued to conduct market research to determine the capabilities of 8(a) contractors to provide the Department of State with Secure Portable Data Storage Devices in support of its Identity, Credential & Access Management Program. The Government does not intend to award a contract on the basis of this SSN or reimburse any costs associated with the preparation of responses. Responding contractors are requested to confirm their 8(a) socio-economic status under North American Industry Classification Code (NAICS) 334112. This SSN is issued solely for information and planning purposes and does not constitute a solicitation. All information received in response to this SSN marked “Proprietary” will be handled accordingly. Responses to the SSN will not be returned. In accordance with FAR 15.201(e), responses to this SSN are not offers and cannot be accepted by the Government to form a binding contract. Responses to this SSN will assist DOS in determining the potential level of interest, competition adequacy, and technical capabilities of U.S. owned qualified 8(a) companies to provide the required services. The Government does not guarantee any action beyond this SSN.

BACKGROUND:

The Department of State seeks a centrally managed yet non-centrally administered enterprise Secure Portable Data Storage (SPDS) solution to safeguard data.

The Department intends to establish a Blanket Purchase Agreement (BPA) or other vehicle to allow domestic offices and overseas posts to purchase devices and licenses. The initial procurement shall include management console software, a limited number of devices, and associated licenses. Additionally, the Department intends to acquire more devices and licenses from a well-established product line over the life of the vehicle.

The devices shall support multiple operating systems, including Windows, Linux, and Mac. They shall be capable of being used as bootable OS Enterprise Central Management Server Software. Additionally, all anticipated hardware and software maintenance costs for the next five years for all components that comprise the SPDS solution must be included as separate line items. Device capacity should be within the range of 64GB to 1TB.

Secure Portable Data Storage Solution Requirements

The contractor shall provide products that adhere to the specifications for the SPDS solution, which include:

FIPS 140-3, Level 3 Certification:

The proposed solution must meet the current Federal Information Processing Standards (FIPS) 140-3, Level 3 certified encryption module utilizing, at minimum, 256-bit AES Key encryption. The vendor proposal shall include the FIPS Certification Number along with the proposal.

License Management:

When purchasing Flash Drives or SSDs, an equal number of remote management licenses must also be purchased at the same time for registration. The available licensing options include one year, two years, or three years.

The Enterprise server shall include a license renewal calculator, which allows the Super Admin to easily set a term date and calculate the number of licenses due for renewal.

The system shall manage the license assignments automatically, even if devices are purchased at different times. The licenses are purchased, and the license keys are provided in an Excel spreadsheet format for importing into the Enterprise server. These licenses are automatically assigned to devices as their existing permit expires.

Onboard Anti-Virus and Anti-Malware Protection:

The proposed solution shall include industry-standard Anti-Virus (AV) and anti-malware (AM) software onboard the encrypted drive. Antivirus deals with older, established threats like Trojans, viruses, and worms, while anti-malware focuses on newer threats like polymorphic malware and zero-day exploits. This feature shall be integrated and not require a separate anti-malware license. The solution shall also support centralized device anti-malware updates.

Onboard Auto-Run Prevention:

The proposed solution shall allow the administrator to disable autorun on the SPDS drives regardless of whether it is permitted on the host workstation.

Centralized Management with the following capabilities:

The Department shall have the ability to manage encryption keys, distribute software, firmware, AV, and AM updates, set device and user policies (including password settings, trusted applications, etc.), and initiate remote destruction for lost or stolen devices.

The required capabilities are:

· Use a multi-user, enterprise database, such as MS SQL

· Query databases using industry-standard ODBC, SQL language, and/or report-writing software

· Capture file name & operation for all file transfers on and offline mode

· Audit capability to provide detailed information on files transferred to and from or modified on the storage device, including complete file path information

· Expiration Policy can set storage to start working or stop working based on dates, including "Disable"

· Provide client license management, e.g., license expiration/renewal notification through the centralized server

· Track off-network devices (phone home capability must be configurable to a specific centralized management server)

· Native Active Directory (AD) integration which supports:

· Adding new management groups from AD

· Adding a new organization-level administrator from AD

· Adding a group administrator from AD

· Supports AD single sign-on to console

· Group Policy –Permitted Hardware Platforms

· Defines hardware platforms the devices are allowed access

· Device assignment, with remote user activation

· Device/User policy control (password complexity settings, trusted onboard applications, etc.)

· The ability to support multi-factor authentication (MFA) at the device

· The ability for the management server to be hosted on a FED Ramp Cloud Platform

· Ability to place encrypted files, objects, or vaults on to other mobile media, network locations, or cloud and control access to files, objects, or vaults to decrypt and use those files

· Native integration with Microsoft Office

Remote Management of the SPDS with the following capabilities:

· Remotely provision, lock, erase, and render devices unusable

· Remotely manage access permissions

· Enforce security policies

· Auditing capabilities of devices and files

· Device login (who, where, when)

· Tracking of file activity

· Track the usage and location of the drives

Remote Destruction:

The solution will provide the ability to identify and initiate self-destruction if an encrypted drive is lost or stolen. This self-destruct feature must render the encrypted drive unusable and ensure the data is unrecoverable.

Remote "destruction" of the drive through NIST SP 800-88 R1 Section 2.6 compliant cryptographic erasure, rendering data inaccessible/unusable, while the media remains reusable.

Decentralized Issuance:

It is essential to have a decentralized issuance of encrypted drives. The Department is a global organization. The solution should not necessitate physically registering encrypted drives at a central location before issuance. Different offices and overseas locations within the Department should be able to issue the proposed devices to their users through a remote administration feature on the centralized management console.

Trade Agreement Act (TAA) Compliant:

All components of the proposed solution shall be TAA-compliant.

Self-Contained Operations:

The solution should not rely on software installation on the host machine to use the encrypted flash drive. However, using a USB cable for encrypted hard drives is acceptable. The installation of the management console software on a server is not required.

Always On Encryption:

The proposed solution will ensure that encrypted drives use always-on encryption, meaning that when data is placed on the device, it is automatically encrypted and remains encrypted until it is removed from the device.

Backward Compatibility:

The proposed solution will ensure that any modifications to the management console software or device firmware do not require the whole-scale deployment of new drives to take advantage of the new features in the modified software.

Obstruction Free Operations:

The SPDS's connection will not block the use of adjacent USB ports. Hard drives can connect via cable to the USB Type-C port.

Credit Card Micro Purchase Capability:

The vendor shall be capable of processing product and license purchases using a Government Purchase card for overseas posts and domestic offices if the total purchase amount is below the micro-purchase threshold ($10,000.00).

Additionally, the contractor must provide, , a report detailing purchased device information (including serial number, capacity, and ordering post) on a monthly or quarterly basis (TBD) and/or allow an authorized Department of State representative to access sales data specific to the contract.

Support:

A technical support platform that offers a ticket management system that allows an interaction between the customer and the service representative and direct contact with the vendor.

Section 508 Compliance:

Products and services delivered shall comply with Section 508 standards.

Warranty:

The contractor shall provide, at a minimum, the standard commercial warranty for all products.

SSN RESPONSE INSTRUCTIONS:

SSN responses should conform to the format below and provide the following information:

· Section 1 - Cover Letter. The cover letter shall include the following:

a. Company information – Include company name, point of contact, contact information (name, address, phone number, and email address), and short description of the company (history, experience in similar size and scope of these requirements (no more than three examples).

b. Confirmation of the company’s 8(a) socioeconomic classification based on NAICS code 334112.

c. A listing of Government contracts held by the respondent.

· Section 2 – Response to Requirements. The purpose of this section is to provide information that will assist DOS to determine the best way to contract for the required products and services. Your response should include a description of the products and services you will provide the meet the Department’s requirements. The respondent may send technical data sheets, product brochures, and other information to further demonstrate their products and services will meet the Department’s requirements.

SUBMISSION INSTRUCTIONS: Responses to this SSN must total no more than 2 pages for the cover letter (Section 1) and no more than 8 pages for Section 2, with text no smaller than 12 point; however, text included in graphics, tables, and figures can be no smaller than 10 point. Any cover pages, tables of contents, and product information (in PDF format) are not included in the total page count. The submissions must be in sufficient detail and clarity to provide DOS with the information it needs. The response should contain no more than 5 PDF files of product information, brochures, etc.

Please provide an electronic version of your written response in Microsoft Word format.

Andrew Rothstein, RothsteinAT@state.gov, no later than, Tuesday, July 16, 2024, at 3:00 p.m. Eastern Time.

The Government will not accept questions after Monday, June 8, 2024 at 3:00 PM, Eastern Time. Please submit questions to RothsteinAT@state.gov

The Government will post the questions and responses on Sam.gov with sufficient time to for contractors to complete their SSN responses.

Please be advised that all submissions become Government property and will not be returned.