2025.09.26 RFI SISO.pdf

RFI TRANSCOM-25-D014

REQUEST FOR INFORMATION (RFI)

FOR

UNITED STATES TRANSPORTATION COMMAND (USTRANSCOM)

SENIOR INFORMATION SECURITY OFFICER (SISO)

TRANSCOM-25-D014

1. Purpose

This RFI is being issued for informational and planning purposes. Information gathered from this RFI will be considered to determine the most beneficial procurement approach for this requirement. The information requested will be used within USTRANSCOM to facilitate decision making and will not be disclosed outside the agency.

This announcement is not a Request for Proposal (RFP) or solicitation of any kind.

USTRANSCOM is not seeking or accepting unsolicited proposals for this requirement. This notice should not be construed as a commitment of any type by the Government to take or not take any action. Please note USTRANSCOM will NOT be responsible for any costs incurred by interested parties in responding to this RFI.

2. Background

The incumbent contract information provided below is for USTRANSCOM’s current SISO requirement.

Incumbent Contract Number: HTC71122FD026 Incumbent Contractor: Electrosoft Services, Inc.

Incumbent Contract Type: Firm Fixed Price (FFP) Incumbent Award Value: ~$29 million Incumbent Contract Acquisition Strategy: 100% Small Business Set-Aside Incumbent Contract Period of Performance: 01 Sep 2022 – 30 Sep 2026

Senior Information Security Officer (SISO)

The scope of the contract effort is to provide a broad range of Risk Management services to support the USTRANSCOM, AMC and SDDC missions. Information Technology (IT) technical skills will be required to support the USTRANSCOM C4 environment, which interfaces with numerous on-site and remote commercial, DoD, service, common-user networks, and the DoD approved cloud (i.e., Secret Internet Protocol Router Network [SIPRNet], Non-secure Internet Protocol Router Network [NIPRNet], Scott AFB Local Area Network [LAN], Scott AFB Wide Area Network [WAN], Metropolitan Area Network [MAN], and the DOD Information Networks

[DODIN]).

Additionally, the contractor shall provide a range of IT services to include cyber security, risk management framework (RMF) security controls assessor representative (SCAR) evaluation, technical testing and evaluation, analysis and guidance, software management, Zero Trust (ZT) support, and all deliverables related to these services.

The anticipated North American Industry Classification System (NAICS) code for this effort is 541519 – Other Computer Related Services. The Small Business Administration small business size standard for NAICS code 541519 is $30.0 million annual average receipts (total or gross income) over the past three years. The acquisition strategy (to include contract vehicle) for this requirement has not yet been determined. The contract type has not yet been determined. The anticipated period of performance is 1 Oct 2026 – 30 Sep 2031 (Base + four 1-year options).

3. Description

USTRANSCOM seeks to issue a contract or task order for the requirement listed above. The purpose of this requirement is to provide a range of IT services to include cyber security, RMF SCAR evaluations, technical testing and evaluation, analysis and guidance, software assurance management, ZT, and all deliverables related to these services.

The draft Performance Work Statement (PWS) includes additional details.

4. Industry Questions

We request interested parties to submit the following information in the format of a White Paper as outlined below. Again, this information will support market research activities within USTRANSCOM. The White Paper should be concise (no more than 5 pages), 12 pt Times New Roman font, and address only the information requested below (title pages, cover letter, etc., will not count against the page limit).

I. Company Information (General)

A. Company Name B. CAGE Code C. Point of contact name, phone number, and e-mail address D. Company Website E. Facility Clearance F. All contract vehicles under which you hold contracts (e.g., OASIS, FABS, etc.).

II. Business Size:

A. Based on the NAICS code (541519 – Other Computer Related Services), please indicate your business size (check one):

Small Large

B. If small business, please check all that apply to your firm:

HUBZone Small Business

Service Disabled Veteran-Owned Small Business

Veteran-Owned Small Business

Small Disadvantaged Business

Woman-Owned Small Business

Economically Disadvantaged Woman-Owned Small Business

III. Any suggestions or recommendations (including a brief explanation “why?”) for this acquisition. These comments will be addressed when the final PWS and Request for Quote are issued. These comments are excluded from the White Paper page limitation. To include suggested:

• Acquisition strategy

• Contract Vehicles

• NAICS

• Contract Type(s)

• Commerciality

• PWS and technical information

• Any other information you feel is value-added

IV. Industry Insight: Bring us your ideas.

• In your experience, what has worked well for other comments or commercial entities?

• What were the challenges or issues encountered?

• What Innovative acquisition strategies and contract vehicles were used?

V. Opportunities for innovation related to the SISO requirement. Respondents are encouraged to provide recommendations on how innovative technologies, processes, or approaches could enhance the Government’s ability to meet this requirement effectively and efficiently.

Specifically, the Government is interested in:

• Emerging Technologies: Suggestions for leveraging cutting-edge technologies or methodologies to address the requirement.

• Process Improvements: Recommendations for streamlining or optimizing current processes to improve outcomes.

• Best Practices: Insights into industry best practices that could be applied to this effort.

• Potential Risks and Mitigations: Identification of potential risks associated with innovative approaches and strategies to mitigate them.

5. Chief Information Security

Capabilities: Generally, describe your company’s abilities and interest in fulfilling USTRANSCOM’s SISO requirement. Specifically address the information in subparagraphs 1-6 below.

1) Experience with instructions, standards, and public laws supporting works such as, DoD Instruction 8500.01, Cybersecurity; DoD Instruction 8510.01, Risk Management Framework for DoD Systems; DoDI 8551.01, Ports, Protocols, Services Management (PPSM);

DoD Cloud Security Playbook, DoD Software Modernization Strategy, DoD DevSecOps, Security Technical Implementation Guides (STIGs), Federal Information Security Management/Modernization Act (FISMA), Clinger Cohen Act, National Institute of Standards and Technology (NIST), Committee on National Security Systems (CNSS), National Security Agency, etc.

2) Experience with security requirements, testing, assessment and validation procedures, and best practices applicable to physical, virtual, and cloud (Infrastructure as a Service [IaaS], Platform as a Service [PaaS], Software as a Service [SaaS]) based environments to include host-based security devices (i.e., Intrusion Prevention Systems [IPS], Intrusion Detection Systems [IDS], firewall, proxy servers, sensors, switches, routers, hubs) and their role in moving packets securely from source to destination.

3) Experience with information technology and software engineering principles, concepts, and techniques including software languages, design concepts, test methods, and integration practices to include security implications and methodologies within centralized and decentralized environments across the enterprise’s computer systems in software development.

4) Experience with Enterprise Mission Assurance Support Service (eMASS) system with emphasis on leveraging automation and completing routine SCAR tasks (e.g., control Independent Verification and Validation (IV&V).

5) Experience with performing risk analysis based upon program offices security artifacts that assess the technical and functional adequacy of cyber security and information assurance while maintaining a strong emphasis on meeting government authorization package timelines.

6) Experience with the implementation and validation of DoD ZT capabilities, activities, and desired outcomes. Provide any information on identifying and integrating solutions to meet the associated ZT outcomes.

7) Provide the following project or contract information for requirements deemed similar to this effort or capabilities described above:

• A brief description of the project

• Contract number

• Period of performance

• Contract type (Firm Fixed Price, Labor Hour, Cost Plus Fixed Fee, etc.).

• Commercial or Non-Commercial Requirement?

• Was your company a prime or subcontractor?

• Dollar value of the project

• Scope of the portion of the effort your company supported

5. Technical Capability Virtual Meetings

The Virtual Technical Capability Meetings are a scheduled one-on-one meeting with your company and the AQ/J6 representatives. This forum will include conversations between the

Government and interested parties based on the information requested above. Please be prepared to discuss this information during your session.

A request for a meeting will need to be submitted with your response. Only those providing a white paper with technical responses and a request will receive a meeting.

A Microsoft TEAMS meeting will be sent to the e-mail address provided on a first come first serve basis. Allocated meeting times are not negotiable and are a hard start and stop time.

Meetings may be forwarded to a maximum of 4 attendees from your company or venture.

Tentative date for meeting will be 20 October 2025. This is subject to change.

6. Response Instructions

Responses to this RFI must be submitted to the TCAQ-DS Mailbox at transcom.scott.tcaq.mbx.TCAQ-DS@mail.mil no later than 10:00AM CT, 17 October 2025.

All responses to the RFI will be reviewed and utilized for market research.

6. Point of Contact (POC)

Darrah Hill Meggan DeBrobander Contract Specialist Contracting Officer

USTRANSCOM/TCAQ-D USTRANCOM/TCAQ-D

darrah.m.hill.civ@mail.mil meggan.a.debrobander.civ@mail.mil

Attachment:

SISO PWS (Draft) mailto:darrah.m.hill.civ@mail.mil mailto:meggan.a.debrobander.civ@mail.mil