2026-S-063 Cybersecurity Support RFI.pdf

Request for Information V1 | April 2022 Page 1

REQUEST FOR INFORMATION FOR

CYBERSECURITY SUPPORT SERVICES

This announcement constitutes a Request for Information (RFI) for the purpose of determining market capability of sources or obtaining information. Responses to this RFI may be used for market research for future solicitations.

I. DISCLAIMER

THIS IS A REQUEST FOR INFORMATION ONLY.

This RFI is issued solely for information and planning purposes – it does not constitute a Request for Proposal (RFP) or a promise to issue an RFP in the future. This RFI does not commit the United States Senate Office of the Sergeant at Arms (SAA) to contract for any product or service whatsoever. Further, the SAA does not seek proposals at this time; will not accept unsolicited proposals; and will not pay for any information or administrative costs incurred in response to this RFI. All costs associated with responding to this RFI will be solely at the interested party’s expense. If the SAA subsequently releases a solicitation, it may be published on the SAM.gov website. Potential contractors are responsible for monitoring this site for possible additional information pertaining to this requirement.

This synopsis contains the currently available information and is subject to change at any time.

II. BACKGROUND

The SAA the serves as the chief law enforcement and protocol officer for the Senate, with responsibilities encompassing the protection of Senate members, staff, visitors, and facilities. This function includes safeguarding critical information systems and networks that support legislative operations, such as email communications, document management, voting systems, and remote access platforms. In an era of escalating cyber threats—ranging from nation-state actors conducting espionage and disruption campaigns to cybercriminals deploying ransomware and phishing attacks—the SAA recognizes the imperative to fortify its cybersecurity posture.

Recent high-profile incidents, including breaches of government agencies and legislative bodies worldwide, underscore the vulnerabilities inherent in interconnected digital infrastructures. The Senate’s role in the United States constitutional form of government makes it a prime target for advanced persistent threats (APTs), supply chain compromises, and insider risks. To address these challenges, the SAA seeks to explore innovative cybersecurity services that leverage emerging technologies like artificial intelligence-driven threat hunting, zero-trust architectures, and cloud-native security solutions. This RFI aims to identify industry capabilities that can integrate seamlessly with existing Senate systems, ensuring minimal disruption while maximizing protection against evolving cyber risks. By soliciting input from vendors and experts, the SAA intends to inform future procurement strategies that prioritize scalability, cost-effectiveness, and alignment with legislative security requirements.

The SAA seeks to solicit services for a variety of cybersecurity services. Below are some key items of note respondents should be aware of:

Request for Information V1 | April 2022 Page 2

a. Services like vendor risk assessments may be solicited on an ongoing, annual basis. Other services like penetration testing may be limited to 90–180 calendar day periods of performance depending on the requirements.

b. ServiceNow is used for a variety of Cybersecurity functions and the SAA would prefer any proposed platforms or tools used in support of those services to integrate with ServiceNow.

c. The SAA supports a significant part of the Legislative Branch of the United States Government. Due to this unique environment, the SAA may choose to abide by all or portions of various federal requirements (OMB Circulars, FISMA requirements, etc.).

Adherence is based on best practices and needs of the SAA; it is not mandated by any Executive Branch action or directive.

d. All personnel are required to have and maintain at a minimum a Secret clearance.

Additional clearance levels may be required for certain tasks.

III. SPECIFIC INFORMATION OF INTEREST

The SAA is seeking information regarding industry capabilities to provide comprehensive cybersecurity services, including managed security services, vulnerability management, and strategic security consulting to bolster the current security posture. Responses to this RFI may include a response to each of the questions and service requests descriptions listed below.

Respondents are encouraged to provide detailed, non-proprietary information on the following areas.

Core Cybersecurity Services

a. What are your organization’s capabilities in providing managed security services, including but not limited to:

1. Cyber threat intelligence

2. Cyber risk assessments, vulnerability assessment and penetration testing

3. Compliance audit

4. Cyber hunt and threat detection

5. End point detection and response

6. Security Operations Center (SOC) as a service

7. Incident response and recovery

8. Risk Management Framework (RMF) implementation

9. Training and workforce development

10. Supply chain risk reviews and mitigations

11. Technical writing support

12. Cybersecurity architecture and planning

b. How do your services align with federal standards (e.g., FedRAMP authorization levels, CMMC, NIST)?

c. Provide examples of scalability for large-scale federal deployments (e.g., supporting

50,000+ users).

Emerging Technologies

Request for Information V1 | April 2022 Page 3

Describe your organization’s capabilities in providing:

a. Detailed integration of AI/ML for predictive threat analysis and automated response.

b. Approaches to zero-trust implementation, including identity and access management

(IAM) and micro-segmentation.

c. Solutions for cloud security (e.g., AWS, Azure, Google Cloud) and hybrid environments.

d. Innovations in quantum-resistant encryption or post-quantum cryptography.

Implementation and Support

Describe your organization’s capabilities for:

a. Estimated timelines and costs for deployment in a federal setting (high-level ranges only).

b. Training and knowledge transfer programs for federal personnel.

c. Metrics for measuring service effectiveness (e.g., mean time to detect/respond, false positive rates).

d. Strategies for compliance with federal data sovereignty and privacy requirements (e.g. 2

U.S.C. § 6628 handling).

Challenges and Recommendations

Describe your organization’s capabilities to:

a. Identify potential challenges in providing cybersecurity services to federal entities (e.g., regulatory hurdles, integration with legacy systems).

b. Suggest ways the SAA can streamline procurement or collaboration to foster innovation.

Company Information

Describe your organization by including:

a. Provide a brief overview of your organization, including size, years in business, relevant certifications (e.g., ISO 27001), and past performance with government contracts.

In addition, any background information about a proposed product, platform or tools including the knowledge, skills, and experience required to support the SAA’s Cybersecurity mission that may be helpful should be included in the response to this RFI.

IV. SUBMISSION INSTRUCTIONS and FORMATTING REQUIREMENTS

The information contained in this RFI will be the only information provided by the Senate during this process. All respondents should submit an information package in accordance with the instructions provided below.

Responses to this RFI are due no later than 1:00pm EST on May 05, 2026 and shall be submitted electronically via email only to the attention of Mashonda Walston at acquisitions@saa.senate.gov.

mailto:acquisitions@saa.senate.gov

Request for Information V1 | April 2022 Page 4

The subject of the email message shall be: “RFI #2026-S-063 Cybersecurity Support". No other method of transmittal will be accepted. Access by the SAA to information in any files attached to the response is the responsibility of the submitting party. Neither the SAA nor the Senate is responsible for any failure to access respondent’s information. Respondents are allowed a maximum of 15 pages, excluding cover page and appendices. The responses should be concise and include supporting data, case studies, or white papers where applicable. Proprietary information should be clearly marked and will be handled accordingly. The SAA has the sole discretion to follow up with selected respondents for clarification or virtual meetings.

V. QUESTIONS AND POINT OF CONTACT

Questions regarding this RFI may be sent to the following Procurement & Contract Specialist:

Name: Mashonda Walston Title: Senior Procurement and Contracting Specialist E-Mail Address: acquisitions@saa.senate.gov

THIS IS NOT A REQUEST FOR PROPOSAL. THIS NOTICE CONSTITUTES THE

ENTIRE REQUEST FOR INFORMATION AND IS THE ONLY INFORMATION

PROVIDED BY THE SERGEANT AT ARMS OR SENATE. THE SERGEANT AT ARMS

WILL NOT RESPOND TO ANY REQUESTS FOR ADDITIONAL INFORMATION.

mailto:acquisitions@saa.senate.gov

III. SPECIFIC INFORMATION OF INTEREST