Intent to Sole Source.docx

INTENT TO SOLE SOURCE

Cyber Cube Data

SOL # 20341524Q00016

The Bureau of the Fiscal Service, on behalf of the Office of Financial Research (OFR) and the Financial Stability Oversight Council (FSOC) intends to make award to CyberCube Cyber Data LLC, 110 South State Street #419 Chicago, IL 60606 on a sole source basis, there is no competitive vendor or regulatory agency that provides these subscriptions, OFR requires CyberCube products: Account Manager (AM); Portfolio Manager (PM); Attritional Loss Model (ALM); SPoF Intelligence; Industry Exposure Database (IED); Economic Exposure Database (EED); Active Risk Monitoring functionality; and CyberConnect APIs. In addition to access to these products via CyberCube’s platform, the proposed acquisition is to acquire bulk historical data on cybersecurity scores, subscores, and exposure scores on a portfolio of up to 10,000 entities, along with the ability to add entities on a quarterly basis. Finally, the acquisition is to acquire ongoing monthly updates to the historical security score, subscore, and exposure data, along with technology dependency, CVE, and cyber incident data for all the entities in the portfolio, as well as consulting services to allow for customization of use of the platform. Cyber Cube LLC has been identified as the only source capable of providing the required content in an arrangement that suits the needs of OFR/FSOC.

The OFR has a mandated to monitor, assess, and report on all risks to financial stability that it sees. Cyber vulnerabilities within the financial sector and at counterparties and third-party service providers to the sector are such a risk to financial stability. Because financial crises are rare events and crises caused by cyber incidents are even rarer, few data sources are available for analyzing drivers of such crises and developing metrics. In such cases, scenario analysis is an ideal alternative for assessing risk. The proposed vendor is unique in providing a cyber scenario modeling platform to simulate expected losses from non-catastrophic (that is, attritional and large) cyber losses and from catastrophic systemic losses. The results are broken down by the targeted entity or the target’s customers, who are reliant on the target as a technology dependency. The vendor’s model was used to underwrite the first cyber catastrophe bond and is now commonly used to underwrite such bonds, which means that its scenario analysis platform aligns with best industry practice.

CyberCube also offers cybersecurity scores – ratings of entities on their cyber defenses. Although other vendors also provide data on cybersecurity scores, CyberCube is unique in also offering exposures scores and scores for an unlimited number of entities, including (via its IED and EED) for an entire industry or even the entire economy, as well as for all the technology service providers to those entities, all in combination with its scenario analysis platform. This makes the vendor’s offering extremely cost effective.

Finally, the Board of Governors of the Federal Reserve System currently uses these CyberCube products, so the OFR’s use will allow coordination and collaboration with them.

The Period of Performance (PoP) will be a base of one (1) year including four (4) twelve-month option periods. Cyber Cube LLC is the best source of these data because it has the most breadth and longest history of any similar commercially available dataset.

NO SOLICITATION IS AVAILABLE. A request for more information, or a copy of the solicitation, will not be considered an affirmative response to this Special Notice. Telephone responses or inquiries to this Special Notice will NOT be accepted.

Fiscal Service will consider written responses received no later than 10:00 AM EST June 10, 2024. Responses must be submitted electronically to purchasing@fiscal.treasury.gov, Attn: CG/BC REF SOL# 20341524Q00016. Vendor responses must include sufficient evidence that clearly shows the proposed service is capable of meeting all of the characteristics of the services needed and described above. If no written response is received that clearly demonstrates an ability to meet all requirements and is received by the aforementioned deadline, Fiscal Service shall make award on a sole source basis to CyberCube Analytics, LLC..

Qualified contractors must provide the following:

1. The name and location of your company, contact information, and identify your business size and socioeconomic category (Large Business, Small Business, Disadvantaged Business, 8(a), Service-Disabled Veteran Owned Small Business, HUBZone, etc.). Please ensure contact information includes the name of the point of contact, email address, and telephone number should the Government have questions regarding individual responses.

2. Whether your service is available through an existing Government Contract Vehicle or Open Market.

3. A narrative description of how your proposal meets all the characteristics needed for the service.

4. A brief capabilities statement (not to exceed 5 pages) that includes a description of your company's standard line of business, as well as a list of customers your company currently provides these products/services for.

5. UEI Number.

6. Evidence that the company is an actively registered entity in the System for Award Management (SAM) or acknowledgement that the company would register if a formal solicitation were released.

In accordance with FAR Part 52.204-7, contractors must be registered in the System for Award Management (SAM) to be eligible for award. There is no cost to register an entity on SAM.gov. The website to begin registration is:

https://sam.gov/content/entity-registration

The following file extensions are not allowable and application materials/data submitted with these extensions cannot be considered: .bat, .cmd, .com, .exe, .pif, .rar, .scr, .vbs, .hta, .cpl, and .zip files.

Microsoft Office compatible documents are acceptable.

No other information regarding this Special Notice will be provided at this time.

This notice does not restrict the Government to an ultimate acquisition approach. All firms responding to this notice are advised that their response is not a request that will be considered for contract award. All interested parties will be required to respond to any resultant solicitation separately from their response to this notice, should one be issued.