24-031-OITA Security Advisory Alerting Service RFI.doc

Internal Revenue Service (IRS)

Cybersecurity Threat Fusion Center (CTFC) Security Advisory Alerting Service

Request for Information (RFI)

Introduction

SOURCES SOUGHT– THIS REQUEST FOR INFORMATION (RFI) IS RELEASED PURSUANT TO FEDERAL ACQUISITION REGULATION (FAR) PART 10, MARKET RESEARCH.

This RFI is only issued for information and planning purposes. It shall not be construed as either a solicitation of the obligation on the part of the Government. All information received from this RFI will be used for Market Research purposes only. The Department of Treasury solicits vendor responses to this RFI for market research purposes only. This RFI will not result in a contract award.

The Government does not intend to award a contract based on responses to this RFI nor otherwise reimburse vendors for the preparation of any information submitted or Government use of such information. There is no guarantee of a solicitation resulting from this RFI.

Acknowledgment of receipt of responses will not be made, nor will respondents be notified regarding the outcome of the information received. All data received in response to this Sources Sought synopsis marked or designated as corporate or proprietary information will be fully protected from release outside the Government.

The Government shall not be liable for or suffer consequential damages for proprietary information not properly identified. Proprietary information will be safeguarded in accordance with all applicable Government regulations. All documentation shall become the property of the Government and will not be returned.

Reference/Notice Number (if applicable): 24-031-OITA Project Title / Short Description: Security Advisory Alerting Service

PCS or FSC Code:

D318: IT And Telecom- Integrated Hardware/Software/Services Solutions, Predominantly Services

NAICS Code:

541519: Other Computer Related Services.

Release Date:

April 11, 2024 Response Date:

April 17, 2024 Primary Point of Contact and Contact Information:

Name: Sandra R. Anderson

Title: Business Operations Specialist

Email: sandra.r.anderson@irs.gov Phone number: 240-613-7462 Security Advisory Alerts Service The IRS is seeking to procure a cybersecurity advisory alerting service which provides updates via email.

Description of Services The Government has interest in and is seeking information regarding the capability of vendors providing cybersecurity alerting services via email to support the Government’s requirement of receive all vendor-related security advisories that may affect the IRS enterprise for severity, risks, relevance and dissemination to requisite business units within the enterprise.

Specifically, our IRS policy IRM 10.8.50 requires the CTFC VAC receive all vendor-related security advisories that may affect the IRS enterprise for severity, risks, relevance and dissemination to requisite business units within the enterprise. Publication of cybersecurity notifications is critical to ensure removal of known vulnerabilities from the enterprise.

This first step to patch management starts with timely notification of IT vendors’ security vulnerability releases.

To improve the ability to respond to critical, high, medium and low priority software/hardware vulnerabilities that potentially affect operations within the enterprise, the IRS seeks redundancy with notification of cybersecurity vulnerabilities via a subscription-based vulnerability alerting services.

The IRS is seeking to obtain subscription-based vulnerability alerting services, specifically a email services capable of notifying Cybersecurity Threat Fusion Center (CTFC) Vulnerability Analysis Cell (VAC) about vulnerabilities, Zero-Days, and Known Exploited Vulnerabilities (KEVs) potentially affecting all relevant software, hardware, applications, appliances, IT platforms, operating systems, network devices and/or developmental toolkits used in the IRS environment. These email notifications will provide vulnerability details to include vendor-recommended remediations, mitigations and/or security best practices.

· Improve and enhance the capabilities of the IRS CTFC VAC to publish Tiered level approach to distribution of relevant cybersecurity Advisories, Bulletins, and Alerts to affected Business Units for quick response and patching activities.

· Advisories must include a short description/title, impact, whether the vulnerability can be exploited remotely or locally, all relevant CVE #s, the affected OS or software to include versions affected, a description to include some detail about the vulnerability, a solution to include upgrade versions, configuration requirements and any temporary mitigation steps if a full remediation is not yet available.

· Advisories should also provide all relevant Common Vulnerability Exposure (CVE) information related to the specified software (application, appliance, hardware, platform) flaw, base and any vendor-specific Common Vulnerability Scoring System (CVSS) scoring and Base Metric data, NVD Criticality, release date, last update date (if applicable), change log (if applicable), and links to vendor-related advisories, fixes, guidance, etc.

· The requirement is for an email only service. This service should not be part of a suite and no unique IRS network access is required. This should be one-way email traffic to the IRS.

· Timeliness of these cybersecurity notifications is essential. Email notifications should not be a daily or period roll-up. The advisory notifications should be received as the vendor releases them. Service Level Agreements (SLAs) exist based on the criticality of vulnerabilities. Internal IRS notifications must be sent within one hour for critical advisories, within two hours for high advisories, etc.

· Customer support for this service should provide at a minimum a point of contact email and phone number to resolve issues. Resolution must not exceed 24 hours.

· Two independent services for coverage and backup to address the importance of receiving these alerts in a timely manner that cannot afford an outage and reliance on one vendor.

Vendor Inquiries and Questions

Please email questions to both primary and secondary points of contact listed below with the following in the Subject Line: Questions to RFI – Security Advisory Alerting Service. Responses to questions will be available to all vendors through the NASA SEWP and SAM.gov notices for this RFI. The Government reserves the right to respond to some, all, or none of the questions submitted.

RFI Response Submittal Instructions Vendors are encouraged to be as specific as possible in addressing each section of the RFI. Feedback of a general or non-specific nature is less useful and may not be used in refining the acquisition strategy and impacting the content of a possible RFI.

Vendors that meet the requirements described in this announcement are invited to submit their capability statements/RFI response. Vendors shall reference “Response to RFI – Security Advisory Alerting Service “ in the subject line of their response, as well as in the subject line of any other e-mail correspondence referencing this notice.

Respondents shall fill and include the file 24-031-OITA Security Advisory Alerting Service Company Information and Questions.xlsm as an attachment to their response.

Respondents are strongly urged to adhere to this page limitation as defined in the designate sections as well as to limit marketing material in order to provide more substantive information in their response. Vendors may provide links to relevant websites, as appropriate.

Parties may respond to this RFI in accordance with the instructions provided in the table below:

Primary Point of Contact

Sandra R. Anderson e-mail: sandra.r.anderson@irs.gov

Secondary Point of Contact

David Taylor e-mail: david.j.taylor@irs.gov

Proprietary Information See FAR Subsection 3.104-4 for how this information will be safeguarded if properly labeled. The Government reserves the right to publish any information provided by a respondent to the RFI if publishing such information is done without attribution (i.e., does not identify the party submitting the response materials), and would not reveal company trade secrets or other similar protected or proprietary information. For example, if a respondent were to ask when the RFP would be released, then such a question could be published without attribution and would not jeopardize any corporate or trade secrets of the respondent. Accordingly, the Government may publish such materials. On the other hand, if a respondent were to provide detailed product rollout plans for a new payroll system offering, then that material would not be published if properly marked.

The Government will not respond to phone calls regarding this RFI.

Thank you for your interest.