Rev_11-1-19_SOURCES_SOUGHT_NOTICE.pdf

SOURCES SOUGHT

SOLICITATION NUMBER: 29FTC120S0001

INFORMATION SECURITY AWARENESS

Posted Date: Amendment November 4, 2019

Response Date: November 14, 2019 (15 days after posting date)

Archive Date: November 29, 2019 (15 days after response date)

Set Aside: N/A

Classification Code:

NAICS Code: 541519

PSC: D399

Synopsis:

SOURCES SOUGHT/REQUEST FOR INFORMATION

The Federal Trade Commission (FTC), Office of the Chief Information Officer (OCIO) is currently conducting market research seeking capabilities statements from potential sources, including small businesses (SB), 8(a), HUBZone, Economically Disadvantaged Woman-Owned (WOSB), Service Disabled Veteran Owned (SDVOSB) small business that are capable of providing the requirement as described below:

The purpose of this request for information is to determine available sources with expertise in providing information assurance and security support services to the Federal Trade Commission (FTC). The goals are as follows:

• Provide information security and assurance services that directly support the FTC’s mission

• Protect and enhance the confidentiality, integrity, and availability of agency IT services, data, networks, and assets

• Streamline the adoption and implementation of emerging technologies that improve the agency’s performance, without compromising information and data security

• Improve FTC’s ability to respond to rapidly changing cybersecurity requirements and Federal guidelines

I. BACKGROUND

The FTC employs approximately 1,700 federal employees and contractors, with an estimated 100 additional temporary staff between May and September. A majority of the staff are Washington, DC based, located in the Headquarters building at 600 Pennsylvania Avenue NW and the Constitution Center facility at 400 7th Street SW. FTC staff is also located throughout the country in eight regional offices: New York, New York; Atlanta, Georgia; Cleveland, Ohio;

Chicago, Illinois; Dallas, Texas; Seattle, Washington; Los Angeles, California; and San Francisco, California.

The FTC’s Office of the Chief Information Officer (OCIO) is responsible for providing the FTC with a robust, reliable, rapidly scalable, and interoperable infrastructure, providing connectivity and computing capabilities, which allow all FTC staff and mission partners to access, share, and act on needed information. The OCIO also directly supports critical mission area Information Technology (IT) development, modernization, and the enhancement of applications and systems, business services, and related office automation systems; and maintains a robust cybersecurity program that includes the FTC’s disaster recovery efforts.

The FTC is currently embarking on a multi-year effort to modernize its IT service portfolio and increase agility and availability by moving IT services and systems to cloud service providers.

This undertaking requires extensive information assurance and cyber security activities to ensure information security is integrated into the system development lifecycle and align FTC IT with Federal cybersecurity best practices and mandates from DHS, NIST, and OMB. Through this blanket purchase agreement (BPA), the FTC will address ongoing requirements for information assurance and cyber security activities, as well as periodic requirements for authorizing and assessing new systems and engineering innovative security architectures and tools in support of its mission.

II. PERFORMANCE WORK STATEMENT

FUNCTIONAL AREA 1: Information System Security Officer (ISSO) Services

The Contractor shall provide technical experts to be designated as Information System Security Officer (ISSO) for selected FTC IT systems and services and perform ISSO tasks in accordance with FTC policies and procedures and Federal regulations. Upon formal appointment by the applicable System Owner (SO), the ISSO shall be responsible for: ensuring the appropriate operational security posture; maintaining security documentation for the assigned systems or program; and developing, gathering, and reporting measurements to support FTC cybersecurity program.

FUNCTIONAL AREA 2: Information Security Planning and Engineering

The Contractor shall support the FTC’s current and future IT modernization efforts by ensuring confidentiality, integrity, and availability are integrated into FTC’s target architecture. As the FTC migrates its mission critical systems to cloud-based environments, the agency will seek the

Contractor’s expertise to develop information security strategies that protect agency data and networks from emerging threats. Tasks in this functional area include:

• Overall strategic planning for the FTC’s information security program

• Contingency and disaster recovery planning for FTC’s systems and services

• Evaluation and assessment of information security and continuous monitoring tools and services

• Overall architectural design and engineering of new security and monitoring solutions

• Recommendations for securing cloud-based systems and services

• Analysis of emerging trends in information security

• Review of planning documents, such as business cases and strategic plans, to ensure information security is sufficiently addressed

• Recommendations for implementing new Federal information security mandates

• Security policy and business process analysis and recommendations for improvement

FUNCTIONAL AREA 3: Security Authorization and Assessment (A&A) Services

The Contractor shall provide technical expertise to support the entire Security Assessment and Authorization (A&A) process, as outlined in NIST Special Publication 800-37. The Contractor shall develop project plans, detailed schedules, and assign a project manager for activities and deliverables required for the A&A process. The Contractor shall support all phases of the A&A process, including the system categorization, selection, tailoring, implementation, assessment, and monitoring of security controls, and ongoing authorization. The FTC encourages the use of teaming arrangements in order to provide an independent audit and attestation for security control assessments.

FUNCTIONAL AREA 4: Threat and Vulnerability Management

The Contractor shall provide services to assess and manage vulnerabilities and potential threats to the FTC’s IT environment. The Contractor shall use current threat data, industry best practices, and advanced tools and practices to conduct assessments and analysis of the agency’s IT systems and report any findings and recommendations for mitigating risks and threats and improving the agency’s cybersecurity posture with minimal impact to system performance.

Tasks in this functional area shall include: network mapping, vulnerability scanning, phishing simulations, and penetration testing; as well as reporting findings and making remediation recommendations.

FUNCTIONAL AREA 5: Independent Verification and Validation (IV&V)

The Contractor shall provide services to ensure newly developed and implemented IT systems services comply with FTC performance and technical requirements, Federal guidelines and regulations, including FISMA and FIPS standards, proposed architectural designs, and equipment manufacturer specifications. The IV&V deliverables must demonstrate the IT system or service is deployed in accordance with FTC policy requirements and all architectural designs, plans, reports, and technical data modifications and configurations are captured and integrated in appropriate documentation in a timely manner.

FUNCTIONAL AREA 6: Information Technology Risk Management

The Contractor shall support the agency efforts to enhance the internal control framework for the agency’s information technology infrastructure. This includes evaluating, developing, and executing remediation plans for program improvement efforts; recommendations for policy and program changes; performing risk assessments and analysis to determine major risk factors;

coordination with internal and external auditors on matters pertaining to findings and recommendations; and engaging with senior leadership and management in discussions about risk and risk mitigation strategies.

III. STATUTORY STANDARDS/COMPLIANCE REQUIREMENTS

The Contractor must ensure compliance with security and regulatory requirements, policy, and guidance defined by OMB, NIST, the Federal Information Security Modernization Act (FISMA), FedRAMP, and enhanced FTC-specific security and privacy requirements. Applicable Federal and FTC policies and procedures are detailed in Attachment #1, Federal and FTC Policies and Procedures.

IV. PLACE OF PERFORMANCE AND HOURS OF OPERATION

The primary place of performance will depend upon the BPA Call that is issued. Place of performance will primarily include: the FTC Headquarters located at 600 Pennsylvania Avenue, NW, Washington, DC 20580, however, it may also take place at the Constitution Center 400 7th Street SW, Washington D.C. and any of the following regional office as well as off-site support as needed: New York, New York; Atlanta, Georgia; Cleveland, Ohio; Chicago, Illinois; Dallas, Texas; Seattle, Washington; Los Angeles, California; and San Francisco, California.

The hours of operations and location will be communicated in each individual BPA Call.

V. FTC’s INFORMATION SECURITY PROGRAM AND SYSTEM INVENTORY

1. APPENDIX A: FTC’s INFORMATION SECURITY PROGRAM

The FTC’s information systems store and process Controlled but Unclassified Information (CUI) and Personally Identifiable Information (PII). No classified information is contained in these systems. Federal Information Processing Standard (FIPS) 199 classification is Moderate for Availability, Moderate for Integrity, and Moderate for confidentiality for FTC’s general support system and most major applications. The FTC does not have any systems with a FIPS 199 classification for High and does not have any High Value Assets per DHS Binding Operational Directive 18-02).

2. SYSTEM INVENTORY

Table 1 (Attachment #2) lists all systems currently in use at FTC, along with the authorization status and applicable control set. While all listed systems are incorporated in scope of this BPA, each order may only cover a subset of the listed system. Throughout the life of this BPA, the FTC may add new systems or decommission and/or replace existing systems to meet the FTC’s mission requirements.

VI. PLACE OF PERFORMANCE AND HOURS OF OPERATION

The primary place of performance will depend upon the BPA Call that is issued. Place of performance will primarily include: the FTC Headquarters located at 600 Pennsylvania Avenue, NW, Washington, DC 20580, however, it may also take place at the Constitution Center 400 7th Street SW, Washington D.C. and any of the following regional office as well as off-site support as needed: New York, New York; Atlanta, Georgia; Cleveland, Ohio; Chicago, Illinois; Dallas, Texas; Seattle, Washington; Los Angeles, California; and San Francisco, California.

The hours of operations and location will be communicated in each individual BPA Call.

VII. SUBMISSION OF CAPABILITY STATEMENTS

Responders to this Sources Sought Notice shall provide a Capability Statement setting forth its expertise in providing the services under Functional Areas 1 through 6. The capability statement shall have a cover page for each responder with the following information:

1. COVER PAGE:

a. Name of Business

b. Tax Identification Number

c. DUNS

d. Business Status

e. Address

f. Point of Contact:

Name

Address

Telephone Number

Fax Number

E-mail Address

2. FORMAT: No more than two (2) pages per functional area or a total of 12 pages, 8 ½” x 11” pages, single-spaced, type size 12 points, 1” inch margins or no more than a total of 12 pages.

3. CONTENTS: Discussion of qualifications and expertise for each of the six (6) functional areas. The content shall address responders qualification and experience to meet the government requirements within system specifications and mandatory policies and regulations. Responders are encouraged to indicate their GSA Schedule contracts or other GWACs under which this requirement can be met.

4. SUBMISSION: Capability Statements shall be submitted no later than 2:00 p.m. on Thursday, November 14, 2019 to Beverly Johnson, Senior Contract Specialist, at bjohnson4@ftc.gov.

5. OBLIGATION OF THE GOVERNMENT: This Sources Sought Notice does not in any way obligate the government to provide follow up with responders to this notice and/or obligate the government to procure the services set forth in this notice. Any costs incurred by responders to this request will be the responsibility of the responders.

mailto:bjohnson4@ftc.gov