47QFRA22K0006_RFI Layer B CDM_UPDATED 12.17.21.pdf

Request for Information (RFI) – Layer B Modernization

Agency: Cybersecurity and Infrastructure Security Agency (CISA)

Market Research Agency: General Services Administration (GSA), Federal Acquisition Service (FAS), Region 8

Notice Type: Request for Information

NAICS: 541512 Computer Systems Design Services

GSA Reference: 47QFRA22K0006 Posted Date: November 29th, 2021 Update Date: December 17, 2021

GENERAL INFORMATION:

The General Services Administration (GSA), Federal Acquisition Service (FAS), Region 8 is issuing this Request for Information (RFI) on behalf of the Cybersecurity and Infrastructure Security Agency (CISA).

RFI OBJECTIVE:

The purpose of this RFI is to assist the Government in conducting market research focused on gaining technical feedback from industry on recommendations and technical considerations in creating a single integration layer (Layer B) solution for the Continuous Diagnostics and Mitigation (CDM) Program. This information will be used for market research only. The Government is not obligated to release a future solicitation based on this market research.

BACKGROUND:

Established in 2012, the CDM Program is a dynamic approach to fortifying the cybersecurity of government networks and systems. The CDM Program provides cybersecurity tools, integration services, and dashboards to participating agencies (Chief Financial Officers [CFO] Act agencies and non-CFO Act agencies) to support them in improving their security postures by delivering better visibility and awareness of their networks and defending against cyber adversaries.

CDM supports the overall mission of CISA, the nation’s risk advisor, working with partners to defend against today’s threats and collaborating to build a more secure and resilient infrastructure for the future.

CISA builds the national capacity to defend against cyberattacks and works with the federal government to provide cybersecurity tools, incident response services and assessment capabilities to safeguard the government networks that support the essential operations of federal departments and agencies. In supporting CISA’s mission, CDM works closely with agencies and industry partners to deploy capabilities that help agencies protect their hardware and software assets, networks, and the data they contain.

There are four CDM Program capability areas:

• Asset Management, helping agencies understand what is on their networks

• Identity and Access Management, helping agencies understand who the users are that are on their networks

• Network Security Management, helping agencies understand what’s happening on their networks

• Data Protection Management, helping agencies understand how their data is being protected.

The CDM architecture uses a four-layer A-B-C-D design, as depicted below in Figure 1 – CDM Architecture. Layer A contains tools and sensors that are deployed and interact with the low-level hardware and software components in an agency’s information system infrastructure. Layers C and D include the dashboards at the agency and federal enterprise level for reporting key information and agency summary material. Layer B serves as the important integration point specific to the agency-provided solution and supports the data integration and normalization function for the CDM Solution.

Figure 1: CDM Architecture

PURPOSE:

The Government currently maintains dozens of separate, tailored CDM solutions across the Federal Civilian Executive Branch (FCEB) agencies. Layers A and B (Figure 1 – CDM Architecture) are tailored to individual agency environments (or groupings of agencies), with both layers being serviced through the CDM Dynamic and Evolving Federal Enterprise Network Defense (DEFEND) Task Orders (TOs). The Government is interested in exploring the ability to standardize Layer B into a single integration layer solution for use in all CDM Solutions at FCEB agencies.

REQUIREMENT OBJECTIVES:

1. Common (Standardized) Integration Layer solution: The standardized integration layer solution will be required to integrate data that is in multiple localities, simultaneously, based upon unique characteristics of an agency’s environment and network (i.e., data that is stored in differing physical locations and across networks boundaries, including cloud). This solution should create a consolidated CDM data repository for an agency, such that it can transform, normalize, and feed the CDM Agency Dashboard and its common schema (see Figure 1) with high fidelity data.

• The purpose of the solution is to create the agency-consolidated data layer to support integration of information to the CDM Dashboard in an efficient and flexible fashion.

• The solution must be able to integrate data from a large environment with up to 1-3 million endpoints distributed across multiple physical locations and network boundaries.

• The solution must have the ability to integrate data from multiple sources (CDM tools) into the CDM Dashboard, accounting for multiple variations and deviations within a federated agency.

• The single integration layer solution must have a flexible integration architecture, as the CDM Agency Dashboard is updated every 3-6 months.

INDUSTRY MEETINGS:

Based on responses provided by industry, additional information may be requested. As a result, GSA with CISA, at the Government’s discretion, may schedule one-on-one meetings with industry to discuss responses to this RFI. If a follow-up meeting is required, the Government will reach out directly to the industry partner point of contact.

RFI RESPONSE:

Provide a narrative summary that addresses the objectives stated in this RFI and your capability to deliver the solution, including prior achievements. The Government welcomes feedback on the feasibility and utility of the stated objectives above.

Responses are required to include the following information:

CONTRACTOR INFORMATION:

□ Contractor Name and Address

□ DUNS Number and NAICS Code

□ Socio-economic status (HUBZone, Service-Disabled-Veteran-Owned, Woman- Owned, 8(a), Small Business, Large Business)

□ POC Phone and Email

□ Website URL

EXPERIENCE/CORPORATE CAPABILITIES:

1. Does your company have experience building and managing Layer B infrastructure and services that provide similar outcomes to those described in this RFI’s objectives?

a. Describe relevant implementations, including audience and scale, specifically your company’s understanding of how these tools scale to very large numbers of endpoints (1-3 million).

b. Describe your company’s understanding and relevant experiences in designing, building, architecture, operations, and maintenance in large environments, including challenges (e.g., if the tools operate as advertised) that you or your users encountered and how these were managed. Include any lessons learned that are applicable.

c. Describe your company’s support service capabilities (including dedicated help desk staff, capacity, limitations, etc.).

2. Identify any existing Government contract vehicle (GWAC, Federal Supply Schedules, BPA, etc.)

your company currently holds that could support the Layer B software.

INFORMATION REQUESTED:

1. What are the best practices on governance, security, and operational concerns or considerations that must be addressed in order to create and maintain a consolidated integration layer for potentially large datasets/agencies?

2. CISA requests best practices as well as “pros” and “cons” of cloud-based integration versus on premise integration, taking note of operations, security, and costs associated with the system architecture, operations, and maintenance. In listing pros and cons, CISA also requests information on factors where integration between the tool and Agency Dashboard level may not be the best option (e.g., with on premise integration, CISA will not always have direct access to components in an agency’s network boundary).

3. What are the best practices in documentation of interfaces between the tool and integration layers, and between the integration and agency dashboard layers (e.g., what information would be needed to achieve success in each level’s interface control documents)?

4. What is the technical feasibility and challenges associated with designing a common single integration layer solution based on the reality of the scale of the distributed nature of agency architectures, (i.e., needing to field the solution at over 100 agencies, up to 3 million endpoints, and multiple CDM DEFEND TO system integrators)?

a. Participating agencies will utilize different CDM tool solutions (i.e., significant variation in

Layer A in Figure 1). CISA requests best practices in ensuring the solution integrating between the tools and the Dashboards appropriately accounts for variations and deviations from standard architecture.

b. What is a reasonable Service Level Agreement (SLA) to go from a CDM tool “swap-out” (i.e., time to go from ripping out an existing CDM tool to receiving the new CDM tool’s data in the CDM Dashboard) normalized to the common schema?

c. CISA requests information on best approaches that can be taken to reduce the complexity of integration architectures.

5. What is the processing power required and time to process data for 1-3 million endpoints in order to get real time or near real time data?

a. CISA would also like to know how Layer A software may impact the transformation process (i.e., parsing, normalization) of the solution’s design; are processing times impacted on having specific software versions for Layer A tools?

6. What are the best practices surrounding maintaining a limited reliance on Government Off-The-Shelf

(GOTS) development or more effectively providing GOTS development to all agencies using the same tool or software to preserve that customized scripts or software code in order to limit federal level upgrades that could be a large undertaking?

a. What is the level of effort involved in requirements changing or updates related to operational or security issues and how do updates impact day to day functionality?

7. CISA requests recommendations to decrease the amount of duplicate endpoints information and allow integration of endpoint information from multiple scans and/or multiple tools at the integration layer.

a. CISA further requests information on tools or methods available at the integration layer to compare expected endpoint numbers and accuracy with actual information found.

8. Identify any recommended technical performance standards or best current practices that are relevant to a Layer B tool solution.

9. Provide any additional technical information your company believes relevant to this RFI. For example, describe other Layer B tool features and services you could offer.

10. How are Layer B integration tools priced and what is the lifecycle of Layer B integration tools? Are there any challenges to consider when modeling data volume and cost?

a. CISA is also interested in the scalability and elasticity in terms of tools being monitored, and how that would impact procurement costs, as CISA hopes to avoid an overhauling of the data in the case that agencies make changes or completely swap out their Layer A tools.

CONTRACTOR NOTIFICATION:

This RFI is for information and planning purposes only and does not constitute a Request for Quote (RFQ). This RFI is not to be construed as a commitment by the U.S. Government. No award will be made as a result of this RFI. All information is to be submitted at no cost or obligation to the Government. Any information that the Contractor considers proprietary should be clearly marked as such. All submissions become Government property and will not be returned, including any proprietary information. The Government may consider additional communications with submitting companies utilizing the contact information provided in the Corporate Overview to further the Government’s market research.

• All responses are to use Times New Roman font, with a 12-point font, and one-inch margins, single spaced in all sections in Microsoft Word.

• Contractor Information section shall be no longer than 1 page in length.

• Response to questions should be no longer than 10 pages.

• All information submitted shall be UNCLASSIFIED.

• Any information that the Contractor considers proprietary should be clearly marked as such.

• All submissions become Government property and will not be returned, including any proprietary information.

Questions pertaining to this RFI should be submitted no later than 2:00 PM EST on December 6th to Diana Zoppi at Diana.zoppi@gsa.gov and Kevin Criley kevin.criley@gsa.gov. All questions and answers will be added to this RFI announcement no later than COB December 13th.

RFI responses shall be submitted no later than 2:00 PM EST on January 19th via email to Diana Zoppi at Diana.zoppi@gsa.gov and Kevin Criley kevin.criley@gsa.gov.

Contractors who do not respond to this RFI are not excluded from any resulting solicitation(s).

mailto:Diana.zoppi@gsa.gov mailto:Diana.zoppi@gsa.gov