RFI_Acquisition ID 47QFRA24K0005 Strategic Cyber Acquisition and Buying Services (SCABS) RFI.pdf

Request for Information (RFI) – Strategic Cybersecurity Acquisition and Buying Services

(SCABS)

Agency: Cybersecurity and Infrastructure Security Agency (CISA)

Market Research Agency: General Services Administration (GSA), Federal Acquisition Service (FAS), APEX1 on behalf of Cybersecurity and Infrastructure Security Agency

(CISA)

Notice Type: Posted Date:

Request for Information February 21, 2024

NAICS: 541519 Other Computer Related Services; Please include any suggested NAICS and PSC codes in the response.

GSA Reference: Acquisition

I. GENERAL INFORMATION:

The General Services Administration (GSA), Federal Acquisition Service (FAS), APEX1 is issuing a Request for Information (RFI) on behalf of the Cybersecurity and Infrastructure Security Agency (CISA).

II. OBJECTIVE:

The purpose of this RFI is to assist the Government in conducting market research focused on identifying industry partners that can provide enterprise procurement support to the programs within the Capacity Building Subdivision of CISA as described in the objectives below. This information will be used for market research only. The Government is not obligated to release a future solicitation based on this market research. Interested respondents shall refer to the details of the response to this RFI under Section IV.

III. BACKGROUND:

The Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA) is the Nation’s risk advisor, working with partners to defend against today’s threats and collaborating to build more secure and resilient infrastructure for the future. In this role, CISA builds the Nation’s capacity to defend against cyber-attacks. Through a variety of large-scale programs, the Agency works to provide cybersecurity tools, incident response capabilities, and assessment services to safeguard the Federal civilian executive branch (FCEB) ‘.gov’ systems and systems that support national critical functions. One such program has historically provided a vehicle to deliver a significant number of cyber tools and services to the .gov enterprise.

Established in 2012, the Continuous Diagnostics and Mitigation (CDM) Program is a dynamic approach to fortifying the cybersecurity of Government networks and systems. The CDM program is managed by a program office (CDM PMO) within CISA’s Cybersecurity Division (CSD) subdivision Capacity Building (CB). The CDM Program provides cybersecurity tools, integration services, and dashboards to participating agencies (Chief Financial Officers [CFO] Act agencies and non-CFO Act agencies) to improve their respective security postures by delivering better visibility and awareness of their networks and defending against cyber adversaries. In supporting CISA’s mission, CDM works closely with agencies to deploy capabilities that help protect federal hardware and software assets, networks, and the data they contain.

The CDM solution architecture, shown below in Figure 1: CDM Logical Architecture, illustrates the solution implementation supported at CDM-participating agencies:

• Layer A is composed of tools and sensors that, together, provide the coverage of the CDM capabilities. Current Layer A tools vary by agency, and include Azure Update Manager, BigFix, Carbon Black, Cisco ISE, CrowdStrike, ForeScout, Intune, McAfee, Microsoft Active Directory, Microsoft SCCM, Pulse Secure, Qualys, Rapid7, SailPoint, ServiceNow, Splunk, Tanium, Tenable, Tripwire, ZingBox, and others.

• Layer B is the integration layer, which aggregates data from agency Layer A tools, performs data normalization, and then transforms and conforms records. Historically, Layer B is often tailored to individual agency environments and is an agency and CDM shared responsibility. The CDM PMO is pursuing a new approach for Data Services known as the Baseline Extraction and Transformation Security Information Environment (BETSIE), expected to be operational around the end of FY24, that will unify all agencies on one solution for data integration in Layer B.

• Layer C is the Agency Dashboard, which ingests data from Layer B and presents it to agency users in operationally relevant ways to promote the reduction of cybersecurity risk. The Agency Dashboard is standardized for participating agencies.

• Layer D, also known as the Federal Dashboard, presents a unified view of the cybersecurity posture of the entire FCEB enterprise. The Federal Dashboard is standardized for use by CISA analysts.

Figure 1: CDM Logical Architecture (Current State)

The CDM program implemented its mission through a combination of Task Orders (TOs) known as the DEFEND series (grouped by agencies to support Layers A and B) and CDM Dashboard Ecosystem (Layers C and D). The future state will consolidate responsibility for the functions of Layers B, C, and D in the CDM logical architecture via the CDM Data Services (also known as Baseline Extraction and Transformation Security Information Environment or BETSIE) effort. The Government is currently conducting market research on how to best implement capabilities (Layer A) via the recently released Deployment Services RFI.

Over its history, the CDM Program, through GSA, has executed thousands of transactions and license renewals procurements for cybersecurity tools deployed at Layer A within participating CDM Agencies. Today, CDM conducts over 500 procurements each year at a dollar value of over $300M across all the DEFEND buying groups (ie, CFO ACT Agencies and Small and micro Agencies participating in the Shared Service Program).

The intent of this requirement is to provide Capacity Building, CDM PMO and potentially other entities within the Cybersecurity Directorate (CSD) with specialized strategic cybersecurity product procurement support to enable the capability deployment and implementation at Layer A.

The Government believes that this requirement may introduce an Organizational Conflict of Interest (OCI) that restricts the awardee from participating in other CDM, and possibly other CISA Capacity Building, efforts.

IV. PURPOSE:

This purpose of this requirement is to expand CISA’s better buying power for the CDM Program and the larger CISA Cyber Security Division. This involves employing both strategic and tactical procurement approaches for a dynamic cyber capability and requirement set and large CDM customer base (ie, the FCEB). This support will serve as the CDM PMO’s enterprise procurement consulting and executing agent. This construct should lead to efficient buying at both the enterprise and individual transactional level, resolving a number of challenges associate with IT/Cyber procurements at this scale, such as:

- Shelfware – CDM structured enterprise agreements provide advantageous pricing, but often lack flexibility. This leads to “shelfware” as agencies continually to evolve and are not always ready to deploy the tools once available despite saying otherwise.

- Transferability – Agencies often require different product sets or a variety of SKUs even within a product family. When attempting to mitigate shelfware, CISA often looks to promote transferability among participating Agencies to maximize their investments.

This is routinely met with resistance from the Original Equipment Manufacturers (ie, OEMs or product manufacturer).

- Outyear Pricing – While OEMs and Value Add Resellers help Capacity Building achieve significant cost savings at the initial transaction, outyear price escalation and/or product and SKU re-packaging erodes (or even washes out) discount percentages.

- Disjointed buying approaches – At times, large, federated organizations are not aligned when executing SW and cyber tool transactions. Components within an Agency frequently make just in time procurements to meet a narrow need or to fill a license renewal gap. These are often not aligned to more strategic procurements made by large scale Agency programs which would benefit from sequencing and re-aligning these just in time buys.

V. REQUIREMENT OBJECTIVES:

The following provides initial requirement objectives for Strategic Cybersecurity Acquisition and Buying Services. Please note these are not final and not meant to be interpreted as comprehensive tasking areas:

1. Execute procurements for commercial cybersecurity and IT products and any associated cloud infrastructure or support software. Develop bill of materials in conjunction with the government/agency technical leads, OEMs and any system integrators supporting the end user. This is transactional support that will be required to cover the $300+ worth of procurements referenced above.

2. Strategic Procurement Consulting Support. Identify and execute efficient buying methodologies on procurement strategies for Capacity Building (CB) and its programs.

This support includes, but is not limited to, analyzing historical and recurring CISA/Agency funded tool procurements and aligning the various CB program (CDM, CSSO, etc.) cyber capability needs with better buying approaches. It is not expected that a one-size-fits-all methodology meets the government need but identify efficiencies and means to streamline and reduce level of effort (LOE). Approaches may include single or multiple ELAs, agreements or transactional approaches that efficiently align to CB’s cyber capability and service areas. This strategic support must ultimately enable the more tactical and transactional requirements listed in #1 above and resolve the challenges referenced above.

3. Create and/or manage a product licensing tracking and metrics platform. This can be out of the box or customized to support the administration, execution, forecasting, and metrics tracking activities associated with managing a program of this size.

4. Innovative acquisition subject matter expertise to think out of the box and strategically procure cybersecurity tools in an environment where priorities and tools evolve rapidly.

This support would help CB build in agility and flexibility into cyber procurement approaches while keeping pace with threats and being good stewards of taxpayer dollars.

VI. RFI RESPONSE:

The Federal Government will only consider responses from Industry Partners/Interested Parties which intend to perform the work as a Prime contractor. Responses should be tailored in the following format and include the following information: Note: The RFI response shall be split into three Sections.

Section 1 - CONTRACTOR INFORMATION: this information is for administrative.

Interested parties are requested to provide the following as a minimum:

• Contractor name and facility address (list all relevant or significant office locations)

• UEI number, CAGE code, and NAICS code

• Socio-economic status (i.e., HUBZone, Service-Disabled-Veteran-Owned, Woman-

Owned, 8(a), Small Business, Large Business, etc.)

• Facility clearance level

• POC name, phone, and email

• Website URL

• List of any GSA Vehicles, such as GWACs (i.e., Alliant 2, VETS 2, etc.) or GSA

Multiple Award Schedule that your company has access to, and that can support Strategic Cybersecurity Acquisition and Buying Services requirement.

Section 2- CORPORATE EXPERIENCE: this information shall address the questions below as they relate to interested parties corporate experience with the requirement. Please provide your response to the following:

1. Does your company have experience in providing strategic buying/procurement support for IT and/or Cybersecurity tools support consistent with the purpose and requirements objectives identified above? (Note commercial experience and Value Add Reseller experience is acceptable)

• Describe relevant efforts, similar in size, scope, and complexity.

2. Please identify any existing Government contract vehicle(s) (GWAC, Federal

Supply Schedules, BPA, etc.) that your company currently holds which could support the SCABS requirement. Please include a brief narrative why, in your determination, that vehicle would meet the needs of this potential requirement.

Section 3- QUESTIONS: this information asks questions as they relate to the requirement.

1. Given the scale of transactional support required to cover all of the FCEB and various Executive Orders and OMB guidance requiring a significant uplift in cyber posture (i.e., Zero Trust Architectures), what methodology should the Government consider as an approach towards better buying for products and tools?

a. Given the wide array of customer needs and challenges listed in Section IV, what should the government consider as part of this approach?

2. Does your company have an existing tool, product and/or license management platform that can be utilized or reconfigured to meet the government need?

3. What is a recommended acquisition approach the Government should consider addressing this requirement and which allows us to leverage existing buying power to obtain optimal pricing?

4. Is there any other information deemed relevant by the contractor for the Government’s consideration for this requirement?

V. CONTRACTOR NOTIFICATION AND SUBMITTAL INSTRUCTIONS:

This RFI is for information and planning purposes only and is not to be construed as a commitment by the U. S. Government. No award will be made as a result of this RFI. All information is to be submitted at no cost or obligation to the Government. Any information that the Contractor (Interested parties) considers proprietary should be clearly marked as such. All submissions become Government property and will not be returned, including any proprietary information. The Government may consider additional communications with submitting companies utilizing the contact information provided in the Corporate Overview to further the Government’s market research for the Strategic Cybersecurity Acquisition and Buying Services (SCABS)

Submission instructions and information retention:

• All responses are to use Times New Roman font, with a 12-point font, one-inch margins, and single spaced in all sections in Microsoft Word.

• Section1: Contractor Information section shall be no longer than 1 page in length.

• Section 2: Contractor Experience section shall be no longer than 2 pages in length.

• Section 3: Response to questions should be no longer than 5 pages in length.

• All information submitted shall be UNCLASSIFIED and marked as such, on each page.

• Any information that the Contractor considers “proprietary” should be clearly marked as such, on each page.

• All submissions become Federal Government property and will not be returned

(including any proprietary information).

• Submissions that exceed 10 pages may be dismissed (including Cover Page and Table of

Contents).

• The Government may consider additional communications with interested parties that respond to this request for information utilizing the contact information provided in the Corporate Overview to further the Government’s market research for the Strategic Cybersecurity Acquisition and Buying Services requirement.

RFI responses shall be submitted no later than 5:00pm ET on March 8, 2024, via email to Diana Zoppi at diana.zoppi@gsa.gov and Aaron Maddox at aaron.maddox@gsa.gov.

Contractors who do not respond to this RFI are not excluded from any resulting solicitation(s).

mailto:diana.zoppi@gsa.gov