47QFRA26K0008 _ RFI ATTACHMENT 01 _ Requirements Document _ 10 Aug 2026.pdf

47QFRA26K0008

RFI ATTACHMENT 1

Requirements Document

CISA Strategic Cyber Tools Buying in support of:

Cybersecurity and Infrastructure Security Agency (CISA)

1.0 BACKGROUND

The United States Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA) leads the national effort to understand, manage, and reduce risk to the cyber and physical infrastructure that Americans rely on every hour of every day. In its role as the nation’s cyber defense Agency and the national coordinator for critical infrastructure security, CISA works with critical infrastructure partners every day to address the evolving threat landscape and provide tools and services to mitigate risks. The risks U.S. critical infrastructure face are complex and geographically dispersed and they affect a diverse array of stakeholders, including 1) Federal Civilian Executive Branch (FCEB) Agencies; 2) private sector companies;

3) State, local, tribal, and territorial (SLTT) Government Agencies; and 4) critical infrastructure (CI) sectors. CISA spearheads a national effort to ensure the defense and resilience of cyberspace. It is building the national capacity to defend against and recover from cyberattacks.

It works with Federal partners to bolster their cybersecurity and incident response postures and safeguard the FCEB networks that support the nation’s essential operations and secure and store information related to national security, the economy, and public health issues. CISA partners with these entities and the private sector and others daily to detect and mitigate cyber threats and vulnerabilities before they become incidents.

The Federal enterprise depends on information technology (IT) systems and computer networks for essential operations. CISA, through its Cybersecurity Division (CSD), works with each FCEB Agency to promote the adoption of common policies and best practices that are risk-based and can effectively respond to the pace of ever-changing threats.

1.1. ABOUT CAPACITY BUILDING

Within CSD, Capacity Building (CB) serves as CISA’s enterprise cybersecurity services management arm for national stakeholders and the lead for Federal enterprise cybersecurity governance. CB enables its customers to manage cybersecurity risk by building their capacity to implement effective cybersecurity policies, tools, and procedures. CB helps stakeholders better manage cybersecurity risk by 1) Defining expectations for stakeholder cybersecurity; 2) Leading implementation and enforcement of cybersecurity requirements; 3) Managing CISA’s cybersecurity services portfolio; 4) Building capacity; and 5) Enhancing collective defense and readiness.

1.1.1. CB CYBER PROGRAMS

The below sections provide background for some of the cyber programs and initiatives managed by CB. This is not an exhaustive list. This contract intends to leverage the full buying power of the Federal Government for all cyber product needs.

1.1.1.1. CONTINUOUS DIAGNOSTICS AND MITIGATION PROGRAM

Established in 2012, CB’s Continuous Diagnostics and Mitigation (CDM) Program is a dynamic approach to fortifying the cybersecurity of Government networks and systems. The CDM Program provides cybersecurity tools, integration services, and dashboards to participating Agencies (Chief Financial Officers [CFO] Act Agencies and non-CFO Act Agencies) to help them improve their respective security postures by delivering better visibility and awareness of their networks and supporting decision-making in defending against cyber adversaries. In supporting CISA’s mission, the CDM Program works closely with Agencies to deploy capabilities that help protect their hardware (HW) and software (SW) assets, networks, and the data they contain. This near-real time enterprise-wide view of “what” and “who” is on Federal networks (mapping) has grown increasingly more important as America’s cyber adversaries have become more sophisticated. With advanced AI-enabled offensive cyber capabilities available to both nation-states and run-of-the-mill cyber criminals, there is an increase in threats requiring a unified U.S. Government response to exponentially shortened incident response time periods in the AI-age.

Currently, the Government maintains dozens of separate, tailored CDM solutions across the FCEB Agencies. The CDM solution architecture, shown below in Figure 1: CDM Logical Architecture and Figure 2: Logical Data Architecture, illustrates the solution implementation supported at CDM-participating Agencies:

1. Layer A is composed of tools and sensors that, together, provide the coverage of the CDM capabilities. The current Layer A tools vary by Agency. Layer A tools and technologies align with the aggregated capability areas of the TCC

2. Layer B is the integration layer, which aggregates data from Agency Layer A tools, performs data normalization, and then transforms and conforms records. Layer B is often tailored to individual Agency environments and is an Agency and CDM shared responsibility. A standardization data integration solution is in the process of being implemented via the CDM Data Services contract awarded to ECS in FY24.

3. Layer C is the Agency Dashboard, which ingests data from Layer B and presents it to Agency users in operationally relevant ways to promote the reduction of cybersecurity risk. The Agency Dashboard is standardized for participating Agencies.

4. Layer D, also known as the Federal Dashboard, presents a unified view of the cybersecurity posture of the entire FCEB enterprise. The Federal Dashboard is standardized for use by CISA analysts.

Figure 1: CDM Logical Architecture

This above model (Figure 1) is being transitioned throughout 2026 into a new architectural stack to support the Data Services technical approach (see below, Figure 2).

Figure 2: Logical Data Architecture

1.1.1.1.1. CDM DEFEND TASK ORDERS

CISA and GSA leveraged the Dynamic and Evolving Federal Enterprise Network Defense (DEFEND) task orders (TO), which offered an all-encompassing approach for addressing CDM Program requirements, to achieve CDM goals. CISA partnered with GSA Assisted Acquisition Services to manage and administer the TOs. GSA is the contractual authority and executes all contract actions, while CISA manages day-to-day contract actions, provides the TO Contracting Officer Representatives (COR), monitors Contractor performance, and works with system integrator industry partners to ensure overall execution of the TOs’ scope.

Each DEFEND TO is executed by an industry partner responsible for procuring and customizing the Layer A tools, deploying these technologies at FCEB Agencies, and maintaining integrations with the Dashboard. Figure 3 below details the distinct FCEB Agencies supported by each

DEFEND TO.

Task Order Participating Agencies

DEFEND A DHS

DEFEND B DOE, DOI, DOT, MAX.gov, OPM, USDA, VA

DEFEND C DOC, DOJ, DOI, DOS, FCC, TVA, USAID

DEFEND D GSA, HHS, NASA, SSA, Treasury

DEFEND E ED, EPA, FDIC, HUD, HUDOIG, NRC, NSF, SBA, SEC

DEFEND F Non-CFO Act Agencies Figure 3: DEFEND TOs Aligned to FCEB Agencies Supported

1.1.1.2. PROTECTIVE DOMAIN NAME SYSTEM (PDNS) SERVICE

CISA launched the Protective Domain Name System (pDNS) Resolver service in 2022 as a successor to E3A, which helped to address a Congressional mandate that all Federal civilian executive branch (FCEB) Agencies utilize a CISA-managed intrusion detection and prevention system. Protective DNS is part of CISA’s mission — and the national effort — to manage and reduce risk to cybersecurity and to provide greater awareness of the threat landscape.

To minimize the effects of malicious activities such as ransomware, phishing, botnets, and malware campaigns while enhancing insight into these threats, CISA offers FCEB and Critical Infrastructure partners with a policy-implementing DNS recursive resolver service. The service safeguards Federal Agencies by preventing network traffic from reaching destinations that could be malicious, assisting to build resilience against intrusions and compromises. CISA's pDNS service is implemented upstream from Agency networks and does not interfere with internal DNS architecture (for example, internal caching resolvers). The traffic from mobile, roaming and cloud assets flows into the Protective DNS directly. DNS queries pass through pDNS Resolvers for active traffic filtering. If pDNS finds a match between the DNS request and a threat intelligence indicator, the service blocks, redirects, or sinkholes the query response and sends an alert to the origin Agency and to CISA.

The service comprises three (3) components:

Policy-Implementing DNS Resolver: A policy-implementing DNS resolver will take action (e.g., block, redirect, sinkhole) on attempts to access resources on the internet (e.g., domains, IP addresses) deemed malicious by commercial and Government furnished threat intelligence feeds, and log DNS data for analysis. The DNS resolver will also apply filtering decisions submitted by and applicable solely to individual end-user organizations. The DNS resolver service shall be geographically dispersed, be highly available, and operate using modern DNS security protocols. It must be usable by mobile, nomadic, or cloud devices without a technical requirement for those devices to rely on a VPN back to an enterprise network to benefit from the resolver.

Web Application: A web application will provide CISA and its stakeholders with the ability to receive and configure alerts (e.g., from blocking events), generate basic queries to glean insights from the logs, download reports, and view dashboards. The web application will allow CISA to manage the threat intelligence feeds and domains that are used for global filtering decisions and permit individual end-user organizations to add filtering specific to their needs.

Data Lake: A data lake will store DNS events/logs from the resolver and accept direct queries to provide CISA with enhanced insight into how cyber threats utilize DNS to cause harm. To facilitate automated downstream defensive actions and correlation, an event stream shall be delivered to CISA.

1.1.1.3. VDP PLATFORM SERVICE

CISA launched the Vulnerability Disclosure Policy (VDP) Platform in July 2021 to ensure FCEB Agencies benefit from the expertise of the research community. CISA identified that many FCEB Agencies lacked a formal mechanism to receive information from third parties about potential security vulnerabilities on IT systems and had no defined strategy for handling such reports about issues shared by outside parties.

In support of FCEB Agencies, CISA configured and implemented a commercially available Software as a Service (SaaS) platform that offers a centralized, streamlined, and standard approach for accepting vulnerability submissions from a network of security researchers, validating submitted reports, and providing validated reports to FCEB Agency stakeholders for resolution on-Platform. The platform enables participating Agencies to effectively implement Binding Operational Directive 20-01: Develop and Publish a Vulnerability Disclosure Policy. The VDP Platform promotes good-faith security research for improved security and coordinated vulnerability disclosure across the FCEB. Figure 4 provides an overview of the VDP Platform.

Figure 4: VDP Platform Overview https://www.cisa.gov/news-events/directives/binding-operational-directive-20-01 https://www.cisa.gov/news-events/directives/binding-operational-directive-20-01

1.1.1.4. .GOV REGISTRAR AND REGISTRY

CISA offers a user-centered platform for DNS management so that the online services of bona fide U.S.-based Government organizations are easy to identify on the internet. CISA manages the authoritative record of all .gov domain names and their registrants. We ensure that .gov domain names resolve in the global domain name system (DNS). DNS maps easy-to-remember names to hard-to-recall numbers. For example, this allows us to use “cisa.gov” instead of something like “104.106.178.124.”. Increasing and normalizing its use helps the public know where to find official Government information – and where not to. This helps Government organizations maintain better awareness of the security threats to which their .gov systems are exposed and offer additional services to support the privacy, reliability, accessibility, and speed of domains.

CISA is the policy and management authority for the .gov top level domain (TLD). Individuals and enterprises use a TLD to register a domain name (often simply called a domain) for use in their online services, like a website or email. CISA administers the .gov TLD and makes it available solely to U.S.-based Government organizations and publicly controlled entities. For all qualifying entities, it’s available at no cost.

To execute this program, CISA manages: 1) A .gov registry that contains domain names and registrant information for a top-level domain (like .gov, .com, or .us); and 2) a registrar that manages domain name registration.

1.1.1.5. SHARED CYBER THREAT INTELLIGENCE (CTI)

Over the past few years, CISA has offered FCEB Agencies, select Information Sharing and Analysis Centers (ISACS), and state fusion centers (SFCs) Cyber Threat Intelligence (CTI) services through the Shared Cybersecurity Services (SCS) model. SCS provided covered entities with access to commercial cybersecurity threat intelligence and data feeds, free of charge. While this service has been instrumental in offering actionable intelligence, SCS have given CISA unique insight into the barriers that members of the Federal cyber ecosystem face through all stages of the CTI lifecycle. Fragmented information about critical cyber threats reduces analysts’ abilities to effectively generate, use, and share CTI that helps make timely and informed decisions to support their missions. Critical CTI is spread across disparate feeds and exists in inconsistent data formats; this inhibits the collaboration needed to develop an accurate, shared threat picture. Further, the cyber maturity levels of participants in the CTI ecosystem varies widely. Specifically, the Federal cyber ecosystem lacks:

Efficient procurement of CTI and CTI tools and services;

Effective tools, services, and capabilities for CTI collaboration and processing;

Assessments to evaluate maturity or create a roadmap to build and grow

CTI capabilities;

Guidance to effectively use existing CTI services and tools for network defense; and Awareness and centralization of CTI requirements.

1.1.1.6. CYBER TRAINING TOOLS AND INFRASTRUCTURE

CISA is charged with developing the cyber-ready workforce of tomorrow. To do so, CISA leads cybersecurity workforce training and education, providing training for Federal employees, private-sector cybersecurity professionals, critical infrastructure operators, educational partners, and the general public. CISA is committed to supporting the national cyber workforce and protecting the nation's cyber infrastructure.

As such, CISA provides a variety of no-cost training offerings to Federal, state, and local employees. These programs are delivered using classroom-based courses, virtual instructor-led training, self-paced modules, and various cloud training environments.

1.2. CAPACITY BUILDING ACQUISITION AND BUDGET

Within CB, the Acquisition and Budget (AB) team acts as trusted strategic partner for transforming mission needs into executable, efficient, and fully aligned acquisition and budget outcomes. AB’s mission is to enable smarter, scalable, and more coordinated buying across the Federal enterprise, eliminating redundancy, streamlining procurements, and ensuring each dollar spent advances CISA’s priorities.

AB functions as CB’s buying arm, which includes all of CB’s tool procurement and product management related activities, serving an integral role in executing CB’s mission. In this role, AB ensures CISA gets the right cyber tools at the right price by centralizing procurement, eliminating duplicative buys, and leveraging Governmentwide buying power. AB streamlines sourcing, accelerate renewals, and secures best in class pricing and terms—to promote a unified, efficient, and resilient tool stack that strengthens mission critical cyber defense.

Specific to the CDM and other applicable CISA programs, AB’s primary objectives are to achieve optimal tool pricing, offer maximum flexibility, increase scalability, and enhance cyber capabilities for CB stakeholders and FCEB Agency partners. Key related responsibilities include, but are not limited to:

Developing and Implementing a Tool Procurement Strategy that integrates an understanding of customer needs with industry knowledge and access to historical product use/pricing to develop the most advantageous procurement approaches.

License Procurement Oversight, Tracking, and Negotiation for consolidated CB buys/enterprise license agreements (ELA).

Centralized Cyber License Management and Enterprise Tracking to provide enterprise procurement visibility and historical pricing data to inform future purchases.

Office of Management and Budget (OMB) Reporting and Coordination in accordance with (IAW) guidance/directives to ensure compliance with Federal laws and regulations.

Over its history, CDM has procured and deployed automated sensors that breakdown operational silos with machine data to provide consistent situational awareness of Federal Government risk in cyberspace. Given its ability to buy on behalf of Agencies, CDM, via AB, has orchestrated bulk purchasing opportunities with vendors on major initiatives with desirable terms and pricing that facilitates more affordable cyber security.

2.0 PURPOSE AND OBJECTIVE

The purpose of this contract is to directly support the Government to enhance procurement processes, achieve cost savings, and develop tracking tools for better management and analysis of procurements. To support this goal, the contract shall focus on establishing mechanisms and providing support that meets the following objectives:

1. Is Simple and Easy to Use: End users (e.g., CDM and Agency customers) must be able to procure and receive tools quickly (in a matter of days or weeks).

2. Establishes Optimal Product Pricing with Flexible Licensing Terms: Through their unique relationships and expertise, the contractor shall maintain a menu of products, tools and software (SW) that has to establish optimal pricing and flexible terms and conditions (T&Cs). Flexible T&Cs includes, but is not limited to mechanisms to eliminate shelfware, ability to pool licensing on behalf of CISA’s customers, transferability, co-terming of licenses, etc. Optimal pricing is defined as the most advantageous pricing being offered for a particular tool across the FCEB year to year.

3. Leverages Experienced Highly Skilled Cyber and IT Procurement Industry Partners:

Use best in class, industry-leading SW buying expertise to advise CISA, keep pace with the dynamic specialized cybersecurity SW marketplace, and drive cost and procurement efficiencies through strategic and tactical acquisition.

The intent is to expand CISA’s buying power for the CDM Program (including FCEB partners), as well as larger CB Programs, by centralizing cyber tool purchasing. This should lead to efficient buying at both the enterprise and individual transactional level, resolving numerous challenges associated with IT/Cyber procurements at scale. Today, the CDM Program and CB conduct over 500 procurements, with a dollar value of $600M+, annually across all the DEFEND buying groups (see Section 1.1.1.1.1). To manage procurement actions of this scale requires both strategic and tactical procurement approaches that can support a dynamic cyber capability and requirement set for CISA’s large customer base (i.e., the FCEB). CISA requires specialized strategic cybersecurity product procurement support to enable the capability deployment and implementation activity for CDM and the broader set of projects across the enterprise.

3.0 SCOPE

The scope of this contract is to procure cybersecurity tools and provide advisory services supporting large scale procurements and license tracking of cyber-SW, products and tools. The Contractor shall support CISA with strategic and transactional procurement support, enterprise license management and direct materials purchasing on behalf of the FCEB (including CFO Act and non-CFO Act Agencies). Herein and after FCEB refers to both CFO Act and non-CFO Act Agencies. The Contractor shall directly support AB to implement an efficient SW buying management process and associated procurement support platforms with the capability to cover, at minimum, a $600M cyber-SW procurement footprint per year.

This contractor shall assist the Government, specifically AB, in supporting CDM procurements, Agency cyber buys, and buys for tools associated with larger CB programs directly supporting the FCEB. As such, this Contractor shall be expected to coordinate and conduct technical planning with Federally Funded Research and Development Centers (FFRDC), support Contractors and more importantly future Contractors associated with the follow-on to DEFEND who will be executing deployment and integration of tools.

3.1. CAPACITY BUILDING (CB) PRODUCT LIST

The CDM Approved Product List (APL) (Attachment 01) served as the CDM program’s catalog of relevant tools and services since its inception (2013). The CDM APL represented a catalog of products, SW, and technologies that met both CDM requirements and other cybersecurity capability areas. This legacy APL aligned directly to a technical requirements document known as the “Technical Capabilities Volume Two: Requirements Catalog”.

https://www.cisa.gov/resources-tools/programs/continuous-diagnostics-and-mitigation-cdm-program/program-approved-products-list-apl

The current Administration aims to strengthen the unified cyber defense of the Federal Government. Future initiatives seek to eliminate duplicative tools from the cyber tool stack, leveraging the collective buying power of the Federal enterprise to reduce fragmentation and standardize tool offerings across all Departments and Agency components. CISA is the lead for identifying products and technologies that fulfill core cybersecurity capabilities. These selected products and tools will be organized and managed in a catalog, offering a consolidated enterprise view of all CORE cyber tools.

To achieve this Administration’s strategic vision, CB enhanced the legacy APL technology and product validation framework, ensuring alignment with all cybersecurity core capability areas.

As part of this updated approach, CB created the Technical Capability Catalog (TCC) to replace the former Volume 2 requirements catalog. Today, the TCC serves as the foundation for the new Cyber Product List (CPL), which supersedes the legacy CDM APL.

Together, the CPL and TCC provide the baseline for this contract, offering essential context for future next-generation contracts following the DEFEND TOs.

The Government has provided the TCC as a non-exhaustive representation of functional requirements and technologies aggregated by cybersecurity capability area (Attachment 02).

CPL technologies are directly mapped to the TCC and, in many cases, have already been deployed throughout the FCEB. A representative example of the deployed SW footprint can be found in Attachment 03.

The CPL, TCC, and the associated framework are considered dynamic and living artifacts. While the process to validate and test technologies may change over time, the Government will continue curating and maintaining a list of vetted technologies for the foreseeable future. At a minimum, and at time of award (TOA), the Contractor shall source and procure these CPL technologies.

CISA’s largest program, the CDM Program, is expected to initially account for most recurring and new tool procurements. However, throughout the period of performance (PoP), this contract is intended to serve as a strategic enterprise-wide vehicle for cyber commercial SW products and tools for ALL of the FCEB across a variety of capability areas.

4.0 FUNCTIONS

The task descriptions below cover broad functional areas. Future support may cross multiple functional areas within these tasks/subtasks. The Contractor is expected to be agile and flexible when providing support. The Contractor shall perform the following functions:

1. Function 1: Provide Project Management Support.

2. Function 2: Perform Strategic Buying Advisory Support.

3. Function 3: Provide Acquisition and Procurement Support.

4. Function 4: Provide Enterprise License Procurement Management.

4.1. FUNCTION 1: PROVIDE PROJECT MANAGEMENT SUPPORT

The Contractor shall provide project management support under this contract. This includes the management and oversight of all activities performed by Contractor personnel, including subcontractors, to satisfy the requirements identified in this Statement of Work (SOW). The Contractor shall identify a Project Manager (PM) by name who shall provide management, direction, administration, quality assurance, and leadership of the execution of this TO. The

Contractor shall use industry-best standards and proven methodologies that ensure all TO activities are identified, documented, and tracked so that the TO can continuously be evaluated and monitored for timely and quality service. The Contractor shall notify the Contracting Officer (CO) and COR of any technical, financial, personnel, Organizational Conflict of Interest (OCI), or general managerial problems encountered throughout the life of the TO.

The Contractor shall facilitate Government and Contractor communications and all activities necessary to ensure the accomplishment of timely and effective support, performed IAW the requirements contained in this TO.

4.1.1. FUNCTION 1.1: COORDINATE A PROJECT KICKOFF MEETING

The Contractor shall schedule and coordinate a Project Kick-off Meeting within five business days after contract award. The meeting will provide an introduction between the Contractor personnel and Government personnel who will be involved with the TO. The meeting will provide the opportunity to discuss technical, management, and logistic issues; travel authorization; and reporting procedures. At a minimum, the attendees shall include key Contractor personnel, Functional Leads, key Government representatives, the CO, and the COR.

The Contractor shall provide a Kick-Off Meeting Agenda (Deliverable 01) that will include, but not limited to, the following:

The agenda shall include, at a minimum, the following topics/deliverables:

1. Overview

a. Introduction of personnel to include roles and responsibilities, including staffing plan and project organization.

b. Brief overview of technical approach.

2. Management

a. Overview of project tasks and organization (complexity).

b. Overview of tools and platforms to be utilized.

c. Schedule (shows major tasks, milestones, and deliverables; planned and actual start and completion dates for each).

d. Communication plan/lines of communication overview (between both the

Contractor and Government).

i. Draft proposal of meeting cadence/ops tempo to include routine syncs with Government personnel on Tasks 2, 3 and 4, separately.

ii. Meeting cadence to discuss Procurement Report.

iii. Coordination with Agency customers and review of portfolio status.

e. Identified risks and issues and applicable mitigation plans, as well as overview of risk management process.

f. Discussion of draft Program Management Plan (PMP) and Integrated Master

Schedule (IMS) as applicable.

3. Administration

a. Review of Government-Furnished Information (GFI) and Government-Furnished Property (GFP).

b. Deliverable process and procedures.

c. Review of Financial Status Reporting format: including CISA reporting, Agency reporting, invoice review and submission procedures, and tracking of funds by Client Tracking Number (CTN) and cost savings.

d. Invoice requirements.

e. Travel notification, process, and reporting.

f. Request to Initiate Purchase (RIP) submission review and approval process

g. Security requirements/issues/facility/network access procedures.

h. Sensitivity and protection of information.

i. Reporting requirements, (e.g., Monthly Status Report (MSR)/MCAS Briefing)

j. Additional administrative items including press releases.

4. Next Steps

a. Prioritization of Contractor activities.

b. Initial deliverables and procurements.

c. Additional issues of concern.

The Contractor shall provide a draft copy of the agenda for review and approval by the COR prior to finalizing. The Government will provide the Contractor with the number of participants for the Kick-Off Meeting and the Contractor shall provide sufficient copies of the presentation for all present.

4.1.2. FUNCTION 1.2: PREPARE A MONTHLY STATUS REPORT AND CONVENE

MONTHLY STATUS BRIEFING

The Contractor shall conduct a Monthly Status Briefing (Deliverable 02) and develop and provide a MSR Report (Deliverable 03), via email to the CO and COR. The briefing is intended to brief the CO, COR, Agency Representative(s) and/or other Government stakeholders on the status of the TO and activities. The MSR Briefing shall briefly summarize, by task area, the TO management and technical progress to date, as well as provide the current information indicated below. The Government reserves the right to change this requirement to in-person monthly status meetings as required. The purpose of this meeting is to ensure all stakeholders are informed of the monthly activities and the MSR, provide opportunities to identify other activities and establish priorities, and coordinate resolution of identified problems or opportunities. The Contractor PM shall provide meeting minutes in a MSR Report, including attendance, issues discussed, decisions made, and action items assigned.

Within the MSR Report, the Contractor shall provide at a minimum the following information.

This report and required information may change throughout the PoP of this order.

Activities during reporting period, by task and subtask, to include:

o A brief description of the task;

o Ongoing activities;

o New activities;

o Activities completed;

o Deliverables submitted for that period; and o Progress to date on all above-mentioned activities.

Problems and corrective actions taken. The Contractor shall also include issues or concerns that may affect project milestones, personnel, and cost resources and proposed resolutions to address them to include risk mitigation plans;

Government actions required (deliverables awaiting Government approval, etc.).

Schedule (from the PMP; shows major tasks, milestones, and deliverables, as well as planned and actual start and completion dates for each);

Summary of trips taken, conferences attended, etc.;

Procurement status, to include 30, 60, 90-day outlooks for upcoming procurements and high visibility procurements in the queue;

Projected cost of each Contract Line-Item Number (CLIN), broken-down by task and subtask, for the current month for tracking purposes;

Financial status, including:

o Chart reflecting funding and burn rate for the month and cumulative;

o Cumulative invoiced costs for each CLIN and Labor Tasks totals to-date; and o Specific tracking and reporting of various funding types.

A list of current deliverables and milestones generated from the PMP that identifies deliverable due dates. The list shall identify deliverables and milestones submitted for the period by task, as well as provide a projection for the following three (3) months;

Suitability/EOD updates as well as staffing plan updates; and Recommendations for change, modifications, or improvements in task or process.

The Contractor shall reconcile the MSR with each monthly invoice.

4.1.3. FUNCTION 1.3: PROCUREMENT REPORT

The Contractor shall develop a Procurement Report (Deliverable 04) IAW the Procurement Report template that will be agreed to upon post award. The Procurement Report shall initially capture planned procurements and later be updated to capture the lifecycle of Delivery and Acceptance. The Contractor shall keep a historical summary of all tools procured by PoP, to include, at a minimum: 1) The name of item procured; 2) Stock Keeping Unit (SKU); 3) Date of purchase; 4) Total cost; and 5) Purpose. The Contractor shall utilize reporting that can be customized as an output of any platform identified as part of meeting other task requirements of this SOW. The Contractor shall establish a routine meeting to discuss the procurement report with Government stakeholders.

The Procurement Report shall be a living document and is anticipated to be updated periodically throughout the TO and, at a minimum, for the following instances:

a. RIP Reference Number, as applicable;

b. Funding Agency identifier;

c. Customer Agency identifier;

d. Proposed cost from RIP, actual cost of products purchased; CDM tools Special Item

Number (SIN) price comparison, and OneGov price if available;

e. Cost savings to the Government (i.e., discounts);

f. Product dates of order, delivery, receipt of goods by Agency customer, and implementation;

g. For products that require renewal, the date of expiration and previous associated RIP; and

h. Identify changes in a planned procurement of CDM tools or Other Direct Costs (ODC).

The Contractor shall work collaboratively with the CISA CDM Program Management Office (PMO) and Agencies to manage property accountability, to include the transfer of licenses.

4.1.4. FUNCTION 1.4: DEVELOP MEETING REPORTS

The Government will identify the need for a Meeting Report (Deliverable 05) (if required) when a meeting is scheduled. The Contractor shall submit Meeting Reports to document results of meetings one (1) working day following the completion of each meeting. The Meeting Report shall include the following information:

Meeting attendees and their contact information – at minimum identify organizations represented;

Meeting dates;

Meeting location;

Purpose of meeting; and Summary of events, action items and deliverables.

The Contractor shall reconcile their Meeting Report with official meeting minutes if published and advise the COR accordingly.

4.1.5. FUNCTION 1.5: DEVELOP PROBLEM NOTIFICATION REPORTS

The Contractor shall file a Problem Notification Report (PNR) (Deliverable 06) one day after a problem is identified to notify the COR of TO issues (e.g., potential cost/schedule overruns/impacts, assumptions upon which tasks were based that have changed or were incorrect). The PNR shall be prepared IAW the sample provided and include a plan that details the proposed resolution.

4.1.6. FUNCTION 1.6: PREPARE PROGRAM MANAGEMENT PLANS

The Contractor shall develop and deliver a Draft and a Final PMP (Deliverables 07 and 08) based on the Contractor’s proposed solution. The Contractor shall document all support requirements in the PMP. The PMP shall be automated utilizing SW such as MS Project and describe the proposed management approach. The PMP shall cover the entire project and outline the tasks and deliverables necessary to meet the PWS objectives. The PMP shall include milestones, tasks, and subtasks required in this TO. The Contractor shall present and brief the draft PMP at the Kick-Off Meeting. Following the Kick-Off Meeting, the Contractor shall revise the PMP to incorporate Government comments. The PMP shall contain, at a minimum, the following for each task:

A matrix of all deliverables and planned delivery dates;

Applicable Standard Operating Procedures (SOP);

A matrix of all personnel (subcontractors and/or consultants) assigned to the program and the total aggregate level of effort (LOE) for all tasks, including position, office location, building access status, and DHS computer equipment (if any);

Task dependencies and interrelationships;

Contractor organizational structure;

Process management and controls;

Quality control and processes to ensure quality (aligned to the Quality Assurance

Surveillance Plan [QASP]);

Any unique hardware and SW utilized by the Contractor;

Subcontracting plan, including scope and terms of all active subcontracts (if any).

Points of Contact (POC); and General operating procedures for:

o Travel;

o Work hours;

o Leave;

o Deliverables;

o Staff training policies; and o Problem/issue resolution procedures.

The PMP shall contain a separate schedule for each organization area that contains deliverable milestones and deadlines.

The Contractor shall incorporate the Government comments into a final PMP no later than (NLT) 30 days after the Kick-Off Meeting. Changes to the final program plan may be made with mutual consent of the Contractor and the Government.

4.1.7. FUNCTION 1.7: PROVIDE FINANCIAL REPORTING

The Contractor shall provide financial tracking and reporting, via a Contractor Financial Data Collection Template (CFDC) (Deliverable 09), for all aspects of the project, including:

Funds expended, anticipated, incurred, and remaining;

Planned versus expended actuals by month and cumulative;

Monthly and cumulative invoiced amounts;

Financial report of cumulative expenditures monthly;

Funded levels by CLIN;

Labor hours incurred to date by CLIN;

Identification of funding by RIPs and Technical Direction Letters (TDL);

A Diagram reflecting funding and burn rate by month; and Invoice back-up and supporting documentation.

The Contractor shall present a financial report format at the Kick-Off Meeting for Government review. The Collection Template and instructions are provided as Attachment 04. The Government will provide written approval of the proposed format via the COR. This approved format shall be utilized for the monthly financial reporting requirement. The Government may request updates to the format based on Government guidance.

4.1.8. FUNCTION 1.8: PROVIDE ACCOUNTING FOR STAFFING AND MANPOWER

The Contractor shall support CISA’s Contractor Workforce Management System (CWMS) initiatives. CB operates and maintains a secure data collection system in which the contactor shall report ALL contract manpower (including any subcontractor or teaming partners) required for performance of this TO.

In support of streamlined onboarding and personnel accountability, Contractors shall completely and accurately populate all required information in the provided CWMS Contractor Staffing List Template (Attachment 05), ensuring accordance with the outlined instructions and formatting guidelines. Throughout the PoP, Contractors are required to provide staffing updates utilizing the provided CWMS New Contractor Staffing Form (Attachment 06), CWMS Contractor Exit Form (Attachment 07), and CWMS Contractor Update Form (Attachment 08).

All updated forms must be documented and submitted to the Contractor security mailbox (() within one week of the staffing action occurring. If errors are identified, the provided mailto:csd_cb.contractorsecurity@cisa.dhs.gov documentation will be returned for remediation by the Contractor. Baseline staffing plans are to be submitted in alignment with the prescribed deliverable timeline located in contract award documentation. Post baseline, all Contractor personnel supporting this effort shall be accounted for in the Manpower Database before beginning work on this TO.

4.1.9. FUNCTION 1.9: PERFORM TRANSITION IN/OUT

The Contractor shall propose and implement Transition-In and Transition-Out Plans (Deliverable 10) for the migration of current operations.

The Contractor shall execute their transition-in approach to ensure minimal disruption to vital Government business. The Contractor shall ensure there will be no service degradation during and after transition. The Contractor shall implement their transition-in approach to facilitate a seamless transition from the incumbent(s) to the incoming Contractor/Government personnel at the award of the [Contract/Task Order (TO)/Delivery Order]. Within their Transition-In Plan, the Contractor shall identify and discuss the existing roles and responsibilities of the incumbent Contractor(s) and information expected from the incumbent(s). The plan shall also identify the roles and responsibilities of the Contractor and how support will transition, including proposed schedule(s), milestones, and deliverables. The Contractor shall identify any actions the Government needs to take, as well as any assumptions. The Transition-In plan shall be provided at the Kick-Off Meeting.

The Contractor shall implement their Transition-Out Plan that has been provided NLT ninety

(90) days prior to expiration of the [Contract/Task Order (TO)/Delivery Order]. The Transition- Out Plan shall facilitate a seamless transition from the incumbent to an incoming Contractor/Government personnel at the expiration of the TO. The Contractor shall identify how it will coordinate with the incoming and or Government personnel to transfer knowledge regarding the following:

Project management processes;

POCs;

Location of technical and project management documentation; and Status of ongoing technical initiatives and training events.

4.2. FUNCTION 2: PROVIDE STRATEGIC BUYING ADVISORY SUPPORT

The fragmentation and duplication of IT and specialized cybersecurity SW procurements over the years has resulted in inconsistent capability implementations and a decentralized view of the FCEB cyber readiness. To remedy this, CISA has defined and maintains a list of core cyber capabilities (e.g., TCC) and a centralized catalog of products (e.g., CPL) that map to these core capability areas. In the near future, Agencies will be required to procure only the tools listed on this core capabilities catalog maintained by CISA. Additionally, CISA will be responsible for tracking and reporting on CORE tool procurements by and for the Agencies. This will foster a ‘single pane of glass’ centralized view for all cyber procurements across the enterprise.

CISA requires strategic buying expertise to assist the Government with providing enterprise procurement consultation and execution support. The Contractor shall directly support the Government in identifying optimal buying methodologies for CISA, including FCEB procurements. This support includes, but is not limited to, analyzing historical and recurring CISA centrally funded tool procurements, as well as analyzing the CPL catalog and aligning the various CISA Program cyber capability needs with better buying approaches. It is not expected for a one-size-fits-all methodology to meet the Government need, but the Contractor shall identify efficiencies and means to streamline procurements and reduce the LOE required to meet requirements of this effort.

The Contractor shall assist the Government in performing functions, including but not limited to the following:

Advise and Assist: Provide expert guidance to the Government in developing improved strategies for purchasing SW, hardware, and ancillary IT equipment. This involves evaluating current procurement methods, identifying areas for improvement, and suggesting best practices. This acquisition subject matter expertise must drive towards innovative solutions supporting both just-in-time transactions and strategic procurements of cybersecurity products within an environment that has rapidly evolving priorities and technologies. This support aims to help CB integrate agility and flexibility into cyber procurement approaches while keeping pace with threats and maintaining good stewardship of taxpayer dollars. The Contractor shall develop Market Strategy and Research Report(s) (Deliverable 11) by CORE tool on a routine basis to be established post award.

Cyber Product Subject Matter Expertise: The Contractor shall provide cyber product subject matter expertise to advise the Government in making sound cyber investments.

The Contractor shall provide expert advice and knowledge on all cyber products, technical aspects, buying structure, and pricing. The Contractor shall be knowledgeable of market trends, agency investments, and prices paid. This expertise shall help the Government be well-versed in, and keep pace with, the evolving cyber tool landscape.

Data Analysis: CISA is required to report on cyber transactions across the FCEB to OMB and to various internal and external partners. This requires extensive data collection, management, and analytic expertise at scale. As such, the Contractor shall support the collection, tracking, and analysis of cyber tool buying off the CPL, as well as through other means at their disposal. The Contractor shall also analyze historical procurement data, evaluating the current enterprise tool profile to assist in making informed investments and basis of comparisons. This involves understanding the current tools in use, ascertaining their effectiveness, and identifying gaps or inefficiencies.

Recommendation Development: The Contractor shall recommend effective approaches for license, subscription, and other transactional procurements. This includes suggesting the best buying methodology for maximizing efficiency and cost savings. The Contractor shall utilize various methods to support these better buying recommendations, such as:

o Cyber Software Category Management: Develop and maintain a comprehensive category strategy for cybersecurity SW, ensuring alignment with organizational goals and security requirements. The Contractor shall develop a SW and Product Category List (Deliverable 12) that traces to the CPL; this will facilitate easy access and selection by stakeholders.

o Market Analysis: Conduct routine market analysis to identify new cybersecurity tools and SW, assess vendor offerings, and provide recommendations for procurement. The Contractor may be directed to periodically synopsize the existing license agreements, deployed tools and SW, and the CPL to validate optimal pricing remains intact. This analysis will be included in developed Market Strategy and Research Report(s) (Deliverable 11). The periodicity will be recommended by the Contractor and agreed upon by the Government 30 days after award.

o Vendor Management: Establish and maintain relationships with key cybersecurity vendors, negotiate terms, and manage performance to ensure quality and compliance.

o Historical Spend: This includes reviewing, analyzing, and understanding historical cyber tool spend to date (CDM, CB Programs, Agency buys) to support pattern development and analysis that allows for the Government to leverage better buying strategies.

Metrics Creation: The Contractor shall create metrics to document and support cost savings across all procurements. This involves developing key performance indicators (KPIs) and other metrics to track and demonstrate cost savings and procurement efficiency. The Contractor shall ensure these metrics are readily available through their solution for license management platform tool, or process (Section 4.4, Function 4).

4.3. FUNCTION 3: PROVIDE ACQUISITION AND PROCUREMENT SUPPORT

The Contractor shall execute procurements for commercial cybersecurity and IT products and any associated cloud infrastructure or support SW. This includes the planning and acquisition of necessary cybersecurity SW, HW, and ancillary products required during execution of this contract. The Contractor’s processes and procedures shall ensure the selection of competent suppliers, recommend unbiased purchase decisions, establish compliant contracts, and negotiate competitive prices for goods and services as authorized by the Government in a cost-effective manner and IAW public law and applicable regulations. The Contractor may be required to coordinate with vendors on Government commercial terms and conditions. End User License Agreements (EULAs) will only be considered on a case-by-case basis when the Government’s commercial terms and conditions do not address a situation that has been documented and presented to the Government for review. The Contractor shall assist the Government in performing functions, including but not limited to the following:

Bill of Materials (BOM) Development: The Contractor shall assist the Government in developing comprehensive BOMs to support procurement activities. This includes identifying all necessary materials, components, and services required for procurement projects.

Quotation Analysis: The Contractor shall source and analyze quotations and indications of interest from potential suppliers. This involves comparing different quotations to identify the best value options and negotiating favorable terms.

Cost Savings Achievement: The Contractor shall achieve cost savings on both strategic and transactional procurements. This includes identifying opportunities for cost reduction, negotiating better prices, and implementing cost-saving measures throughout the procurement process.

Software Delivery Support: The Contractor shall provide support for the delivery of SW, including license and subscription keys. This involves ensuring timely and accurate delivery of SW products and managing any related issues that may arise.

Property Transfer Management: The Contractor shall manage the transfer of property as needed. This includes overseeing the transfer of ownership or custody of procured items, ensuring compliance with relevant policies and procedures.

In addition to the above support, the Contractor shall follow procurement procedures outlined in Section 5.0.

4.4. FUNCTION 4: PROVIDE ENTERPRISE LICENSE AND PROCUREMENT

MANAGEMENT SUPPORT

The Contractor shall assist the Government in managing the entire lifecycle of SW and tool procurements. For this requirement, the Contractor shall operate and maintain a procurement tracking application, process, or tool that will support managing and tracking all CISA cyber transactions. The Government prefers the solution to be a native platform, tool, or process that can be offered as SaaS. This solution should provide comprehensive tracking and reporting capabilities for all procurement activities. This tool can be out-of-the-box or customized to support administration, execution, forecasting, and metrics tracking activities associated with managing a program of this size. It should be noted that the Government currently utilizes the Microsoft Power suite and manual methodologies to track historical buys and agreements.