70FA3122I00000006_Cybersecurity Compliance Services Support.pdf

Request for Information (RFI)

Cybersecurity Compliance Services Support

Office of the Chief Information Security Officer (OCISO)

70FA3122I00000006

Federal Emergency Management Agency

August 2022

Table of Contents

1 Synopsis

2 Program Background

3 Program Solution

3.1 Business Capabilities

3.2 Operational Requirements

3.3 Non-Functional Requirements

3.4 Constraints

4 Requested Information

4.1 Company Information

4.2 General Information

5 RFI Response Instructions

5.1 Response Format Requested

5.2 How to Deliver the Response

5.3 Information for the Response

Request for Information

VERSION 1.0 Page 3 of 9

1 Synopsis

The FEMA Office of the Chief Information Security Officer (OCISO), Compliance Division maintains FEMA’s compliance posture in accordance with Federal Information Security

Modernization Act (FISMA) and facilitates a continuous monitoring Authority to Operate (ATO) process that provides security authorization services support to all FEMA systems. The purpose of this effort to ensure the confidentiality, integrity, and availability systems, networks and data are at an acceptable level of risk throughout the system development life cycle by acquiring and providing Information System Security Officers (ISSOs), Security Analysts, Program Manager, and other cyber resources determined in the future to fulfill cyber security requirements for

FEMA’s Enterprise systems.

This is a market research tool being used to determine the availability of other existing vendors that can provide these capabilities and services.

This RFI is for research purposes only.

VERSION 1.0 Page 4 of 9

2 Background

FEMA’s mission is to reduce the loss of life and property and protect communities nationwide from all hazards, including natural disasters, acts of terrorism, and other manmade disasters. FEMA leads and supports the nation in a risk-based, comprehensive emergency management system of preparedness, response, recovery, assistance, and mitigation. In support of this mission, FEMA uses a wide variety of information systems and information technology (IT) solutions and services. These systems, solutions, and services must be operated and maintained at the highest level of confidentiality, availability, and integrity.

FEMA’s IT environment is an amalgam of new and legacy technologies, architectures, platforms, and tools that includes a variety of PC-based, client-server, web-based, cloud-based, mobile technology, and service-oriented components. The IT systems supporting

FEMA are implemented using a variety of service providers under both mature and evolving oversight and governance conditions. OCISO provides cyber support to FEMA’s emergency management and continuity mission by utilizing the Federal Cyber Security Framework.

OCISO plans, coordinates, integrates, synchronizes, and conducts activities that lead day-to-day safeguarding and protection of FEMA information systems (directly and indirectly connected to the FEMA infrastructure).

At a minimum, OCISO supports information within the continental United States (CONUS) and outside the continental United States (OCONUS). These information systems may reside at, but are not limited to, FEMA Headquarters (within the National Capital Region); the 10

Regional Offices (Boston, New York, Philadelphia, Atlanta, Chicago, Denton, Kansas City, Denver, Oakland, and Seattle); 8 Distribution Centers [Moffett, Guam, Hawaii, Fort Worth, Caribbean, Atlanta, Disaster Information System Clearinghouse (DISC), and Fredrick];

various Disaster Emergency Communications facilities; and Government Owned and

Contractor Operated (GOCO) facilities.

3 Program Solution

FEMA is looking for a contractor to provide project management and cyber security compliance support services to the agency’s IT system owners and key stakeholders throughout the systems development lifecycle (SDLC) to include classified and unclassified systems. The Contractor shall incorporate security engineering and business best security practices into its management of all services, releases, and projects. The

Contractor’s overall approach for integrating the two shall be described in the Service

Management Plan (SMP). The Contractor’s adherence to this SMP process shall be reviewed at Contract and Call Order Contractor Performance Reports (CPRs) and shall be incorporated into 90 Day Action Plans and Integrated Master Schedules (IMSs). The content of the SMP shall be in accordance with ISO/IEC 20000-2:2019, National Institute of Standards and Technology (NIST) Cybersecurity Framework, NIST Risk Management

Framework (RMF), and Department of Homeland Security (DHS) 4300 Series. An initial

VERSION 1.0 Page 5 of 9

SMP shall be submitted with the Contractor’s proposal, and an updated version 60 days after award of the first Call Order. The SMP shall be updated thereafter in accordance with

ISO/IEC 20000- 2:2012 and Contractor implementing procedures. The Contractor shall provide staff that consists of appropriately experienced personnel in support of all systems and applications through BPA call orders as the Government’s requirements evolve.

FEMA has approximately 110 IT systems of various sizes and complexity to include various system designations such as high value assets, financial, privacy, mission essential, and mission support. There are an additional 350 applications that support the approximate

110 systems that require security authorization support. All systems and applications are in various stages of the system lifecycle ranging from initiation and design to decommission.

Out of the approximate 110 systems, approximately 50 are enterprise systems; the remaining approximate 60 are program management office (PMO) area specific systems.

There are 3 systems that have been identified as classified. This SOW shall also support the numerous modernization efforts across the agency to transition systems off legacy technology, provide sound cybersecurity enterprise solutions and migrate systems to a cloud environment. The Contractor shall provide compliance support services in the following technical areas of scope:

• Task Area 1: Contract and Call Order Management

• Task Area 2: Security Design and Development

• Task Area 3: Supply Chain Risk Management

• Task Area 4: Security Authorization o Security Analyst o Information System Security Officer o Automation Support

• Task Area 5: Vulnerability Remediation Management

• Task Area 6: Change and Configuration Management

• Task Area 7: Training

• Task Area 8: Project Management o Project Manager o Technical Writer o Administrative Officer

3.1 RFI Questions

Vendors should address their business capabilities by answering the following questions:

ID RFI Questions

Please describe your company’s end-to-end process in successfully executing the

Security Authorization Process in alignment with the Systems Engineering Lifecycle

(SELC).

VERSION 1.0 Page 6 of 9

ID RFI Questions

How does your company plan to conduct comprehensive risk assessments and risk analysis to support timely and accurate risk-based decisions?

How will your company ensure quality authorization packages (work packages) are submitted on time to support well-informed risk-based decisions?

What experience does the your company have in assessing risk for FEDRAMP authorized cloud service offerings (IaaS, PaaS, SaaS)?

Does your company have knowledge and experience with the effective implementation of native cloud services offered by FedRAMP authorized systems? If so, what services have been successfully implemented for previous customers?

What experience does your company have with using automated tools and their corresponding output to support continuous monitoring and ongoing authorizations?

What are those tools?

How will your company ensure skilled resources are hired and strategically positioned in a manner that facilitates successful achievement of goals and objectives in a resource constrained environment?

How will your company ensure resources are properly trained in response to emerging technology, innovation, and an evolving threat landscape?

How does your company plan to effectively manage small- and large-scale projects with varying degrees of difficulty and levels of effort with minimal impact to the customer and expected delivery date?

4 Requested Information

Vendor response(s) should include the following:

VERSION 1.0 Page 7 of 9

4.1 Company Information

Please provide the following information:

a. A brief description of your company.

b. Unique Entity Identifier (UEI).

c. Contact information (address, telephone, e-mail, website address).

d. Commercial, U.S government, and international government insurance markets for which your company provides services similar to what OCISO is seeking.

e. If designated as a small business, please provide more information below:

To be considered for a Small Business set-aside, at least 50 % of the cost of contract performance incurred for personnel shall be expended for employees of the responder.

RESPONSE

Small Business? (FAR 19.102) □ YES □ NO

Small Disadvantaged small business? (FAR 19.304) □ YES □ NO

Service Disabled small business? (FAR 19.14) □ YES □ NO

8(a) small disadvantaged small business? (FAR 19.8) □ YES □ NO

HUBZone small business? (FAR 19.13) □ YES □ NO

Woman-Owned Small Business? (FAR 19.15) □ YES □ NO

Involved in a mentor and/or protégé program? (DFARS 219.71) □ YES □ NO

The anticipated North American Industry Classification System (NAICS) code for this requirement is 541512 – Computer Systems Design Services. However, the Government is open to other NAICS suggestions that might be more appropriate. A justification explaining why another NAICS would be more appropriate must be included in your statement. The

Government will make the final determination as to what NAICS is more appropriate.

http://www.acquisition.gov/far/current/html/Subpart%2019_1.html http://www.acquisition.gov/far/current/html/Subpart%2019_3.html http://www.acquisition.gov/far/current/html/Subpart%2019_14.html#wp1093836 http://www.acquisition.gov/far/current/html/Subpart%2019_8.html#wp1092796 http://www.acquisition.gov/far/current/html/Subpart%2019_13.html#wp1094801 http://www.acquisition.gov/far/current/html/Subpart%2019_15.html#wp1094868 http://www.acq.osd.mil/dpap/dars/dfars/html/current/219_71.htm

VERSION 1.0 Page 8 of 9

4.2 General Information

Interested parties are being asked to provide the following information:

a. Answers to questions set forth in Section 3 (no more than 20 pages).

b. Company information (Section 4) (no more than two pages and does not count against the 20-page limitation).

c. Examples of their commercial pricing for Government customers for market research purposes only. Responders will not be held to this amount if a solicitation arises out of this market research effort. Examples of pricing should show any distinctions in pricing during the program office’s build and testing phases and during actual sale of policies.

5 RFI Response Instructions

5.1 Response Format Requested

Reponses in Microsoft Word for Office 2013 compatible format or PDF are due no later than

August 7, 2022, 12:00 PM EST. Page size shall be no greater than 8 1/2" x 11”. The top, bottom, left and right margins shall be a minimum of one inch each. Reponses shall be in 12-point, Times New Roman font. Line spacing shall be set at 1.0 or 1.5. As stated above, statements shall be no more than 22 pages, including a two-page limit for company information. Hyperlinks are prohibited.

Proprietary information, if any, should be minimized and MUST BE CLEARLY MARKED. To aid the Government, please segregate proprietary information. Please be advised that all submissions become Government property and will not be returned.

The responses to this RFI will be reviewed by staff from the FEMA OCISO and OCIO and may be used to develop requirements for potential future acquisitions.

VERSION 1.0 Page 9 of 9

5.2 How to Deliver the Response

Questions and requests for clarifications must be sent to Colin Galvin, Contracting Officer, at colin.galvin@fema.dhs.gov no later than 12:00 PM EST, August 30, 2022. No telephonic questions will be accepted. Questions received after the deadline will not be answered.

Responses shall be sent via email to Colin Galvin, Contracting Officer, at colin.galvin@fema.dhs.gov. The subject line of all submittals shall include “Cybersecurity

Compliance Services Support RFI”.

Responses are due no later than September 7, 2022, 12:00 PM EST.

5.3 Information for the Response

In accordance with Federal Acquisition Regulation (FAR) 10.002(b)(2)(i), this notice is issued for the purpose of gauging the interest in this opportunity as well as determing market capabilities to meet requirements. This request is for planning purposes only, and does not constitute a solicitation or an indication the government will contract for the items contained in this notice.

This notice is not to be construed as a Request for Proposal (RFP), nor is there any commitment on the part of the government to award a contract implied, nor does the government intend to pay for any information submitted as a result of this request. The government does not reimburse respondents for any cost associated with submission of the information being requested or reimburse expenses incurred to interested parties for responses to this notice. Any response received will not be used as a proposal. FEMA is not seeking proposals at this time and will not accept or evaluate any unsolicited proposals. Not responding to this RFI does not preclude participation in any future RFP, if any is issued. If a solicitation is released, it will be synopsized on Beta.SAM.gov, competed using a Governmentwide Acquisition Contract (GWAC), or a

Government Federal Supply Schedule (FSS). It is the responsibility of potential Offerors to monitor Beta.SAM.gov, GWACs, and FSS for additional information pertaining to this requirement.

mailto:colin.galvin@fema.dhs.gov