Request For Information (RFI) Questionnaire.pdf

DHS Statement of Work (SOW)

Learn more at fema.gov 1

FSOC - RFI Questionnaire

General

1. Name of Company, SAM.gov Unique Entity Identifier (UEI) number, and Cage Code.

2. Point of contact name, phone number and e-mail address

3. Size of business according to North American Industry Classification System (NAICS) Code

541519.

Pricing

4. What quantitative and qualitative information do you need from the government to assist you in forming a quality Basis of Estimate?

5. Should pricing proposals accommodate a difference in labor rates between all the locations associated with this contract?

6. Could support firm-fixed-price (FFP) contract?

Technical

7. Understand the management, maintenance, and maturing of the current Cyber Fusion Security

Operations and NOSC 24 hours a day, 7 days a week (24x7), 365 days a year (24x7x365) to identify, detect, protect, respond, and recover from threats to the FEMA information systems enterprise.

8. How do you provide project and program management services for tasks and activities in the below defined herein and ensure that any technical, performance, or administrative issues are addressed quickly and professionally?

a. Provide administrative support for contract work activities to include support FSOC:

prepare memorandums and correspondence to be delivered via Operational

Distribution as applicable; perform filing, passing of clearances, meeting and conference coordination, and other office administration duties.

b. Monitor and track program and task performance to ensure on-time service delivery within established cost estimates.

9. How do you provide leadership, management, and administrative support for Contractor work in support of Cyber Operations, and in the development and implementation of a Quality

Assurance Plan (QAP)?

10. How do you provide cybersecurity incident handling and threat identification capabilities for

24x7x365 situational monitoring, and cyber defense services; to provide the ability to rapidly detect and identify malicious activity, advance persistent threats (APT), and to promptly subvert that activity; and to collect data and maintain metrics that demonstrate the impact of the Agency’s cyber defense approach, its cyber state and cyber security posture?

Learn more at fema.gov 2

11. Would your personnel supporting this task able to have a minimum of a SECRET clearance prior to supporting the FEMA security operations?

12. Would you be able to put a team of personnel to use a host of tools to identify, track, analyze, and report on threats to FEMA’s information systems, presently including:

a. Security Information and Event Management (SIEM) & Extended Detection and

Response (XDR) – Cybersecurity Event Correlation, Analysis and Automation

b. Email – User-reported cybersecurity events

c. Endpoint Detection and Response (EDR) and Endpoint Protection Platform (EPP) –

Endpoint Security Events

d. Network Monitoring Tools – Potential Cybersecurity-Associated Network Events

e. Ticketing System – Internal Ticketing/Tracking of Cases

f. DHS Enterprise Case Management Portal (Swimlane) – DHS Reporting of Cases and current case tracking

g. Perform Continuous Diagnostic Monitoring (CDM) 8x5 (M-F) and on call as needed in support of the following:

i. Monitor customer provided tools for security compliance violations in the

FEMA network

ii. Monitoring mobile devices for hardware and software compliance

iii. Monitor customer provided tools to identify and remediate rogue hardware devices on the network

iv. Monitor customer Cloud workload Security violations and work with systems

ISSO/SO and FEMA compliance team for remediation

v. User Behaviors Analysis and compliance

h. Track remediation of compliance violations to correction and completion

i. Work with all stakeholders (SCCM, TRM and RMD) to automate FEMA authorized software approval and management.

13. How do you respond rapidly CONUS and OCONUS. The Contractor shall provide cyber security expertise for traveling for incidence response as requested and funded by FEMA?

14. What technical expertise could you provide FEMA NOSC to manage, coordinate response and remediation communications, document, and report on FEMA computer security incidents?

15. How do you provide Cyber Threat Intelligence (CTI) support with technical expertise in hacker/hacktivist group capabilities and intentions to conduct a computer network exploitation

(CNE) and/or computer network attack (CNA) against the US Critical Infrastructure as it specifically relates to FEMA systems and mission?

16. What capability do you have in place for tracking and managing vulnerabilities found in FEMA systems?

17. How do plan putting together a Penetration Testing and Red Team to deliver a real-world risk assessment of the security posture of FEMA systems? Would you be able to conduct annual pen testing for High Valued Assets (HVA)s, High Categorization systems, priority systems as directed by leadership, and systems as requested by System Owners?

18. How do you:

Learn more at fema.gov 3

a. Establish and maintain a testing schedule for systems in scope including HVAs, High

Categorization systems, priority systems as directed by leadership, and systems as requested by System Owners?

b. Develop processes and procedures to conduct penetration tests and red-team activities and stay abreast of current attack vectors and unique methods for exploitation of computer networks?

c. Create a Rapid Penetration Testing process for tests that need a quick turnaround of results?

19. Could you provide:

a. Security engineering and subject matter expertise to conduct market research, product evaluation, prototyping, integration, development, deployment, recapitalization, operations, and maintenance support for a variety of technologies across the FEMA enterprise?

b. Support for new and emerging technologies, working across FEMA to provide security requirements to projects and programs?

c. Assisting the Chief Security Architect in developing the security architecture, developing recommendations for improving the security of the IT infrastructure that supports FEMA’s mission and security objectives, identifying technologies that will enforce FEMA’s security policies?

d. Support for procurement activities (inclusive of having technologies included in the

Technical Reference Model), assisting with the development of remediation plans for security weaknesses, and providing input to various programs and projects across

FEMA throughout the DHS and FEMA Project Life Cycles?

20. How do you perform technical and operational support for security tools, products, solutions, and the supporting infrastructure to include the IT equipment and tools for use in conducting security assessments. Specific activities include but are not limited to the following:

21. The Contractor shall assist OCISO with security architecture planning by ensuring its strategic goals and development of IT infrastructure supports the mission as well as its security objectives. Cyber Security shall provide detailed, risk-based security reviews of products in support of requests for additions to the DHS approved products inventory.

22. How could you provide security engineering and subject matter expertise to conduct market research, product evaluation, prototyping, integration, development, deployment, and recapitalization for a variety of technologies across the FEMA Enterprise?

23. How do to provide security consulting on enterprise security initiatives including projects like moving to a Zero Trust architecture, securing cloud environments, security stack consolidation, automation, and optimization solutions?

24. Could you provide:

a. Additional resources may be requested to perform services with similar responsibilities to personnel performing in Task 1 of this Task Order.

b. Additional resources may be requested to perform services with similar responsibilities to personnel performing in Task 2 of this Task Order.

c. Additional resources may be requested to perform services with similar responsibilities to personnel performing in Task 3 of this Task Order.