RFI Information Assurance Compliance Support Services Update.pdf

NOTICE ID: 70RSAT26RFI000009

REQUEST FOR INFORMATION (RFI)

Department of Homeland Security (DHS) Science and Technology (S&T) Directorate

Chief Information Office / Information Assurance Compliance Support Services

FY26

NOTE: THIS IS A REQUEST FOR INFORMATION (RFI) ONLY. This RFI is issued solely for information and market research planning purposes. This RFI shall not be construed as an obligation on the part of the Government. This is NOT a Request for Quotations or Proposals. No solicitation document exists, and the Government may or may not issue a formal solicitation as a result of the responses received to this RFI.

The Government will not pay for any response or demonstration expenses. All costs incurred responding to this RFI will be solely at the interested party's expense. Failure to respond to this RFI will not preclude participation in any future solicitation. Any information received will become the property of the Government and will not be returned to the submitter. Interested parties are responsible for adequately marking proprietary or sensitive information.

The Government’s explicit intent, in this request for information, is to not receive from respondents any proprietary data, trade secrets, business sensitive information, or information considered CONFIDENTIAL under 18 U.S.C. §1905. The Government’s constraint does not in any way relieve contractors from their responsibility to properly mark proprietary data when it is provided, nor does it alleviate any requirement for the Government to protect marked data. The Government is not obligated to protect unmarked data.

The information provided in this RFI is subject to change and is not binding on the Government. All submissions become the property of the Federal Government and will not be returned.

Government technical experts drawn from staff within the Department of Homeland Security (DHS) and other federal agencies may review responses. The Government may use selected support Contractor personnel to assist in the review of the RFI responses. These support Contractors will be bound by appropriate non-disclosure agreements to protect proprietary information.

I. PURPOSE OF THIS RFI

The purpose of this RFI is to collect information from qualified and interested sources with the capability and experience in providing services identified in the RFI and the attached draft Statement of Work

(SOW).

II. BACKGROUND/DESCRIPTION

The U.S. Department of Homeland Security Science & Technology Directorate (S&T) Chief Information Officer (CIO) Office focuses on providing the tools, technologies, and knowledge products for the nation’s Homeland Security Enterprise. S&T strives to enable effective, efficient, and secure operations across all homeland security missions by applying scientific, engineering, analytics, and innovative approaches to deliver timely solutions in support of DHS's mission.

The S&T CIO Office supports S&T by providing personnel, technology, property, security, and processes for S&T operations, supporting staff in Washington, D.C. and laboratories nationwide. S&T currently manages approximately 35 distinct IT Systems with currently 2500 endpoints and projects, anticipating growth over the period of performance. These systems include multiple General Support Systems (or networks), three distinct Cloud-based solutions, partnerships with two Federally Funded Research and

Development Corporations and a number of standalone and experimental systems supporting Laboratory Operations.

The DHS S&T CIO Office requires professional technical support services to help achieve its mission and objectives by integrating innovative technology into daily operations for DHS components. IT support services are needed for the Information Assurance (IA) branch. This Branch is comprised of two distinct functional areas: Information System Security Office and Compliance. The branch supports the S&T Chief Information Security Officer (CISO) and facilitates Federal Information Security Modernization Act (FISMA, 2014) compliance for all S&T IT systems. The services include compliance support, including testing, tracking and compliance services to adhere to all Cyber-related mandates, i.e. Executive Orders (EO), Emergency Directives (ED), Office of Management and budget (OMB) memorandums, Department of Homeland Security Cyber Task Orders (CyTO) and others as required as well as support and manage all Cyber Audits.

The Contractor shall ensure adherence of S&T IT operations to all DHS rules and regulations associated with DHS Management Directive 4300 and FISMA compliance -- 4300A Sensitive Systems Policies.

III. QUESTIONS FOR INDUSTRY

1- Describe your organization’s capability and experience implementing the FedRAMP baseline when implementing and assessing a cloud system, while considering NIST SP 800-53 and 800- 37?

2- Provide recommendations on the knowledge, skills, qualifications, certifications, and years of experience of Information System Security Manager (ISSM), and Zero Trust and Security Operations (SOC) personnel required to support the tasks as outlined in the draft SOW.

3- Describe your organization’s capability and experience supporting the Zero Trust Framework in a federal environment that has led to modernized IT governance models and matured implementation levels.

4- Describe your organization’s capability and experience developing performance metrics and reporting mechanisms to ensure quality, timeliness, and compliance in delivering end-to-end to all cyber mandates? Include examples.

5- Describe your organization’s capability and experience with implementing emerging technologies and continuous improvement and innovation into a end-to-end Cyber Security program.

6- Describe your organization’s capability and experience implementing and managing a Project Management Office (PMO) Level III. To include the knowledge, skills, qualifications and certifications required to support the task outlined in the draft SOW.

IV. SUBMISSION REQUIREMENTS

Responses from all interested sources are encouraged to respond. Responses shall be a maximum of eight

(8) pages and shall include a cover letter with the following information:

1) Response to RFI Notice 70RSAT26RFI000009

2) Company Legal Business name and Physical address;

3) Identify business socio-economic status;

4) Recommend the NAICS Code most aligned with the requirement;

5) Company points of contact including phone numbers and email addresses;

6) A comprehensive response that addresses the six (6) questions delineated above;

7) Identify if your firm currently holds any Best-in-Class (BIC) vehicles (e.g. 8 (a) STARS III, Alliant 2, VETS 2, POLARIS, NITAAC, and GSA MAS contracts, etc.), to include the applicable contract number; and https://usdhs.sharepoint.com/sites/dhsconnect/org/comp/mgmt/ocio/ciso/Pages/sspolicy.aspx

8) Identify if your company would be interested in competing for this requirement as prime contractor or subcontractor, if solicited. If subcontracting, identify any joint ventures or teaming arrangements that would be pursued.

Submissions shall be made using Microsoft Office applications. Font shall not be smaller than 12-point Times New Roman.

All Responses shall be submitted to the Office of Procurement Operations (OPO) at the following email address: Contracting Officer (CO) Danette Williams, Danette.Williams@hq.dhs.gov and Contract Specialist (CS) Marco Macherelli, Marco.Macherelli@hq.dhs.gov no later than 10:00.a.m., February 17, 2026.

V. ACQUISITION HISTORY

Work performed under Blanket Purchase Agreement (BPA) 70RSAT22A00000001 awarded against GSA GS35F0255X to SiloSmashers, Inc. is associated with the following RFIs:

• 70RSAT26RFI000006 Service Delivery Support

• 70RSAT26RFI000009 Information Assurance Compliance Support

• 70RSAT26RFI000010 Systems Engineering/Operations and Maintenance Support

The BPA expires July 31, 2026.

Work performed under Task Order (TO) 70RSAT23FR0000001 awarded against GSA 47QTCB21D0009 to APF Technology, LLC, is associated with the following RFI:

• 70RSAT26RFI000009 Information Assurance Compliance Support

VI. INDUSTRY DAY

The Government may hold an Industry Day for this requirement. Details regarding an Industry Day will be provided at a later time.

Note: The Government reserves the right to hold one-on-one meetings as a result of responses received from this RFI as part of its market research. Meetings may be held with companies who provide comprehensive and relevant responses to the topic and questions in this notice.

mailto:Danette.Williams@hq.dhs.gov mailto:Marco.Macherelli@hq.dhs.gov