70RSAT26RFI000028 RFI FPS NetScan.pdf

NOTICE ID: 70RSAT26RFI000028

REQUEST FOR INFORMATION (RFI)

Department of Homeland Security (DHS) Science and Technology Directorate (S&T)

Federal Protective Service (FPS) Network Scanning Tool

FY26

NOTE: THIS IS A REQUEST FOR INFORMATION (RFI) ONLY. This RFI is issued solely for information and market research planning purposes. This RFI shall not be construed as an obligation on the part of the Government. This is NOT a Request for Quotations or Proposals. No solicitation document exists, and the Government may or may not issue a formal solicitation as a result of the responses received to this RFI.

The Government will not pay for any response or demonstration expenses. All costs incurred responding to this RFI will be solely at the interested party's expense. Failure to respond to this RFI will not preclude participation in any future solicitation. Any information received will become the property of the Government and will not be returned to the submitter. Interested parties are responsible for adequately marking proprietary or sensitive information.

The Government’s explicit intent, in this request for information, is to not receive from respondents any proprietary data, trade secrets, business sensitive information, or information considered CONFIDENTIAL under 18 U.S.C. §1905. The Government’s constraint does not in any way relieve contractors from their responsibility to properly mark proprietary data when it is provided, nor does it alleviate any requirement for the Government to protect marked data. The Government is not obligated to protect unmarked data.

The information provided in this RFI is subject to change and is not binding on the Government. All submissions become the property of the Federal Government and will not be returned.

Government technical experts drawn from staff within the Department of Homeland Security (DHS), and other federal agencies may review responses. The Government may use selected support Contractor personnel to assist in the review of the RFI responses. These support Contractors will be bound by appropriate non-disclosure agreements to protect proprietary information.

I. PURPOSE OF THIS RFI

The purpose of this RFI is to collect information from qualified and interested sources with the capability and experience in providing services identified in the RFI.

II. BACKGROUND/DESCRIPTION

Recent gap analyses and need assessments have highlighted the importance of developing a portable network scanning tool tailored to FPS operational requirements. The tool must enable comprehensive discovery and inventory of IT, Internet of Things (IoT), and Operational Technology (OT) assets, perform vulnerability and configuration assessments in environments without centralized monitoring, and generate structured outputs compatible with FPS’s existing inventory and reporting tools. The project will also address the need for interoperability with legacy systems, unique asset tracking, and compliance with government travel and operational constraints.

The Department of Homeland Security Science & Technology Directorate Homeland Security Advanced Research Projects Agency (HSARPA) is leading the development of this tool, with FPS as the component customer and eventual recipient. The Contractor will design, develop, test, and deliver the tool, with oversight and project management provided by DHS S&T HSARPA.

2.0 SCOPE

The Contractor shall design, develop, test, and deliver a consolidated, portable, agentless network scanning tool for use by FPS. The tool will support real-time discovery and inventory of information technology (IT), Internet of Things (IoT), and Operational Technology (OT) assets, vulnerability and configuration assessments, and integration with FPS’s existing inventory and reporting systems. The project will also include the development of a user interface, documentation, and training materials, as well as validation and testing in operational environments.

The attached draft Statement of Work (SOW) provides background for the FPS Network Scanning Tool.

III. QUESTIONS FOR INDUSTRY

1. Company Background

1.1 Please provide a brief overview of your company and its experience with network scanning, cybersecurity assessments, and work with federal or critical infrastructure clients.

1.2 What similar projects have you completed for federal, state, or local government customers?

2. Technical Capability

2.1 Can you describe your solution’s ability to perform agentless, portable network scanning across both traditional IT and non-traditional IoT/OT systems?

2.2 How does your solution support asset discovery, inventory, and vulnerability/configuration assessment in environments with minimal documentation and limited or no centralized monitoring?

2.3 Does your tool operate safely in locally connected, non-networked, or minimally documented environments (e.g., HVAC, lighting, video surveillance, access control)?

2.4 Does your tool store, update, and validate localized asset baselines over time, and what local mechanisms exist to flag 'new' or 'removed' devices when re-scanning a specific facility?"

2.5 What are the hardware and software requirements for deploying your solution in the field?

2.6 Does your tool evaluate vulnerabilities using locally stored threat/vulnerability databases, or does it require an active internet connection to cross-reference CVEs? How are configuration weaknesses (e.g., default credentials) assessed safely on OT systems?"

2.7 What technical methodologies (such as passive packet inspection or traceroute analysis) does your tool use to trace and visualize network paths, particularly when looking for unauthorized dual-homed systems or external internet connections on isolated OT networks?

2.8 How does your solution ensure safe operation without disrupting critical OT systems?

2.9 Can the tool perform its entire workflow—from discovery and vulnerability analysis to report generation—in a strictly offline, standalone environment with zero connectivity to external networks, cloud controllers, or central licensing servers?"

3. Integration and Reporting

3.1 Can your solution generate structured outputs compatible with government inventory and reporting tools (e.g., CSV, XML, or integration with platforms like MIST)?

3.2 How does your solution support integration with existing asset management or risk reporting systems?

3.3 Are there APIs or data export features available?

3.4 How does your tool handle nonstandard IP subnetting, overlapping IP address spaces, and unrouted VLANs when attempting to discover and map local assets?"

3.5 How does your tool measure and manage false positive and false negative rates for device identification and vulnerability detection, and what options exist for tuning or validating these against known baselines?"

3.6 How does your tool detect and handle cases where the same device is discovered multiple times in different network segments or assessment contexts, to prevent double-counting and misattribution in inventories?"

4. Security and Compliance

4.1 How does your solution align with federal cybersecurity requirements, such as FISMA, NDAA, TAA, and NIST standards?

4.2 Is your solution currently in use in any federal environments with similar compliance requirements?

4.3 How does your tool store scan outputs and assessment artifacts locally, and what specific mechanisms (e.g., encryption at rest, role-based access controls) are used to protect those artifacts on the scanning device?"

4.4 How do you prevent data mixing between logically distinct environments and maintain clear separation for reporting?"

4.5 How does your tool handle interruptions such as power outages, network failures, or unexpected device responses? Specifically, what checkpointing or state-tracking mechanisms allow you to resume scans without re-scanning the entire environment?"

5. Performance and Metrics

5.1 What is the average time required for a full scan and vulnerability assessment in a typical facility environment?

5.2 What structured export formats (e.g., JSON, XML, CSV, Cyclone DX SBOM) does your tool natively output to facilitate direct integration into external Federal or DHS risk-management platforms?"

5.3 What performance metrics does your product natively track (for example, time from scan initiation to first vulnerability detection, total scan duration, number of devices scanned per unit time), and how are these exposed to users or exported for analysis?"

5.4 Can your solution provide metrics such as:

- Mean Time to Detect vulnerabilities

- Automated discovery rate vs. manual methods

- Inventory completeness and validation rates

6. Support and Training

6.1 What training, documentation, and support do you provide for deployment and operation of your solution?

6.2 Do you offer on-site or remote support for troubleshooting and updates?

7. Licensing, Pricing, and Delivery

7.1 What are your standard licensing models (perpetual, subscription, user-based, site-based, etc.)?

7.2 What is your typical delivery timeline for a project of this scope?

7.3 Are there any anticipated challenges or long lead times for hardware or software components?

8. References and Demonstrations

8.1 Can you provide references for similar work performed for federal or critical infrastructure clients?

8.2 Are you able to provide a demonstration or trial of your solution in a government environment?

9. Additional Information

9.1 Do you have any recommendations or best practices for deploying agentless, portable network scanning in complex, mixed IT/OT environments?

9.2 Are there any unique features or differentiators of your solution relevant to our requirements?

IV. SUBMISSION REQUIREMENTS

All interested sources are encouraged to respond. Responses shall be a maximum of 10 pages total including cover and any photos, graphs, charts, etc. and shall include a cover letter with the following information:

1) Response to RFI Notice 70RSAT26RFI000028

2) Company Legal Business name and Physical address;

3) Identify business socio-economic status for NAICS 541715;

4) Recommend the NAICS Code most aligned with the requirement;

5) Company points of contact including phone numbers and email addresses;

6) A comprehensive response that addresses the questions delineated above;

7) Identify if your firm currently holds any Best-in-Class (BIC) vehicles (e.g. 8 (a) STARS III, Alliant 2, VETS 2, POLARIS, NITAAC, and GSA MAS contracts, etc.), to include the applicable contract number; and

8) Identify if your company would be interested in competing for this requirement as prime contractor or subcontractor, if solicited. If subcontracting, identify any joint ventures or teaming arrangements that would be pursued.

Submissions shall be made using Microsoft Office applications. Font shall not be smaller than 12-point Times New Roman.

Please provide your response to this RFI no later than 5:00 p.m. Eastern Time on Friday, August 28, 2026 to the DHS Headquarters Office of Procurement Operations (OPO) Contracting Officer Jennifer Koons; jennifer.koons@hq.dhs.gov and Contract Specialist Dorothy Woolfolk;

dorothy.woolfolk@hq.dhs.gov. Any questions and inquiries must be submitted to the email addresses above.

V. INDUSTRY DAY

The Government may hold an Industry Day for this requirement. Details regarding an Industry Day will be provided at a later time.

Note: The Government reserves the right to hold one-on-one meetings as a result of responses received from this RFI as part of its market research. Meetings may be held with companies who provide comprehensive and relevant responses to the topic and questions in this notice.