NOSC NCCS Industry Day Presolicitation Conference Slides (Final) (121823).pdf

Empower • Collaborate • Innovate • Procure

DHS Network Operations Security Center (NOSC) Network, Cloud, and Cybersecurity Services (NCCS)

Pre-Solicitation Conference December 18, 2023

11:00 a.m. – 12:30 p.m.

Hosted by DHS:

Office of Procurement Operations Office of the Chief Information Officer

OFFICE OF PROCUREMENT OPERATIONS

Welcome Tisha Blue-Warren

Office of Procurement Operations

Industry Liaison

2 (v1)

Pre-Solicitation Conference Agenda I. Welcome DHS OPO Industry Liaison

II. Rules of Engagement DHS OPO Industry Liaison

III. Project/Program Overview DHS HQ OCIO IT Operations

IV. Scope and DHS High-Level DHS HQ OCSO/OCIO IT Operations

V. Fitness/TS Process DHS OCSO CTR Fitness / OCSO PSD

VI. Acquisition Strategy/Schedule DHS OPO

VII. RFP and Eval Factors DHS OPO

VIII. Industry Comments/Questions DHS OPO & HQ OCIO/OCSO

IX. 10 Minute Break

X. Q&As Session – Q&A Pod DHS OPO & HQ OCIO/OCSO

XI. Closing Remarks DHS OPO Industry Liaison

Rules of Engagement

• The information presented today is for informational purposes only.

• This presentation does not constitute a request for proposals.

• This presentation does not constitute a final version of the Government’s requirement and is not binding.

• Please place your questions in the Q&A pod.

• Any responses provided during this presentation may be subject to change.

• Anticipate that the Pre-Solicitation slides and Q&As will be posted to SAM.gov NLT noon, December 21, 2023.

DHS NOSC Overview Dustin Goetz, Enterprise Operations Division Chief

• Background

• Scope

NCCS Purpose and Overview

• Contract Purpose:

• Procure the full range of program management, systems engineering and technical assistance, systems operations and maintenance, and other professional support services for the DHS information enterprise Wide Area Network (WAN) and Homeland Security Enterprise Network (HSEN) network, cloud/platform and critical system and application, and cybersecurity monitoring and analysis, incident management and coordination (including cybersecurity incident handling and incident response), and alert and notification functions for the expanding DHS NOSC and for select DHS components

• Scope includes working with existing DHS component NOCs/SOCs (or NOSCs) and providing a flexible and scalable support model to accommodate potential further alignment and consolidation of additional operations center requirements in the DHS NOSC

Legacy DHS HQ / Information Enterprise Governance

DHS NOSC CONOPs Roadmap

NCCS Objectives

• Primary Objectives:

• Evolve the DHS NOSC to build a best-in-class service node that meets DHS Cybersecurity Provider

(CSP) and industrial doctrinal Center of Excellence service maturity standards

• Re-define the DHS HQ NOSC as the central hub of IT Service Management for DHS OCIO for all network infrastructure (WAN and select LAN); platform (including cloud), system, and application;

and cybersecurity services for the DHS Homeland Security Enterprise Network (HSEN) at all classification levels and enclaves

• Unclass/SBU/CUI (A-LAN), Secret (B-LAN/HSDN), Top Secret (C-LAN), and D-LAN (SAP)

• Implementation Objectives:

• Streamline functions and services by: elimination of redundant or overlapping services;

synchronization and alignment of business processes; and consolidation of operating locations

• Modernize operations by: implementing a Common Operating Picture via unified dashboards and standardized platforms and tools; defining standardized (and scalable/variable) service support, cost, and security control catalogs; and enhanced automation of business functions and integration across technical platforms

Revised NCCS Statement of Work Structure

• Task 1: Contract Management

• Task 1.1: Program Management Services

• Task 1.2: Transition Planning and Management

• Task 2: Capability Delivery and Improvement

• Task 2.1: Knowledge Management

• Task 2.2: Doctrine, Policy, Planning, and SOP Development Support

• Task 2.3: Service Catalog, Relationship, and Service Management Practices

• Task 2.4: Communications Support

• Task 2.5: Project Management Support

• Task 2.6: Continuous Service Improvement Program

• Task 2.7: Performance and Investment Metrics

• Task 2.8: Capability Test, Training, and Exercise Program

• Task 2.9: Data Call and Data Acquisition Support

• Task 2.10: Cybersecurity Services Provider Program

• Task 3: Network, Cloud, and Cybersecurity M&A, Event and Incident Management and Response, and Associated Support Services

• Task 3.1: Monitoring and Analysis (M&A) and Incident Response

• Task 3.2: Network Operations Services

• Task 3.3: Cloud, Platform, and System Operations Services

• Task 3.4: Core Cybersecurity Services

• Task 3.5: Program Web and Tool Support and System Administration

• Task 3.6: Service Delivery Implementation

• Task 4: HSEN Network Infrastructure Operations and Maintenance (O&M) Support Services

• Task 4.1: IT Service Management

• Task 4.1.1: Configuration, Change, and Release Management

• Task 5: Field Engineering Technical Services

• Task 6: Other Cybersecurity Services

• Task 6.1: Cybersecurity Services Provider (CSP) Audit and Accreditation Program

• Task 6.2: Information Security Vulnerability Management Program

• Task 6.3: Information System Security Control Assessment Program Support

• Task 6.4: Intrusion Defense Chain FISMA Metrics Tracking

• Task 6.5: DHS Industry Cyber Hygiene Assessment Program Support

• Task 6.6: Zero Trust

• Task 7: Surge Support

DHS High-Level Fitness Process OCSO CTR Fitness

Ebony Rabb

Selection: Applicant selected for position; eApp completion (if applicable); forms submission; and Fingerprinting (if applicable)

Checks: System repository and investigative checks are conducted

Review: A review of investigative forms, checks, and any additional supporting documentation provided

EOD Decision: A preliminary determination is made. The determination can either be to Grant, Deny, or Delay the start of contract employment

Investigation: The investigation is Scheduled; field work completed; report of investigation returned back to DHS for final adjudication

Final Decision: If there is a favorable decision, applicant continues to work; Unfavorable decision applicant must be removed from contract and PIV must be retrieved.

DHS High-Level Personnel Security Keyshia Barber / OCSO PSD

Phase I

Access level required: Top Secret/SCI

Active Top Secret Facility Clearance (FCL) granted by the Defense Counterintelligence and Security Agency (DCSA)

NOTE: Offeror must have an accredited SCIF at their site.

High Level Acquisition Strategy Gregory Clark, Office of Procurement Operations (OPO)

• Requirement Overview:

• Base Period: Twelve (12) months with four (4) Twelve-Month Optional Ordering Periods

• Transition-In: Up to 120 Days

• Competition: Full and Open

• Phased Solicitation

• Phase I – Top Secret Facility Clearance, Mandatory Down-select

• Phase II – Corporate Technical Experience and Reference Checks, Advisory Down-Select

• Phase III – Proposal Evaluation

• Mixture of T&M, LH, and FFP CLINs / Sub-CLINs

• Sub-contracting Goals

Proposed Evaluation Factors Phase I

Mandatory Down-Select

Factor 1: Facility Clearance and Level of Safeguarding

• Offerors must possess a Top Secret Facility Security Clearance. All Offerors will be notified in writing via email by the Contracting Officer of the Government’s mandatory decision for Offeror’s to proceed or not to proceed with Phase II submissions.

• Failure to participate in Phase I precludes further consideration of an Offeror. Proposal submissions will not be accepted from Offerors who have not submitted a Phase I Proposal by the due date and time stated in the solicitation.

Phase II

Advisory Down-Select

Factor 2: Corporate Technical Experience and Reference Check

The Government will evaluate the Corporate Technical Experience and Reference Checks of the Offeror by seeking responses to two (2) specific questions, requiring the Offeror to provide a written description of each answer, and to provide reference information for three (3) projects of similar size, scope, and complexity. The answers will be used to determine the extent and nature of experience the Offeror has in staffing a geographically dispersed operation and in operating a Security Operations Center (SOC). The Government will evaluate the provided Corporate Technical Experience to determine whether it is recent (3 years), relevant, and whether the Offeror operated in the capacity as the prime contractor.

Phase III

(In Order of Importance)

Factor 3: Staffing and Management Approach

Factor 4: Technical Approach

Factor 5: Scenario Responses

Factor 6: Past Performance

Factor 7: Price

Phase III

(In Order of Importance)

Factor 3: Staffing and Management Approach

• The Government will evaluate the Offeror’s approach to managing staffing, management systems, teaming partners, subcontractors, consultants and business partners, equipment providers, Cloud Service Providers, and Colocation Providers.

Phase III

(In Order of Importance)

Factor 4: Technical Approach

• The Government will evaluate the technical approach proposed by the Offeror to provide the services described in the SOW. The Government will evaluate the Offeror’s approach to conducting coordinated cybersecurity and network management operations across multiple distributed locations as well as mobile field operations. The Government will assess the Offeror’s methods for maintaining technical control and monitoring those environments while providing the required visibility and reporting to the Government.

The Government will assess the comprehensiveness of the Offeror’s response and will assess innovative concepts that the Offeror implements in addressing cybersecurity and network management issues and incidents.

Phase III

(In Order of Importance)

Factor 5: Scenario Responses

• The Government will determine its level of confidence that the Offeror can successfully perform the requirements identified in the SOW based on the evaluation of its demonstrated written scenario responses.

Phase III

(In Order of Importance)

Factor 6: Past Performance

• The Offeror shall provide three (3) references. The Offeror shall include rationale supporting the assertion of relevance for each reference. These references shall also be from different contracts. To be considered, past performance data shall not be older than 3 years from the date of the proposal and may include active contracts.

• b) Past performance references shall be as a prime contractor or first-tier subcontractor on previous or current projects/task that are similar in size, scope, and complexity to the work identified in the SOW. Past performance does not necessarily have to be Government related; but it is important to demonstrate and provide evidence of past performance work similar in size, scope, and complexity to that described in the SOW.

• Offeror shall ask its references to submit a complete and accurate Past Performance Questionnaire (PPQ).

• The Government may also use present and/or past performance data obtained from a variety of sources, not just those contracts identified by Offerors.

Phase III

(In Order of Importance)

Factor 7: Price

• The Offeror’s price proposal submission shall be in accordance with the instructions contained in the Excel-based worksheet provided in the solicitation. A complete and accurate Pricing Schedule submission is required within an Offeror’s Volume IV proposal submission.

• The Pricing Schedule lists all labor categories required at the IDIQ level. The Offeror shall enter its labor rates for each listed labor category for the base period of performance and each optional ordering period. Offerors will be evaluated on the labor rates provided in their price proposal.

• The Government will determine whether the Offerors’ labor categories and labor rates are fair and reasonable.

Notional Timeline Nicole Belanger, OPO

Date Event

December 2023 • Pre-Solicitation Conference

January 2024

• Solicitation Released

• Industry Questions

• DHS Issues Amendment to Address Industry Questions

February 2024

• Phase 1 Responses Due

• Mandatory Down-Select

• Phase 2 Participants Invited

• Phase 2 Responses Due

• Advisory Down-Select

Notional Timeline (Cont’ Nicole Belanger, OPO

Date Event

March 2024 • Final Proposal Submissions Due

April 2024 • Contract Awarded

Q&A Session - Panel

❑Gregory Clark, Contracting Officer, OPO

❑Dustin Goetz, Division Chief, DHS HQ OCIO ITOD

❑Ahmad Gharib, NOSC Branch Chief, DHS HQ OCIO ITOD

❑Ron Lafond, DHS HQ OCIO ITOD NOSC Operations Manager / COR

Q&A Questions

• Question 1a: Can you please confirm that either GSA based Contractor Teaming Arrangements (CTAs) or those under FAR 9.601 (1) will be accepted?

Question 1b: And if the latter, can please confirm that Past Performance from each member of the CTA Partnership or JV will be accepted?

• Question 2: Do subcontractors also need a TS Facility clearance?

• Question 3: Will the Government release a list of preferred tools (GOTS, COTS & FOSS) with the solicitation and levels of experience with each tool? (e.g. Splunk)

• Question 4: Is it your intent to perform NCCS in government facilities or via off-site contractor facilities?

• Question 5: Will this contract absorb all or any work currently being performed under the HSEN (formerly OneNet) contract?

(See attachment to the Pre-Solicitation Conference slides for responses)

Break (10 Minutes)

Q&A Session – Q&A Pod

❑Gregory Clark, Contracting Officer, OPO

❑Dustin Goetz, Division Chief, DHS HQ OCIO ITOD

❑Ahmad Gharib, NOSC Branch Chief, DHS HQ OCIO ITOD

❑Ron Lafond, DHS HQ OCIO ITOD NOSC Operations Manager / COR

Q&A Pod Questions & Responses (See Attachment to Pre-Solicitation Conference Slides)

Thank you for Attending the DHS NOSC NCCS Pre-Solicitation Conference

OPO Industry Liaison Email: opoindustryliaison@hq.dhs.gov mailto:opoindustryliaison@hq.dhs.gov