70RTAC24RFI000005 - Cybersecurity Governance Compliance -.pdf

RFI #: 70RTAC24RFI000005

SENSITIVE BUT UNCLASSIFIED

REQUEST FOR INFORMATION

Cybersecurity Governance & Compliance

Department of Homeland Security Chief Information Security Officer Directorate

This is a request for information (RFI) issued for planning purposes only, and does not constitute a solicitation for proposals, offers, bids, and/or quotes. This is not an announcement of a forthcoming solicitation, or confirmation that the Government will contract for the items/services contained in the RFI, nor is any commitment on the part of the Government to award a contract implied. The purpose of this notice is to conduct market research to identify qualified and interested sources that could provide the services stated. The information requested by this notice will be used within the Department of Homeland Security (DHS) to facilitate decision making and will not be disclosed outside the agency. Any information provided to the Government is strictly voluntary and will be provided at no cost to the Government.

Respondents are advised that the Government will not pay for any information or administrative cost incurred in response to this RFI. Responses received in response to this RFI will not be returned. Proprietary information and trade secrets, if any, must be clearly marked. All information received that is marked Proprietary will be handled accordingly.

Background The DHS Chief Information Security Officer Directorate (CISOD) is responsible for developing a comprehensive management approach for ensuring compliance with Federal legislation, regulation and guidelines, departmental policies, and procedures, as well as ensuring information systems operate at an acceptable level of risk based on the designated mode of operations. The DHS CISOD includes the DHS Enterprise and Management Directorate for cyber security management, oversight, and customer support.

Requirements include program management, professional services for the integrated planning, management, and execution of CISOD’s cybersecurity mission, National Security Systems support, Governance Risk and Compliance programs, and Cybersecurity through the Acquisition Life Cycle support for National Security and Sensitive but Unclassified/Controlled Unclassified Information programs and systems. Also, included is engineering and technical assistance for Cybersecurity related missions as required to meet DHS, Office of the Chief Information Officer (OCIO), and CISOD strategic plans, mission goals and objectives. The requirement will support sub-organizational units within the CISOD which include the National Security Cyber Division and Enterprise Cybersecurity Governance Division. This RFI requires interested contractors to indicate their ability to fulfill the requirements.

Tasks

The Contractor shall support the following tasks:

1. Project Management

The Contractor shall provide program management services such as transition planning, resource management, quality assurance, risk management, status and problem reporting, and administrative support.

2. National Security System (NSS) Support

The contractor shall support the National Security Cyber Division (NSCD) with architecture and engineering support to review, update and create various system architectures. The contractor shall also analyze, create, document and review processes and methodologies to streamline and enhance cybersecurity processes to support the Governance, Risk, and Compliance (GRC) for the continuous monitoring processes.

This shall include analysis and research of tools and creation of recommended utilization methodologies.

3. National Security Systems (NSS) Risk Management and Compliance Support

The contractor shall work with DHS HQ components, contractors, or other organizations within DHS to assess and evaluate DHS NSS Systems, Appliances and Applications, and provide cyber risks recommendations associated to DHS NSS. This task is inclusive of any cyber risk compliance and reporting activities and may stem from Cyber Supply Chain Risk Management risk assessments.

4. DHS Cybersecurity through the Acquisition Lifecycle

The Contractor shall provide cybersecurity review for all planned major acquisition systems as part of the Information Technology Acquisition Review (ITAR) process.

Provides expertise, reviews, and develops documentation in support of activities in the Acquisition Lifecycle Framework (ALF) phases, Program Health Assessments, and Cyber Risk Recommendation Memos. The Contractor shall assist with the coordination, planning, and management of Cyber ALF Working Groups and Integrated Project Teams (IPTs) as appropriate.

5. Cybersecurity Awareness and Training

The Contractor shall provide the support to manage all aspects of delivery of the CISOD Cybersecurity training support services. Services include project planning, content development, instructional design, training tool support, status and problem reporting, and administrative support.

6. Enterprise Cybersecurity Governance

The contractor shall actively develop and support the compliance monitoring/reporting activities related to DHS Federal Information Security Management/Modernization Act (FISMA) and other official reporting (both internal and external to DHS).

7. Component Services: Risk Management and Compliance

The contractor shall provide Risk Management and Compliance support to FISMA systems within the MGMT-HQ FISMA Portfolio and to ensure security authorization and compliance metrics are maintained in accordance with DHS policy.

8. Enterprise Cybersecurity Risk and Reporting Analysis

The contractor shall support the project management, development, and administration of governance, risk, and compliance systems and tools. The Contractor shall provide support for the FISMA metrics program by preparing Quarterly and Annual DHS Federal Information Security Modernization Act (FISMA) Reports that are submitted to Office of Management and Budget (OMB) and Congress. The Contractor shall support the development and publishing of the fiscal year (FY) DHS Information Security Performance Plan (ISPP) which drives the DHS Scorecard, defining performance requirements, priorities, and overall goals for the DHS Enterprise throughout the fiscal year. This support includes data analysis and risk reporting.

Information Request

Interested vendors that can provide the necessary services are asked to respond to this notice with a corporate capability statement that includes general background information and technical capabilities describing your firm's experience with projects similar in size and scope to the requirement.

In addition, interested vendors shall submit responses to each of the following questions:

• Provide your experience with managing an enterprise Governance, Risk, and Compliance (GRC) Program for classified, unclassified, and national security systems and all activities related to Risk Management Framework (RMF) and Assessment and Authorization activities to achieve authorization decisions. To include risk assessment, analysis, and recommendation, as well as providing support for FISMA compliance, FISMA reporting, and FISMA Inventory.

• Describe your experience with Cybersecurity Engineering and Architecture practices to further streamline and enhance the execution of tasks within the GRC and other related areas.

• Describe your experience providing RMF services in multi cloud environments (i.e., AWS and Azure) with IAAS, SAAS, and PAAS. Include experience with FEDRAMP and non-FEDRAMP cloud system authorization.

• Describe your experience with development and maintenance of Federal Department level cybersecurity policies that govern the implementation of the Information Technology cybersecurity program and implementation of standards and frameworks for identifying and managing NSS, FISMA, and FedRAMP reporting and compliance.

• Describe your experience with Cybersecurity in the Acquisition Lifecycle Framework (ALF). Cybersecurity ALF includes concept of cyber resiliency and incorporating supply chain risk management.

• Describe your experience with IT Business processes and Project Management Program that support design, development, implementation and execution of various PM activities, tools and methodologies including development of business logic and flows utilizing tools like ServiceNow and Atlassian JIRA/Confluence. Project Management includes transition planning, special project planning, resource management, personal daily accountability, budget tracking and estimate to complete projections, quality assurance, risk management, status and problem reporting.

• Describe your experience with the development of training content, graphics, modules, training delivery, and reporting – specifically for topics like cybersecurity as well as AI, NIST role base training, and Social Engineering?

The capability statement shall be a maximum of eight (8) pages. It shall include a cover sheet that includes:

1. Company Name and address

2. Point of contact (name of representative, e-mail address, phone number, DUNS number)

3. Company CAGE and DUNS

4. Business size

5. List of vendor’s contracting vehicles related to this RFI requirement.

6. Level of corporate facility clearance, if any.

The remainder of the document shall include:

7. Past Experience: Responses to this RFI shall indicate similar/relevant contracts/orders within the past three (3) years for the same or similar services required under this notice. Contract information may include those with Federal, State and local Government, as well as private companies. Please include dollar value and period of performance. Please include any relevant work with DHS.

8. Responses to the bulleted questions.

Submission Instructions:

The total submission page count shall not exceed 8 pages (the coversheet is excluded from the page count), Times New Roman, Font Size 12. Only one submission will be reviewed per responding vendor for this RFI. E-mail response/attachment(s) shall not exceed 5 MB in total. Any questions submitted regarding this RFI will not receive a response.

Please submit your response to:

Keira Buggs (Keira.Buggs@hq.dhs.gov)

Michael Lipperini (Michael.Lipperini@hq.dhs.gov)

Information submitted must be in sufficient detail to allow a thorough government review of the firm’s interest and capabilities.

All responses are due No Later Than Friday, April 19, 2024, at 4:00 PM Eastern Standard Time (EST).

The Government reserves the right to hold one-on-one meetings as a result of responses received from this RFI as part of its market research. Meetings may be held with particular vendors who provide comprehensive responses to the questions posed.