OIS Cybersecurity and Information Technology Services_Sources Sought Notice.pdf

Page | 1

Sources Sought Notice 75P00120R00010

SOURCES SOUGHT NOTICE

HHS OIS Cybersecurity and Information Technology

Services

I. INTRODUCTION

This SOURCES SOUGHT NOTICE is to determine the availability of potential small businesses

(e.g., 8(a) business development participants, HUBZone small business concerns, service-disabled veteran-owned small business concerns, and economically disadvantaged women-owned small business (EDWOSB) concerns and women-owned small business (WOSB) concerns) that can provide Cybersecurity and Information Technology Services. The information from this market research will help the Department of Health and Human Services (HHS)

Office of the Chief Information Officer (OCIO) plan their acquisition strategy.

THIS IS STRICTLY MARKET RESEARCH. HHS/PSC AND HHS/OIS WILL NOT

ENTERTAIN QUESTIONS REGARDING THIS MARKET RESEARCH.

II. GENERAL INFORMATION

This Sources Sought Notice is for information and planning purposes only and should not be construed as a commitment by the Government. This is not a solicitation announcement for proposals and no contract will be awarded from this Notice. No reimbursement will be made for any costs associated with providing information in response to this Notice. Respondents will not be notified of the results of this evaluation. Capability statements will not be returned and will not be accepted after the due date.

As previously stated, the Government will not entertain questions regarding this Market

Research; however, general questions may be forwarded to the following:

Contract Specialist: Vanja Basaric

Email Address: Vanja.Basaric@psc.hhs.gov

III. BACKGROUND

U.S. Department of the Health & Human Services (HHS)

The Department of Health & Human Services (HHS) is the U.S. government’s principal agency for protecting the health of all Americans and for providing essential human services. The mission of

HHS is to enhance the health and well-being of Americans by providing effective health and human services and by fostering sound, sustained advances in the sciences, underlying medicine, public health, and social services. HHS accomplishes its mission through programs and initiatives that cover a wide spectrum of activities, serving Americans at every stage of life. Eleven Operating

Divisions (OpDivs), including eight (8) agencies in the U.S. Public Health Service (PHS) and three

(3) human services agencies, administer HHS’ programs. In addition, staff divisions (StaffDivs) provide leadership, direction and policy management guidance to the Department. Integral to these responsibilities is the open sharing of information that is sensitive to the Department and national security. HHS faces the challenge of providing important services and products to the American

Page | 2 people while simultaneously reducing costs and protecting sensitive information.

HHS is entrusted with the personally identifiable information (PII) for over 100 million Americans, and that information is a target for cyber criminals seeking economic gain as well as nation states who might seek in general to compromise the security of government information and gain economic, military, or political advantage. HHS leverages an enterprise risk management (ERM) approach to implement an enterprise-wide cybersecurity program to protect its critical information.

HHS continuously monitors for new risks, prioritizes based on impact, and adjusts remediation and mitigation strategies.

HHS Office of the Chief Information Officer (OCIO)

The HHS Office of the Chief Information Officer (OCIO) supports the HHS mission by leading the development and implementation of an enterprise Information Technology (IT) infrastructure across

HHS. This office establishes and provides support for E-Government Initiatives, IT Operations

Management, IT Investment Analysis, IT Security and Privacy, Performance Measurement, Policies for Improved Management of Information Resources and Technology, Strategic Development and

Application of Information Systems and Infrastructure, and Technology-Supported Business

Process Reengineering.

HHS Office of Information Security (OIS)

The Office of Information Security is organized by divisions supported by operational branches to execute various cybersecurity functions and services to the agency. These divisions align functional roles for Cybersecurity Operations (OIS-OPS), Cybersecurity Governance, Risk, and Compliance

(OIS-GRC) Management, Executing Cybersecurity Services to the Office of the Secretary (OIS-

OS), and Cybersecurity Business Operations (OIS-BizOps). Overseeing each of these divisions is the direct Office of the Chief Information Security Officer (OCISO). Collectively these divisions within the OCISO are tasked with executing the cybersecurity mission within the OCIO.

OIS has access to the agency’s cybersecurity security enclave infrastructure and systems to protect the agency from cyber threats. OIS seeks to improve overall program and project management, operational delivery, privacy management, cybersecurity governance, risk management, and compliance to support organizational efficiencies, maturing cybersecurity service delivery, and ensure compliance with HHS project standards and overall federal IT resourcing.

The White House Office of Management and Budget Circular A-130 provides guidance to federal agencies on general policy for the planning, budgeting, governance, acquisition, and management of

Federal information, personnel, equipment, funds, IT resources and supporting infrastructure and services. The policy requires federal agencies to establish a comprehensive approach to improve the acquisition and management of information resources. The Circular highlights requirements from

The Federal Information Technology Acquisition Reform Act (FITARA) to improve the acquisition and management of information resources. FITARA, passed by Congress in December 2014, published guidance to agencies to ensure a more efficient allocation of financial resources and focused on elimination of duplication and ineffective spending. FITARA was intended to strengthen CIOs ability to increase responsible planning, budgeting, programming, acquisition, and implementation of information technology. This guidance is now available as OMB Memorandum

M-15-14: Management and Oversight of Federal Information Technology.

Page | 3

In October 2008, HHS issued the HHS OCIO Policy for Information Technology Enterprise

Performance Life Cycle along with the EPLC Framework Overview Document that describes a structured approach to planning, managing, and overseeing HHS IT projects over their entire life cycle. The EPLC Policy, together with the EPLC Framework, serves as the authority for EPLC requirements, objectives, responsibilities, and standards for managing all IT projects at HHS. The

EPLC Policy was revised in 2016 to incorporate project management elements for FITARA.

Industry and government experience demonstrates that the quality of IT projects is directly proportional to the quality of the management processes used to acquire and operate the IT products those projects produce. Implementing the EPLC framework helps ensure the quality of HHS IT products through improved project management processes. EPLC establishes a project management and accountability environment for HHS IT projects to achieve consistently successful outcomes that maximize alignment with Department-wide and individual OPDIV goals and objectives.

Implementation of the EPLC methodology allows HHS to improve the quality of project planning and execution, reducing overall project risk. Managing and governing all IT projects from a single, standard project management framework facilitates HHS-wide compliance with the Clinger-Cohen

Act, FITARA, and other legislative and regulatory requirements that require HHS to manage and govern its IT projects from an enterprise perspective.

Key elements of EPLC and FITARA within OIS include oversight of IT projects to ensure adhere to agency guidelines for engineering and development processes, security and privacy requirements, and delivery of cybersecurity programs and solutions that provide:

Flexibility to adequately manage risk while allowing for differences in development methodology, project size, complexity, scope, duration, and acquisition strategy.

Structure using sound project management practices, and ensuring involvement by business stakeholders and technical experts throughout the project’s life cycle.

Methodical incremental and iterative development to be considered first as the preferred methodology to implement all cybersecurity projects, as appropriate.

Collaboration with all critical partners and stakeholders to ensure timely, effective multi-disciplinary reviews of all cybersecurity projects.

Accountability and transparency.

In 2015, the United States Congress passed the Cybersecurity Act of 2015 (CSA), and within this legislation is Section 405(d): Aligning Health Care Industry Security Approaches. As an approach to this requirement, in 2017 HHS convened the 405(d) Task Group leveraging the Healthcare and

Public Health (HPH) Sector Critical Infrastructure Security and Resilience Public-Private

Partnership. The Task Group is comprised of a diverse set of over 150 members representing many areas and roles, including cybersecurity, privacy, healthcare practitioners, Health IT organizations, and other subject matter experts. The Task Group’s charge was to develop documentation that provides a common set of voluntary, consensus-based, and industry-led guidelines, practices, methodologies, procedures, and processes that serve as a resource to meet three core goals to: 1.)

Cost-effectively reduce cybersecurity risks for a range of health care organizations; 2.) Support voluntary adoption and implementation; and 3.) Ensure on an ongoing basis that content is actionable, practical, and relevant to healthcare stakeholders of every size and resource level.

Attacks on the data-rich Healthcare and Public Health (HPH) sector have the potential to both threaten the safety and privacy of American citizens and cause disruption to the ability of our health

Page | 4 professionals to provide care to patients. In response to these malicious efforts, OIS launched the

Health Sector Cybersecurity Coordination Center (HC3). The HC3 focuses on the expert collection, analysis, and enhancement of cybersecurity intelligence with the goal of improving the knowledge, responsiveness, and effectiveness of cybersecurity teams within the HPH sector and HHS itself.

Responding to attacks on the sector and preparing the sector for new threats requires collaboration across key HPH stakeholders, which is the core mission of the Health Sector Cybersecurity

Coordination Center. HC3 oversees the functions of both the Cyber Threat Intelligence team, the

Cyber Engagement Team, and the administrative and support teams. These teams have specific functional areas and responsibilities for ensuring the enrichment of cyber intelligence information and engagement and communication with the HPH sector.

IV. Scope

The overall scope of OIS’ requirements are categorized into seven (7) Functional Areas (FAs):

FA 1: Cybersecurity Technology and Operational Delivery Support Services

1. Task Transition Management

2. Task Management

3. Security Tool Infrastructure Management (STIM) Support Services

4. Cybersecurity Incident Monitoring and Reporting Support Services

5. Enterprise Security Services Support Services

6. Technologies/Systems

7. Surge Support

FA 2: Advanced Cybersecurity Defense Support Services

1. Task Order Transition Management

2. Task Order Management

3. Advanced Cybersecurity Defense Support Services

4. Health Sector Cybersecurity Coordination Support Services

5. Cybersecurity Incident Response Support Services

6. Technologies/Systems

7. Surge Support

FA 3: Splunk Operational Delivery Support Services

1. Task Transition Management

2. Task Management

3. Security Tools – Security Information and Event, Log Management Engineering (Currently

Splunk)

4. Security Tools – Security Information and Event, Log Management Engineering

Architecture (Currently Splunk)

5. Splunk SOC Analyst (IR/Content)

6. Technologies/Systems

7. Surge Support

Page | 5

FA 4: Cybersecurity Governance Risk and Compliance Support Services

1. Task Transition Management

2. Task Management

3. Enterprise and OS Cybersecurity Governance Management and OS Cyber Policy

Management

4. Enterprise and OS Cybersecurity Risk Management

5. Enterprise and OS Cybersecurity Compliance and OS Vulnerability Management

6. OS Cybersecurity Data Guardian and Training Management

7. Technologies/Systems

8. Surge Support

FA 5: Privacy Support Services

1. Task Transition Management

2. Task Management

3. The Office of Privacy and Information Management (PIM) - Program Management Support

4. PIM - Breach Response Management; and

5. PIM - Privacy Impact Assessments (PIAs)

6. PIM - Privacy Policy & Strategy

7. PIM - Privacy Training and Awareness

8. Surge Support

FA 6: Cybersecurity Program and Engagement Support Services

1. Task Transition Management

2. Task Management

3. Program Support; and

4. Communications and Strategy Management Support

5. Surge Support

FA 7: Cybersecurity Project Support Services

1. Transition

2. Task Order Management

3. Cybersecurity Project Support

4. Surge Support

Page | 6

V. RESPONSE INFORMATION

In order to respond to this notice, contractors must complete the vendor questionnaire, describing past and current experience for one or more of the seven Functional Areas in section

IV. Past experience must have been performed within the last three years. Responders must address each Functional Area separately in the tabs provided in the questionnaire, and must address all tasks within each Functional Area. In order to be considered capable for a given

Functional Area, contractors must show experience and capability in ALL of the tasks under a

Functional Area. Contractors should not submit partial responses, which do not address all of the tasks for a Functional Area. Contractors may choose to submit responses for one, several, or all seven of the Functional Areas. Character limits per cell are 2,000 or less for each row/task in the Functional Area tabs.

NAICS Codes

FA 1: Cybersecurity Technology and Operational Delivery Support Services – 541513

- Computer Facilities Management Services

FA 2: Advanced Cybersecurity Defense Support Services – 541513 - Computer

Facilities Management Services

FA 3: Splunk Operational Delivery Support Services – 518210 – Data Processing, Hosting, and Related Services

FA 4: Cybersecurity Governance Risk and Compliance Support Services – 541513 -

Computer Facilities Management Services

FA 5: Privacy Support Services - 541519 - Other Computer Related Services

FA 6: Cybersecurity Program and Engagement Support Services – 541611 –

Administrative Management and General Management Consulting Services

FA 7: Cybersecurity Project Support Services - 541611 – Administrative Management and General Management Consulting Services

VI. RESPONSE DEADLINE

Responses must be submitted no later than October 30th by 12pm Eastern to the Contract

Specialist, Vanja Basaric, via email at vanja.basaric@psc.hhs.gov.

mailto:vanja.basaric@psc.hhs.gov.