832368272 - ID3 EISS - Sources_Sought_EISS - FINAL.pdf

Page 1 of 4 Pages

SOURCES SOUGHT NOTICE

832368272

The Defense Information Systems Agency (DISA) is seeking sources for Cyber Development

Directorate (ID), Endpoint Protections Portfolio, ID3 Endpoint Integrator Support Services.

CONTRACTING OFFICE ADDRESS: DITCO SCOTT, 2300 East Drive, Building 3600, Scott AFB, IL 62225-5406

INTRODUCTION:

This is a SOURCES SOUGHT NOTICE to determine the availability and technical capability of small businesses (including the following subsets: Small Disadvantaged Businesses, Certified

8(a), Service-Disabled Veteran-Owned Small Businesses, HUBZone Small Businesses and

Woman-Owned Small Businesses) to provide the required products and/or services.

PEO Cyber (ID), Endpoint Protections Portfolio, ID3 is seeking information from potential sources for: Endpoint Integrator Support Services. As part of DISA's continual improvement of the DoDIN and continued initiative to implement new security technologies, DISA is interested in modernizing the DoDIN security model through the acquisition, engineering, and lifecycle management of secure and reliable endpoint and network defense capabilities in support of the agency’s focus on Zero Trust and future efforts to protect and defend the DoDIN. As Endpoint

Protection evolves, it will serve to provide a more comprehensive approach to assist CC/S/A/FAs in fulfilling the Secretary of Defense’s Executive Order to rapidly transition and secure the current and latest release of Microsoft Windows versions.

Strategy: setup of technical meetings involving all relevant stakeholders and ensure technical feasibility: develop and maintain detailed project plan to track progress; assist with technical evaluations; help coordinate relationships with third parties/vendors; assist in the maintenance of

Endpoint project documentation; and provide software development support for Endpoint assessment capabilities.

The anticipated Period of Performance includes a one-year base period and four, one-year option period.

The anticipated Place of Performance is DISA HQ, 6900 Cooper Ave. Ft. Meade, MD

DISCLAIMER:

THIS SOURCES SOUGHT NOTICE IS FOR INFORMATIONAL PURPOSES ONLY. THIS

IS NOT A REQUEST FOR PROPOSAL. IT DOES NOT CONSTITUTE A SOLICITATION

AND SHALL NOT BE CONSTRUED AS A COMMITMENT BY THE GOVERNMENT.

RESPONSES IN ANY FORM ARE NOT OFFERS AND THE GOVERNMENT IS UNDER

NO OBLIGATION TO AWARD A CONTRACT AS A RESULT OF THIS NOTICE. NO

Page 2 of 4 Pages

FUNDS ARE AVAILABLE TO PAY FOR PREPARATION OF RESPONSES TO THIS

NOTICE. ANY INFORMATION SUBMITTED BY RESPONDENTS IS STRICTLY

VOLUNTARY.

CONTRACT/PROGRAM BACKGROUND: New Requirement

REQUIRED CAPABILITIES:

1) The DoD EISS team supports an extremely broad yet technically detailed focus area. Our mission is to support DoD customers in using existing and emerging Endpoint capabilities, DoD EISS team must perform architecting, engineering, and testing (to include, but not limited to design, development, integration, implementation, supported the Authorization process and data analysis), continuing implementation of updates and upgrades for Endpoint Protections. Describe and provide an example of your company’s experience Developing architecture documents to include adoption of relevant architectural and reference design, development, integration, implementation, accrediting and data analysis.

2) DoD EISS exists to support our customers; therefore, customer support and outreach are our top priorities. Describe and provide an example of your company’s experience with collaborating and inputs to test events, configuration management, release management, lifecycle development, sustainment, and Concept Development and the supported documentation for those activities.

3) DoD EISS creates the Cyber Threat Security Plan that conforms to the Defense Federal

Acquisition Regulation Supplement (DFARS) Subpart 204.73, Safeguarding Unclassified

Controlled Technical Information, DFARS Clause 252.204-7012, Safeguarding unclassified controlled technical information, and DoD, DISA, National Institute of

Standards and Technology (NIST), and other federally mandated regulations, instructions, procedures, and laws. Describe and provide an example of your company’s experience developing and implementing a Cyber Threat Security Plan.

4) The DoD EISS team utilizes NIST standards for RMF Describe and provide an example of your company’s experience with Endpoint solutions, and government provided COTS and GOTS solutions to be certified and accredited via the NIST RMF

A&A process. System monitoring includes the security patches, hot fixes, Security

Technical Implementation Guide (STIG) updates, IAVA updates and Security

Requirements Guide (SRG) updates.

5) Describe and provide an example of your company’s experience creating and implementing a detailed Configuration Management (CM) Plan that outlines steps and procedures for making configuration changes to include track security, functional and system configurable items.

Page 3 of 4 Pages

6) DoD EISS seek innovative ways to improve the security of the Government’s endpoints, close known gaps in current technology and approaches, create solutions, and support endpoint implementation guidance. Describe and provide an example of how your company may use experienced SMEs to provide innovation.

7) The DoD EISS team must provide expertise in evaluating business operations and processes to identify areas where technical solutions would improve business performance contributing specialized knowledge and insight to solutions based on

Microsoft products and technologies. Describe and provide an example of your company’s experience working with Government at all classification to discover and implement solutions created to specifically address the needs of DoD secure configuration environment or influence the evolution with expertise in Microsoft’s tools, technologies, and products including but not limited to Microsoft 365, Power Platform, Microsoft Azure and Power BI, Microsoft Defender for Endpoint (MDE) and Intune

Microsoft Endpoint Configuration Manager (MECM) and Azure Services.

8) The DoD EISS seek to discover, understand, engineer, and deploy AI solutions to enhance endpoint protection capabilities for operating the DoDIN. Describe your company’s experience and expertise helping to develop and implement AI strategies for Government.

SPECIAL REQUIREMENTS:

• None

SOURCES SOUGHT:

The North American Industry Classification System Code (NAICS) for this requirement is

541519, with the corresponding size standard of 150.

In order to make a determination for a small business set-aside, two or more qualified and capable small businesses must submit responses that demonstrate their qualifications.

Responses must demonstrate the company’s ability to perform in accordance with FAR clause 52.219-14, Limitations on Subcontracting.

To assist DISA in determining the level of participation by small business in any subsequent procurement that may result from this Sources Sought Notice, provide information regarding any plans to use joint ventures (JVs) or partnering. Please outline the company's areas of expertise and those of any proposed JV/partner who combined can meet the specific requirements contained in this notice.

SUBMISSION DETAILS:

Responses should include:

1) Business name and address;

2) Name of company representative and their business title;

3) Small Business Socio-economic status (if small);

Page 4 of 4 Pages

4) CAGE Code;

5) Prime contract vehicles; to include ENCORE III, SETI, NIH CIO-SP4, NASA SEWP V, General Service Administration (GSA): OASIS, ALLIANT II, VETS II, STARS III, MAS (including applicable SIN(s), groups or pools), or any other Government Agency contract vehicle that allows for decentralized ordering. (This information is for market research only and businesses with a valid cage that lack prime contract vehicles are still encouraged to respond to this notice.)

Businesses who wish to respond must send a response via email NLT 4:00 PM Eastern Daylight

Time (EDT) on May 15, 2024 to Jacob M. Brauer jacob.m.brauer.civ@mail.mil. Interested businesses should submit a brief capabilities statement package addressing the specific questions above (no more than five pages) demonstrating the ability to perform the services listed under

Required Capabilities.

Proprietary information and trade secrets, if any, must be clearly marked on all materials. All information received that is marked Proprietary will be handled accordingly. All submissions become Government property and will not be returned. All government and contractor personnel reviewing submitted responses will have signed non-disclosure agreements and understand their responsibility for proper use and protection from unauthorized disclosure of proprietary information as pursuant to 41 USC 423. The Government shall not be held liable for any damages incurred if proprietary information is not properly identified.