832469106_RFI_ RE3.pdf

REQUEST FOR INFORMATION - 832469106

Defense Information Systems Agency (DISA) Threat Mitigation Division (RE3) is seeking information from industry to assist with the development and planning of a potential new requirement.

THIS IS A REQUEST FOR INFORMATION (RFI) NOTICE ONLY. THIS IS NOT A

REQUEST FOR PROPOSALS (RFP). NO SOLICITATION IS AVAILABLE AT THIS TIME.

1. Overview/Purpose/ Description of Procurement DISA is leaning forward in leveraging advanced third-party solutions in order to (IOT) better assess cyber supply chain risk. The increased reliance of commercial-off-the-shelf (COTS) has required the use of various devices, services, and technology instantiations, for which provenance and pedigree have not been assessed or verified. As a result, DISA has determined that there is a need to explore third party solutions to assess information, communication and technologies (ICT) for rogue and counterfeit components.

2. Scope of Effort

DISA Threat Mitigation Division (RE3) requires expert contractor assistance to provide hardware counterfeit detection IOT refine DISA’s Extensible Bill of Materials (xBOM) capabilities to identify and mitigate rogue, counterfeit and/or white labeled devices within the DISA supply chain.

3. Technical Characteristics This should include (but not limited to) supporting the following key areas:

• Ensure network and Universal Serial Bus (USB) peripheral devices are interrogated at the layer 1 (physical layer) before being connected to the Department of Defense Information Network (DoDIN) or Defense Information System Network (DISN).

o Must be able to test devices up to 100 gigabits.

o Must be able to test fiber optical, serial, USB, and ethernet ports.

• Provide offsite technical subject matter expertise (SME) and any personnel that are identified to support the DISA xBOM effort who do not have a technical background must be approved by the DISA SCRM Team Lead.

o The original equipment manufacturer (OEM) SME technical support will be proficient with the testing equipment.

o SME Technical support will be provided during the business hours of the time zone the assessment is being conducted.

o In the event of a possible rogue/counterfeit device is found all RFIs or inquiries must be answered within 12 hours of notification.

o All emailed notifications of possible or confirmed rogue/counterfeit devices will be acknowledged via email by third-party representatives within one business day.

• The initial training, which will take place at the Contractor’s location, will not exceed three business days, and shall include:

o A full walkthrough/demonstration of both the dashboard and the testing of USB peripheral and network devices with the mobile test kits.

o Conduct testing with mobile test kits on not less than three different USB peripheral and three different network devices.

• The tool kit must be portable on commercial travel.

• The kit should have ethernet, WiFi, and 4G/5G capabilities.

4. Requested Information

Please include in your response the following:

1. Please describe in detail the capabilities that the product(s) can deliver for each required technical characteristic (key areas) mentioned above.

• Due to the robust inventory of Network and USB peripheral devices, test kits must be able to test at a network speed of 100 gigabitsIOT ensure that the maximum number of devices in our inventory are able to be tested.

• The test kits must be able to connect to devices by utilizing fiber optical, serial, USB, and ethernet ports.

• The OEM SME technical support will be proficient with the testing equipment IOT provide technical support to the DISA xBOM mobile team to resolve any issues during the proof of concept.

• SME Technical support will be provided during the business hours of the time zone the assessment is being conducted to ensure the xBOM mobile team has technical support during the proof of concept.

• The initial training shall include a full walkthrough/demonstration of both the dashboard and the testing of USB peripheral and network devices with the mobile test kits to ensure the xBOM mobile team is proficient on the test equipment.

• Initial testing shall include conducting testing with mobile test kits on not less than three different USB peripheral and three different network devices to ensure xBOM mobile team is proficient on the test equipment.

• The tool kit must be portable on commercial travel due to the various locations assessments will be conducted.

• The kit should have ethernet, WiFi, and 4G/5G capabilities IOT ensure connectivity to the solution provider’s dashboard.

2. Is the solution commercially available and what customers have used/currently use the solution?

3. What is the timeline for the test kit to test individual devices both network and USB peripheral?

4. What technical knowledge will DISA personnel need to have to be able to operate the test kits? DISA SCRM Analysts will have a background in hardware and ICT devices. Any additional training specific to a Hardware Bill of Material (HBOM) test solution will need to be given to DISA personnel by the solution owner.

Please include the following non-technical information:

1) Business name and address;

2) Name of company representative and their business title;

3) Type of Small Business;

4) CAGE Code;

5) Your contract vehicles that would be available to the Government for the procurement of the product and/or service, to include ENCORE III, SETI, NIH, NASA SEWP V, DoD ESI, General Service Administration (GSA): OASIS, ALLIANT II, VETS II, STARS III, Federal Supply Schedules (FSS) (including applicable SIN(s)), or any other Government Agency contract vehicle that allows for decentralized ordering. (This information is for market research only and does not preclude your company from responding to this notice.)

RESPONSE GUIDELINES:

Interested parties are requested to respond to this RFI with a white paper. Submissions cannot exceed 20 pages, single spaced, 12-point type with at least one-inch margins on 8 1/2” X 11” page size. The response should not exceed a 5 MB e-mail limit for all items associated with the RFI response. Responses must specifically describe the contractor’s capability to meet the requirements outlined in this RFI. Oral communications are not permissible. SAM.gov will be the sole repository for all information related to this RFI.

Companies who wish to respond to this RFI should send responses via email no later than April 3, 2024 at 9:00am EST to Amanda Thole, amanda.l.thole.civ@mail.mil, Danni Schwend, danielle.m.schwend.civ@mail.mil and Kimberly Finkey, kimberly.s.finkey.civ@mail.mil.

INDUSTRY DISCUSSIONS:

DISA representatives may choose to meet with potential offerors and hold one-on-one discussions. Such discussions would only be intended to obtain further clarification of potential capability to meet the requirements, including any development and certification risks.

QUESTIONS:

Questions regarding this announcement shall be submitted in writing by e-mail to Amanda Thole, amanda.l.thole.civ@mail.mil, Danni Schwend, danielle.m.schwend.civ@mail.mil and Kimberly Finkey, kimberly.s.finkey.civ@mail.mil. Verbal questions will NOT be accepted.

Answers to questions will be posted to SAM.gov. The Government does not guarantee that questions received after April 3, 2023 at 9:00am EST will be answered. The Government will not reimburse companies for any costs associated with the submissions of their responses.

DISCLAIMER:

mailto:amanda.l.thole.civ@mail.mil mailto:danielle.m.schwend.civ@mail.mil mailto:amanda.l.thole.civ@mail.mil mailto:danielle.m.schwend.civ@mail.mil

This RFI is not a Request for Proposal (RFP) and is not to be construed as a commitment by the Government to issue a solicitation or ultimately award a contract. Responses will not be considered as proposals nor will any award be made as a result of this synopsis.

All information contained in the RFI is preliminary as well as subject to modification and is in no way binding on the Government. FAR clause 52.215-3, “Request for Information or Solicitation for Planning Purposes”, is incorporated by reference in this RFI. The Government does not intend to pay for information received in response to this RFI. Responders to this invitation are solely responsible for all expenses associated with responding to this RFI. This RFI will be the basis for collecting information on capabilities available. This RFI is issued solely for information and planning purposes. Proprietary information and trade secrets, if any, must be clearly marked on all materials. All information received in this RFI that is marked “Proprietary” will be handled accordingly. Please be advised that all submissions become Government property and will not be returned nor will receipt be confirmed. In accordance with FAR 15.201(e), responses to this RFI are not offers and cannot be accepted by the Government to form a binding contract.