832469256 Sources Sought DIBNet .docx

SOURCES SOUGHT NOTICE

832469256

The Defense Information Systems Agency (DISA) Cyber Program Executive Office (PEO Cyber), Data Analytics Program Management Office (ID6) is seeking sources for Defense Industrial Base Network (DIBNet) - Development and Sustainment

CONTRACTING OFFICE ADDRESS: Defense Information Systems Agency, Defense Information Technology Contracting Organization (DITCO)/PS8311 – Scott Air Force Base, IL 62225-5406

INTRODUCTION:

This is a SOURCES SOUGHT NOTICE to determine the availability and technical capability of small businesses and large businesses (including the following subsets: Small Disadvantaged Businesses, Certified 8(a), Service-Disabled Veteran-Owned Small Businesses, HUBZone Small Businesses and Woman-Owned Small Businesses) to provide the required products and/or services.

The DISA is seeking information from potential sources for: DIBNet - Development and Sustainment. The DISA is seeking sources for the development and sustainment of the next generation platform supporting the DIBNet. The DISA Defense Industrial Base (DIB) platform currently resides in the Amazon Web Service (AWS) Gov Cloud for information sharing and collaboration between the Department of Defense (DoD) and the DIB participants. The current DIBNet program is a cyber threat information sharing program to enhance and supplement DIB participants capabilities to safeguard the DoD information that resides on or transmits DIB unclassified networks or information systems. Building on the success of the DIBNet component of the Cyber Network Defense Tools Program task order which will expire on July 27, 2025, the new task order will be called DIBNet – Development and Sustainment. The next generation platform is envisioned to be the primary platform for cybersecurity collaboration and information sharing between the DoD and the DIB Partners.

The current DIBNet platform provides a scalable platform built upon information sharing practices to enhance collaboration between the DoD and the DIB Partners. This platform shall operate as the primary portal for a document repository, portal spaces for collaboration, and forums to discuss and share cyber threat intelligence data. The DIBNet platform shall be designed to enhance capabilities for information sharing utilizing machine-to-machine capabilities and data standards such as Structured Threat Information eXpression (STIX) and Trusted Automated eXchange of Indicator Information (TAXII). The next generation DIBNet platform shall either build upon or replace the capabilities delivered by the current solution.

The DIBNet contractor must be able to develop new capabilities based on open-source technologies as well as integrate Commercial Off-The-Shelf or third-party developed components. The contractor will be responsible for Federal Information Processing Standard full systems development life-cycle activities including requirements, development, integration, testing, certification/accreditation, and operations. This includes engineering for creating design artifacts, integration guides, user guides, system policies/procedures, technical assessments, technical recommendations, and performance metrics. Participation in various technical meetings, committees and working groups will be required as directed by the Government.

The anticipated Period of Performance is June 28, 2025 – June 27, 2029, with one 1-year base period and four 1-year option periods.

The anticipated places of performance are DISA HQ Fort Meade, MD, Department of Defense Crime Center (DC3) Linthicum Heights, MD, and The Pentagon, Washington, DC.

DISCLAIMER:

THIS SOURCES SOUGHT NOTICE IS FOR INFORMATIONAL PURPOSES ONLY. THIS IS NOT A REQUEST FOR PROPOSAL. IT DOES NOT CONSTITUTE A SOLICITATION AND SHALL NOT BE CONSTRUED AS A COMMITMENT BY THE GOVERNMENT. RESPONSES IN ANY FORM ARE NOT OFFERS AND THE GOVERNMENT IS UNDER NO OBLIGATION TO AWARD A CONTRACT AS A RESULT OF THIS NOTICE. NO FUNDS ARE AVAILABLE TO PAY FOR PREPARATION OF RESPONSES TO THIS NOTICE. ANY INFORMATION SUBMITTED BY RESPONDENTS IS STRICTLY VOLUNTARY.

CONTRACT/PROGRAM BACKGROUND:

Contract Number: HC1028-18-D0006 Task Order Number: HC1028-20-F-6103 Contract Vehicle: ENCORE III Full & Open Suite Incumbent and their size: Booz Allen Hamilton, Large Business Method of previous acquisition: Fair Opportunity Period of performance:

Base Period: August 10, 2020 – July 27, 2021 Option Year (OY) 1: July 28, 2021 – July 27, 2022 OY2: July 28, 2022 – July 27, 2023 OY3: July 28, 2023 – July 27, 2024 OY4: July 28, 2024 – July 27, 2025

REQUIRED CAPABILITIES:

Potential Offerors would be required to:

1) Describe and provide examples of your ability to configure, test and deploy applications/systems in Government approved commercial cloud environments i.e., Amazon GovCloud, Azure Government, etc. utilizing responsive design that adhere to DoD guidelines such as section 508.

2) Describe your expertise developing custom Application Programming Interface and schemas for distribution and use by other parties.

3) Describe your expertise developing and/or modifying websites that are used to collect input from user’s generally by means of forms and further analyzing or manipulating the data for inclusion in metrics, sharing to partner organizations, etc.

4) Develop portal analytics use cases and capabilities, not limited to the following, that can display portal activity/usage, login/logout/failure attempts, document analytics to whom has downloaded and viewed, as well as trend analysis of forum, topic, and discussion posts.

5) Describe your expertise with the ingestion, storing and dissemination of STIX/TAXII to share indicators of compromise and cyber threat information.

SPECIAL REQUIREMENTS:

Must have Secret Facility Clearance. Please provide your current Facility Clearance level.

SOURCES SOUGHT:

The North American Industry Classification System Code (NAICS) for this requirement is 541519 with the corresponding size standard of $34M.

In order to make a determination for a small business set-aside, two or more qualified and capable small businesses must submit responses that demonstrate their qualifications. Responses must demonstrate the company’s ability to perform in accordance with FAR clause 52.219-14, Limitations on Subcontracting.

To assist DISA in determining the level of participation by small business in any subsequent procurement that may result from this Sources Sought Notice, provide information regarding any plans to use joint ventures (JVs) or partnering. Please outline the company's areas of expertise and those of any proposed JV/partner who combined can meet the specific requirements contained in this notice.

SUBMISSION DETAILS:

Responses should include:

1) Business name and address;

2) Name of company representative and their business title;

3) Small Business Socio-economic status (if small);

4) CAGE Code;

5) Prime contract vehicles; to include ENCORE III, SETI, NIH CIO-SP4, NASA SEWP V, General Service Administration (GSA): OASIS, ALLIANT II, VETS II, STARS III, MAS (including applicable SIN(s), groups or pools), or any other Government Agency contract vehicle that allows for decentralized ordering. (This information is for market research only and businesses with a valid cage that lack prime contract vehicles are still encouraged to respond to this notice.)

Businesses who wish to respond must send a response via email NLT 12:00 PM Central Standard Time (CT) on June 4, 2024 to Rachel Arentsen at rachel.l.arentsen.civ@mail.mil. Interested businesses should submit a brief capabilities statement package addressing the specific questions above (no more than five pages) demonstrating the ability to perform the services listed under Required Capabilities.

Proprietary information and trade secrets, if any, must be clearly marked on all materials. All information received that is marked Proprietary will be handled accordingly. All submissions become Government property and will not be returned. All government and contractor personnel reviewing submitted responses will have signed non-disclosure agreements and understand their responsibility for proper use and protection from unauthorized disclosure of proprietary information as pursuant to 41 USC 423. The Government shall not be held liable for any damages incurred if proprietary information is not properly identified.

Page 2 of 4 Pages

Page 1 of 5 Pages