832469639 Network Threat Visibility Protection_SSN_FINAL.pdf

Page 1 of 5 Pages

SOURCES SOUGHT NOTICE

Tracking Number 832469639

The Defense Information Systems Agency (DISA) Internet Protection Branch (ID51) is seeking sources for Network Threat Visibility and Protection – Engineering & Program Management Support

CONTRACTING OFFICE ADDRESS: DISA/Defense Information Technology Contracting Organization (DITCO)/PS8311 – Scott Air Force Base, IL 62225-5406

INTRODUCTION:

This is a SOURCES SOUGHT NOTICE to determine the availability and technical capability of small businesses (including the following subsets: Small Disadvantaged Businesses, Certified 8(a), Service-Disabled Veteran-Owned Small Businesses, HUBZone Small Businesses and Woman-Owned Small Businesses) to provide the required products and/or services.

DISA is seeking information from potential sources for:

Web Content Filtering (WCF) Engineering and Sustainment Support Services. The WCF system was developed to meet requirements from the Joint Task Force—Global Network Operations and Information Assurance/Computer Network Defense Enterprise-wide Solutions Steering Group (IA/CND ESSG) to deploy a capability to scan and block malicious inbound and outbound traffic traversing through the Unclassified but Sensitive Internet Protocol Router Network (NIPRNet), Internet Access Points (IAPs) and the NIPRNet Federated Gateways (NFG). The current WCF system is used to protect the NIPRNet, IAP, and NFG traffic and is comprised of Palo Alto Next Generation firewalls, F5 SSL Orchestrators, Juniper routers, and a Splunk logging system. The WCF system delivers two basic enterprise-wide features:

1) outbound Uniform Resource Locator (URL) filtering on a pre-defined list or a custom-generated list created by the DISA Joint Operations Center (DJOC) and 2) inbound spyware, malware, anti-virus, and vulnerability filtering on content from Internet servers to the Department of Defense (DoD) clients. WCF reduces the attack surface and increases mission assurance by providing custom and standard URL filtering and content filtering, including anti-virus and anti-spyware signatures. WCF ensures delivery of mission critical traffic by providing dynamic rate limiting at the Internet Access Points (IAPs). WCF is deployed at six Contiguous United States (CONUS) sites and four Outside of the Contiguous United States (OCONUS) sites.

WCF functionality has evolved since its initial deployment in 2009 from providing WCF for only outbound web-borne requests to the Internet, to providing Intrusion Prevention System (IPS) functionality for both inbound and outbound traffic on all ports. The WCF system includes the capability to inspect Transport Layer Security (TLS)-encrypted web traffic.

The anticipated Period of Performance is September 28, 2025, to September 27, 2030, inclusive of one 1-year base period and four 1-year option periods.

The anticipated Place of Performance: Primary location is DISA HQ, 6900 Cooper Ave. Ft.

Meade, MD. Secondary location for occasional meetings is contractor facility/location.

Page 2 of 5 Pages

DISCLAIMER:

THIS SOURCES SOUGHT NOTICE IS FOR INFORMATIONAL PURPOSES ONLY. THIS

IS NOT A REQUEST FOR PROPOSAL. IT DOES NOT CONSTITUTE A SOLICITATION

AND SHALL NOT BE CONSTRUED AS A COMMITMENT BY THE GOVERNMENT.

RESPONSES IN ANY FORM ARE NOT OFFERS AND THE GOVERNMENT IS UNDER

NO OBLIGATION TO AWARD A CONTRACT AS A RESULT OF THIS NOTICE. NO

FUNDS ARE AVAILABLE TO PAY FOR PREPARATION OF RESPONSES TO THIS

NOTICE. ANY INFORMATION SUBMITTED BY RESPONDENTS IS STRICTLY

VOLUNTARY.

CONTRACT/PROGRAM BACKGROUND:

Contract Number: HC1028-18-D-0009 Task Order Number: HC1028-20-F-6160 Contract Vehicle: ENCORE III Full & Open Suite Incumbent and their size: Electronic Consulting Services (ECS) Federal, LLC, Large Business Method of previous acquisition: Fair Opportunity Period of performance: One-year base period and four one-year option periods

Base Year: September 28, 2020 - September 27, 2021 Option Year (OY) 1: September 28, 2021 - September 27, 2022 OY2: September 28, 2022 - September 27, 2023 OY3: September 28, 2023 - September 27, 2024 OY4: September 28, 2024 - September 27, 2025

REQUIRED CAPABILITIES:

The Government requires advanced engineering support in order to provide sustainment and support for an existing WCF solution at the DoD IAPs. The current WCF solution provides a highly critical perimeter defense capability at the Internet to NIPRnet access points for DoD NIPRnet. Based on Palo Alto Next Generation firewalls, F5 load balancers, and a Splunk logging system, it is deployed at CONUS sites and OCONUS sites. This system protects the entire DoD NIPRnet from internet borne cyber threats to DoD users. WCF functionality has evolved since its initial deployment in 2009, from providing web content filtering for only outbound web borne requests to the Internet, to providing IPS functionality for both inbound and outbound traffic on all ports with the exception of email and Domain Name System (DNS).

1. Tier III Engineering Support

The Web Content Filtering-Enterprise Break & Inspect (WCF-EBI) with NIPRNet Federated Gateway (NFG) team provides Tier II / Tier III support when requested, testing, and evaluating new versions of network firewall policies signatures, testing new signature updates and databases, testing and releasing new operating system (OS) updates

Page 3 of 5 Pages for supporting servers, and working with vendors to provide trouble ticket support for Tier II. Tier III Support identifies, isolates, and resolves software anomalies.

Describe and provide an example of your company’s experience with identifying, isolating, and resolving software anomalies without being contacted from end-users (unless Tier II and Tier III Engineers agree that direct communications are needed to resolve some issue). Also describe and provide an example of your company’s process of escalating software bugs from Tier II to Tier III Engineers.

2. System Evolution, Research, Innovation, and Improvement

The WCF-EBI with NFG system is always evolving to stay ahead of software /hardware weaknesses, back doors access, and any adversaries tools / process to gain unauthorized access or bypass security in place.

Describe and provide an example of your company’s experience with network architecture design and analysis of new features and future changes relating to the WCF & NFG system, including but not limited to, researching new products (hardware and/or software), procedures, and implementing integration with the current network firewall configuration.

3. Testing and Integration

The WCF-EBI with NFG team is always performing tests on the whole system environment to ensure all software, hardware, patches, and updates are compatible, safe, and secure prior to release to the DoD network.

Describe and provide an example of your company’s experience with developing, writing, and executing test plans for all enhancements and modifications to a system.

This can include but is not limited to, experience in using network traffic generators such as Ixia and Breaking Point to generate simulated network traffic, as well as testing and evaluating all hardware/software updates prior to release.

4. Program and Operational Support

The government team creates, maintain, and presents a variety of documents, plans, schematics, reports, trouble tickets, logs, Standard Operating Procedures (SOPs), procedures, presentations, and briefs to senior leadership and other internal and external stakeholders as required.

Describe and provide an example of your company’s experience with program / project management, the creation of detailed project schedules, test plans, analyses of alternatives, vulnerability assessment reports, risk registers, and issue logs, as well as briefing senior leadership, engineering panels, and stakeholders about test results, status updates, risk findings, plans, and diagrams.

Page 4 of 5 Pages

SPECIAL REQUIREMENTS:

Must have Top Secret SCI Facility Clearance. Please provide your current Facility

Clearance level.

SOURCES SOUGHT:

The North American Industry Classification System Code (NAICS) for this requirement is 541519, with the corresponding size standard of $34M.

To make a determination for a small business set-aside, two or more qualified and capable small businesses must submit responses that demonstrate their qualifications. Responses must demonstrate the company’s ability to perform in accordance with FAR clause 52.219-14, Limitations on Subcontracting.

To assist DISA in determining the level of participation by small business in any subsequent procurement that may result from this Sources Sought Notice, provide information regarding any plans to use joint ventures (JVs) or partnering. Please outline the company's areas of expertise and those of any proposed JV/partner who combined can meet the specific requirements contained in this notice.

SUBMISSION DETAILS:

Responses should include:

1) Business name and address;

2) Name of company representative and their business title;

3) Small Business Socio-economic status (if small);

4) CAGE Code;

5) Prime contract vehicles; to include ENCORE III, SETI, NIH CIO-SP4, NASA SEWP V, General Service Administration (GSA): OASIS, ALLIANT II, VETS II, STARS III, MAS (including applicable SIN(s), groups or pools), or any other Government Agency contract vehicle that allows for decentralized ordering. (This information is for market research only and businesses with a valid cage that lack prime contract vehicles are still encouraged to respond to this notice.)

Businesses who wish to respond must send a response via email NLT 12:00 PM Central Standard Time (CT) on July 3, 2024 to Susan Griffithe at susan.e.griffithe.civ@mail.mil.

Interested businesses should submit a brief capabilities statement package addressing the specific questions above (no more than five pages) demonstrating the ability to perform the services listed under Required Capabilities.

Proprietary information and trade secrets, if any, must be clearly marked on all materials. All information received that is marked Proprietary will be handled accordingly. All submissions become Government property and will not be returned. All government and contractor personnel reviewing submitted responses will have signed non-disclosure agreements and understand their responsibility for proper use and protection from unauthorized disclosure of proprietary

Page 5 of 5 Pages information as pursuant to 41 USC 423. The Government shall not be held liable for any damages incurred if proprietary information is not properly identified.