832469639 NTVP SSN_repost FINAL.pdf

Page 1 of 5 Pages

SOURCES SOUGHT NOTICE

Tracking Number 832469639

The Defense Information Systems Agency (DISA) Internet Protection Branch (ID51) is seeking sources for Network Threat Visibility and Protection – Engineering & Program Management Support

CONTRACTING OFFICE ADDRESS: DISA/Defense Information Technology Contracting Organization (DITCO)/PS8311 – Scott Air Force Base, IL 62225-5406

INTRODUCTION:

This is a REVISED SOURCES SOUGHT NOTICE to determine the availability and technical capability of small businesses (including the following subsets: Small Disadvantaged Businesses, Certified 8(a), Service-Disabled Veteran-Owned Small Businesses, HUBZone Small Businesses and Woman-Owned Small Businesses) to provide the required products and/or services.

NOTE: THIS SOURCES SOUGHT NOTICE IS FOR THE SAME REQUIREMENT THAT

WAS ORIGINALLY POSTED ON THE WEBSITE SAM.GOV ON JUNE 18, 2024, UNDER

THE SAME TRACKING NUMBER. THIS REPOSTED SOURCES SOUGHT NOTICE IS

REVISED TO CLARIFY THAT ONLY TIER III ENGINEERING SUPPORT IS REQUIRED,

NOT TIER II. ATLHOUGH THE PREVIOUS SOURCES SOUGHT NOTICE DISCUSSED

BOTH TIER II AND TIER III SUPPORT, THE REQUIRED CAPABILITY QUESTION

INVOLVING TIER III SUPPORT HAS BEEN REVISED TO CLARIFY THAT THIS

REQUIREMENT DOES NOT PERFORM TIER II SUPPORT. VENDORS THAT HAVE

SUBMITTED A RESPONSE TO THE ORIGINAL SOURCES SOUGHT NOTICE THAT

WAS POSTED ON JUNE 18, 2024 WILL NEED TO SUBMIT A NEW OR UPDATED

RESPONSE TO THIS REPOSTED SOURCES SOUGHT NOTICE IN ORDER TO BE

CONSIDERED AS A POTENTIAL SMALL BUSINESS SOURCE.

DISA is seeking information from potential sources for:

Web Content Filtering (WCF), Enterprise Break and Inspect (EBI) and NIPRNet (Non- Classified Internet Protocol Router Network) Federated Gateway (NFG) Engineering and Tier III Support Services.

The program office (Internet Protection Branch ID51) supports two cybersecurity systems, WCF and EBI, connected to the Internet Access Points (IAPs) backbone and the routing and security on the NIPRNet Federated Gateway backbone. The WCF system is designed to manage both NIPRNet-Originated and Internet-Originated client Web traffic that traverses the NIPRNet/Internet boundary. This is accomplished by providing Department of Defense (DoD) positive control of all traffic, except for Ports 25 Simple Mail Transfer Protocol (SMTP) and 53 Domain Name System (DNS) content that enters the NIPRNet into and from the Internet. The EBI system is designed for NIPRNet-initiated/outbound encrypted traffic traversing to the Internet – the full outbound session of traffic is decrypted and inspected by WCF and SharkSeer then re-encrypted and continues to its destination. NFG provides a secure, robust and scalable means for non-DoD Federal Agencies and Mission Partners to connect and transfer data to and from NIPRNet. The current infrastructure for the programs is comprised of Palo Alto Next

Page 2 of 5 Pages

Generation firewalls, F5 Secure Sockets Layer (SSL) Orchestrators, Juniper routers, and a Splunk logging system.

The anticipated Period of Performance is September 28, 2025, to September 27, 2030, inclusive of one 1-year base period and four 1-year option periods.

The anticipated Place of Performance: Primary location is DISA HQ, 6900 Cooper Ave. Ft.

Meade, MD. Secondary location for occasional meetings is contractor facility/location.

DISCLAIMER:

THIS SOURCES SOUGHT NOTICE IS FOR INFORMATIONAL PURPOSES ONLY. THIS

IS NOT A REQUEST FOR PROPOSAL. IT DOES NOT CONSTITUTE A SOLICITATION

AND SHALL NOT BE CONSTRUED AS A COMMITMENT BY THE GOVERNMENT.

RESPONSES IN ANY FORM ARE NOT OFFERS AND THE GOVERNMENT IS UNDER

NO OBLIGATION TO AWARD A CONTRACT AS A RESULT OF THIS NOTICE. NO

FUNDS ARE AVAILABLE TO PAY FOR PREPARATION OF RESPONSES TO THIS

NOTICE. ANY INFORMATION SUBMITTED BY RESPONDENTS IS STRICTLY

VOLUNTARY.

CONTRACT/PROGRAM BACKGROUND:

Contract Number: HC1028-18-D-0009 Task Order Number: HC1028-20-F-6160 Contract Vehicle: ENCORE III Full & Open Suite Incumbent and their size: Electronic Consulting Services (ECS) Federal, LLC, Large Business Method of previous acquisition: Fair Opportunity Period of performance: One-year base period and four one-year option periods

Base Year: September 28, 2020 - September 27, 2021 Option Year (OY) 1: September 28, 2021 - September 27, 2022 OY2: September 28, 2022 - September 27, 2023 OY3: September 28, 2023 - September 27, 2024 OY4: September 28, 2024 - September 27, 2025

REQUIRED CAPABILITIES:

The Government requires advanced engineering support in order to provide Tier III support for the existing WCF EBI and NFG Programs that provide protections at the DoD IAPs.

1. Tier III Engineering Support

The Web Content Filtering-Enterprise Break & Inspect (WCF-EBI) and NIPRNet Federated Gateway (NFG) team is responsible for providing Tier III support to identify, Page 3 of 5 Pages isolate and resolve software anomalies. This support includes testing, and evaluating new versions of network firewall policies, testing new signature updates and databases, testing and releasing new operating system (OS) updates for supporting servers, and working trouble tickets that are escalated when Tier I and Tier II are unable to resolve. Some situations may require the team to reach out to vendor support to provide a resolution.

Describe and provide an example of your company’s experience with identifying, isolating, and resolving software anomalies. In addition, describe and provide an example of your company’s process of providing support when software bugs are identified due to customer feedback or vendor notification.

2. System Evolution, Research, Innovation, and Improvement

The WCF-EBI and NFG Programs are always evolving to stay ahead of software /hardware weaknesses/vulnerabilities, back doors access, and any adversaries tools / process to gain unauthorized access or bypass security in place.

Describe and provide an example of your company’s experience with network architecture design and analysis of new features and future changes relating to the WCF EBI & NFG infrastructure, including but not limited to, researching new products (hardware and/or software) based on evolving technologies, and implementing/integrating new improvements and technologies with the current network firewall configuration.

3. Testing and Integration

The WCF-EBI and NFG team routinely perform tests on the system environment to ensure all software, hardware, patches, and updates are compatible, safe, and secure prior to release to the DoD network.

Describe and provide an example of your company’s experience with developing, writing, and executing test plans for all enhancements and modifications to a system.

This can include but is not limited to, experience in using network traffic generators such as Ixia and Breaking Point to generate simulated network traffic, as well as testing and evaluating all hardware/software updates prior to release.

4. Program and Operational Support

The Program is responsible for creating, maintaining, and presenting a variety of documents, plans, schematics, reports, trouble tickets, logs, Standard Operating Procedures (SOPs), procedures, presentations, and briefs to senior leadership and other internal and external stakeholders as required.

Describe and provide an example of your company’s experience with program/project management, the creation of detailed project schedules, test plans, analyses of alternatives, vulnerability assessment reports, risk registers, and issue logs, as well as

Page 4 of 5 Pages briefing senior leadership, engineering panels, and stakeholders about test results, status updates, risk findings, plans, and diagrams.

SPECIAL REQUIREMENTS:

Offeror must have Top Secret Sensitive Compartmented Information (SCI) Facility Clearance at the time of proposal and award. Please provide your current Facility Clearance level.

SOURCES SOUGHT:

The North American Industry Classification System Code (NAICS) for this requirement is 541519, with the corresponding size standard of $34M.

To make a determination for a small business set-aside, two or more qualified and capable small businesses must submit responses that demonstrate their qualifications. Responses must demonstrate the company’s ability to perform in accordance with FAR clause 52.219-14, Limitations on Subcontracting.

To assist DISA in determining the level of participation by small business in any subsequent procurement that may result from this Sources Sought Notice, provide information regarding any plans to use joint ventures (JVs) or partnering. Please outline the company's areas of expertise and those of any proposed JV/partner who combined can meet the specific requirements contained in this notice.

SUBMISSION DETAILS:

Responses should include:

1) Business name and address;

2) Name of company representative and their business title;

3) Small Business Socio-economic status (if small);

4) CAGE Code;

5) Prime contract vehicles; to include ENCORE III, SETI, NIH CIO-SP4, NASA SEWP V, General Service Administration (GSA): OASIS, ALLIANT II, VETS II, STARS III, MAS (including applicable SIN(s), groups or pools), or any other Government Agency contract vehicle that allows for decentralized ordering. (This information is for market research only and businesses with a valid cage that lack prime contract vehicles are still encouraged to respond to this notice.)

Businesses who wish to respond must send a response via email NLT 12:00 PM Central Standard Time (CT) on September 10, 2024 to Susan Griffithe at susan.e.griffithe.civ@mail.mil. Interested businesses should submit a brief capabilities statement package addressing the specific questions above (no more than five pages) demonstrating the ability to perform the services listed under Required Capabilities.

Proprietary information and trade secrets, if any, must be clearly marked on all materials. All information received that is marked Proprietary will be handled accordingly. All submissions

Page 5 of 5 Pages become Government property and will not be returned. All government and contractor personnel reviewing submitted responses will have signed non-disclosure agreements and understand their responsibility for proper use and protection from unauthorized disclosure of proprietary information as pursuant to 41 USC 423. The Government shall not be held liable for any damages incurred if proprietary information is not properly identified.