USHMM_RFI Managed IT Security and MSSP Services.pdf

UNITED STATES HOLOCAUST MEMORIAL

MUSEUM

REQUEST FOR INFORMATION (RFI)

Comprehensive Managed IT Security, Multi-Cloud/DevSecOps Architecture, Network Engineering, and Specialized MSSP Operational Services Solicitation / Market Research Tracking Number: USHMM-RFI-2027-MSSP

DISCLAIMER / MARKET RESEARCH NOTICE:

This Request for Information (RFI) is issued solely for information gathering and planning purposes. It does not constitute a Request for Proposal (RFP), Invitation for Bid (IFB), or an obligation on the part of the United States

Holocaust Memorial Museum (USHMM) to acquire any products or services. Responses to this notice are not offers and cannot be accepted by USHMM to form a binding contract. Responders are solely responsible for all expenses associated with responding to this RFI.

I. Executive Summary and Strategic Purpose The United States Holocaust Memorial Museum (USHMM) is conducting formal market research to evaluate commercial vendor capabilities, industry pricing benchmarks, federal/commercial labor rates, and available contract acquisition vehicles (e.g., GSA MAS SIN 54151HACS, NASA SEWP, CIO-SP3/4, SAM.gov) for re-procuring comprehensive Managed Information Technology (IT) Security, Multi-Cloud/DevSecOps Architecture, Network Engineering, and specialized Managed Security Service

Provider (MSSP) operational activities.

The primary objective of this market research effort is to evaluate whether competitive commercial marketplace capabilities exist to:

● Sustain, support, and execute day-to-day operations across USHMM's existing "As-Is" security infrastructure without operational disruption or increased organizational risk.

● Perform rigorous security architecture evaluations, threat modeling, gap analyses, and compliance assessments against industry-best security and privacy standards (NIST SP 800-53 r5, FISMA, PCI DSS v4.2.1, CISA Zero Trust Maturity Model, CSF 2.0).

● Architect and recommend a modernized, cost-effective "To-Be" security state incorporating Zero

Trust architecture, automated orchestration, tool consolidation, and a Government Owned

Contractor Operated (GOCO) Security Operations Center (SOC) framework.

● Execute a seamless, structured transition lifecycle from the "As-Is" state to the "To-Be" operational model within strict schedule and budget parameters.

II. Background and Operational Baseline USHMM’s cybersecurity footprint has expanded significantly in response to accelerated multi-cloud migrations (Amazon Web Services [AWS] and Google Cloud Platform [GCP]), zero-trust network segmentation mandates, hybrid remote access requirements, and rigorous compliance targets. The current security environment maintains a high operational volume, averaging 4,000+ security operational tickets per month, 1,200 endpoints, and 800 users

Core Staffing & Leadership Model:

The current contract baseline provides dedicated Chief Information Security Officer (CISO) strategic governance combined with hands-on operational execution supported by six core technical roles:

● Chief Information Security Officer (CISO) – Strategic governance, security architecture, executive reporting, audit leadership.

● Security Architect – Zero trust design, cloud security architecture, control frameworks.

● Security Operational Support – NGFW, endpoint security, Daily operational ticket resolution, multiple-system health maintenance, security tool integrations.

● Security Analyst – Threat hunting, detection and response, Tier 2/3 incident response, log analysis, SIEM monitoring.

● AWS Architect / DevSecOps Oversight – Multi-cloud security, SCPs, IaC pipeline security (Terraform), CNAPP.

● Network / System Engineer – NGFW security and tuning, SASE/ZTNA, NAC, wireless security, endpoint (user and sever) controls.

III. USHMM "As-Is" Security Stack Matrix (Aligned to CISA Zero Trust Pillars) To ensure respondents fully understand the current environment, the table below provides the full

USHMM "As-Is" Security Tool Matrix mapped across the CISA Zero Trust Maturity Model pillars and cross-cutting capabilities:

Zero Trust Pillar / Layer Deployed Technologies & Tooling

Operational Capabilities & Scope

Identity Pillar Okta, Delinea (PAM), Active Directory

(Core Directory/Auth), Proofpoint, CP

Harmony Identity and compliance

MFA, SSO, SAMLv2, OIDC, Privileged

Access Management, Real-time AD

Audit Pin tracking, JIT workflows, Human identity risk scoring.

Devices Pillar Armis Centrix, Check Point Harmony

Endpoint, SentinelOne, Morphisec, Jamf Pro , CP Harmony Mobile, IT/IoT/OT asset discovery and control, EPP/EDR/DLP, Moving Target

Defense, Apple MDM/configuration, mobile threat defense, continuous

Rapid7 InsightVM, CP Infinity IoT

Protection, Forescout vulnerability scanning, IoT security, network access control

Networks Pillar Check Point Quantum NGFW, Forescout NAC, CP Harmony SASE, Fortinet NDR, CP Exposure

Management, Gigamon / Glimpse

Microsegmentation, ACL, App filtering, VPN segmentation, SSL inspection, IPS, VLAN termination, Network Access Control, Secure

Access Service Edge / ZTNA, Network

Detection & Response, FW policy optimization, traffic visibility fabric.

Apps & Workloads Pillar CP CloudGuard WAF, CP CloudGuard

Posture (CSPM/CWPP/CNAPP), CP

Harmony Email & Collaboration, CPInfinity XDR/XPR

Web/API security, cloud security posture management, container/workload security, email & collaboration security including

SPAM/Phishing, Malware detection, DNS/DKIM monitoring and SSPM, multi-vector endpoint detection and response.

Data Pillar Varonis, CPHarmony Endpoint DLP, Cohesity, UpGuard Data classification, access & Network account governance for on-prem and cloud resources, shared drive explicit

ACL auditing/remediation, data loss prevention, air-gapped backups

(30d+ retention), Real-time third-party supply chain risk assessment.

Visibility & Analytics (Cross-Cutting)

LogRhythm (SIEM), Check Point

Infinity Events & AIOps, Gigamon, Fortinet NDR, SolarWinds, Rapid7, Deception/Honeypots

(SentinelOne/Harmony/Morphisec)

Centralized log aggregation, security

(CP) event correlation, network detection & response, deception technology, full-stack telemetry enrichment.

Automation & Orchestration (Cross-Cutting)

Torq (Hyperautomation), Check Point

Infinity Playbooks (SOAR) with Hyper agents, SentinelOne Autonomous

Response

Automated incident response playbooks, security orchestration, autonomous endpoint isolation, ticket workflow automation.

Governance & Audit (Cross-Cutting)

UpGuard (TPRM), Proofpoint

Awareness, CP Exposure

Management, SolarWinds, Rapid7

InsightVM and Armis Viper

Third-party vendor risk assessment, security awareness training, continuous compliance tracking

(FISMA, NIST SP 800-53 r5, PCI DSS v4.2.1), Vulnerability Management

Note on Interoperability: All listed tools in the As-Is environment are deeply integrated to enrich telemetry data for AI/ML automated detection and maintain a unified operational view across the GoCo SOC model.

IV. Detailed Functional Requirements & Operational Domains Vendors must demonstrate robust capability across five primary operational domains:

1. Multi-Cloud Security Management (AWS & GCP)

● Creation, auditing, and maintenance of Service Control Policies (SCPs) and granular Identity and

Access Management (IAM) permissions across multi-cloud environments.

● Edge defense configuration and continuous rule-tuning for Check Point WAF/WAAP, AWS Shield, and

Cloud (Check Point vSEC) Network Firewalls.

● Administration of cloud-native security services (AWS Inspector, GuardDuty, Security Hub, CloudTrail log retention, Rapid7, others as required).

● Maintenance of Infrastructure as Code (IaC) security using Terraform modules and continuous posture management via Check Point CloudGuard CNAPP/CSPM.

2. Active Directory (AD) & Privileged Access Management (PAM)

● Real-Time Object Lifecycle Tracking: Continuous monitoring of the AD (via Okta, AdManage and

Varonis) to detect creation, modification, and deletion of user, group, and computer objects.

● Privileged Membership Alerting: Instant alerting on unauthorized modifications or additions to sensitive administrative groups (e.g., Domain Admins) using varonis or AdManage.

● Executive Reporting: Automated compilation of daily audit logs into executive summary reports for the CIO and CISO.

● PAM & Zero Trust Alignment: Enforcement of Least Privilege via Microsoft LAPS, Delinea PAM, Just-in-Time (JIT) elevation, SAML/OIDC SSO integrations, session recording, and periodic privilege access certification.

3. Storage & Shared Drives Access Governance

● Explicit User-Level ACL Auditing & Remediation: Systematic scanning and removal of explicit user-level Access Control Lists (ACLs) on shared network drives (on-prem and cloud), enforcing group-based access via Active Directory and IAM Security Groups.

● Access Baseline Enforcement: Automated detection of ACL drift, auditing of "Everyone" or

"Authenticated Users" permissions, sensitive data logging, and recursive permission checks to fix broken inheritance.

4. Endpoint, MDM, & Server Hardening

● Server & Endpoint Infrastructure: Maintenance of security baselines (CIS Benchmarks), patch management enforcement (OS and Application), and immediate host isolation protocols during active incidents.

● Apple Mobile Device Management (Jamf Pro): Administration of Jamf Pro (mandating staff holding

Jamf Level 300 Certification) and Apple Configurator to deploy security profiles, complex password policies, FileVault encryption, OS and application patching, and remote wipe capability.

● Non-Standard IT Asset Protection: Monitoring specialized operational technology (OT) assets, including Building Management Systems (BMS), environmental climate monitoring for artifact collection preservation, and interactive exhibit systems.

5. Network, WiFi & Monitoring Infrastructure

● Wireless Network Security: Management of Aruba Central to define security baselines, conduct gap analyses against standards, and publish prioritized risk remediation backlogs.

● Network Fabric & Traffic Inspection: Administration of enterprise WAN/LAN switching fabric, MPLS connections, SolarWinds network performance monitoring, and Gigamon traffic aggregation.

● NGFW management for ACL control and threat protection, VPN termination and cluster management.

V. The "As-Is" to "To-Be" Transformation Lifecycle Model

A central requirement of this procurement is managing each part of the transformation lifecycle.

Vendors must respond with specific methodologies for each of the four phases below:

Phase Phase Title Core Objectives & Operational

Expectations

Phase 1 Support 'As-Is' Seamlessly assume operational control and daily ticketing support for USHMM's legacy and hybrid security infrastructure without service interruption or degradation in SOC responsiveness.

Phase 2 Evaluate 'As-Is' Perform comprehensive architecture gap analyses, threat modeling, and risk assessments against NIST SP

800-53 r5, FISMA, and CISA Zero

Trust Maturity Model benchmarks.

Phase 3 Recommend 'To-Be' Architect an optimized, modernized

Zero Trust security posture. Provide recommendations for tool consolidation, automation playbooks, and a cost-effective co-managed SOC model with shared dashboard visibility.

Phase 4 Execute Transition State Implement a structured, low-risk transition-in/transition-out migration plan to achieve the recommended

'To-Be' architecture while maintaining continuous 24/7 monitoring and regulatory compliance.

VI. Vendor Requested Information & Questionnaire Interested commercial vendors are requested to submit a structured response addressing the following six core sections:

1. Corporate Information & Contracting Vehicles

● Company Name, UEI/DUNS Number, CAGE Code, Primary Point of Contact (Name, Title, Email, Phone).

● Business Size and Socioeconomic Status (e.g., Small Business, 8(a), SDVOSB, WOSB, HUBZone, Large

Business).

● Available Contract Vehicles (e.g., GSA MAS SIN 54151HACS, NASA SEWP V, CIO-SP3/4, OASIS, or other GWACs). Specifically indicate SIN 54151HACS sub-categories held (High-Risk System

Assessment, Incident Response, Vulnerability Assessment, DevSecOps).

2. Integrated CISO & MSSP Operational Capabilities

● Describe your firm's experience providing Cyber Compliance and Risk Manager paired with hands-on

MSSP operational execution.

● Provide examples of managing complex, integrated tool stacks similar to USHMM's 25+ tool environment across Identity, Devices, Networks, Apps, Data, and SIEM/SOAR.

3. Key Technical Domain Qualifications

● Detail experience with real-time Active Directory Audit tracking, Admanage, and Varonis ACL auditing/remediation.

● Detail experience in supporting CP NGFW, advanced threat protection and threat hunting capabilities

● Supporting multi-stack security endpoint architecture.

● Confirm staff availability holding Jamf Level 300 Certifications for Apple MDM management.

● Detail the cloud security capabilities across AWS/GCP (SCPs, Terraform IaC, Check Point CloudGuard

CNAPP, WAF/WAAP tuning).

4. Transformation Lifecycle & Transition Approach

● Describe your proposed methodology for assuming operations of an incumbent tool stack (Phase 1) without disruption.

● Outline your framework for conducting gap analyses (Phase 2), recommending a Zero Trust To-Be state (Phase 3), and executing transition-in within 30-60 days (Phase 4).

5. Labor Categories & Certification Baselines

● Confirm whether your firm currently employs personnel with the following mandatory/preferred certifications:

➢ Cloud Architecture & Security: AWS Certified Security - Specialty, AWS Certified Solutions

Architect Professional, CISSP-ISSAP/ISSEP.

➢ Apple Endpoint Management: Jamf Certified Admin (Level 300) or Jamf Certified Expert (Level

400).

➢ Identity & PAM: Certified IAM Specialist, Delinea/Okta Certified Professional.

➢ General Governance & Incident Response: CISSP, CISM, CISA, GIAC (GCIH, GCFA, GNFA).

6. Pricing Benchmarks & Market Rate Expectations

● Provide feedback on the commercial feasibility of managing this scope under a Firm-Fixed-Price (FFP) monthly fee structure.

● Provide fully burdened hourly commercial labor rates or GSA schedule rates in the Washington, DC

Metropolitan Area for equivalent labor categories (CISO, Security Architect, DevSecOps Engineer, Security Analyst, Network/System Engineer).

VII. Submission Instructions & Response Format

● Response Deadline: All responses shall be submitted electronically no later than October 30, 2026, at

5:00 PM EDT.

● Submission Format: Responses must be submitted in PDF or Microsoft Word format, strictly limited to no more than fifteen (15) pages (excluding cover page and labor rate tables).

● Point of Contact: Submissions and any clarifying technical inquiries must be emailed to Mary Green, USHMM Contracting Officer at magreen@ushmm.org with the subject line "RFI Response - USHMM Managed IT Security & MSSP Services".

VII. Submission Instructions & Response Format