Amended Sources Sought Cyber Security Services.pdf

DEPARTMENT OF DEFENSE

ACQUISITION DIRECTORATE

SOURCES SOUGHT NOTICE

1.0 General Information

Document Type: Sources Sought Notice Title: Cybersecurity Support Services Sources Sought Post Date: 03/12/2025 Sources Sought Response Date: 04/10/2025 NAICS Code: 541519-Other Computer Related Services Product Service Code: D310-IT and Telecom, Cyber Security and Data Backup

2.0 Background

The Washington Headquarter Service (WHS) on behalf of the Defense Security Cooperation Agency (DSCA) is releasing this solicitation. The contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to perform Cybersecurity Support Services.

3.0 Introduction

The Defense Security Cooperation Agency (DSCA) has program responsibilities regarding the sale and transfer of defense articles and services to international customers. As part of its overall responsibilities, DSCA is the Department of Defense (DoD) agency delegated the responsibility to manage the transfer, sale, and lease of U.S. military end- items under Sections 516 and 623 of the Foreign Assistance Act (FAA) of 1961 (22 U.S.C. 2321j) as amended, and Chapters 2, 3, and 6 of the Arms Export Control Act (AECA). DSCA requires contractor support pertaining to Cybersecurity Support services to best execute these responsibilities.

Information Management and Technology’s (IM&T) Role in the DSCA Mission and Security Cooperation (SC) Community is to manage a portfolio of Information Technology (IT) mission systems and services efficiently enabling the DSCA mission for the SC. IM&T operates and maintains the robust IT infrastructure relied upon by DSCA workforce and the SC community worldwide.

IM&T is working toward the integration of the SC community with streamlined mission systems and information sharing practices to (1) provide a near real-time view of enterprise community activities,

(2) facilitate organizational learning, (3) enable strategic decision making, and (4) efficiently allocate IT resources to successfully support the SC mission.

The organizational structure of IM&T is aligned functionally and highlights services including customer and requirements management, portfolio management, application development and support, help desk support, and partner relationship management. IM&T is comprised of the IT Policy and Planning Division (PPD), Technology Services Division (TSD), and Enterprise Application Development and Support Division (EADSD); IM&T is led by the Chief Information Officer (CIO) and resides within the Office of Business Operations (OBO).

4.0 Sources Sought

To facilitate market research, the Government is looking to identify qualified sources under the North American Industry Classification System (NAICS) 541519 – Other Computer Related Services. Responses are requested from “all” sources including Other than Small Businesses.

Small Businesses, 8(a) small businesses, HUBZone small businesses, Service-Disabled Veteran-Owned Small Businesses, Women-Owned Small Businesses and Economically Disadvantaged Women- owned Small Businesses are encouraged to respond.

This Sources Sought (SS) Notice is for information and planning purposes only and shall NOT be construed as a solicitation or as an obligation on the part of the Government. This notice does not obligate the Government to award a contract or otherwise pay for the information provided in the response. The Government reserves the right to use information provided by respondents for any purpose deemed necessary and legally appropriate. Any concern responding to this notice should ensure that its response is complete and sufficiently detailed to allow the Government to determine the concern’s qualifications to perform the work.

Respondents are advised that the Government is under no obligation to acknowledge receipt of the information received or provide feedback to respondents with respect to any information submitted. After a review of the responses received, a pre-solicitation synopsis and solicitation MAY be published in Contract Opportunities on SAM.gov. However, responses to this notice will not be considered adequate responses to a solicitation.

The Government will NOT accept requests for meetings or briefings. No phone solicitations or email concerning the status of the Request for Proposal (RFP) will be accepted prior to its release. Information and materials submitted in response to this notice WILL NOT be returned.

As a result of this notice, the Government MAY issue a Request for Proposal (RFP). There is no solicitation available at this time. However, should such a requirement materialize, no basis for claims against the Government will arise as a result of a response to this Sources Sought Notice, nor the Government’s use of such information as either part of our evaluation process, nor in developing specifications for any subsequent requirement.

Confidentiality: No proprietary, classified, confidential, or sensitive information should be included in your response. The Government reserves the right to use any non-proprietary technical information in any resultant solicitation.

5.0 Program Details

The Washington Headquarters Services/Acquisition Directorate (WHS/AD) is issuing this notice to obtain information to assist the DSCA in providing support for Cybersecurity Support Services.

The purpose of this Sources Sought Notice is to identify a pool of qualified offerors to provide the U.S. Department of Defense (“DoD”) with services to support Cybersecurity. The following service requirement critical task areas describe the broad range of functions and tasks in support of this effort:

6.0 Service Requirement Critical Task Areas/Elements

All submissions *must include verifiable* information about a firm’s ability to comply with the security requirements for this effort:

1) Security Clearance. The overall classification of work associated with this sources sought is at the SECRET level. The Contractor shall have a current facility clearance of SECRET at the time of proposal to work this effort. All personnel assigned to this contract must be U.S.

citizens.

2) Task Areas. Capability statements should address the Task Areas and Key Capabilities identified below and for each provide information to demonstrate how the offeror’s experience and recent past performance (last 3 years) is relevant to the technical areas listed, including the dollar value, period of performance, size and scope of the offeror’s prior contracts. Offeror’s can address one, all, or a combination of the task areas identified below. Please identify which specific task areas are addressed in the capability statement.

Task 1 Governance and Strategy

• The contractor shall Input into the CYBR 5- and 8-year strategy that aligns to DSCA agency mission/strategy, DSCA CIO initiatives, and DOD CIO and Joint Force Headquarters Department of Defense Information Network (JFHQ-DODIN) strategy with anticipation of updates to audit and inspection metrics that CYBR will need to address.

• CYBR Team Performance, The contractor shall provide strategic and programmatic input in order to leverage performance goals to meet stated vision, strategy, and objectives. These efforts are to assist with the task of supporting annual objectives that are developed by CYBR Program Leads and tied to CYBR objectives and strategy for the Branch. These are tracked and discussed regularly with work tracked via Jira.

Other Tasks: The primary tasks for Cybersecurity Support services are:

• Governance and Strategy

• Cybersecurity Compliance

• IT Enterprise Risk Management

• Cybersecurity Operations

• Cybersecurity Compliance Support

• Cybersecurity Risk Support

• Cybersecurity Operations Support

• Cybersecurity Governance Support

• Strategic and Program Support Enhancements

• Advisory Services to improve policy, process, and procedure for CYBR overall

Place of Performance: The majority of the work associated with this effort is anticipated to be performed at the Contractor’s facility or when necessary, at DSCA Headquarters (HQ) in Arlington, VA and NSA Mechanicsburg, PA.

7.0 Capability Statements

Offerors must demonstrate their ability to comply with the requirements in this Sources Sought in order to be considered capable of satisfying the Government’s requirement.Security Capability information must be displayed on page 1 of the response.

All interested offerors having the experience, skills and capabilities necessary to perform the stated requirements are requested to provide capability statements not to exceed 5 pages in “Times New Roman” 12-pitch font on 8.5 x 11 paper that include the following information:

1) Company name, address, point of contact name, telephone, and email address.

2) CAGE Code and DUNS Number.

3) Business size status (business size/socio-economic category must be submitted to be used).

4) Offeror acknowledgement and capability to provide personnel that will need to successfully pass a National Agency Check.

5) Identify contracts your company has been awarded under NAICS: 541611 – Administrative Management and General Management Consulting Services.

Additional information on NAICS codes can be found at www.sba.gov.

6) Recommended/suggested NAICS codes for this effort.

7) Recommended/suggested contract type.

8) Number of contracts currently held with the Government to include any Federal

Supply Schedules listed under GSA Advantage.

9) Documentation that addresses each of the nine (4) Service Requirement Critical

Tasks/Elements detailed above.

10) A description of Corporate Experience & Past Performance Information for similar contracts and/or projects accomplished within the last 3 years. The description must include where, when, and for whom each similar contract and/or project was performed and a brief description of each contract and/or project, including the size, scope, dollar value, and period of performance. This information must demonstrate how the offeror’s recent Corporate Experience and Past Performance (last 3 years) is relevant to the TEAMS Requirement.

8.0 Submission Instructions

The response to this notice is limited to five (5) single sided pages including all attachments, charts, etc. (single spaced, 12-point font minimum excluding charts and graphics) and should also include current business size status, and any applicable Federal Supply Schedule(s). This indication should be clearly marked on the first page of the response, as well as the eligible business concern’s name, point of contact, address, and cage code.

All responses to this Sources Sought Notice must be submitted electronically (via e-mail) to the WHS NCR AD Mailbox DSCA Group repository inbox at whs.ncr.ad.mbx.dsca-group@mail.mil.

The subject of the email must be titled “Sources Sought: “Cybersecurity Support Services” Facsimile responses will not be accepted.

To facilitate a timely and comprehensive review of all submitted responses, offerors must respond using the format requested in this Notice. Any deviation from this format may lead to the rejection of the response.

9.0 Common Cut-off Time/Date

Responses to the information above are due no later than 4:30 PM on Thursday, April 10, 2025.

Responses received after this date and time may not be considered.

http://www.sba.gov/ mailto:whs.ncr.ad.mbx.dsca-group@mail.mil

ATTACHMENT 1

CONTRACTOR CAPABILITY INFORMATION

Part I. Business Information

Please provide the following business information for your company/institution and for any teaming or joint venture partners:

Company/Institute Name:

Address:

Point of Contact:

CAGE Code:

Phone Number:

E-Mail Address:

Web Page URL:

Size business pursuant to North American Industry Classification System (NAICS) Based on the above NAICS Code, state whether your company is:

Small Business (Yes/No) Woman Owned Small Business (Yes/No) Small Disadvantaged Business (Yes/No) 8(a) Certified (Yes/No) HUBZone Certified (Yes/No) Veteran Owned Small Business (Yes/No) Service Disabled Veteran Small Business (Yes/No) Central Contractor Registration (CCR) (Yes/No)

A statement as to whether your company is domestically or foreign owned (if foreign, please indicate the country ownership).

List of any applicable Federal Supply Schedules and expiration dates: