Cyber Security Support SSN Amendement 3-17-25.pdf

DEPARTMENT OF DEFENSE

ACQUISITION DIRECTORATE

SOURCES SOUGHT NOTICE

1.0 General Information

Document Type: Sources Sought Notice

Title: Cybersecurity Support Services Sources Sought Post Date: 03/17/2025 (Amended)

Sources Sought Response Date: 04/10/2025

NAICS Code: 541519-Other Computer Related Services

Product Service Code: D310-IT and Telecom, Cyber Security and Data Backup

2.0 Background

The Washington Headquarter Service (WHS) on behalf of the Defense Security Cooperation Agency

(DSCA) is releasing this solicitation. The contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to perform Cybersecurity Support Services.

3.0 Introduction

The Defense Security Cooperation Agency (DSCA) has program responsibilities regarding the sale and transfer of defense articles and services to international customers. As part of its overall responsibilities, DSCA is the Department of Defense (DoD) agency delegated the responsibility to manage the transfer, sale, and lease of U.S. military end- items under Sections 516 and 623 of the

Foreign Assistance Act (FAA) of 1961 (22 U.S.C. 2321j) as amended, and Chapters 2, 3, and 6 of the

Arms Export Control Act (AECA). DSCA requires contractor support pertaining to Cybersecurity

Support services to best execute these responsibilities.

Information Management and Technology’s (IM&T) Role in the DSCA Mission and Security

Cooperation (SC) Community is to manage a portfolio of Information Technology (IT) mission systems and services efficiently enabling the DSCA mission for the SC. IM&T operates and maintains the robust IT infrastructure relied upon by DSCA workforce and the SC community worldwide.

IM&T is working toward the integration of the SC community with streamlined mission systems and information sharing practices to (1) provide a near real-time view of enterprise community activities,

(2) facilitate organizational learning, (3) enable strategic decision making, and (4) efficiently allocate

IT resources to successfully support the SC mission.

The organizational structure of IM&T is aligned functionally and highlights services including customer and requirements management, portfolio management, application development and support, help desk support, and partner relationship management. IM&T is comprised of the IT Policy and Planning Division (PPD), Technology Services Division (TSD), and Enterprise Application

Development and Support Division (EADSD); IM&T is led by the Chief Information Officer (CIO) and resides within the Office of Business Operations (OBO).

4.0 Sources Sought

To facilitate market research, the Government is looking to identify qualified sources under the

North American Industry Classification System (NAICS) 541519 – Other Computer Related

Services. Responses are requested from “all” sources including Other than Small Businesses.

Small Businesses, 8(a) small businesses, HUBZone small businesses, Service-Disabled

Veteran-Owned Small Businesses, Women-Owned Small Businesses and Economically

Disadvantaged Women- owned Small Businesses are encouraged to respond.

This Sources Sought Notice (SSN) is for information and planning purposes only and shall

NOT be construed as a solicitation or as an obligation on the part of the Government. This notice does not obligate the Government to award a contract or otherwise pay for the information provided in the response. The Government reserves the right to use information provided by respondents for any purpose deemed necessary and legally appropriate. Any concern responding to this notice should ensure that its response is complete and sufficiently detailed to allow the

Government to determine the concern’s qualifications to perform the work.

Respondents are advised that the Government is under no obligation to acknowledge receipt of the information received or provide feedback to respondents with respect to any information submitted. After a review of the responses received, a pre-solicitation synopsis and solicitation

MAY be published in Contract Opportunities on SAM.gov. However, responses to this notice will not be considered adequate responses to a solicitation.

The Government will NOT accept requests for meetings or briefings. No phone solicitations or email concerning the status of the Request for Proposal (RFP) will be accepted prior to its release. Information and materials submitted in response to this notice WILL NOT be returned.

As a result of this notice, the Government MAY issue a Request for Proposal (RFP). There is no solicitation available at this time. However, should such a requirement materialize, no basis for claims against the Government will arise as a result of a response to this SSN, nor the

Government’s use of such information as either part of our evaluation process, nor in developing specifications for any subsequent requirement.

Confidentiality: No proprietary, classified, confidential, or sensitive information should be included in your response. The Government reserves the right to use any non-proprietary technical information in any resultant solicitation.

5.0 Program Details

The Washington Headquarters Services/Acquisition Directorate (WHS/AD) is issuing this notice to obtain information to assist the DSCA in providing support for Cybersecurity Support Services.

The purpose of this Sources Sought Notice is to identify a pool of qualified offerors to provide the

U.S. Department of Defense (“DoD”) with services to support Cybersecurity. The following service requirement critical task areas describe the broad range of functions and tasks in support of this effort:

6.0 Service Requirement Critical Task Areas/Elements

All submissions *must include verifiable* information about a firm’s ability to comply with the security requirements for this effort:

1) Security Clearance. The overall classification of work associated with this SSN is at the

SECRET level. The Contractor shall have a current facility clearance of SECRET at the time of proposal to work this effort. All personnel assigned to this contract must be U.S. citizens.

2) Task Areas. Capability statements should address the Task Areas and Key Capabilities identified below and for each provide information to demonstrate how the offeror’s experience and recent past performance (last 3 years) is relevant to the technical areas listed, including the dollar value, period of performance, size and scope of the offeror’s prior contracts. Offeror’s can address one, all, or a combination of the task areas identified below. Please identify which specific task areas are addressed in the capability statement.

Task 1: Governance and Strategy -

The contractor shall Input into the CYBR 5- and 8-year strategy that aligns to DSCA agency mission/strategy, DSCA CIO initiatives, and DOD CIO and Joint Force Headquarters Department of Defense Information Network

(JFHQ-DODIN) strategy with anticipation of updates to audit and inspection metrics that CYBR will need to address.

Task 2: Cybersecurity Compliance -

Tasks in this task area will be completed by ISSO Role. The contractor shall

Provide ISSO Support (6 ISSO FTEs) for the 5 IM&T Portfolios in direct support of portfolio Information Systems Security Managers (ISSMs) producing all required DOD compliance documentation for Risk Management Framework

(RMF), Audit Response and Remediation, Cyber Task Orders, Required

Scorecards, Privacy documentation, and other compliance requirements as communicated and required by DOD and as detailed in the DSCA CYBR

Service Catalog.

Task 3: IT Enterprise Risk Management Support –

Tasks in this Task area will be completed by Security Control Assessor (SCA), Lead Validator, and Controls Validators. The contractor shall support the DSCA

CYBR RMF activities in the form of Security Control Assessor Support, Controls Validation Support (RMF, IT, and Federal Information System

Controls Audit Manual (FISCAM), Support of the Cybersecurity DevSecOps

Pipeline as related to the CYBR responsibilities, and the activities detailed in the

Service Catalog. The contractor will evaluate current approaches to inspection readiness (CSSP and CORA) and provide recommendation for improving readiness on an ongoing basis to include potential automation of readiness.

Task 4: Cybersecurity Operations -

Tasks in this task area will be completed by Information Security Continuous

Monitoring (ISCM) role, Incident Response (IR) role, Information Systems

Security Engineering (ISSE) role, and Watch Officer role. The contractor shall support the Cybersecurity Operations Team with Information Systems

Continuous monitoring support, Cybersecurity Service Provider (CSSP)

Alignment Support, Incident Response Support, Watch Officer Support and

Branch Communications planning both internal and external to DOD and other entities, as well as the duties outlined in the Service Catalogue.

Place of Performance: The majority of the work associated with this effort is anticipated to be performed at the Contractor’s facility or when necessary, at DSCA Headquarters (HQ) in Arlington, VA and NSA Mechanicsburg, PA.

7.0 Capability Statements

Offerors must demonstrate their ability to comply with the requirements in this Sources Sought in order to be considered capable of satisfying the Government’s requirement(s). Security Capability information must be displayed on page 1 of the response.

All interested offerors having the experience, skills and capabilities necessary to perform the stated requirements are requested to provide capability statements not to exceed 5 pages (cover page not include in page count) in “Times New Roman” 12-pitch font on 8.5 x 11 paper that include the following information:

1) Company name, address, point of contact name, telephone, and email address.

2) CAGE Code and UEI Number.

3) Business size status (business size/socio-economic category must be submitted to be used).

4) Offeror acknowledgement and capability to provide personnel that will need to successfully pass a National Agency Check.

5) Identify contracts your company has been awarded under NAICS: 541519 –

Other Computer Related Services, NAICS: 541611 – Administrative

Management Consulting Services, and/or NAICS: 541990 – All Other

Professional, Scientific, and Technical Services. Additional information on NAICS codes can be found at www.sba.gov.

6) Recommended/suggested NAICS codes for this effort.

7) Recommended/suggested contract type.

8) Number of contracts currently held with the Government to include any Federal

Supply Schedules listed under GSA Advantage.

9) Documentation that addresses each of the four (4) Service Requirement Critical

Tasks/Elements detailed above.

10) A description of Corporate Experience & Past Performance Information for similar contracts and/or projects accomplished within the last 3 years. The description must include where, when, and for whom each similar contract and/or project was performed and a brief description of each contract and/or project, including the size, scope, dollar value, and period of performance. This information must demonstrate how the offeror’s recent Corporate Experience and Past Performance (last 3 years) is relevant to the TEAMS Requirement.

8.0 Submission Instructions

The response to this notice is limited to five (5) single sided pages including all attachments, charts, etc. (single spaced, 12-point font minimum excluding charts and graphics) and should also include current business size status, and any http://www.sba.gov/ applicable Federal Supply Schedule(s). This indication should be clearly marked on the first page of the response, as well as the eligible business concern’s name, point of contact, address, and cage code.

Note: The Cover Page will not be included in page count.

All responses to this SSN must be submitted electronically (via e-mail) to the WHS NCR AD

Mailbox DSCA Group repository inbox at whs.ncr.ad.mbx.dsca-group@mail.mil, Ali Beshir at ali.m.beshir.civ@mail.mil, and Courtney Applewhite at courtney.s.applewhite.civ@mail.mil. The subject of the email must be titled “Sources Sought: “Cybersecurity Support Services” Facsimile responses will not be accepted.

To facilitate a timely and comprehensive review of all submitted responses, offerors must respond using the format requested in this Notice. Any deviation from this format may lead to the rejection of the response.

9.0 Common Cut-off Time/Date

Responses to the information above are due no later than 4:30 PM on Thursday, April 10, 2025.

Responses received after this date and time may not be considered.

mailto:whs.ncr.ad.mbx.dsca-group@mail.mil mailto:ali.m.beshir.civ@mail.mil mailto:courtney.s.applewhite.civ@mail.mil

ATTACHMENT 1

CONTRACTOR CAPABILITY INFORMATION

Part I. Business Information

Please provide the following business information for your company/institution and for any teaming or joint venture partners:

Company/Institute Name:

Address:

Point of Contact:

CAGE Code:

Phone Number:

E-Mail Address:

Web Page URL:

Size business pursuant to North American Industry Classification System (NAICS)

Based on the above NAICS Code, state whether your company is:

Small Business (Yes/No)

Woman Owned Small Business (Yes/No)

Small Disadvantaged Business (Yes/No)

8(a) Certified (Yes/No)

HUBZone Certified (Yes/No)

Veteran Owned Small Business (Yes/No)

Service Disabled Veteran Small Business (Yes/No)

Central Contractor Registration (CCR) (Yes/No)

A statement as to whether your company is domestically or foreign owned (if foreign, please indicate the country ownership).

List of any applicable Federal Supply Schedules and expiration dates: