Attch 2 - CYCLOPS Sources Sought Questions.docx

Business Name and Size: _________________________________________________

1. Have you executed a contract, greater than $10M in annual value, for an integrated instance of insider threat risk management, targeted user monitoring, user behavior analytics, and 24x7 asset monitoring for a mature insider threat program within a large federal agency in which you were solely accountable for the detection of anomalous behavior and insider threats? If the answer to question 1 is no, the remainder of this RFI may be difficult to adequately address.

2. If the answer to question 1 is yes, please describe the Insider Threat program to include: • Number of applications • Number of users • Number of contractors you provided to support this effort • Description of methodologies employed for detecting anomalous user behavior • Description of methodologies employed for 24x7 asset monitoring.

3. If the answer to question 1 is yes, please describe the externally facing customer programs and systems monitored: • Third-party data integration/analytics conducted • Number of customers covered by behavioral analytics/24x7 monitoring • Any event identified, that was covered by the mainstream media, which you were responsible for the detection and resolution of the external fraudulent activities.

4. Have you successfully advocated constructive improvements to the agency’s policies, governance, and infrastructure (i.e., agency’s Insider Threat Ecosystem) that were adopted enhancing the agency’s Insider Threat posture? If yes, please describe the improvements.

5. Have you successfully performed innovative Insider Threat data analytics on vast stores of near real time and archived transactional data sets from across a wide range of IT systems (e.g., mainframe, servers, and network devices) some of which include legacy systems and performing advanced data analytics leveraging various technologies (e.g., machine learning) in a highly secure environment? This includes any internal investments to improve Insider Threat analytics capabilities/services (e.g., in-house lab or to perform advance research).

6. Have you successfully developed Insider Threat Use Cases, with supporting definitions and rationale, cross-organizational reporting, provides risk metrics, supports legal review and investigative processes, for the identification and prediction of malicious activity? If yes, please describe your methods.

7. Have you successfully identified previously undetected anomalous patterns, trends, and events that led to the discovery of Insider Threat activity supported with the associated corrective actions?

8. Describe examples of how your company successfully implemented near real-time fraud and predictive analytics on big data platforms across a wide range of IT systems (e.g., mainframe, servers, and network devices) on government networks on both structured and unstructured data sets to produce analytic views of correlated activities.

9. Describe examples of how your company has successfully implemented a scalable 24x7x365 use behavior monitoring capability staffed by at least four analysts per shift.

10. Do your proposed experts have at least 2-year’s technical experience in the specific discipline of user behavior analytics and detection and the utilization of predictive analytics models that leverage machine learning capabilities for detection of malicious activities? Additionally, how many years of experience do the data scientists have specifically tailored to supporting user behavior analytics and insider threat capabilities?

11. Explain and provide a contingency plan for how your company would continue to provide project support and meet project deadlines in case of a natural disaster or any other event causing a power outage in one geographic location?

12. Please address experience and provide a transition plan where your company successfully staffed and assumed operations of large-scale Insider Threat programs without a disruption in service from a prior provider within the first 90 days? Additionally, do you currently have resources performing Insider Threat Services with a large federal government agency which supports 80,000 or more employees, to include information technology resources and Governance? If so, please identify the agencies.

13. What experience do you have in conveying complex statistical data and analytics to senior executives and other stakeholders?

14. Have you successfully participated in audits from GAO, CISA, etc. for Insider Threat capabilities for large government agencies? If so, for which agencies and when, and by whom was the audit conducted?

15. Are you able to perform 51% or more of the work at the senior and SME levels required, with your own staff that is currently employed by your company?

16. If you have mainly performed as a subcontractor for a fraud detection and prevention project, do you currently possess the skills and resources to manage the contract as a prime?

17. Do you have the ability to perform a 45-day transition upon award of this contract, ensuring key personnel are successfully cleared and onboarded by the transition deadline?