cATO - Request for Information.pdf

United States Request for Information (RFI) Patent and Trademark Office Continuous Authorization to Operate (cATO)

CUI//SP‐PROCURE

Introduction The U.S. Patent and Trademark Office (USPTO) is excited to launch this Continuous Authorization to

Operate (cATO) effort as an opportunity to engage industry in an intentional, innovative, and insightful way. The USPTO is at the cutting edge of the nation's technological progress and achievement and information technology underpins every action and workflow process within the USPTO. The USPTO is the issuing authority for United States (US) intellectual property (IP) rights for patents and trademarks – as such, an important component of the USPTO agenda is digital transformation to improve and enhance granting U.S. patents and registering trademarks. The USPTO’s mission is to drive U.S.

innovation, inclusive capitalism, and global competitiveness.

The Context and Objectives The USPTO Office of Chief Information Officer (OCIO) is committed to upholding cybersecurity standards and securing sensitive information, including confidentiality of intellectual property, personally identifiable information (PII), and business identifiable information (BII). Beyond its core functions of granting patents and registering trademarks, the USPTO prioritizes the implementation of robust cybersecurity measures to safeguard confidential data. Adhering to these security requirements, the USPTO diligently follows stringent protocols to grant Authorization to Operate (ATO) to all its systems before their introduction into the production environment. This commitment underscores the agency's dedication to fostering innovation while ensuring the highest levels of security and compliance in handling sensitive information, thereby maintaining the trust and integrity of the intellectual property ecosystem it oversees.

The Office of the Chief Information Security Officer (OCISO) works in concert with other OCIO Offices via a product‐oriented approach to delivering business value to customers in which empowered teams follow a target architecture and take an agile, DevSecOps approach to delivery.

The USPTO’s system inventory includes approximately 112 systems which are:

FedRAMP authorized software‐as‐a‐service (SaaS), platform‐as‐a‐service (PaaS), and infrastructure‐ as‐a‐service (IaaS) solutions;

Solutions hosted within FedRAMP IaaS/PaaS environments, to include Amazon Web Services (AWS), Microsoft Azure Cloud, and Google Cloud, with most of these systems hosted in AWS; or

Custom built, legacy on‐premise or commercial off the shelf installed on‐premise solutions.

The USPTO uses NIST SP 800‐53 Revision 5 security and privacy controls in the development of System

Security and Privacy Plans (SSPPs).

Although the current ATO process at the USPTO adheres to the National Institute of Standards and Technology Risk Management Framework (NIST RMF), the current implementation of the process is static, time‐consuming, and not aligned with agile, modern software development, and DevSecOps practices. Presently, the USPTO is working towards continued refinement and adoption of a DevSecOps pipeline as part of the digital transformation effort and in work toward continuous integration, continuous delivery, and continuous security (e.g. automated governance and automated continuous authorization to operate (cATO)).

The overall objectives for the USPTO’s Cybersecurity Program are to provide and integrate agile, state‐ of‐the‐art cybersecurity services to enable secure and efficient business operations. The USPTO seeks to bring the ATO process into alignment with USPTO’s agile, automated Ways of Working. The resulting process changes will simplify and accelerate the effort needed to achieve and maintain a system ATO.

The USPTO aims for continuous transformation toward the understanding of our real time risk position (enabling cATO) to enable higher quality (safer), faster, and more efficient business value delivery.

Desired outcomes also include: resource efficiencies; dynamic implementation and assessment of security and privacy controls; continuous monitoring of system security posture; improved quality of accreditation documentation; and improved consistency of accreditation standards enforced at USPTO, including improving transparency between assessors and product teams.

The USPTO is actively seeking market research information from vendors with demonstrated experience in successfully supporting the transition of federal agencies from legacy implementations of NIST SP 800‐37 Revision 2, Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy, to a more agile and automated approach. The USPTO envisions the development and implementation of Security by Design and Privacy by Design principles to establish a culture continuous security (including cATO), along with a culture of continuous delivery and proactive operations.

Market Research Guidance This Request for Information (RFI) market research survey and subsequent market research stages listed below are intended as preliminary market research information gathering which the USPTO will use to determine which vendor(s) is/are the most likely to successfully meet the agency’s needs. The RFI is not a solicitation for a contract. The Contracting Officer (CO) may elect to utilize the Patent and Trademark Office Efficiency Act, 35 U.S.C. 2(b)(4)(A), which provides for the Alternative Competition Method defined in section 6.1.1 of the Patent and Trademark Office Acquisition Guidelines (PTAG). If the USPTO CO elects to use PTAG 6.1.1. Alternative Competition then the CO may decide to progress to issuing a solicitation to the vendor(s), who the Contracting Officer Representative (COR) and CO determine from the PTAG 6.1.1. process to be most likely to successfully meet the agency’s needs. Throughout this market research process, capable vendors may be determined eligible to participate in an alternative competition. This multi‐staged market research effort is not a request for proposals.

The USPTO intends to use a rapid‐staged market research approach which seeks to efficiently engage industry early in the process and foster innovation, especially in the market research for cATO. This innovative RFI market research model allows the USPTO and Industry participants to quickly and collaboratively co‐create solutions, moving efficiently from market research to possible solicitation and then to potential award with maximum transparency and minimum time. The cATO market research envisions a process using a multi‐staged, “show me, don’t tell me approach” – asking industry for evidence‐based, effective, and efficient automated governance/cATO approaches applicable to USPTO’s specific mission of granting patents and registering trademarks.

Failure to submit a response to Stage One eliminates vendors from participating in future Stages, and from any additional consideration for participation in an Alternative Competition PTAG 6.1.1.

The cATO market research will leverage Agile methodologies and initial stages are envisioned as:

Stage One: Industry Survey RFI (Current).

Note: Participation in Alternative Competition will only be used if the contracting officer elects to use Patent and Trademark Office Efficiency Act, 35 U.S.C.

Stage Two: Invitation to vendor(s) to participate in Technology Discussions Symposiums.

Stage Three: Invitation to submit Concept Paper(s) & present/demonstrate a prototype solution

(e.g. bake‐off).

Stage Four: Identification of the final vendor(s) to participate in the Alternative Competition, Patent and Trademark Office Efficiency Act, 35 U.S.C. 2(b)(4)(A).

Note: The USPTO reserves the right to issue multiple solicitations depending on the results of this market research and the agency’s requirements.

Stage Five: Issuance of Solicitation(s); Evaluation(s), and Contract Award(s).

o Overarching Plan & Pilot(s).

After each stage, USPTO’s CO and COR will determine if the subsequent stage is necessary. If after Stage

One or any subsequent stage’s review and analysis of the market research information, the CO and COR determine that sufficient information has been gathered, the USPTO, may determine which vendor(s) is/are the most likely to successfully meet the agency’s needs and possibly move to the next Stage or directly to Stage Four.

cATO RFI Questions

1. Has your team implemented cATO at a Federal Agency? If yes,

1.1. For how many agencies?

1.2. Defense or civilian agencies (List them)?

1.3. What was the agency, complexity, and types of systems?

1.4. Is implementation complete or in‐process (describe status)?

2. Describe your company’s approach to cATO implementation within a federal organization, including your work, if applicable, implementing cATO for other federal government organizations. At a minimum, include the following information:

2.1. Key roles involved in the transformation.

2.2. “Pre‐work” and/or organizational change processes required for success, including control inheritance, common control implementation, and standardization of the system specific and hybrid controls.

2.3. Top technology challenge(s) (limitations/restrictions) faced and how it/they were overcome?

2.4. Top organizational change challenge(s) faced and how it/they were overcome?

2.5. How long did it take to implement and transition to an end‐to‐end cATO process in the federal organization where you implemented cATO processes?

2.6. How long does it take to execute an initial ATO (from Categorization to Authorization RMF steps) for a system under the cATO process?

2.7. On average, how much time / what is the level of effort annually required to sustain an ATO for systems authorized under the cATO process?

2.8. What metrics and/or performance indicators did you use to show success of the transformation to cATO?

2.9. How did you leverage maximum re‐use of previous ATO documentation and artifacts such that product team effort is minimized?

3. Describe your approach to automate NIST RMF steps relating to the creation of a system security and privacy plan (system categorization, control selection – to include tailoring, inheritance and control implementation) and automating assessment, authorization, and continuous monitoring. Consider the following in the response:

3.1. The approach and tools/technology (e.g., GRC tools, SIEM, threat intelligence/analysis/modeling, AWS Security Hub, web services etc.) used to automate security control implementation.

3.2. The approach and tools/technology used to automate security control testing.

3.3. For controls that cannot be tested via automated means, what other efficiency actions can be taken to streamline assessment of controls?

3.4. Leveraging NIST Open Security Controls Assessment Language (OSCAL) to implement the solution.

3.5. The percent of the security controls implemented/tested/assessed with automation.

3.6. Leveraging AI/ML/RPA capabilities.

3.7. Vulnerability analysis and alert generation.

3.8. Dashboard report generation on organizational, business, and system level risk posture.

3.9. Automation success (high/moderate/low) achieved for each RMF step.

4. Describe Best practices for implementing cATO in cloud‐based Infrastructure‐as‐a‐Service and Platform‐as‐a‐Service environments.

4.1. What Amazon Web Services tools and technologies can be leveraged to effectively implement cATO?

4.2. What Microsoft Azure cloud tools and technologies can be leveraged to effectively implement cATO?

4.3. What Google Cloud Platform cloud tools and technologies can be leveraged to effectively implement cATO?

4.4. What other tools and technologies required to implement the solution?

4.5. Are the tools/technologies that you recommend applicable to the cATO process of FedRAMP Software‐as‐a‐Service, Platform‐as‐a‐Service, or Infrastructure‐as‐a‐Service?

4.6. How can the approach be tailored to support cATO for physical on‐premise environments?

5. From your experience which Governance, Risk and Compliance (GRC) platform is best suited to support the implementation of cATO in a federal organization? Provide a brief rationale to support the response.

6. Identify policy and compliance lifecycle management tools which can be integrated with a GRC tool to support automated testing of policy‐based controls?

7. Have you successfully implemented cATO for a federal organization using Department of Justice’s Cyber Security Assessment and Management (CSAM) tool, and if so, for which agency, what was the complexity and type of systems?

8. Describe how the transformation to a cATO process leverages DevSecOps, Security by Design, and Privacy by Design principles to establish a culture of continuous security along with a culture of continuous delivery and proactive operations (i.e. what organizational and security improvements also resulted from your implementation of cATO within a federal organization)? Discuss:

8.1. Continuous monitoring outcomes;

8.2. Active cyber defense outcomes; and

8.3. Security target architecture resulting from cATO implementation.

9. Provide any additional information that you think would be helpful in our decision‐making process.

The Submission Instructions NOTE: Industry engagement/responses are strongly discouraged from containing ANY proprietary or

Trade Secret information in response to this market research request. Assume all information provided will be used and discussed with other industry partners and public, and additionally, may be used in refining the Agency's requirements or future market research efforts. If a company includes ANY proprietary or Trade Secret information it must clearly mark such information on a line‐by‐line basis.

Inclusion of proprietary or Trade Secret information may lead the USPTO to conclude that the submission is not most likely to successfully meet the agency’s needs. This is a market research request and not a request for proposals.

Response Specifications

Page limit: 15 pages (Excluding Title Page and Table of Contents)

Title page must include:

o Company Name o Primary Point of Contact o Phone Number and Email Address o UEI Number o NAICS Code(s) o Business Size Standards o Socioeconomic Category(ies) o Federal Supply Schedule (FSS) or other Government‐wide Acquisition Contract (GWAC)

Contract Number(s) (NASA SEWP/GSA OASIS, etc.)

All margins minimum: 1‐inch

Minimum size font: 11 (Times New Roman)

Document format: Adobe PDF

Submit response to cATO_ACQ@uspto.gov with Subject Line: “cATO Market Research Survey RESPONSE

[Company Name]”.

Questions about this posting shall be submitted to cATO_ACQ@uspto.gov with Subject Line: “cATO

Market Research Survey QUESTION ‐ [Company Name], no later than February 9nd, 2024 at 12:00 PM

EST. USPTO will not be responding to technical questions during this Phase of the market research.

Survey Response Close Date: March 1st, 2024 at 12:00 PM EST. The USPTO may extend the closing date of the RFI based on response quality or quantity.