CB Security Operations Services RFI final 4.14.22.docx

Request for Information (RFI) – Capacity Building (CB) Security Operations Services Agency: Cybersecurity and Infrastructure Security Agency (CISA) / Cybersecurity Division (CSD) / Capacity Building (CB) Market Research Agency: CB Notice Type: Request for Information (RFI) NAICS: 541330 – Engineering Services; 541512 Computer Systems Design Services GSA Reference: 47QFRA22K0018 Posted Date: April 14, 2022

I. GENERAL INFORMATION

This Request for Information (RFI) is being issued on behalf of Cybersecurity and Infrastructure Security Agency (CISA).

II. RFI OBJECTIVE

The purpose of this RFI is to assist CISA in conducting market research focused on identifying potential offerings/offerors for Security Operations Services within a Zero Trust Framework. CISA seeks feedback from industry partners who offer a wide variety of Security Operations Services and those who have delivered complex enterprise solutions in the federal space. Feedback will assist CISA in assessing various industry structures based on capability and size. It will also provide key insights into understanding market segmentation and industry capabilities, refining use cases and functional requirements, as well as obtaining industry feedback and insights on the as-is offerings of Security Operations Services within the categories identified below (see Section IV). The government is particularly interested in industry insights on implementations of Zero Trust architectures and providing enhanced Incident Response capabilities. CISA envisions delivering flexible solutions and capabilities through the Cybersecurity Quality Services Management Office’s (Cyber QSMO) shared services marketplace.

The information provided to CISA in response to this RFI will be used for market research only. CISA is not obligated to release a future solicitation based on this market research.

III. BACKGROUND

CISA leads the national effort to defend critical infrastructure against the threats of today, while working with partners across all levels of government and in the private sector to secure against the evolving risks of tomorrow. CISA's mission includes protecting the Federal Government's networks and physical infrastructure, to helping entities in the public and private sectors manage potential risk, to enhancing public safety communications at all levels of government.

Capacity Building (CB) serves as CISA’s enterprise cybersecurity services management arm for national stakeholders and the lead for federal enterprise cybersecurity governance. CB enables its customers to manage cybersecurity risk by building capacity to implement effective cybersecurity policies, tools, services, and procedures. CB helps stakeholders better manage cybersecurity risk by defining expectations for stakeholder cybersecurity; leading implementation and enforcement of cybersecurity requirements; managing CISA’s cybersecurity services portfolio; building capacity; and enhancing collective defense and readiness. Specifically, CB enhances stakeholder cybersecurity readiness, bolsters enterprise capabilities and protections, and increases the community’s capacity to adequately manage cyber risk by:

· Defining critical requirements, needs, and performance expectations.

· Overseeing and guiding the implementation of key cybersecurity initiatives and urgent actions, including federal cybersecurity policy, leading practices, cyber directives and operational guidance.

· Managing CISA’s cybersecurity services portfolio; evolving shared services, capabilities and delivery models; and delivering tailored services and assistance based on customer needs.

A critical component of CISA’s mission is provisioning critical, enterprise-wide cybersecurity services and programs to ensure the security of federal networks. Maturity, available resources, and organic capability in cybersecurity vary by agency which leaves the federal government facing common, significant challenges in securing information technology from cybersecurity risk. Therefore, it is imperative that these services be aligned to each organization’s cybersecurity capability and resources while addressing the common cyber defense challenges.

In April of 2019, the Office of Management and Budget (OMB) released a memo offering guidance to address some of these challenges and risks, pre-designating CISA as the Cyber QSMO. CISA’s Cyber QSMO aims to offer a government marketplace consisting of high-quality cybersecurity services that align with federal requirements in a cost-effective manner. The QSMO is responsible for offering solutions for common technology or fully managed services. QSMO must ensure these solutions are cost-effective and sustainable while offering increased efficiencies and enhanced security throughout the Federal Civilian Executive Branch (FCEB).

In April 2020, OMB formally designated CISA as the Cyber QSMO[footnoteRef:2] and specifically highlighted the provisioning of Security Operations Services in the formal designation. Under this designation CISA defined a standard set of core security operations capabilities, based on work by the Department of Defense (DoD), Federal Network Defense, Homeland Security System Engineering and Development Institute (HSSEDI) and OMB, meant to act as a baseline for security postures of civilian agencies. The QSMO is leveraging these capabilities, along with other tools/services, to provide a suite of Security Operations Services to help federal customers meet rapidly evolving operational needs and decrease total cost of ownership and related procurement and management burdens. [2: For Cyber QSMO information: https://cisa.gov/cyber-qsmo ]

CISA is in the early stages of defining a suite of Security Operations Services and what they would entail if CISA offered them to the Federal Enterprise. CISA’s goal for Security Operations Services is to offer customizable cybersecurity solutions, services, and tools to the federal enterprise based on an organization’s resources and organic cyber defense capabilities. Conceptually, these services would complement and/or supplement existing federal and commercial offerings. By offering Security Operations Services, CISA would enable the FCEB and other partners to focus on their respective mission areas.

IV. Overview of SECURITY OPERATIONS SERVICES OFFERING As a designated federal shared service provider (FSSP), CISA intends to offer customizable services which can be scaled and tailored to meet the needs of each customer. Standard capabilities, solutions and tools will be available to all participants with options to expand targeted services or packages based on maturity, subscriber organic cyber defense capabilities, resources and/or customer requirements. This offering must be flexible and accommodate efficient acquisition of a wide-ranging set of capabilities for multiple organizations.

CISA’s Security Operations Services notional capabilities include, but are not limited to:

Security Operation Center (SOC) support, Managed Security Support, Insider Threat Prevention and Detection Services, Cyber Threat Intelligence (CTI) and Information Sharing, Incident Response (IR)/Incident Management, Network/High Value Assets (HVA)/System Monitoring, Penetration testing, Vulnerability Management (VM), Endpoint Detection and Response (EDR), Secure Application Development Support Services, Big Data Platform, and the ability to utilize and support machine learning and analytics.

CISA’s QSMO, as the Cybersecurity Functional Area designated standards lead, established the Business Functions and Capabilities in conjunction with the Federal Integrated Business Framework (FIBF) model. These functions serve as the common baseline of what services agencies need and what solutions should be offered. The descriptions for the notional capabilities above can be found in the FIBF Services Activity tab in the SOC Business Capabilities spreadsheet. These functions and capabilities can be found on the GSA Shared Services website at the below link:

Security Operations Center | Governmentwide Business Standards and Capabilities - Federal Integrated Business Framework (gsa.gov)

V. INDUSTRY MEETINGS:

Based on responses provided by industry, additional information may be requested. As a result, GSA in partnership with CISA, at the government’s discretion, may schedule f one-on-one meetings with industry to discuss responses to this RFI. If a follow-up meeting is required, CISA will reach out directly to the industry partner point of contact (POC).

VI. RFI RESPONSE

Interested parties should respond to this RFI outlining their capabilities (as identified below and in accordance with the general overview above) as well as recommendations to providing services associated with the broad Security Operations Services scope. Responses may include references to examples that align with capabilities, existing offerings or services currently provided by the responder.

Responses are required to include the following information:

VI.I ContRACTOR INFORMATION

Section 1 of the response is for administrative information and shall include the following as a minimum:

A. Contractor name and facility address (list all relevant or significant office locations) B. DUNS number and NAICS code C. Socio-economic status (HUBZone, Service-Disabled-Veteran-Owned, Woman- Owned, 8(a), Small Business, Large Business) D. Facility clearance level E. POC name, phone, and email F. Website URL The number of pages in Section 1 of the whitepaper shall be no longer than one (1) page in length.

Section 2 of the response shall answer/address the below questions and functional areas as they relate to the functions and capabilities listed on the GSA FIBF website[footnoteRef:3] and listed in Section IV. Responders should highlight specific examples of current support or solutions that are deployed to federal or commercial organizations: [3: For SOC FIBF information: https://ussm.gsa.gov/fibf-cyb-soc ]

VI.II INFORMATION REQUESTED

EXPERIENCE/CORPORATE CAPABILITIES:

1) Identify the number and provide a brief description of past and/or current Security Operations offerings (i.e., SOC, Managed Security Support Provider (MSSP), Threat Intelligence, Penetration Testing, etc.)

2) Identify any existing Government contract vehicle (Governmentwide Acquisition Contract (GWAC), Multiple Award Schedule (MAS) program, Blanket Purchase Agreement (BPA), etc.) your company currently holds that could support the suite of Security Operations Services identified.

ZERO TRUST DEVELOPMENT/IMPLEMENTATION EXPERIENCE:

3) Describe your experience or provide insights into implementing a Zero Trust security solution in both on-premise and cloud-based environments.

4) Provide approaches to achieving Zero Trust security goals outlined in OMB Memo M-22-09.

5) What key features or solutions should be considered that would have the most immediate security impact for the Federal Government?

IMPLEMENTATION AND SERVICE METHODOLOGY:

6) Provide a brief overview of your security operations or managed security services (MSS) and any supporting products.

7) For MSSP or SOC specific offerings, describe the architecture of the MSS delivery to include applicable elements of the data center, SOC, log data collection and any other pertinent information.

8) List primary tools used to deliver these services, highlighting the function or utility they provide:

a. Indicate whether they are third-party or organic to the company.

b. If applicable, describe integration capabilities with federal enterprise platforms and infrastructure.

c. If applicable, highlight the enterprise approaches and/or products that are used as part of your integrations

9) Indicate how services are delivered to include insight into licensing or cloud infrastructure.

INCIDENT RESPONSE:

10) Provide any recommendations on how incident response activities, including breach response services should be performed.

11) Describe your current offerings or experience with remote/on-site incident response.

a. Describe your ability to deploy incident response and persistent hunting forensics in less than 24 hours for endpoint/cloud and less than 48 hours for network data.

12) Highlight any self-service/automation capabilities you have implemented for incident response.

NETWORK AND SYSTEM MONITORING:

13) Indicate the capabilities of your services to monitor firewall, intrusion detection system (IDS), intrusion prevention system (IPS) and vulnerability data.

14) If applicable, please describe network analysis capabilities or third-party service.

15) Indicate HVA security monitoring capabilities or any categorization/prioritization capabilities.

16) Indicate any automated capabilities or managed endpoint detection and response-type service offerings.

SECURITY INFORMATION MANAGEMENT

17) Indicate the data sources supported for log collection, reporting and retention. Can logs be collected from any source? Describe the collection methods.

18) The federal enterprise is required to maintain log data in accordance with the Cyber Executive Order 14028 (May 12, 2021). Identify any challenges or limitations to log collection capabilities at federal agencies.

THREAT INTELLIGENCE

19) Indicate any organic threat intelligence information gathering and sharing capabilities.

a. If not inherent to your company, identify experience or partnerships with third-party Cyber Threat Intelligence Services and associated sharing mechanisms.

20) Highlight any intelligence information sharing platforms/solutions developed or implemented (classified/unclassified/open source) at large scale organizations.

a. Does your company or any partners offer portal access to external threat intelligence feeds?

b. Does your company or any of your partners offer API access to external threat intelligence feeds?

c. Does your company or any of your partners provide threat intelligence in accordance with industry standards?

ADVANCED DATA ANALYTICS

21) Recommend technologies used or that could be used to enable advanced analytics for cyber defense.

22) Describe the information provided by and features available through API, web-based portal or console associated with your services to include threat visualization capabilities.

23) Describe how big data platforms are used to support the collection/analysis of network and endpoint data?

VULNERABILITY MANAGEMENT SERVICES

24) Describe the service capabilities to monitor vulnerability scans internally and externally with an organization.

25) Indicate organic or experience with third party technologies used to conduct scans, both commercial and open source.

ACQUISITION APPROACH

26) What should the government consider as part of their acquisition approach for these security operations service offering?

27) Describe your understanding of the current federal landscape for Security Operations Services capabilities

a. What existing vehicles exist to support large scale implementations?

b. Would a large scale CISA services offering overlap with existing vehicles?

c. Describe any gaps in current services offerings?

LICENSING STRUCTURE

28) Please describe your current licensing model for similar security services to include examples of itemized bundles of licenses or product subscriptions and commercially available pricing (i.e., SOC, MSSP, Threat Analytics, etc.).

29) Indicate and describe the pricing model for managing/monitoring virtualized or on-prem services to include data logging, storage, infrastructure etc.

30) What should the Government consider in its approach as it pertains to any pricing differentials (i.e., sophistication, complexity or scale)?

VII. CONTRACTOR NOTIFICATION and submittal instructions This RFI is for information and planning purposes only and does not constitute a Request for Quote (RFQ). This RFI is not to be construed as a commitment by the U.S. Government. No award will be made as a result of this RFI. All information is to be submitted at no cost or obligation to the Government. Any information that the Contractor considers proprietary should be clearly marked as such. All submissions become Government property and will not be returned, including any proprietary information. The Government may consider additional communications with submitting companies utilizing the contact information provided in the Corporate Overview to further the Government’s market research.

· All responses are to use Times New Roman font, with a 11-point font, and one-inch margins, single spaced in all sections in Microsoft Word or PDF.

· Contractor Information section shall be no longer than 1 page in length.

· Responses to the Information Requested Section should be no longer than 10 pages (reference architectures, flow graphics and diagrams that can be attributed to question responses can be added as addendums and will not be counted as a page).

· All information submitted shall be UNCLASSIFIED.

· Any information that the contractor considers proprietary should be clearly marked as such.

· All submissions become government property and will not be returned, including any proprietary information.

Questions pertaining to this RFI should be submitted no later than 29 April 2022 by 12:00 PM EST. to R8 at Diana Zoppi diana.zoppi@gsa.gov and Aaron Maddox at aaron.maddox@gsa.gov. All questions and answers will be added to this RFI announcement no later than COB 12 May 2022.

RFI responses shall be submitted no later than 25 May 2022 by 12:00 PM EST. via email to Diana Zoppi at diana.zoppi@gsa.gov and Aaron Maddox at aaron.maddox@gsa.gov.

Contractors who do not respond to this RFI are not excluded from any resulting solicitation(s).

image1.png