CISA COCO Biannual FY24 Industry Day QA File 1 of 2 .pdf

Question Government Response Where can we download the slides? Thank you! Slides were posted on May 1, 2024 to the original SAM.gov announcement for this event.

Thx for slides will this also be recorded? This event was not recorded.

If we don’t have direct past performance in particular area, will teaming partner’s past performance be considered

Please review the evaluation criteria provided in each solicitation for past performance and/or prior experience instructions.

Information Technology Security & Compliance Support Services (ITSCSS) ‐

F2023061297 was listed on the slide as released on 22 APR. I wanted to verify this date.

ITSCSS was released on GSA eBUY on April 22, 2024.

For PS IC: the "small business program" line says, "Not Set‐Aside for SB," but can you confirm it will be on STARS 3 as an 8(a) set‐aside?

On the chart presented on slide 23, the "Not Set‐Aside for SB" was referring to the incumbent effort on the right. Following robust market research, the Government has decided to set‐aside the recompete on STARS 3 as an 8(a) set‐aside, which is indicated on the left side of the chart.

Would Priority Services Integrator Contractor require Facility Clearance? Yes, Priority Services Integrator Contractor will require a facility clearance.

Who do we reach out to in the event we have questions regarding these opportunities?

Questions can be submitted to APFS‐Inquiries@cisa.dhs.gov and we will coordinate with the CO and program requirement owners. Once a solicitation has been released, please use the contact information provided in the solicitation to submit questions.

Looking through the deck, I don't see CAD as an opportunity. Has been consumed as part of another contract?

Yes, it is now part of Mission Engineering Program Support Services (ME PSS) requirement, please see APFS record F2024064641.

Is a follow‐on anticipated for CISA Gateway Cybersecurity Enhancement? No, a follow‐on is not anticipated for CISA Gateway Cybersecurity Enhancement.

For Exercise and Support Services, is CISA open to a technical solutions for the analytic support or is that for FTEs?

Requirements will be task specific. However, much of the support required is LOE‐centric. In general, CISA is looking for offerors to include technical solutions as part of their overall technical approach where it is appropriate and value added.

Certain tasks will require technical solutions. Examples include:

Exercise modeling, simulation, and management capabilities, to include:

‐ Simulation of traditional media and social media, ‐ Simulation of the open and dark web/internet, ‐ Modeling and simulation of infrastructure systems, ‐ Modeling and simulation of computer networks, ‐ Exercise management platforms to manage and facilitate exercise play in distributed functional exercises.

Exercise Data Analysis and Reporting:

‐ CISA is looking to leverage technical solutions, such as machine learning, natural language processing, and large language models to assist in the qualitative and quantitative analysis of large data sets consisting of structured and unstructured data. Early tasks will likely focus on identification of an overall methodological approach, followed by an identification and application of appropriate technical solutions.

Information Technology Security & Compliance Support Services (ITSCSS) ‐

F2023061297 was listed on the slide as released on 22 APR. I wanted to verify this date. Thank you

ITSCSS was released on GSA eBUY on April 22, 2024.

From the RFI, for CISA Exercise Support, has there been any major changes in the requirements? Will a draft come out prior to the final solicitation?

No major changes in the overall scope. However, CISA has pulled the "Exercise Data Analysis and

Reporting" task out from under the "Program Management and Analysis" task. These will be listed in the SOW as two separate tasks.

CISA does intend to release a draft RFP.

Will VETS2 opportunities be discussed separately or down the line of the presentation? It looks like some of the opportunities that have been planned to use the VETS2 vehicle have been marked as TBD or have been passed over. Thank you!

The Government encourages all interested parties to continue to monitor the APFS for any updates on any of the forecasted opportunities. Additionally, the Government encourages all interested parties to respond to any ongoing market research inquiries (e.g., Requests for Information, Sources

Sought Notices, draft Request for Proposals) to help aid the contracting officer in determining the appropriate acquisition strategy.

What is the status of the "External Affairs Office Strategic Communications

& Support Services" 70RCSA21FR0000075. Potential completion date is

9/29/2024. Can CISA please confirm is a RFI or Market Research will be released for this solicitation. Thanks!

The incumbent contract will be extended, via FAR 52.217‐8, through 3/28/2025 to allow time for the recompete to occur, remove the contract from the end of FY cycle and ensure the contract doesn't end in the middle of the current political cycle.

Does COCO intend to use the BPA for CISA Exercises to issue multiple awards?

The CISA Exercise Support Services BPA is anticipated to be a multiple‐vendor, multiple‐award contract.

Questions: Looking through the deck, I don't see CAD as an opportunity.

Has been consumed as part of another contract?

Yes, it is now part of Mission Engineering Program Support Services (ME PSS) requirement, please see APFS record F2024064641.

Are you planning an Industry Day for the Exercise Support Services contract prior to the July release?

Multiple industry days for this requirement have already been conducted during the market research phase. The Government does not intend to hold a pre‐solicitation conference or industry day at this time.

Which contract vehicle was the INFORMATION TECHNOLOGY SECURITY &

COMPLIANCE SUPPORT SERVICES (ITSCSS) RFP released?

ITSCSS was released on GSA eBUY on April 22, 2024 via the GSA Multiple Award Schedule

Information Technology (MAS IT), Highly Adaptive Cybersecurity Services (HACS) Special Item

Number (SIN) 54151HACS.

Will the Exercise Support Services contract incorporate a multi‐phase or downselect process?

CISA is finalizing its approach for the technical evaluation which may include a multi‐phase/down‐ select process.

Will you be interviewing the bidders directly for the cybersecurity contract? What does the process look like and when is it anticipated to start?

No interviewing of bidders directly, as that approach was not stated in the solicitation. The PS Cyber

SME Support Services requirement is currently in source selection.

With the growth of the HSEEP program, is there any consideration for the possibility of a multiple award procurement strategy?

The CISA Exercise Support Services BPA ia anticipated to be a multiple‐vendor, multiple‐award contract.

Has the Cyber Skilling Academy req been rescinded? Got an email about it in APFS but the page serves a 404

Cyber Skilling Academy has not been rescinded. When the Government updates APFS records, they are temporarily unavailable while the edits are made and then republished. The record is currently available on APFS under record number F2023060826.

What are the determining factors for the use of VETS2, OASIS, etc.?

CISA considers market research results from multiple sources, such as industry responses to SSNs, small business goals, the use of mandatory DHS strategic sourcing vehicles, and other market research methods.

The NAICS Code for CIRA doesn't match OASIS NAICS codes The NAICS Code of 541611 Administrative and General Management Consulting Services is the correct NAICS Code. The APFS record will be updated accordingly.

I do not see the Cyber analytics Data systems (CISA CADS) or the Joint

Collaborative Environment (JCE) represented within today's slides. Will updated acquisition information be provided regarding these engagements?

Both are now part of ME PSS requirement, please see APFS record F2024064641.

For the Critical Infrastructure Risk Analysis ‐ What Pool will be used on

OASIS?

The Government intends to use OASIS SB Pool 1.

Please clarify the NAICS code for the CIRA effort based on available NAICS codes on OASIS SB

For the Critical Infrastructure Risk Analysis (CIRA) solicitation, the COCO could consider NAICS 541330 Engineering Services or NAICS 541611

Management Consulting Services on OASIS SB Pool 1 NAICS.

The NAICS Code of 541611 Administrative and General Management Consulting Services is the correct NAICS Code. The APFS record will be updated accordingly.

Are you planning any changes to the Cyber Storm opportunity given the evolution of AI / GenAI since the last award?

Each Cyber Storm iteration and its respective scenario focus areas are determined in coordination with the Cyber Storm planning community as we begin planning, taking into account current threats and evolving technology.

Regarding CISA Grants Operations Support Services. I believe the RFI was released on SAM and it was due yesterday (4/30). Can you confirm the

Contract Vehicle been already determined? It is listing OASIS SB.

Market Research is still being conducted and the acquistion strategy and the vehicle have not been determined. Please continue monitoring APFS for updates.

Hello the CISA Grants RFI was just submitted yesterday. Is SED set on the acquisition method?

Market Research is still being conducted and the acquistion strategy and the vehicle have not been determined. Please continue monitoring APFS for updates.

Is CISA Grants Operations Support Services WOSB set aside, or simply SB on OASIS Pool 1?

Market Research is still being conducted and the acquistion strategy and the vehicle have not been determined. Please continue monitoring APFS for updates.

Can you please clarify the existing contractor NIWC PAC for the CISA

Grants program?

The existing contractor is Naval Information Warfare Center Pacific (NIWC PAC).

Administrative Support Service: what kind of training is being done? Is it technical training?

ISD is seeking FTE support to assist the ISD Training Section/Team. The FTE that supports training will assist with tracking the mandatory training requirements/Individual Development Plans and processing SF182 Training requests. They will coordinate training sessions with CISA SMEs through cross‐collaboration. Technical Training is not part of the requirement.

OASIS SBP1 for CIRA does not support IT NAICS The NAICS Code of 541611 Administrative and General Management Consulting Services is the correct NAICS Code. The APFS record will be updated accordingly.

As a WOSB transitioning from B2B to B2G (no federal government clients as of yet), is there anything that can make us more competitive competing for our first contract with CISA? Optimize Management Group, LLC ‐

Project Management Consultancy

The CISA small business specialist will reach out to schedule some time to discuss. For any other inquiries of a small business nature, please feel free to reach out to CISA small business at procurement‐sb@cisa.dhs.gov and someone will respond back to you.

Will Exercise Support Services be a multi award or single award BPA? Via

GSA MAS Schedule?

The CISA Exercise Support Services BPA is anticipated to be a multiple‐vendor, multiple‐award contract.

It seems like the Cyber Skilling Academy work should be under HCaTS per the DHS contracting requirements for training. Is that being considered?

It was considered. The Cybersecurity Pathway and training services is not an offering under HCaTS.

The Information Technology Training ‐ Special Item Number 611420 is better aligned with the appropriate cyber training areas.

The Analytical Infrastructure Governance Support contract doesn't appear to be listed in APFS. Has that RFI released?

The APFS record was temporarily unpublished for updates. It was republished to APFS on May 16, 2024 under APFS record number F2023061294. Sources sought notices were posted to SAM.gov and

GSA eBuy in February 2024.

Is there an update for Network Operation Management (NOM)? APFS updates are not clear as to whether it is still needed or if the opportunity will move to FY2025

The APFS record #F2023061002 was updated on April 29, 2024 to reflect that this requirement is no longer required.

When does CISA anticipate to release answers to questions be released for JCDC?

The Government posted the responses on 5/13/2024 to SAM.gov.

JCDC Planning Office Support has a requirement for seven (7) Key Resumes and LOCs. As you know, cyber professionals are at a premium and will rarely "wait" for a job/position. With a 4th QTR award, why would the Key

Resumes and LOCs be so extensive ‐ knowing that those Key Personnel proposed will unlikely be available at time of Award/Start of Work?

The Government's requirements are unique so we want to ensure that the awardee is able to bring in personnel with these unique skillsets. The Key Personnel identified in this RFQ will lead the support for each unique requirement in the Statement of Work.

Will the Operational Technical Support Solicitation be released on 8(a)

STARS III?

A sources sought notice for all potential 8(a) vendors was posted to SAM.gov on April 29, 2024 and responses were due on May 13, 2024. The Government will select the contract vehicle after considering the results of the market research including the responses to the SSN.

What OCI restrictions, if any, are expected to apply to PSS? Will contractors (either Prime or subK) be precluded from other CSD opportunities, given the nature of PSS support?

The Program is performing OCI analysis. The RFQ will contain additional instructions.

What drove PSS to OASIS?

The acquisition strategy was developed based on market research and the DHS requirement to use strategic sourcing vehicles.

When is the date of the Pre‐proposal conference for CSD PSS?

This event has not been scheduled. The Government will update SAM.gov as additional information is available.

will you wait for OASIS+ for any procurements, as that should be out and available soon

OASIS SB and 8(a) Pool contracts expire on December 19, 2024 and OASIS Unrestricted contracts expire March 1, 2025. As long as requirements are solicited and awarded prior to those end dates they can span up to five (5) years beyond. If there is a gap between the end of OASIS and the beginning of OASIS+ then CISA will explore other vehicles.

if OASIS+ awards are made before the solicitation is released will new

OASIS+ awardees be able to compete?

OASIS and OASIS+ are two different vehicles and if the solicitation is released on one it must be awarded on the same one.

With PSS being deemed a "Total Small Business" is there an opportunity to make some of the Tracks 8(a), SB, HUBZone, etc.?

No, the Government does not intend to include separate socioeconomic tracks at this time.

Could you provide any updates on the recompetition opportunity regarding the strategic communications & support services contract, identified by contract number 70RCSA21FR0000075?

The incumbent contract will be extended, via FAR 52.217‐8, through 3/28/2025 to allow time for the recompete to occur, remove the contract from the end of FY cycle and ensure the contract doesn't end in the middle of the current political cycle.

Is there an incumbent on the first one you spoke about? (vendor is referring to Administrative and Executive Correspondence Support

Services)

Yes, the current contract number is 70RCSA21FR0000103 and the incumbent is D&G Support

Services, LLC.

Will ME PSS be a single award on OASIS SB? Yes, the Government anticipates a single award on OASIS SB at this time.

Why does Escort Services say SDVOSB and Not Set Aside for SB? What does that mean?

The recompete is set‐aside for SDVOSB's while the incumbent contract was not set‐aside for SB's

(Unrestricted). The chart on each slide was formatted to include the current requirement on the left and the incumbent effort on the right.

is Market Research for Strategic Communications already released?

@Jason Hawkins, seems to have indicated that this was already out? Can

CISA Please confirm the timing for this RFI.

The incumbent contract will be extended, via FAR 52.217‐8, through 3/28/2025 to allow time for the recompete to occur, remove the contract from the end of FY cycle and ensure the contract doesn't end in the middle of the current political cycle.

Good morning. For the Internal Controls opportunity (APFS#

F2023062379), is there an existing gap in service, or was the incumbent contract with GT/Guidehouse (70RCSA21FR0000027) extended past the original Jan‐2024 end date?

A bridge contract, contract number 70RCSJ24FR0000008, was awarded to Guidehouse to allow time for the Government to finalize the requirement with the intention of recompeting it.

In the instances of Contract Vehicle being OASIS, is the expectation these will be OASIS+ if the OASIS+ GWAC is awarded prior to your Solicitation

Release dates?

OASIS SB and 8(a) Pool contracts expire on December 19, 2024 and OASIS Unrestricted contracts expire March 1, 2025. As long as requirements are solicited and awarded prior to those end dates they can span up to five (5) years beyond. If there is a gap between the end of OASIS and the beginning of OASIS+ then CISA will explore other vehicles.

Will the Chat Notes be available

The chat notes are not going to be published. All questions have been recorded and the answers provided in writing supercede any answers provided verbally or via chat during the event. The initial

QA (file 1 of 2) is being posted on May 17, 2024 and the remaining QA responses (file 2 of 2) will be posted on or around May 31, 2024.

Can you share where/if OCIO ITSCSS was released?

ITSCSS was released on GSA eBUY on April 22, 2024 via the GSA Multiple Award Schedule

Information Technology (MAS IT), Highly Adaptive Cybersecurity Services (HACS) Special Item

Number (SIN) 54151HACS.

Will CEEOSS be multiple award? The Government anticipates making a single award.

For CISA Cloud Migration and O&M, will this be multiple award? The Government anticipates making a single award.

If we don’t have past performance in certain field say for example, cyber security, can JV partner or Teaming agreement’s past performance be considered?

Please review the evaluation criteria provided in each solicitation for past performance and/or prior experience instructions.

Regarding Exercise Support Services. Does CISA intend to issue multiple awards under the BPA? If so, has the Government determined the range of how many awards it will consider offering?

The CISA Exercise Support Services BPA is anticipated to be a multiple‐vendor, multiple‐award contract.

No final decision have been made with regard to pool structuring or the number of awards to be made.

Can you provide a timeline for when an RFP would be released for the

Cyber Storm Support Services, as well as what vehicle the program is expected to come out in?

Release of the RFP is anticipated for May 2024. The requirement will go out on OASIS.

What is the current status of the "Cybersecurity Management and Strategy

Support" contract? I heard it will be reissued with modifications? Is it still the case?

The Government is still considering the path forward. More information will be provided as it becomes available.

Is the government considering releasing a recording of this meeting to view afterwards?

This event was not recorded. Slides, registration list, and QA will be publicly posted to SAM.gov

OCI Question Regarding CISA Mission Engineering Program Support

Services F2024064641 ‐‐ I am enquiring about an OCI question regarding the subject opportunity.

We are an OASIS SB preparing to team with a large company for this opportunity. The other company is already engaged in contracts in CISA

CSD (OSS). We are inquiring about whether there is the possibility of

“firewalling” our partner from specific tasks in order to avoid an OCI?

The Program is performing OCI analysis. The RFQ will contain additional instructions.

APFS: F2024064641 ‐‐ On the May 1st industry day, the govt had indicated that there will be a pre RFP event for the solicitation with APFS in subject

(Program Support Services (PSS) for CISA/CSD/ME). Would you please advise when CISA is hosting the event and how to register for it.

The Government intends to host a pre‐quotation conference. The Government will update SAM.gov with a definitive date. This event has not been scheduled yet.