CISA Infrastructure Security IT Systems - Sources Sought Notice.pdf

SOURCES SOUGHT NOTICE

FOR

DEPARTMENT OF HOMELAND SECURITY (DHS)

CYBERSECURITY & INFRASTRUCTURE SECURITY AGENCY (CISA)

CISA Infrastructure Security IT Systems

INTRODUCTION

The Cybersecurity & Infrastructure Security Agency (CISA) is issuing a Sources Sought Notice (SSN) as a means of conducting market research to identify potential qualified firms having an interest in, and the resources to support the requirement for CISA Infrastructure Security information Technology (IT) Systems Services.

This SSN is for planning purposes only and shall not be construed as an obligation on the part of the Government. This is NOT a Request for Quotations or Proposals. No solicitation document exists, and the Government may or may not issue a formal solicitation resulting from the responses received to this SSN.

The Government will not pay for any response expenses. All costs incurred responding to this SSN will be solely at the interested party's expense. Failure to respond to this SSN will not preclude participation in any future solicitation. Any information received will become the property of the Government and will not be returned to the submitter. Interested parties are responsible for adequately marking proprietary or sensitive information.

Government technical experts drawn from staff within CISA, and other federal agencies may review responses. The Government may use selected support contractor personnel to assist in the review of the SSN responses. These support contractors will be bound by appropriate non-disclosure agreements to protect proprietary information.

PROGRAM BACKGROUND

CISA’s mission is to lead the national effort to protect and enhance the resilience of the nation’s physical and cyber infrastructure. CISA includes the CISA Mission Enabling Offices (MEOs) and six Divisions:

the Cybersecurity Division (CSD), the Emergency Communications Division (ECD), the Integrated Operations Division (IOD), Infrastructure Security Division (ISD), the Stakeholder Engagement Division (SED), as well as, the National Risk Management Center (NRMC), which are headquartered with the National Capital Region (NCR).

CISA’s IT landscape has historically produced networks and systems individually managed and maintained within each of its divisions as well as its MEOs. The government requires development and operations & maintenance support for the CISA Office of the Chief Information Officer (OCIO) to maintain and enhance the CISA Infrastructure Security IT capabilities. These IT capabilities shall support CISA’s ability to continue establishing a modern IT infrastructure; adoption of cloud native services;

supporting the CISA Infrastructure IT system environments; and continually improving the performance, security, and availability of the CISA Infrastructure Security IT services.

CISA’s objective is to obtain expertise to support the:

Development of new capabilities and tools to support CISA’s Infrastructure Security mission.

This will require architecting, designing, developing, and supporting the capabilities including, but not limited to, databases, web application services, cloud hosted environments, applications, and system development.

Modernization of existing capabilities and tools to enable further adoption of cloud native resources. This will require reviewing existing cloud migrations that have been performed to IT systems, optimizing IT systems to leverage cloud native and managed services to include but not limited to databases, serverless capabilities, Application Program Interfaces (APIs) gateways and containerized platforms.

Adoption and incorporation of CISA’s enterprise services into IT systems supporting CISA’s Infrastructure Security mission.

Providing Tier II and III level support to users of CISA’s IT Infrastructure Security systems. This includes but is not limited to responding to tickets and issues escalated from CISA’s Technical Operations Center, resolving tickets that require specialized knowledge of the specified IT system(s), troubleshooting and diagnosing issues with application configurations and user privileges, development of knowledge and technical articles to support first call resolution and ensuring system backups are occurring on their scheduled basis.

REQUIRED CAPABILITIES

The Contractor shall provide services in support of the areas specified in the DRAFT Statement of Work (SOW) attached to this announcement.

It is imperative that businesses responding to this SSN articulate their capabilities clearly and adequately regarding each task area listed.

Industry input is also requested on the attached draft SOW. Questions and/or feedback related to the draft SOW must be submitted as a separate document.

ELIGIBILITY

The applicable NAICS code for this requirement is 541512, Computer Systems Design Services, with a Small Business Size Standard of $34.0 Million. The Product Service Code is R408 Support – Professional: Program Management/Support.

Note: In accordance with DHS Directive 060-01, Development and Use of Strategic Sourcing Contract Vehicles, dated 24 August 2012, strategic sourcing vehicles are mandatory for use, with limited exceptions. Therefore, a strategically sourced contract vehicle will take priority over awarding a standalone CISA contract.

SUBMISSION DETAILS

Interested businesses should submit a brief capabilities statement package (up to ten (10) 8.5 x 11-inch pages, font no smaller than 10 point) demonstrating ability to provide the services listed in this announcement. Questions/feedback should be no more than five (5) pages with same specifications as noted above. Responses to questions are not guaranteed directly.

Responses to this SSN, including any capabilities statement, shall be electronically submitted in either Microsoft Word or Portable Document Format (PDF), via email no later than October 31, 2024, at 1:00 p.m. ET.

Note: The Government reserves the right to hold one-on-one meetings resulting from SSN responses received as part of its market research. Meetings may be held with companies who provide comprehensive and relevant responses to the topic and questions in this notice.

All responses under this SSN must be emailed to:

Shannon Kennedy, Contract Specialist, shannon.kennedy@mail.cisa.dhs.gov and Eva I. Shaw-Taylor, Contracting Officer, eva.shaw-taylor@mail.cisa.dhs.gov.

If your organization has the potential capacity to provide the required services, submit the following information:

1) Organization name, UEI, CAGE code, Business size (large or small) and socio-economic status (i.e., 8(a), Small Disadvantaged, HUBZone, Service-Disabled Veteran-Owned, Women-Owned Small Business, etc.), address, primary points of contact (POCs) and their email address, web site address, and telephone number.

2) Identify any strategic sourcing vehicles or federal supply schedules your company is included on.

3) Tailored capability statements addressing the requirements of this notice, with appropriate documentation supporting claims of organizational and staff ability.

4) Include the type of work your company performed within the last three (3) years in support of the same or similar requirements (similar in size, scope, and complexity).

a. Provide examples that reflect your company’s capabilities in the task areas outlined in the draft SOW and specify whether support has been provided as a prime contractor or subcontractor.

b. If significant subcontracting or teaming is anticipated; identify potential team members (if known) and describe the administrative and management structure of such arrangements.

Furthermore, CISA’s preference is to procure services on a small business set-aside basis, to the extent possible based on market research results.

We encourage all small businesses, in all socioeconomic categories (including, 8(a) Business Development Program, Small Disadvantage Business, Historically Underutilized Business Zone, Service- Disabled Veteran-Owned, Women-Owned Small Business concerns), to identify their capabilities in meeting the requirement at a fair market price.

All data received in response to this SSN that is marked or designated as corporate or proprietary will be fully protected from any release outside the Government.

APFS: F2023061281

Notional Milestones:

Sources Sought Notice October 2024

Finalize SOW and Acquisition Strategy December 2024

Release Solicitation March 2025

Award June 2025