Cyber III - RFI.pdf

REQUEST FOR INFORMATION ANNOUNCEMENT

6 September 2022

THIS IS A REQUEST FOR INFORMATION SYNOPSIS ONLY. THERE IS NO

SOLICITATION AVAILABLE AT THIS TIME.

THIS REQUEST FOR INFORMATION SYNOPSIS IS NOT TO BE CONSTRUED AS A

COMMITMENT BY THE SPACE FORCE TO ISSUE A SOLICITATION OR

ULTIMATELY AWARD A CONTRACT. NEITHER UNSOLICITED PROPOSALS NOR

ANY OTHER KINDS OF OFFERS WILL BE CONSIDERED IN RESPONSE TO THIS

REQUEST FOR INFORMATION.

I. Synopsis:

1. The United States Space Force (USSF), Space Systems Command (SSC), Enterprise Corps, Strategic Warning and Surveillance Systems Directorate (SZQ) is conducting market research to identify contractors with technical competence complete a cybersecurity assessment on Ground Based Radars (GBRs) for three divisions: Upgraded Early Warning Radar (UEWR), Perimeter Acquisition Radar Attach Characterization System (PARCS), and COBRA DANE.

There are nine locations for assessments.

a. UEWR – Beale AFB, CA

b. UEWR – Cape Cod SFS, MA

c. UEWR – Clear SFS, AK

d. UEWR – Royal Air Force (RAF) Fylingdales, United Kingdom

e. UEWR – Thule AB, Greenland

f. BMEWS and PAVE PAWS Test and Development System (BPPT&DS) – Peterson

SFB, CO

g. PARCS/PARCS Software Development Suite (SDS) – Cavaliver SFS, ND

h. PARCS Development, Integration and Testing System (PDITS) – Peterson SFB, CO

i. COBRA DANE/COBRA DANE Transmitter System (CDTS) – Eareckson AS, AK

The Ground Based Radars (GBRs) work together to provide missile warning using the Integrated Tactical Warning/Attack Assessment system. The radars also perform space operations missions including surveillance, missile warning, reconnaissance, space support, space control, and space situational awareness.

Space Operations Command (SpOC) S3/6C requires a cybersecurity assessment of the SSC/SZQ accredited systems/enclaves listed above to fulfill Operational Acceptance (OA) requirements.

Potential awardee must have an Agent of the Security Control Assessor (ASCA) accreditation from SpOC.

All information contained in this Request for Information is preliminary, as well as subject to modification, and is in no way binding on the Government. The Government will not pay for any information submitted in response to this request. The information requested will be used solely within the Space Force to facilitate decision making and will not be disclosed outside of the

Government. The determination of an acquisition/procurement strategy, based upon the comments submitted in response to this Request for Information, is solely within the discretion of the Government. This synopsis is open to all qualified contractors, regardless of size. The applicable North American Industry Classification System (NAICS) is: 334511 – Radar systems and equipment manufacturing. If a potential responder believes a different NAICS code is more applicable to this effort than the one noted here, an alternate NAICS and justification for its use should be noted in their response.

The Government believes the Rough Order of Magnitude of the base effort is between $1 million and $2 million, not to include the Option.

II. Scope of Work:

The contractor must be certified as a Space Operations Command (SpOC) Agent for the Security Control Assessor (ASCA). The contractor will have a travel team no greater than 5 members who must all have a Secret clearance. Additionally, the contractor will perform a non-intrusive cybersecurity assessment on government identified systems and devices and the associated software products installed on these devices. Assessments will be conducted using the Defense Information Systems Agency (DISA) provided Security Technical Implementation Guidance (STIG) Checklists. Some systems may require multiple STIG Checklists to be assessed for multiple software applications installed on the device.

The contractor will produce custom scripts to automate any manual portion of the STIG Checklist. Copies of these scripts will be supplied to the Government Information System Security Manager (ISSM) of the system for review prior to data collection.

The contractor will also perform interviews and physical checks as part of the cybersecurity assessment. The results of the interviews and physical checks will be consolidated with the results of the DISA STIG benchmarks. Deliverables will include: an Initial Findings Spreadsheet, Risk Management Framework (RMF) Security Assessment Report (SAR), Program Plan of Action and Milestones (POA&M), and an Authorization Decision Document.

The scan must be performed within five days with minimal operational downtime.

III. Information Sought:

Within the 15 pages specified by this Request for Information, qualified potential contractors are requested to provide the following information to meet the Request for Information objectives.

1. The Government requests industry feedback from potential contractors’ ability to perform the cybersecurity assessment in no more than five days with minimal operational downtime and a full report within 30 days of the assessment.

a. Describe the timeline of the five days to complete the assessment.

IV. Questions:

In addition to the information requested above in response to this Request for Information, the Government is seeking responses to the questions below:

1. Is the contractor on the approved ASCA SpOC list?

2. What is the contractor’s cybersecurity assessment capabilities?

3. Will the contractor require its personnel to have a workstation?

4. Has the contractor had previous work experience with SSC/SZQ (previously

AFLCMC/HBQ)?

5. What experience does the contractor have with cybersecurity or Government agencies?

6. Describe small business participation opportunities, if any.

7. Is the contractor on any Government-wide Acquisition Contracts (GWAC)?

V. Response Information:

Submit your responses via email in a PDF or an MS Office compatible electronic format with “ASCA Cybersecurity Assessment” in the subject line to lead contracting officer James Lovely at james.lovely.1@spaceforce.mil with a courtesy copy to Kiera Thorpe, Contracting Specialist, at kiera.thorpe@spaceforce.mil.

Response information shall contain only ONE electronic file, no larger than 10 megabytes (MB) in size that contains the following:

1. Cover letter

2. Company name, mailing address/website, location of facilities, CAGE Code, NAICS number(s), business size and any eligibility under the U.S. Government socio-economic programs and preference, and point of contact to include telephone number(s) and email address. Specify if responding concern is a U.S. or foreign-owned firm.

3. Responses to the Request for Information in Section III shall be no more than 15 pages, 11 point Times New Roman font (no smaller than 10 point when embedded within graphics)

4. Responses to questions in Section IV (if desired)

Multiple electronic submissions to avoid the 10 MB size limitation will not be allowed.

Any response submitted by contractors to this Request for Information constitutes consent for their submission to be reviewed by Government personnel, Federally Funded Research and Development Center (FFRDC) employees and Advisory & Assistance Services (A&AS) contractor employees supporting SSC/SZQ, unless the respondent clearly objects in writing to the release of this information to FFRDC contractor employees and A&AS contractor employees supporting SSC/SZQ, in the cover letter accompanying your Request for Information response package.

The information received will assist in formulating an acquisition strategy decision. Responses are due no later than 15 September 2022, 8 a.m. Mountain Standard Time (MST), however, earlier submissions of responses are highly desirable. Responses received after this date and time may not be considered.

Address all contracting and acquisition strategy questions to the Contracting Team:

James Lovely, Lead Contracting Officer, at james.lovely.1@spaceforce.mil Kiera Thorpe, Contracting Specialist, at kiera.thorpe@spaceforce.mil