Cybersecurity Assessments RFI FINAL.docx

REQUEST FOR INFORMATION

Cybersecurity Assessments Department of Homeland Security Chief Information Security Officer Directorate

This is a request of information (RFI) issued for planning purposes only, and does not constitute a solicitation for proposals, offers, bids, and/or quotes. This is not an announcement of a forthcoming solicitation, or confirmation that the Government will contract for the items/services contained in the RFI, nor is any commitment on the part of the Government to award a contract implied. The purpose of this notice is to conduct market research to identify qualified and interested sources that could provide the services stated. The information requested by this notice will be used within the Department of Homeland Security (DHS) to facilitate decision making and will not be disclosed outside of the agency. Any information provided to the Government is strictly voluntary and will be provided at no cost to the Government.

Respondents are advised that the Government will not pay for any information or administrative cost incurred in response to this RFI. Responses received in response to this RFI will not be returned. Proprietary information and trade secrets, if any, must be clearly marked. All information received that is marked Proprietary will be handled accordingly.

Background The DHS has a requirement for services to support and assist the federal staff within the Chief Information Security Officer Directorate (CISOD) organizational units. The requirement includes engineering and technical assistance for Cybersecurity related missions as required to meet DHS, Office of the Chief Information Officer (OCIO), and CISOD strategic plans, mission goals and objectives. The services shall be non-personal and not inherently Governmental in accordance with established Federal regulation and agency policy. The Contractor(s) will support sub-organizational units within the CISOD which include: Governance, Assessments, Vulnerability Management, and National Security Systems Branches. This RFI requires interested contractors to indicate their ability to fulfill the requirements.

Tasks The Contractor shall support the following tasks:

1. Manage a program valued at over $10M per year to include: transition planning, special project planning, resource management, personnel daily accountability, budget tracking including estimate to complete projections, quality assurance of deliverables, risk management status and problem reporting.

2. Perform Independent Verification and Validation (IV&V) testing over remediated Information Technology (IT) security controls by reviewing and performing analysis of Component artifacts. Reviews include a compliance check to ensure that controls tested by component are adequately tested, communicating results to the Component, tracking Component submitted packages.

3. Provide Risk and Vulnerability Technical Writing Support by supporting technical teams in developing documentation is clear and comprehensive. Materials will be for all CISOD and DHS stakeholders to include Senior Leadership. Materials will include papers, flyers, multi-media presentations for a variety of technical subjects.

4. Provide technical support, including managing and optimizing Atlassian products, specifically Jira and Confluence, to support multiple team workflows, enhance communication, and ensure efficient project management in line with federal directives.

5. Establish and maintain a comprehensive Information Security and Vulnerability Management (ISVM) program to ensure the security and integrity of the enterprise IT infrastructure across all of DHS. This includes publishing security alerts and bulletins for the agency, continuous monitoring of DHS-wide vulnerabilities, expert guidance on threat mitigation efforts, providing metrics for CISA Binding Operational Directive (BOD) compliance, and developing training materials for the program.

6. Conduct comprehensive High Value Asset (HVA) assessments in alignment with the Cybersecurity and Infrastructure Security Agency (CISA) Assessment Evaluation and Standardization (AES) guidelines. This includes ensuring that all members meet CISA’s AES-HVA Applicant Qualification Requirements and pass exam requirements and maintain CISA’s qualifications. In addition, all requirements to maintain the assessment process, including setup, execution, reporting results, maintaining an HVA assessment schedule and Standard Operating Procedures ( SOPs) will need to be performed.

7. Perform comprehensive Risk and Vulnerability Analysis (RVA) assessments, functioning as penetration and purple team assessments, in accordance with federal guidelines and current cybersecurity best practices. RVA assessments utilize major frameworks like Open Web Application Security Project (OWASP) and National Institute of Standards and Technology (NIST) and cover web applications, servers, operating systems, cloud services, network and artificial intelligence (AI) workflows.

8. Track, document, and support remediation of all disclosed vulnerabilities, using expertise in penetration testing and exploitation tools in support of the Vulnerability Disclosure Program (VDP) and HackDHS initiatives. Contractors will be responsible for analyzing submitted findings and vulnerabilities and maintaining all processes and documents of the program.

9. Conduct ongoing research into current and emerging trends in artificial intelligence (AI), influencing policy and developing best practices for AI security and application testing. Contractors will also develop mock AI systems for effective testing, creating comprehensive guidance and best practices for AI security testing and delivering analysis of and training on AI technologies.

10. Conduct comprehensive Cybersecurity Service Provider (CSP) assessments in alignment with CSP accreditation criteria. This includes support of the CSP Program Management Office (PMO) by coordinating with DHS personnel for the successful operation of the program, as well as managing the assessment team conducting the assessments.

11. Conducting Component Cybersecurity Assessments of information systems by performing technical assessments of assigned systems and applications to determine the severity of weaknesses and supporting the Security Authorization (SA) and Continuous Monitoring (CM) of the systems utilizing frameworks such as the NIST Risk Management Framework (RMF) process. Results of the assessments will also be entered into the DHS compliance tool and alternate tools as agreed upon by the government.

12. Conduct assessments of National Security System (NSS) assessment and analysis shall consist of cybersecurity risk assessments, security control assessments, creation of Body of Evidence (BoE) artifacts (e.g.; Security Assessment Report (SAR)) in support of Security Authorization (SA), Continuous Monitoring (CM), and Risk Management Framework (RMF) activities in accordance with DHS 4300B policy and guidance, system categorization coordination, and cyber risk recommendation reporting, in support of National Security Cyber Division (NSCD) work products. Results of the assessments will be documented in the Management Component’s (MGMT) compliance tool and will also be entered into alternate tools as agreed upon by the government.

Interested vendors that can provide the necessary services are asked to respond to this notice with a corporate capability statement that includes general background information and technical capabilities describing your firm's experience with projects similar in size and scope to the requirement.

The capability statement shall be a maximum of five (5) pages. It shall include a cover sheet that includes:

1. Company Name and address

2. Point of contact (name of representative, e-mail address, phone number, DUNS number)

3. Company CAGE and DUNS

4. Business size

5. List of vendor’s contracting vehicles related to this RFI requirement

6. Level of corporate facility clearance, if any.

The remainder of the document shall include:

7. Past Experience: Responses to this RFI shall indicate similar/relevant contracts/ orders within the past three (3) years for the same or similar services required under this notice. Contract information may include those with Federal, State and local Government, as well as private companies. Please include dollar value and period of performance. Please include any relevant work with DHS.

Any questions submitted regarding this RFI will not receive a response.

Please submit your response to:

Keira Buggs (Keira.Buggs@hq.dhs.gov) Michael Lipperini (Michael.Lipperini@hq.dhs.gov) Information submitted must be in sufficient detail to allow a thorough government review of the firm’s interest and capabilities.

Your response should be no more than 5 pages (the coversheet is excluded from the page count). All responses are due No Later Than Wednesday, April 25, 2024, at 12:00 PM Eastern Time.

SENSITIVE BUT UNCLASSIFIED