RFI DoDIN Risk and Situational Awareness Picture (DRSAP) Final.pdf

REQUEST FOR INFORMATION

Joint Force Headquarters - Department of Defense Information Network / Logistics and Contracts / Defense Information Technology Contracting Organization (JFHQ- DODIN/J4/DITCO) is seeking information from industry to assist with the development and planning of a potential new requirement.

THIS IS A REQUEST FOR INFORMATION (RFI) NOTICE ONLY. THIS IS NOT A

REQUEST FOR PROPOSALS (RFP). NO SOLICITATION IS AVAILABLE AT THIS TIME.

1. Overview/Purpose/ Description of Procurement: JFHQ-DODIN requires visualization capabilities that can provide Situational Awareness (SA) of Department of Defense Information Network (DODIN) systems, networks, and information availability. The primary purpose is to enhance knowledge of the DODIN and to improve the quality and timeliness of collaborative decision-making regarding the employment, protection, and defense of the DODIN. To be effective, DODIN SA must be available and shared in near real-time to the relevant decision-makers. JFHQ-DODIN works in collaboration with U.S. Cyber Command (USCYBERCOM) in their vision to lead an adaptive force that assures the availability, delivery, and protection of the DODIN.

2. Scope of Effort: JFHQ-DODIN has developed a visualization solution called “DoDIN

Risk and Situational Awareness Picture (DRSAP)”. The purpose of the DRSAP requirement is to provide operational and executive level visual that displays the Cyber Terrain risk posture of all 45 Director of Area of Operations (DAOs).

3. Technical Characteristics: JFHQ-DODIN requires a visualization dashboard that is flexible and customizable.

• The capability shall have the ability to collect and aggregate network data to provide an overall risk to the network.

• The capability shall have the ability to drill down with minimum clicks to gain more information about an object, incident, etc.

• The capability shall provide demonstrated Security Information and Event Management/ Security Orchestration, Automation, and Response (SIEM/SOAR) functionality.

• The capability shall have the ability to connect to Joint Cyber Command and Control (JCC2) platforms (Rally, SIGACT) and visualize the data.

• The capability shall be compatible with existing Joint Cyber Warfighting Architecture (JCWA) architecture and applications.

• The capability shall be interoperable with existing JFHQ-DODIN built SharePoint applications.

• The capability shall be able to search and visualize the asset posture of systems within each DAO. Asset posture includes the following:

a. Asset type;

b. Vulnerability status for known CVEs;

c. Security Technical Implementation Guide (STIG) compliance;

d. Operating System (OS) and OS version;

e. Installed software with version details;

f. Whether asset is forward facing directly to the internet and available services.

• The capability shall be able to search and visualize cyber sensor architectures for all DAOs supporting a TIER 1 Internet access point. Details shall include censor types and placement within the overall DODIN architecture.

• The capability shall be adaptable to visualizing new data sources dynamically as they become available.

• The capability shall visualize last seen updated data from each separate data feed.

• The capability shall have the ability to search and visualize summarized cyber events/alerts from SIEM solutions.

• The capability shall have the ability to directly link back to source of record for original data source to allow users to gather additional details for source system.

• The capability shall display nation-state and adversary activity targeting the DODIN derived from commercial and government-based threat intelligence organized actor, DAO, sector, function, Tactics, Techniques and Procedures (TTP), and date.

• The capability shall display the Scope, Assemble, Score, Relate, Enforce (SASRE) score on applicable computing devices in relation to vulnerable assets within DODIN focus on Severity, Weaponization, and Adversary Use / Exploitation and MITRE ATT&CK T-Codes.

• The capability shall provide visualization of trending details for threats, alerts. asset posture, task order status from each DAOs.

• The capability shall have the ability to search and visualize compliance status against applicable orders, issued by JFHQ-DODIN, across the entire Department of Defense (DoD) organized by DAO.

• The capability shall have the ability to display and modify risk factors and weights based on each data set available within the system.

• The capability shall have the ability to allow or restrict users to each visualization dashboard based on group membership.

4. Requested Information: JFHQ-DODIN leadership is requesting a visualization solution that helps to answer key questions that help drive decisions:

• What are the critical cyber threats to the DODIN?

• Are we seeing attempts to use those threats against DODIN systems? If yes, please describe.

• What systems are vulnerable to those adversary threats?

• Which vulnerable systems are supporting mission critical capabilities?

• What mitigations do DAOs have in place for those vulnerable systems?

• Which DAOs are responsible for these systems?

• What is the current cyber risk posture for each critical threat across the DODIN?

RESPONSE GUIDELINES:

Interested parties are requested to respond to this RFI with a white paper. Submissions cannot exceed five (5) pages, single spaced, 12-point type with at least one-inch margins on 8 1/2” X 11” page size. The response should not exceed a 5 MB e-mail limit for all items associated with the RFI response. Responses must specifically describe the contractor’s capability to meet the requirements outlined in this RFI. Oral communications are not permissible. The System of Award Management (SAM.gov) will be the sole repository for all information related to this

RFI.

Companies who wish to respond to this RFI should send responses via email no later than 09 July 2024 to jeremy.d.markusic.civ@mail.mil and amder.d.lindauer.civ@mail.mil.

INDUSTRY DISCUSSIONS:

DISA representatives may choose to meet with potential offerors and hold one-on-one discussions. Such discussions would only be intended to obtain further clarification of potential capability to meet the requirements, including any development and certification risks.

DISCLAIMER:

This RFI is not a Request for Proposal (RFP) and is not to be construed as a commitment by the Government to issue a solicitation or ultimately award a contract. Responses will not be considered as proposals, nor will any award be made as a result of this synopsis.

All information contained in the RFI is preliminary as well as subject to modification and is in no way binding on the Government. FAR clause 52.215-3, “Request for Information or Solicitation for Planning Purposes”, is incorporated by reference in this RFI. The Government does not intend to pay for information received in response to this RFI. Responders to this invitation are solely responsible for all expenses associated with responding to this RFI. This RFI will be the basis for collecting information on capabilities available. This RFI is issued solely for information and planning purposes. Proprietary information and trade secrets, if any, must be clearly marked on all materials. All information received in this RFI that is marked “Proprietary” will be handled accordingly. Please be advised that all submissions become Government property and will not be returned nor will receipt be confirmed. In accordance with FAR 15.201(e), responses to this RFI are not offers and cannot be accepted by the Government to form a binding contract.

mailto:jeremy.d.markusic.civ@mail.mil mailto:amder.d.lindauer.civ@mail.mil mailto:amber.d.lindauer.civ@mail.mil