ENTERPRISE CYBER ANALYTICS_RFI.pdf

UNCLASSIFIED

REQUEST FOR INFORMATION (RFI) / SOURCES SOUGHT (SS) NOTICE

FOR ENTERPRISE CYBER ANALYTICS

(U) The Government is requesting information on Enterprise Cyber Analytics tools which provide Security Information and Event Management (SIEM) and Security

Orchestration and Automation (SOAR) capabilities.

(U) THIS IS A REQUEST FOR INFORMATION (RFI) AND NOT A SOLICITATION. This

RFI is for planning purposes only and shall not be considered an invitation for bid, request for quotation, request for proposal, or as an obligation on the part of the Government to acquire any products or services. Your response to this RFI will be treated as information only and will follow a three-phase timeline (please see below timeline section). No entitlement to payment of direct or indirect cost or charges by the Government will arise because of contractor submission of responses to this announcement or the Government’s use of such information. This request does not constitute a request for proposals or the authority to enter negotiations to award a contract. No funds have been authorized, appropriated, or received for this effort. The information provided may be used by the Government in developing an acquisition strategy, or performance work statements, or specifications. Interested parties are responsible for adequately marking proprietary or competition sensitive information contained in their responses. The Government is not required to award a contract based on this RFI or to otherwise pay for the information submitted in response to this RFI.

(U) By submitting information in response to this RFI, respondents consent to the release and dissemination of submitted information to any Government entity. As such, to the extent that any information submitted in response to this RFI is marked as, or construed to be proprietary or business-sensitive, respondents are hereby notified (a) of the potential that such information may be disclosed to third party (support contractor) and (b) that submission of information in response to this RFI constitutes consent to disclosure of submitted information. The Government expects to have third party support during its review of RFI responses. Industry Partners (IP) who require a

Non-Disclosure Agreement (NDA) arrangement shall coordinate with and submit its corporate

NDA to the POC listed below, specifically referencing this RFI's number and title in the NDA’s scope. The completed NDA will be promptly returned to the IP.

POC: Casey Nau

Email: casey.nau@gsa.gov

(U) NO phone calls and/or requests for a Solicitation will be accepted or acknowledged. Company

Brochures are NOT desired.

(U) Technical questions regarding this RFI should be directed to Renee Grace (renee.grace@gsa.gov) and Casey Nau (casey.nau@gsa.gov) no later than (NLT) 11:00 a.m.

ET on February 12, 2024. Phone calls will not be accepted.

(U) The Government requests responses to this RFI to be submitted NLT February 20, 2024, at

3:00 PM ET. All interested parties should submit in writing (no more than 20 pages, single-spaced) their capabilities, experience, and familiarity with providing the services stated below.

Responses to identified capabilities should be clearly marked within the response with the ability to meet threshold and/or objective requirements clearly identified within the response. A response of ‘no’ or ‘not provided’ with the given architecture is an appropriate answer. The complete response to this RFI is limited to a total of 20 pages. The Government is not seeking marketing materials in response to the RFI. The responses should be in Adobe Acrobat Portable Document Format (PDF) or in a format compatible with Microsoft Office. Please submit your responses via email to Renee Grace (renee.grace@gsa.gov) and Casey Nau (casey.nau@gsa.gov) NLT 3:00 PM ET on February 20, 2024. Phone calls will not be accepted.

SCOPE:

(U) This request is for information only regarding Enterprise Cyber Analytics tools which support business and security operations in a multi-classification Department of Defense (DoD) architecture following the DoD Zero Trust (ZT) paradigm. The capabilities have been grouped into two categories: those supporting Analytics & Visualization and those supporting Automation

& Orchestration. Failure to identify a capability in one category will not be identified as a failure in another category. Collaboration may be possible between industry partners to provide an integrated solution for Enterprise Cyber Analytics which meets regulatory requirements and desired functionality.

(U) Current Federal and DoD regulations require logging and monitoring of enterprise information systems. These activities are leveraged for the purpose of improving network resilience, increased security, and improved operations through the application of an enterprise cyber analytics program. Through proactive use of captured data, analytics tools provide near real-time intelligence to support Security Operations Center (SOC) and Network Operations Center (NOC) teams. In the context of ZT, SIEM and SOAR tools are integrated to support Analytics, Visualization, and Automation objectives. While capabilities in Table 1 are divided into SIEM and SOAR, a response which answers one capability may be appropriate since the development of a holistic analytics program may consist of multiple integrated products. For example, solutions which efficiently address automation and integration with case management may marry with another solution providing efficient and economical logging, log retention, and log management to deliver an acceptable solution.

PURPOSE:

(U) The Government is requesting information on Enterprise Cyber Analytics tools with SIEM and SOAR capabilities. This information will be used in the development of an integrated system for Special Operations Forces (SOF) Information Systems (IS) which achieves the objectives described in the ZT Visibility & Analytics and Automation & Orchestrion pillars while balancing cost and performance.

TIMELINE:

(U) Phase 0 – Request for Information: Enterprise Cyber Analytics (RFI) submitted to Industry January 17, 2024.

(U) Phase 1 – RFI Responses: Industry Partners with technology capabilities that potentially meet the areas of interest are encouraged to submit RFI responses NLT February 20, 2024. Note: The Government will respond to questions about the RFI that are provided to the Contracting Officer NLT February 12, 2024. All correspondence (questions and answers) will be by email to the Contracting Officer.

(U) Phase 2 – Immediate Post RFI Actions: RFI responses that were reviewed to have the highest potential to satisfy the technology requirements for Enterprise Cyber Analytics may be contacted for additional information requests. For technology that did not meet the potential to satisfy technology requirements, industry partners will be notified by email with additional detail.

(U) Phase 3 – Follow-on Efforts: The Government will decide if testing or a potential future competitive acquisition is desired based on review of the RFI response.

Table 1: Enterprise Analytics Needs (Unclassified)

Enterprise Analytics

Capability Attribute Performance Threshold Objective

Log Management

Event Logging

Monitor and log data from servers, applications, devices, and users in accordance with

USG and DoD Policy.

Tools for configuration and management of data collectors

Native data collectors and parsers for a wide base of application and device types

T = O

Data Storage

Process, aggregate, and store data in a central location

Data indexing for efficient querying

Compatible with Hybrid

Cloud and Multi

Cloud environments

Nonproprietary format

T = O

Security Information and

Event Management Analytics

Integrated analytical tools for real-time detection and visualization events

Real-time analytics detect and prioritize events

Batch analytics for pattern identification and correlation

Custom Visualization

Advanced Search

Functionality

Integration with security and detection telemetry sources

Capable of ingesting

Open-Source threat intelligence

Data science algorithms for advanced modeling of events and behaviors

Advanced User &

Entity Behavior

Analytics capability to profile and baseline behaviors

IT Operations Integration &

Operation

Compatible with network monitoring and security tools

Collaboration and notification integration

Real-time monitoring of network, cloud and on-premise environments

Artificial

Intelligence enabled management and optimization of network

Policy as Code support

Security Orchestration, Automation, and

Response (SOAR)

Prevention

Integrated tools to automate the prevention of cyber threats

Integrations with security appliances

Integration with asset management

Native support for common threat intelligence services

Automated monitoring and assessment of security configuration posture

Advanced insider threat detection

Artificial intelligence support for correlation of threat intelligence with SIEM data

Response

Integrated tools to support incident response and remediation

Integration with SIEM

Event detection

Automated response playbooks

Integrations with case management tools

Artificial intelligence supported dynamic policy management