Exec Course RFI - 2022.docx

FEDERAL BUREAU OF INVESTIGATION FINANCE DIVISION | PROCUREMENT SECTION

Request for Information March 9, 2022

RFI – CRS CETU EXECUTIVE MANAGEMENT CYBERSECURITY COURSE – 2022

DISCLAIMER:

THIS NOTICE IS FOR INFORMATIONAL PURPOSES ONLY. THIS IS NOT A REQUEST FOR PROPOSAL OR QUOTE. IT DOES NOT CONSTITUTE A SOLICITATION AND SHALL NOT BE CONSTRUED AS A COMMITMENT BY THE GOVERNMENT. RESPONSES IN ANY FORM ARE NOT OFFERS AND THE GOVERNMENT IS UNDER NO OBLIGATION TO AWARD A CONTRACT AS A RESULT OF THIS ANNOUNCEMENT. NO FUNDS ARE AVAILABLE TO PAY FOR PREPARATION OF RESPONSES TO THIS ANNOUNCEMENT . ANY INFORMATION SUBMITTED BY RESPONDENTS TO THIS TECHNICAL DESCRIPTION IS STRICTLY VOLUNTARY .

INTRODUCTION

Responses to this RFI may be used to formulate final requirements and/or to identify qualified vendors capable of meeting those requirements. The description below outlines preliminary requirements envisioned for the External Vendor Cyber Training. The information gathered may be used to formulate acquisition strategies for competitive solicitations.

NAME OF REQUIREMENT

Cyber Division’s (CyD) Cyber Readiness Section (CRS) Executive Management Cybersecurity Course for the Federal Bureau of Investigation (FBI) Cyber Education and Training Unit (CETU).

PURPOSE

The United States Department of Justice (DOJ), FBI, is requesting information and conducting market research on the current vendor capabilities to provide FBI Cyber Executive leadership with the training and information they need in a two to three day course that will navigate today's cyber complex environment, with an emphasis on generating a greater understanding of cyber security architecture and risk management. Specifically, the FBI is looking for a vendor to provide industry standard corporate C-suite fundamentals, technical concepts, and other cyber management fundamentals in an interactive style designed to help FBI leaders intelligently address the unique concerns of cyber investigations and violations.

Responders are advised that the U.S. Government will not pay for any information or administrative costs incurred in response to this Sources Sought /RFI; all costs associated with responding to this Sources Sought/RFI will be solely at the interested party’s expense. Not responding to this Sources Sought/RFI does not preclude participation in any future RFQ, if any is issued. If a solicitation is released, it will be synopsized on the sam.gov contract opportunities website. It is the responsibility of the potential offerors to monitor the site for additional information pertaining to this requirement. All responses shall be single page in Microsoft Word 2013 format utilizing Times New Roman font 12. Responses should indicate this is a submission in response to RFI – CRS CETU EXECUTIVE MANAGEMENT CYBERSECURITY COURSE - 2022. Responses shall be submitted no later than March 25, 2022.

BACKGROUND

As part of this program, CETU provides training merging together the FBI executive management responsibilities and incident response, and the private sector responsibilities and responses relating to cyber-attacks and threats. The goal is to provide FBI executives with an understanding and perspective of the C level executives in order to foster better relationships with private sector partners. These relationships are key to building trust among the FBI and the private sector, as well as aiding sharing information for investigations. It is important that FBI executives understand the language, motivation, and have high-level technical knowledge of private sector companies in order to fully understand the threats private sector companies face. CETU would like to partner with a University or private sector company to give FBI Executives a high-level cybersecurity course that will provide insight into the current posture of C Level Executives.

SCOPE

To meet objectives, the contractor team may be required to fulfill the following topics:

· A facilitated discussion with a C-Suite (such as CSO, CISO, CEO) member who worked or works for a company that had a computer intrusion and work with the FBI or law enforcement during the incident. Below are the following topics to include in the discussion.

· Walk the attendees through an incident from start to finish.

· What was a positive or good experience working with law enforcement?

· What was negative or bad about working with law enforcement?

· Did you work with other government agencies during your computer intrusion incident?

· When during the incident did you decide to involve law enforcement? In hindsight would you have engaged with them earlier or later?

· What were the factors you considered around involving law enforcement?

· When you call law enforcement, what are your expectations and needs?

· How can law enforcement better engage with private sector ahead of a computer intrusion?

· What does cyber insurance or a mitigation firm bring to the table and what new factors does this bring into your considerations during an incident?

· What are the best practices/ industry standards you follow during an incident?

· Cryptocurrency

· Executive level overview of cryptocurrency

· Computer Intrusion Threats

· Executive level overview of major threats to include Ransomware

· Recent and historical examples

· Cyber Hygiene

· Enterprise wide and personal

· Private sector governance

· Industry standards such as Defense in Depth, Mitre Attack Framework, NIST

· Risk Considerations

· C-Suite Structure

· General Factors of IT Architecture

· Cyber Nomenclature In addition to the topics listed above, the following activities and exercise may be included”:

· Real world examples of concepts being taught/demonstrated

· Discussion activities

· Knowledge checks throughout

· Incident response exercise from private sector perspective The FBI is also looking for information from industry regarding:

· Do you have any level 2, more in depth to cybersecurity for executives?

· Do you have an industry certification that could be applied to this course?

The primary places of performance will be in vendor-provided hotel facility spaces in Chantilly, Virginia; Huntsville, Alabama; and other negotiated cities in the United States.

ANTICIPATED PERIOD OF PERFORMANCE:

The contract is estimated to be a base period of twelve months, with four additional twelve-month option periods. The associated NAICS is 611430.

ANTICIPATED CONTRACT TYPE:

The contract type is contemplated to be Firm Fixed Price, utilizing firm fixed priced labor rates, and deliverables. The SOW will have flexibility in order to adjust courses as Cyber events and issues evolve throughout the life of the contract.

RESPONSES

The businesses shall submit information on their three most relevant, recent contracts (preferably within the federal government or DoD spaces) within the past five years. This shall include corporate experience that reflects relevance to requirements of the RFI on similarity in size, scope, complexity, and technical difficulty. If any company has experience with FOIA business processes, this should also be highlighted in the response. Any predecessor companies or company names that were being used during the performance of the contracts shall be included.

For all contracts listed, the businesses shall provide the following information:

· Company/Division name, DUNS Number, Socioeconomic Category, and Cage Code

· Business Size

· Program title

· Contract number, Delivery Order, Task Order number

· Type of contract (e.g., firm-fixed-price, cost-reimbursable)

· Contracting Agency/Customer

· Original contract value and current value and reason for difference

· Fee Structure: Amount awarded vs. amount available for award, and provide an explanation for any differences in the amounts

· Date of Award, Period of Performance, original and current date completion dates

· Name, address, and telephone number of the current Government Program Manager, CO, Contracting Officer (include both Administrative and Procuring CO, if applicable) for Government contracts or Name, address, and telephone number or Customer Program Manager and Business Administrator for non-Government contracts.

· Program Details to include the role of the company (Prime, Sub, JV, etc.), the nature of the work and how the work is relevant to this requirement.

· Summarize major achievements, successes, innovations and awards that were accomplished during contract performance, as well as any major problems/challenges encountered, and corrective actions taken to resolve them during the period of performance of the contract

· Percentage and nature of the work to be performed by the entity on the present acquisition and their role

Make sure to include in your capabilities statement any contracts or GWACs that you currently hold.

RFI responses shall be sent via email to swalker4@fbi.gov. Submissions must be received no later than 12:00 pm CST on 25 March 2022. Questions or comments regarding this notice may be addressed to Contracting Officer Stevon Walker at the above email addresses until 12:00 pm CST 23 March 2022. Questions will be formatted with subject line identifying the RFI Title. Verbal questions will NOT be accepted. The Government does not guarantee that all questions will be answered.

INDUSTRY ENGAGEMENT

FBI representatives may or may not choose to meet with potential quoters. Such engagements would only be intended to get further clarification of potential capability to meet the requirements, especially any development and certification risks.

Stevon Walker Contracting Officer swalker4@fbi.gov

RFI - CRS CETU EXECUTIVE MANAGEMENT CYBERSECURITY COURSE - 2022

Version 1.0 image1.jpeg