ITP RFI_Technical Support Services_final_20251219.docx

FY26 Insider Threat Program Requirements for an RFI Technical Support

SOURCES SOUGHT/REQUEST FOR INFORMATION (RFI)

SECRET SERVICE

OFFICE OF PROFESSIONAL RESPONSIBILITY

INSIDER THREAT PROGRAM (ITP)

This notice constitutes a Request for Information (RFI) Pursuant to Federal Acquisition Regulation (FAR) Part 15.201 for the purpose of determining the capability of sources in the marketplace. This RFI is for procurement planning purposes only and shall not be construed as a request for proposals/quotes, solicitation, or commitment on the part of the Government to issue any future solicitation or award. The Government will not reimburse any costs associated with the development and submission of materials in response to this request.

The contemplated effort would be firm-fixed-priced with a 12-month base period and two 12-month option periods. The North American Industry Classification System (NAICS) code for this requirement is 541519.

BACKGROUND

The States Secret Service plays a critical role in meeting the Department of Homeland Security’s (DHS) priorities for preventing terrorism and enhancing security. On October 7, 2011, President Obama signed Executive Order 13587 - Structural Reforms to Improve the Security of Classified Networks and the Responsible Sharing and Safeguarding of Classified Information. Section 6 of the Executive Order, Insider Threat Task Force, requires all government agencies to implement an insider threat detection and prevention program consistent with guidance and standards developed by the National Insider Threat Task Force (NITTF). The mission of the Secret Service ITP is to deter, detect, and mitigate an insider threat incident at the Secret Service. Insider threat incidents include terrorism, espionage, unauthorized disclosure, sabotage, workplace violence, and corruption.

This effort is a follow-on to a previous order, which was 8(a). The Program Office is interested in responses from 8(a) firms. The contract resulting from this market research is intended to be an 8(a) award.

The objective of this RFI is to engage with industry in search of a potential strategic partner to provide Insider Threat investigative analysts, training assistant for workforce, Microsoft Purview Insider Threat integration consultation within the current Secret Service Insider Threat Program environment.

GENERAL REQUIREMENTS

· All contractor personnel must be US Citizens and performing their work within the US

· Provide Insider Threat investigative analyst to support ITP through the entire analytical process using a User Activity Monitoring (UAM) tool and various information sources.

· Contractor shall have experience with the Insider Threat Framework.

· Provide Insider Threat investigative technical support to track and report on real world incidents through identifying, monitoring, analyzing, and responding to insider threat activities within the Secret Service.

· Provide trend and anomaly analysis, support to insider threat investigative activities.

· Utilize information from multiple data sources analyze user behaviors and activities and put into context to determine if damage to an organization is likely.

· Provide analysis and processing of user activity data by applying predetermined, automated, risk logic, for determined patterns of ‘typical behaviors’ for users demonstrating concerning behaviors.

· Gather facts and relevant data, analyzes data, draws conclusions supported by facts, and develops written reports of findings based on insider threat policies and procedures.

· Utilize a structured analytical process to identify physical, information, personnel, and operational protection gaps that could provide an adversary with insights into Critical Program Information/critical information.

· The contractor shall consult on integration of MS Purview into the Insider Threat architecture.

· The contractor shall define reporting and program integration plans to implement MS Purview to complement other insider threat tools.

· The contractor shall assist ITP Program Manager with Insider Threat Awareness trainings and briefings for workforce and new employees.

· The contractor shall assist the ITP Program Manager in developing an Insider Threat Vigilance Campaign

Questions:

1. Describe your firm’s experience with other federal agencies Insider Threat Programs within the Intelligence Community.

2. Describe your firm’s experience with the six-step analytical process: triage, research, analysis, and mitigation with federal agencies that have non-classified and classified network.

3. Describe your firm’s experience with consulting on the integration of MS Purview as it relates to the Insider Threat architecture.

4. Describe does your firm have experience with specific User Activity Monitoring software. Which ones?

5. Please provide a recommended staffing plan for the hypothetical Insider Threat Hub environment listed below. Please include quantity of contractors, labor categories, and knowledge & experience levels.

· UAM Monitoring of 8,000 – 10,000 employees

· 6,500 policy alerts (Highs, Med-His, & Med) per week

· Existing Government ITP Team:

· (1) Investigative Analyst Lead – Government

· (4) Entry-level Investigative Analysts - Government

· (1) ITP Training Assistant

All interested parties are invited to submit a capabilities statement, which shall not exceed three (3) total pages and no smaller than 12-point Times New Roman font. If providing information relevant to the ability of your firm to successfully execute the work described in this notice.

The capability statement should demonstrate understanding, capability, approach, qualification, and experience in meeting the work requirements.

Finally, interested parties should identify challenges and risks associated with meeting the requirements and how the organization would minimize those risks. The Secret Service will review the capability statement to determine if the interested party is capable of satisfying the requirements based on its demonstrated understanding, capability, approach, qualification, and past experience. Please note that at least 50 percent of the cost of contract performance incurred for personnel shall be expended for employees of the concern, and/or shall perform work for at least 50 percent of the cost of manufacturing the supplies, not including the cost of materials. pursuant to the FAR clause at 52.219-14 entitled “Limitations on Subcontracting (MAR 2020)”.

In furnishing the requested information, please include the following as part of the submission:

1. Name of the Organization

2. Address of the Organization

3. CAGE Code and DUNS Number for the Organization

4. Small business standing (i.e. large or small business) under NAICS Code 541519

5. If a Small Business, indicate Small Business Type(s) (e.g., Small Business, Woman-Owned Small Business, Economically Disadvantaged Woman-Owned Small Business, Small Disadvantaged Business, 8(a) Certified, HUBZone Certified, Veteran Owned Small Business, and/or Service-Disabled Veteran-Owned Small Business)

As much as possible, it is preferred that capability statements be nonproprietary. However, capability statements with company-sensitive data and concepts will be accepted, and the Government will respect restricted data markings. Responders are expected to appropriately mark their submissions that contain proprietary information; receipt of classified materials is not anticipated.

All responses shall be submitted electronically, via email, no later than 4:00pm Eastern Time (ET) on December 29, 2025 to the points of contacts listed below. Only attach MS Word/Excel compatible files or Adobe Acrobat PDF files in electronic correspondence.

Points of Contact

Contract Specialist: Caitlin Minor, caitlin.minor@usss.dhs.gov

Contracting Officer: Crystal Garcia, crystal.garcia@usss.dhs.gov