DHS NOSC NCCS 2.0 Industry Day Slides_5-19-2026 Final.pptx

DHS Network Operations Security Center (NOSC) Network, Cloud, and Cybersecurity Services (NCCS) 2.0 Pre-Solicitation Conference May 19th, 2026 11:00 a.m. – 12:30 p.m.

Hosted by DHS:

Office of Procurement Operations Office of the Chief Information Officer Disclaimer: Information contained in this briefing is subject to change. Please review policy before proceeding with any action.

OFFICE OF PROCUREMENT OPERATIONS

Empower • Collaborate • Innovate • Procure Notes: Font sizes are recommended. However, PowerPoint will automatically adjust font size to fit content, as needed.

Welcome

LeDina Nelson Office of Procurement Operations Industry Liaison

Pre-Solicitation Conference Agenda

Rules of Engagement The information presented today is for informational purposes only.

This presentation does not constitute a request for proposals.

This presentation does not constitute a final version of the Government’s requirement and is not binding.

Please place your questions in the Q&A pod.

Any responses provided during this presentation may be subject to change.

OFFICE OF THE CHIEF INFORMATION OFFICER

Background & Overview

Ahmad Gharib Cyber Defense Division Chief DHS Office of Chief Information Officer

Notes: Font sizes are recommended. However, PowerPoint will automatically adjust font size to fit content, as needed.

NCCS 2.0 Purpose and Overview Contract Purpose:

Procure the full range of program management, systems engineering and technical assistance, systems operations and maintenance, and other professional support services for the DHS information enterprise Wide Area Network (WAN) and Homeland Security Enterprise Network (HSEN) network, cloud/platform and critical system and application, and cybersecurity monitoring and analysis, incident management and coordination (including cybersecurity incident handling and incident response), and alert and notification functions for the expanding DHS NOSC and for select DHS components, all while leveraging Agentic AI capabilities

Scope includes working with existing DHS component NOCs/SOCs (or NOSCs) and providing a flexible and scalable support model to accommodate potential further alignment and consolidation of additional operations center requirements in the DHS NOSC

Legacy DHS HQ / Information Enterprise Governance

DHS NOSC CONOPs Roadmap

OFFICE OF THE CHIEF INFORMATION OFFICER

Scope & Suitability Process

Sean Leach NOSC Security Operations Branch Chief DHS Office of Chief Information Officer

Notes: Font sizes are recommended. However, PowerPoint will automatically adjust font size to fit content, as needed.

NCCS Objectives Primary Objectives:

Evolve the DHS NOSC to build a best-in-class service node that meets DHS Cybersecurity Provider (CSP) and industrial doctrinal Center of Excellence service maturity standards Re-define the DHS HQ NOSC as the central hub of IT Service Management for DHS OCIO for all network infrastructure (WAN and select LAN); platform (including cloud), system, and application; and cybersecurity services for the DHS Homeland Security Enterprise Network (HSEN) at all classification levels and enclaves Unclass/SBU/CUI (A-LAN), Secret (B-LAN/HSDN), Top Secret (C-LAN), and D-LAN (SAP) Implementation Objectives:

Streamline functions and services by: elimination of redundant or overlapping services; synchronization and alignment of business processes; and leverage Agentic AI to reduce analyst workload and minimize repetitious tasks Modernize operations by: implementing a Common Operating Picture via unified dashboards and standardized platforms and tools; defining standardized (and scalable/variable) service support, cost, and security control catalogs; and enhanced automation of business functions and integration across technical platforms

Revised NCCS 2.0 Statement of Work Structure Task 1: Contract Management Task 1.1: Program Management Services Task 1.2: Transition Planning and Management Task 2: Capability Delivery and Improvement Task 2.1: Knowledge Management Task 2.2: Doctrine, Policy, Planning, and SOP Development Support Task 2.3: Service Catalog, Relationship, and Service Management Practices Task 2.4: Communications Support Task 2.5: Project Management Support Task 2.6: Continuous Service Improvement Program Agentic AI Task 2.7: Performance and Investment Metrics Task 2.8: Capability Test, Training, and Exercise Program Task 2.9: Data Call and Data Acquisition Support Task 2.10: Cybersecurity Services Provider Program

Revised NCCS Statement of Work Structure Task 3: Network, Cloud, and Cybersecurity M&A, Event and Incident Management and Response, and Associated Support Services Task 3.1: Monitoring and Analysis (M&A) and Incident Response Task 3.2: Network Operations Services Task 3.3: Cloud, Platform, and System Operations Services Task 3.4: Core Cybersecurity Services Task 3.5: Program Web and Tool Support and System Administration Task 3.6: Service Delivery Implementation Task 4: HSEN Network Infrastructure Operations and Maintenance (O&M) Support Services Task 4.1: IT Service Management Task 4.1.1: Configuration, Change, and Release Management Task 5: Field Engineering Technical Services

Revised NCCS Statement of Work Structure Task 6: Other Cybersecurity Services Task 6.1: Cybersecurity Services Provider (CSP) Audit and Accreditation Program Task 6.2: Information Security Vulnerability Management Program Task 6.3: Information System Security Control Assessment Program Support Task 6.4: Intrusion Defense Chain FISMA Metrics Tracking Task 6.5: DHS Industry Cyber Hygiene Assessment Program Support Task 6.6: Zero Trust

Task 7: Surge Support

DHS High-Level Suitability Process

Selection: Applicant selected for position; e-QIP completion; forms submission; and Fingerprinting

Checks: Criminal history; Financial history; Citizenship; previously completed investigations

Review: e-QIP acceptability (legibility, accuracy, completeness); Issue Resolution

EOD Decision: Favorable decision an applicant can start; Unfavorable decision an applicant cannot start

Investigation: Scheduled; field work completed; report of investigation back to DHS

Final Decision: Favorable decision an applicant continues to work; Unfavorable decision an applicant must be removed from contract

OFFICE OF THE CHIEF SECURITY OFFICER

Access and Facility Clearance

Gail Brown, Industrial Security Program Office of the Chief Security Officer

Notes: Font sizes are recommended. However, PowerPoint will automatically adjust font size to fit content, as needed.

Access and Facility Clearance

Security Requirement Top Secret clearance with access to Sensitive Compartmented Information (SCI) and Special Access Program (SAP)

Evaluation Factor Phase I: Pass/Fail

Active Top Secret Facility Clearance (FCL)

Safeguarding DHS SCIF/Accredited Contractor SCIF

Acquisition Strategy

Nicole Belanger Contract Specialist

Notes: Font sizes are recommended. However, PowerPoint will automatically adjust font size to fit content, as needed.

(Proposed) High Level Acquisition Strategy

Contract Overview:

Strategically Sourced Single Award Indefinite Delivery Indefinite Quantity (IDIQ) contract Hybrid Firm Fixed Price (FFP), Labor Hour (LH), Time and Materials (T&M) Period of Performance (POP): Twelve (12) months with four (4) Twelve-Month Option Periods

Competition: Full and Open Phased Solicitation:

Phase I – Factor 1: Top Secret Facility Clearance, Mandatory Down-select Phase II – Factor 2: Demonstrated Prior Experience and Reference Checks; Factor 3: Staffing and Management Approach; and Factor 4: Price

Notional Timeline

Michael Lipperini Contract Specialist

Notes: Font sizes are recommended. However, PowerPoint will automatically adjust font size to fit content, as needed.

Notional TimeLine

Q&A Sessions

LeDina Nelson OPO Industry Liaison

Notes: Font sizes are recommended. However, PowerPoint will automatically adjust font size to fit content, as needed.

Q&A Session - Panel Tisha Blue-Warren, Contracting Officer, OPO Ahmad Gharib, Division Director, Cyber Defense, DHS HQ OCIO Sean Leach, NOSC Security Operations Branch Chief, DHS HQ OCIO Selina Green, DHS HQ OCIO EMBO, COR

Q&A Session

1. Will DHS provide guidance for small businesses interested in teaming or subcontracting under NCCS 2.0?

2. Will an attendee list, teaming forum, or prime contractor contact list be made available after Industry Day?

3. Will DHS be submitting the final RFP to all firms who responded to the RFI or only selected organizations?

4. Will the Government entertain One-on-One meetings with the industry?

5. Who are the current incumbent prime contractors supporting NCCS and NOSC operations?

6. Will small business Joint Ventures, Contractor Teaming Arrangements, or mentor protege structures be permitted?

7. To ensure maximum competition and transparency in this acquisition, please confirm the Government intends to provide non-incumbent offerors with the necessary granularity regarding the current 'as-is' state of operations through the release of a technical library or detailed 'Extent of Effort' document that defines the specific boundaries and historical data of each legacy contract being transitioned into this consolidated scope.

8. Will DHS permit subcontractor Facility Clearance reliance, or must the prime contractor independently possess the required clearance level?

9. Will NCCS 2.0 require support across the full RMF lifecycle, including ATO package development, POA&M management, and ongoing continuous monitoring activities within NOSC environments?

10. Will NCCS 2.0 operate as an enterprise wide NOSC capability across DHS, or be delivered through component specific operational models?

11. Approximately how many total FTE's currently support the environment?

12. Will contractor personnel require access to SCIF environments for operational support activities?

13. Will Government furnished SCIF workspace be provided, or will accredited contractor SCIF capability be required for portions of performance?

14. How much flexibility will contractors have regarding remote or hybrid operational support models across the IDIQ and Task Orders?

15. Would DHS consider emphasizing the importance of senior personnel who combine operational expertise with AI oversight, mentoring, escalation support, and institutional knowledge transfer to strengthen mission continuity and workforce development?

Break (10 Minutes)

Q&A Session – Chat Pod

Tisha Blue-Warren, Contracting Officer, OPO Ahmad Gharib, Division Director, Cyber Defense, DHS HQ OCIO Sean Leach, NOSC Security Operations Branch Chief, DHS HQ OCIO Selina Green, DHS HQ OCIO EMBO, COR

Q&A Pod Questions Question 1: Which technical capability areas are considered highest priority for mission success under NCCS 2.0?

Question 2: Are there particular cybersecurity frameworks, cloud environments, or zero trust initiatives that vendors should prioritize when preparing capabilities?

Question 3: Will the requirement emphasize operational cybersecurity support, engineering services, end-user support, or a combination of all three?

Question 4: Which components are covered under this SOW?

Question 5: Will there be opportunities for small businesses to demonstrate innovation, automation, or AI-assisted operational efficiencies?

Question 6: Do you have subcontracting goals?

Thank You for Attending the

DHS NOSC NCCS 2.0

Industry Day Event image2.jpeg image4.png image5.png image6.png image7.png image8.png image9.png image1.jpeg