Joint_Analytics_Development_Transition_and_Optimization_RFI.pdf

United States Cyber Command

(USCYBERCOM)

Request for Information

RAINFIRE:

Joint Analytics Development, Transition and Optimization

Verision 1.0

23 Feb 18

2 Request for Information RAINFIRE Analytics Support, Version 1.0, 23Feb18

USCYBERCOM

Request for Information

RAINFIRE

Joint Analytics Development, Transition, and Optimization

23 February 2018

United States Cyber Command (USCYBERCOM) is seeking information from industry to assist with the development and planning of the Joint Analytics Development, Transition, and Optimization Program.

This is a Request for Information (RFI) notice only. This is not a Request for Proposals (RFP). No solicitation is available at this time.

1. Overview and Procurement Description:

This RFI is requesting responses from both large and small businesses, including the following subsets:

Small Disadvantaged Businesses (SDBs), Historically Underutilized Business Zones (HUBZone) Firms, Certified 8(a), Service-Disabled Veteran-Owned Small Businesses (SDVOSBs) and Women Owned Small Businesses (WOSBs). USCYBERCOM is seeking information on providing analysis support capabilities and analytic capability development, transition, and optimization.

The USCYBERCOM Capabilities Development Group (CDG) Analytics Portfolio requires analytics support capabilities, to include analytic development, transition, and optimization. The analytic capabilities procured under this effort will support cyber warfighters within the Department of Defense (DoD). The USCYBERCOM CDG has been working in collaboration with the broader strategic cyber and information technology (IT) initiatives of the United States Government, to include: The Big Data Platform (BDP), the Unified Platform (UP), the Joint Regional Security Stacks (JRSS), the Joint Information Environment (JIE), the Intelligence Community IT Enterprise (IC ITE), the Joint Cyber Command and Control, (JCC2), the Joint Cyber Situational Awareness (JCSA), the Enterprise Logging (EL), and Army Defensive Cyber Operations (DCO-A) Programs of Record. These efforts will be key influencers for the analytic support provided under this planned effort.

2. Scope of Effort Through the responses provided, the Government intends to obtain the following information:

a. Industry’s capabilities to meet the acquisition and technical characteristics described in Section 3.

b. Industry input and suggestions on requirements, acquisition, and management approaches in a way that would maximize innovative approaches and solutions while minimizing cost and improving schedule

c. Feedback on refining and improving the proposed acquisition and technical characteristics.

d. Acquisition recommendations, including contract type, contract structure, strategies to maximize competition and strategies to maximize small business participation.

3. Acquisition and Technical Characteristics This effort is expected to enable a single contractor to provide the analytics capabilities, development, integration, and optimization required by the USCYBERCOM CDG Analytics Portfolio. Each analytic is expected to be highly variable, based upon the target operational environment and granular requirements.

Furthermore, the quantity of analytics is expected to evolve over the life of this effort. The Government anticipates awarding task orders annually for analytics. The Government also anticipates awarding additional ad-hoc task orders for other analytic needs throughout the period of performance. Current

3 Request for Information RAINFIRE Analytics Support, Version 1.0, 23Feb18 analytic work may transition onto the RAINFIRE contract. As an integrator, the contractor shall manage the analytic development and sustainment lifecycle and maximize the use of third party developers (e.g., subcontractors) with innovative solutions to meet analytic requirements. This shall include using developers in the unclassified domain to expand the base of available solutions. Under this effort, the contractor shall:

a. Provide integration management, including: project management, systems engineering, oversight, planning, and coordination of analytics activities. This includes the following, at a minimum:

Technical Data Management; Project Reporting; Risk, Issue, and Opportunity Management; and comprehensive cost, schedule, and requirements control functions.

b. Provide analytic support to the complete array of Cyber Mission Forces (CMF), to include the Cyber National Mission Force (CNMF) and Cyber Protection Team (CPT) Cyber Missions.

c. Provide analytics capabilities that meet operational requirements for cyber capabilities across DoD Information Network (DoDIN) data sources and other mission data.

d. Holistically develop, test, integrate, transition, and sustain analytics capabilities:

o Work with operators under agile development constructs to decompose requirements, gather feedback, train users, conduct progress demonstrations, and develop and deliver user guide and training materials.

o Provide systems engineering support, including: Architecture Analysis, System Design Analysis, Requirements Management, and Configuration Management. Activities may include:

Collect analytic use cases and lead decompositions of stakeholder requirements, to include drafting requirement documents

Support cyber-hunt activities Provide support to the systems and capabilities of the CDG Analytics Portfolio Use GFE provided target cloud environments.

o Develop analytics for USCYBERCOM:

Deliver new analytic capabilities at various levels, using agile development constructs (as defined by Table 1). The combination of analytics, including the target environments (e.g., GFE clouds), will change as needed.

Analytic Level Characteristics Hours* Level 1 - Existing Visualization

- Existing Platform Data

- Low-Level Analytic or Prototype

~1,000 Hours

Level 2 - Existing Visualization

- Existing Platform data

- Moderate Analytic

~2,500 Hours

Level 3 - Modify Existing Visualization

- New Platform Data Required

- Moderate Analytic

~3,600 Hours

Level 4 - New or Modified Visualization

- New Platform Data Required

- Complex Analytic

~13,800 Hours

Level QRC - Quick Reaction Capabilities for One Year

- Working with Mission Data

- Deliver Mission-Relevant Analytics

~11,000 Hours

*Based on previous efforts; includes development, maintenance and 3rd party support hours

TABLE 1: ANALYTIC LEVELS

4 Request for Information RAINFIRE Analytics Support, Version 1.0, 23Feb18

Analytic development will likely require some combination of the following skills:

Various Tools/Programing Languages: to include R, Python or SAS Data mining and data auditing Statistical analysis Machine learning Data visualization Translation of unstructured data into structured information either at rest or at motion Implementation of analytic solution in packages such as Amazon Web

Services (AWS), Azure, SQL, or CRM Maximize the use of agile development constructs, enabling the Government to effectively prioritize working activities. The contractor shall provide a framework for agile development with any Government expectations and dependencies clearly identified and tracked.

o Test and Evaluate Analytics:

Demonstrate both preliminary and developed/tested capabilities.

Develop laboratory environments with production-representative environments Conduct comprehensive test planning.

Execute testing to ensure the delivery of a high quality product (e.g., functional, performance, regression, user acceptance, security, and analytic-specific testing).

Track and resolve defects or issues discovered during testing.

o Integrate and Transition Analytics:

Physically deploy analytics to production environments, including: initial transitions, patches, upgrades, fixes, enhancements, and software changes.

Train stakeholders on capabilities.

Integrate analytics into various platforms.

Provide Analytic Integration of third-party analytics, at various levels (as defined by Table 1).

Procure tools necessary to test the integration of analytic capabilities with the systems used by various customers, using a procurement model whereby the Government can acquire as-needed commercially available licensed tools and products on various hardware and systems used by stakeholders.

Integrate analytic capabilities in collaboration with broader strategic cyber and information technology initiatives, as defined in Section 1.

Transition analytics warfighter support capabilities out of research and development organizations (e.g., DoD Advanced Research Projects Agency

(DARPA)).

o Optimize and Customize Analytics, including analytics that are provided by a third-party.

o Sustain Analytic Capabilities

Maintain and sustain analytic capabilities throughout their lifecycle (e.g., implement patches, bug fixes, track and resolve issues).

Provide subject matter expertise to the Government and other stakeholders on an ad-hoc basis.

5 Request for Information RAINFIRE Analytics Support, Version 1.0, 23Feb18

Maintain a repository (e.g., library) of analytic capabilities available to USCYBERCOM and conduct configuration control of this repository.

Provide an on-call help desk support (e.g., analytic subject matter expertise) and integrate the help desk solution with an existing Tier-1 infrastructure.

e. Provision and maintain production-representative, cloud-based development environments on a case-by-case basis. Development environments will be provided to mission partners in order to facilitate development and transition activities.

f. Support systems engineering, development, test, integration, transition, and sustainment of future analytics needs, such as: streaming analytics, cloud analytics, edge analytics, and other specialized analytic needs.

g. Maximize the use of off-site facilities to reduce footprint requirements within Government spaces, however some work may be performed at Government facilities.

h. The contractor shall possess the requisite personnel with TS/SCI level clearances in order to work in domain space while managing analytic developers who may not possess any cleared personnel or access to classified information.

i. The contractor shall have facilities capable of processing and storing information on the TS/SCI domain space.

4. Requested Information All requested information is intended to facilitate the Government’s market research efforts and inform the Government’s acquisition approach. Please ensure submissions include responses to the following information:

a. Identification and Interest o Company Name and Address o Name of Company Representative and Business Title o Business Category(ies) (e.g., Large Business, Small Business, SDBs, HUBZone, 8(a), SDVOSB, WOSB, involvement in a mentor and/or protégé program, etc.)

o Explain your company’s ability to meet the classification and security requirements of this effort.

b. Explain your company’s potential interest in this effort (e.g., Prime, subcontract, teaming arrangements, Joint Ventures etc.).

c. Corporate experience providing similar development and integration services.

d. Acquisition Approaches:

o Acquisition approaches or alternatives that would meet the Government’s requirement under this effort.

o Potential factors that would differentiate superior approaches to meeting the requirements of this effort o Risks that the Government should be aware of with regard to meeting this requirement.

o Approaches for maximizing the use of small businesses and small business attributes, either as subcontractors or prime contractors to meet the Government’s requirement o Other acquisition approaches that the Government should consider in refining its requirement for this effort.

e. Technical/Management Approaches:

o Innovative approaches that the Government should consider in refining its requirement for this effort o Agile development approaches that the Government should consider in refining its requirement for this effort

6 Request for Information RAINFIRE Analytics Support, Version 1.0, 23Feb18 o Approaches for holistically developing, testing, integrating, transitioning, and sustaining Analytics Capabilities.

o Other specific technical approaches that the Government should consider in refining its requirement for this effort

5. Industry Discussions Representatives of USCYBERCOM may choose to meet with potential offerors and hold one-on-one discussions. Such discussions would be intended to obtain further clarification of RFI response and the potential capability to meet requirements.

6. Questions Questions regarding this announcement shall be submitted in writing by email to proposal_submission@cybercom.mil and shall be clearly marked “QUESTIONS in response to RAINFIRE RFI “. Verbal questions will not be accepted. Answers to questions will be posted to FedBizOpps. The Government does not guarantee that questions received after March 12, 2018 will be answered. The Government will not reimburse companies for any costs associated with the submissions of their RFI responses.

7. Response Guidelines Interested parties are requested to respond to this RFI with a white paper. White papers should be in Microsoft Word for Office, Adobe PDF, or compatible format and shall not exceed 10 pages, excluding cover, title, and table of contents pages. A page is defined as each face of an 8 ½ by 11 inch sheet with information contained within a one-inch margin on all sides. Text shall be Times New Roman and no less than 10-point font. The response should not exceed a 5MB email limit for all items associated with the RFI response.

Reponses must specifically describe responses to each of the bullets (a. through e.) in Section 4.

FedBizOpps will be the sole repository for all information related to this RFI.

Companies that wish to respond to this RFI shall send responses clearly marked “RESPONSES to RAINFIRE RFI” via email “time stamped" no later than March 12, 2018, 4:00PM Eastern Time to proposal_submission@cybercom.mil. In the subject line of the email please label in the following format: “RAINFIRE_RFI Responses_Company Name_DDMMYYYY. The Government may or may not choose to meet with potential respondents. Such meetings and discussions would only be intended to obtain further clarification of potential capabilities.

8. Disclaimer This RFI is not a RFP and is not to be construed as a commitment by the Government to issue a solicitation or ultimately award a contract. Responses will neither be considered as proposals nor will any award be made as a result of this RFI. All information contained in the RFI is preliminary as well as subject to modification and is in no way binding on the Government. Federal Acquisition Regulation (FAR) clause 52.215-3, “Request for Information or Solicitation for Planning Purposes”, is incorporated by reference in this RFI. The Government does not intend to pay for information received in response to this RFI. Respondents to this invitation are solely responsible for all expenses associated with responding to this RFI. This RFI will be the basis for collecting information on available capabilities and is issued solely for information and planning purposes. Proprietary information and trade secrets, if any, shall be clearly marked on all materials provided in response to this RFI. All information received that is marked

7 Request for Information RAINFIRE Analytics Support, Version 1.0, 23Feb18

“Proprietary” will be handled accordingly. Please be advised that all submissions become Government property and will not be returned. In accordance with FAR 15.201(e), responses to this RFI are not offers and cannot be accepted by the Government to form a binding contract.

9. Attachments There are no attachments to this RFI