NSS_(EI E)_Cybersecurity_SME_Support.pdf

DEPARTMENT OF DEFENSE

WASHINGTON HEADQUARTERS SERVICES

1155 DEFENSE PENTAGON

WASHINGTON, DC 20301-1155

ACQUISITION

DIRECTORATE

Fa

Date: 8 July 2016

Project Title: Energy Security Technology Certification Program (ESTCP)

ATTENTION: Fair Business Opportunity (FBO) vendors

FROM: Washington Headquarters Services - Acquisition Directorate (WHS-AD)

WHS/AD is seeking vendors with the appropriate past performance experience and capabilities to provide support services for the Installation Energy (IE) Directorate within the Office of the

Assistant Secretary of Defense for Energy, Installations & Environment (OASD(EI&E)). The

Office of the Assistant Secretary of Defense (Energy, Installations and Environment) oversees the Department of Defense (DoD) Facility Energy Program and progress towards achieving facility energy goals. The OASD(EI&E) is responsible for issuing facility energy policy and guidance, coordinating the Defense Department’s facility energy strategy, engaging with DoD

Components, and coordinating all congressional reports related to facility energy.

Responses from “all” sources is requested including Small Businesses, 8(a) small businesses, HUBZone small businesses, Service-Disabled Veteran-Owned Small Businesses, Women-

Owned Small Businesses and Economically Disadvantaged Women-owned Small Businesses.

The Energy Security Technology Certification Program (ESTCP) funded ten projects in FY16 that focus on demonstration of various aspects of microgrids. All of these projects interact with

Control Systems (CS) on Military Networks and require obtaining authority to operate (ATO) in order to perform the demonstrations. A few of these projects focus on demonstration of technology that is designed to enhance or improve cyber security posture of Military Industrial

Control Systems.

However, while these demonstration projects all have common elements, the process for obtaining ATO for these technologies is not well understood by the project teams. Each project has budgeted for consultants with subject matter expertise, at significant cost, to assist with navigating the Risk Management Framework (RMF) in order to obtain an ATO. The simultaneous implementation of these demonstration projects at multiple sites across different services provides an opportunity to collect lessons learned and share best practices to improve project execution efficiency and reduce cost. Additionally, the collective experience gained by these similar projects going through the RMF provides opportunity to identify specifications for this type of technology that could be used to expedite the process for like-technology in the future.

The ESTCP Program Office requests support from a Cyber Security subject matter expert (SME) to act as an advisor to the Program Office to monitor the project teams’ efforts toward obtaining an ATO, and facilitate information sharing across project teams to improve project execution efficiency.

This Sources Sought Notice is for market research purposes only and is not a request for proposal (RFP) nor does it restrict the Government as to the final acquisition strategy. The

Government will not reimburse respondents for any costs incurred in preparation of a response to this notice. Firms responding to this notice should provide information to support their capabilities by including recent and relevant contract past performance (3-5 years), including the dollar value, period of performance, and scope of the work that highlights and demonstrates its experience and capability in the following technical areas of:

Control systems (includes industrial control systems, SCADA, platform IT, etc.);

Architecture design, secure networking, relevant security control selection, cybersecurity expertise of embedded electronic control systems, and website security;

Demonstrated knowledge of the DoD CIO, USCYBERCOM, the National Institute of

Standards and Technology (NIST), the DHS ICS-CERT, the Department of Energy

(DOE), and organizations such as SANS, the Defense Industrial Base, Manufacturers

Association, and Cyber Ranges;

Knowledge of DoD polices (AT&L, CIO, USCYBERCOM, Services) Unified Facilities

Criteria (UFC), technical letters and RMF KS Portal;

Knowledge and experience in conducting energy-related control systems cybersecurity assessments;

Demonstrated knowledge of the Defense Information Systems Agency Unified

Capability Approved Product List;

Demonstrable experience with DoD savings-to-investment ratios and strategy;

Knowledge of IP and Legacy control systems protocols in support of real-property related control systems; and, Experience in technology evaluation and review for DoD energy and cyber security investment.

Specific Task Areas of the PWS:

Task 1 – ESTCP Program Office Support

The Subject Matter Expert shall provide the following support:

Advise the ESTCP Program Office on Cyber Security related questions from project teams and installation representatives;

Collect lessons learned from FY16 project teams’ efforts in obtaining an ATO and develop a report on findings; and, Facilitate information sharing across project teams on RMF process and issues related to obtaining an ATO.

Required format: There is a maximum page limitation of 8 typed pages that are single spaced using 12 inch Times New Roman font within an 8.5 by 11 inches page size. No hard copy or facsimile submissions will be accepted. Cover letters and extraneous materials (brochures, etc.)

will not be considered.

Interested sources should submit their responses to Contract Specialist, Stephanie Houle, of

WHS-AD, via email to stephanie.l.houle.civ@mail.mil Not Later Than 17:00 EST Tuesday, 21

July 2016. Sources shall respond with the subject heading: ESTCP Support NSS. Sources should include their business address, Point of Contact, Cage Code, Duns number, and Small Business status.

For small business concerns please contact:

WHS Office of Small Business Programs:

Janique Hudson

Small Business Specialist

Office: (703) 545-1806

Janique.a.hudson.civ@mail.mil

*Disclaimer: This request for information is for market research purposes only. This is not a solicitation.

mailto:stephanie.l.houle.civ@mail.mil mailto:Janique.a.hudson.civ@mail.mil