VDP Request for Information.pdf

Request for Information (RFI) – CISA Vulnerability Disclosure Platform (VDP)

Agency: Cybersecurity and Infrastructure Security Agency (CISA)

Market Research Agency: General Services Administration (GSA), Federal Acquisition Service (FAS), Region

Notice Type: Posted Date:

Request for Information December 20, 2020

NAICS: 541512 Computer Systems Design Services

GSA Reference: ID08200VDP

I. GENERAL INFORMATION:

The General Services Administration (GSA), Federal Acquisition Service (FAS), Region 8 is issuing this Request for Information (RFI) on behalf of the Cybersecurity and Infrastructure Security Agency (CISA).

II. OBJECTIVE:

The purpose of this RFI is to assist the Government in conducting market research focused on identifying potential vendors as well as to gain technical feedback from industry on the Government’s centralized Vulnerability Disclosure Platform requirement. This information will be used for market research only. The Government is not obligated to release a future solicitation based on this market research. Interested respondents shall refer to the details of the response to this RFI under Section VI.

III. BACKGROUND

Most federal agencies currently lack a formal mechanism to receive information from third parties about potential security vulnerabilities on their systems. Many agencies have no defined strategy for handling reports about such issues shared by outside parties. Only a few agencies have clearly stated that those who disclose vulnerabilities in good faith are authorized. CISA recently released draft Binding Operative Directive 20-01, which identifies the requirement that each Federal Civilian Executive Branch (FCEB) agency develop and publish a vulnerability disclosure policy and maintain supporting handling procedures for identified vulnerabilities. Vulnerability disclosure policies enhance the resiliency of the government’s online services by encouraging meaningful collaboration between federal agencies and the public. The subsequent sections describe the concept a vulnerability disclosure platform that could support Agencies with the handling of submitted vulnerabilities, to be managed centrally by the CISA Cybersecurity Quality Services Management Office (QSMO), based on government-wide standards, policy, and business requirements.

IV. OVERVIEW OF VULNERABILITY DISCLOSURE PLATFORM (VDP)

The intent of the vulnerability disclosure platform is to provide a CISA managed central platform to facilitate the submission and tracking of vulnerabilities discovered in internet-accessible information systems of the FCEB agencies, including Independent Agencies and all Boards, Commissions, and Committees. Participation in the vulnerability disclosure platform is envisioned to be voluntary for FECB agencies, and therefore the platform needs to scale to support a potentially varying number of agencies at any time. The government desires that the vulnerability disclosure platform be a software-as-a-service web application that serves as the primary point of entry for vulnerability reporters to alert the government of potential issues on federal information systems for those agencies that participate in the platform. Remediation of identified vulnerabilities on federal information systems is intended to be the responsibility of the appropriate hosting agencies, not CISA or the vulnerability disclosure platform service provider.

Figure 1: Vulnerability Disclosure Platform Overview below presents a high-level overview of the reporting process and potential process flow for a reported vulnerability:

1. Reporter submits a report, creating a issue in the platform.

2. Platform provider filters noise and triages reports.

3. Agency is notified of a report (via an email or API).

4. Agency works towards remediating the report according to their procedures.

This action occurs external to the platform.

5. Agency updates the platform ticket (email, API, or platform interface).

6. Reporter is notified, close out.

Figure 1: Vulnerability Disclosure Platform Overview

The following sections address the vulnerability disclosure platform’s functionality, stakeholders, interfaces, and ability to support a Bug Bounty option.

A. Vulnerability Disclosure Platform Functionality The vulnerability disclosure platform’s intended functionality, at a minimum, includes the following:

• The platform provides a primary point of entry for vulnerability reporters to alert the government of potential issues on federal information systems for those agencies that participate in platform.

• The service provider screens obviously errant reports (“noise filtering”) and performs a base level of validation of the submitted report (“triage”).

• The platform provides a clear way to track reported vulnerabilities and link reports that are related by reporter, vulnerability type, or other purpose.

• The platform provides a web-based communication mechanism between the reporter and the agency. The platform must allow for communication to occur between the actual individual reporting the vulnerability and the agency (FECB) where the vulnerability resides. This potential communication will assist agencies in remediation efforts.

• The platform allows agency users to create and manage role-based accounts for their organization or suborganizations.

• The platform offers an application programming interface to take various actions on vulnerability reports or pull metrics. (See API section Bullet C below which addresses the actions necessary through an API)

• The platform provides metrics around reports, offering agencies and CISA insight into the reporting process. These may include:

o Number of vulnerability disclosure reports o Number of reported vulnerabilities determined to be valid (e.g., in scope and not false-positive) o Number of currently open and valid reported vulnerabilities o Number of currently open and valid reported vulnerabilities older than 90 days from the receipt of the report o Median time to validate a submitted report o Median time to remediate/mitigate a valid report o Median time to initially respond to the reporter

• The platform provides alerts to the reporter and agency users on updates, as well as to CISA based on events of interest, metrics approaching or hitting defined thresholds, etc. These alerts should be configurable in the user interface and available via Application Programming Interface (API).

B. Vulnerability Disclosure Platform Stakeholders

This section identifies the anticipated platform stakeholders – organizations or individuals who either have direct access to the system or indirectly benefit from it, specifically:

• Vulnerability reporters

• Federal Civilian Executive Branch agencies

• CISA

• Platform service provider

Vulnerability Reporters

a. Reporters have a clear place to report vulnerabilities in FCEB systems without a requirement to need to know which specific agency or component manages the information system.

b. Reporter can share updates and receive updates with an agency.

c. Reporters can create an account and profile.

d. Reporters can log into their account to track submissions and their status.

e. Reporters can be notified by e.g., email of a change in a report’s status (if desired).

f. The platform may allow reporters to earn recognition or “points” for the valid reports they have submitted.

Federal Civilian Executive Branch Agencies

a. Each agency maintains a profile in the platform. Agency superusers can manage their agency profile and their own users, granting and revoking access permissions (e.g. user can edit, user can only read). By logging into the platform interface, agency users can see an agency dashboard with the list of submissions (open/closed) and general statistics.

b. The platform allows agencies to communicate with reporters to request more information or seek external validation when vulnerability has been fixed.

c. Upon reporter’s submission of a vulnerability, the agency is notified (e.g., via email or via the use of the platform API hooked into the agency’s own issue tracking system). The agency can update the submission’s status via platform interface or API. Once the vulnerability is triaged, the agency can update or close the submission, an action that triggers a notification to the reporter.

CISA

a. CISA manages the administration of superuser credentialing to the system.

b. CISA maintains insight into disclosure activities,but does not actively participate in each disclosure remediation process. CISA has at least read-only access to all agency reports and can view aggregate statistical data and reports.

c. CISA gets alerts when pre-defined thresholds are met (e.g., agency accumulates X number of unresolved submissions, submissions reach X number of days without agency update, etc.).

Platform Service Provider

a. Responsible for hosting and managing the platform, including administrative responsibilities , CISA-user management, technical support, and maintaining the security of the platform in alignment with Federal and Department of Homeland Security requirements that authorize the system to operate.

b. Provides screening and initial triage of submissions, validating it appears to be a real weakness displayed in the system.

C. Vulnerability Disclosure Platform Interfaces The vulnerability disclosure platform should provide the following interfaces:

Web application

• Provides users (vulnerability reporters, agencies, CISA) direct access to the platform feature set.

• Allows reporters to submit vulnerabilities, track submissions and their status, and maintain communication (as they choose).

• Allows agencies to manage submissions and view summary statistics.

• Allows CISA to adjudicate submissions where the agency is unknown (or has been unresponsive), view statistical data and trends, run reports, export data, and view agency submissions.

Email

• Notifications and alerts of submissions and updates can be emailed to the userbase from the platform (submission details are not included in the email). For example:

o Agencies are alerted on newly created tickets and updates, reporters are notified on ticket updates and closures.

o CISA is alerted when certain defined thresholds are met (ticket unresolved for X days, agency accumulating more than X reports without action, etc.).

API

• Allow automated application-level communications between the platform and an external application like an agency issue tracking system, via an API.

o This could, for example, automatically create a ticket in agency system once a report is submitted in the platform, or update the platform when the agency ticket is updated, etc.

D. Bug Bunty Functionality The vulnerability disclosure platform must include the ability for agencies to provide bug bounties (financial incentives) for valid submissions. Agencies will be responsible for funding and operating their own bug bounty programs. CISA does not intend to fund a bug bounty program for FCEB agencies.

V. INDUSTRY MEETINGS:

Based on responses provided by industry, additional information may be requested. As a result, GSA with CISA, at the Government’s discretion, may schedule one-on-one meetings with industry to discuss responses to this RFI. If a follow-up meeting is required, the Government will reach out directly to the industry partner point of contact.

VI. RFI RESPONSE:

The Government will only consider responses from Industry Partners which intend to do the work as a Prime contractor. Responses are required to include the following information:

CONTRACTOR INFORMATION:

• Contractor Name and Address

• DUNS Number and NAICS Code

• Socio-economic status (HUBZone, Service-Disabled-Veteran-Owned, Woman-Owned, 8(a), Small Business, Large Business)

• POC Phone and Email

• Website URL

QUESTIONS:

Experience/Capabilities:

1. Does your company have experience in providing a similar platform targeted at facilitating Vulnerability Disclosure, similar in scope to the general parameters identified in this RFI?

a. If so, please describe the experience, including federal contract/task order number (if applicable), period of performance, customer information (i.e., agency and location) and a summary of experience

b. Any existing Government contract vehicle (GWAC, Federal Supply Schedules, BPA, etc.) the Contractor currently holds that could support the Vulnerability Disclosure Platform requirement? If so please identify.

Information Requested

1. What should the Government consider when determining whether to procure an existing software-as-a-software vulnerability disclosure platform versus procuring support to build a new software-as-a-service solution?

2. Utilization of the vulnerability disclosure platform will not be mandatory for FCEB agencies, and

FCEB agencies may have to fund some portion of their own participation in the platform. What approaches should the Government consider when structuring and estimating costs by Agency?

3. How can the pricing of the platform be delivered in a way to ensure that Agency of varying size receive similar pricing discounts? In addition, are there specific volume points that the Government should consider when estimating cost?

4. Are there areas of additional functionality, beyond the high-level functionality identified in Section IV, that the Government should consider for inclusion in this requirement?

5. Are there additional labor services that would be necessary to procure as part of a future solicitation to ensure the overall success of the vulnerability disclosure platform?

6. What scalability considerations should the Government consider if the platform were ever to support vulnerability disclosure for all internet-accessible information systems of all FCEB agencies?

7. What is your suggested approach to addressing requirement and what are the risks and benefits (from a business, management, and technical view) of your approach?

8. What is the preferred acquisition approach that the government should take in addressing this requirement?

9. What are the best practices or lessons learned based on your experience that you feel are important and applicable to the requirement?

10. Other information deemed relevant by the Contractor for the Government’s consideration for this procurement.

Contractor Notification: This RFI is for information and planning purposes only, and does not constitute a RFQ, and is not to be construed as a commitment by the U. S. Government. No award will be made as a result of this RFI. All information is to be submitted at no cost or obligation to the Government. Any information that the Contractor considers proprietary should be clearly marked as such. All submissions become Government property and will not be returned, including any proprietary information. The Government may consider additional communications with submitting companies utilizing the contact information provided in the Corporate Overview to further the Government’s market research for the Vulnerability Disclosure Platform requirement.

• All responses are to use Times New Roman font, with a 12 point font, and one inch margins, single spaced in all sections in Microsoft Word.

• Contractor Information section shall be no longer than 1 page in length.

• Contractor response to questions shall be no longer than 5 pages.

• Response to questions should be no longer than five pages.

• All information submitted shall be UNCLASSIFIED.

Questions pertaining to this RFI shall be submitted no later than 2:00pm ET on January 3, 2020, via email to Diana Zoppi at diana.zoppi@gsa.gov and Lisa Jobes at lisa.jobes@gsa.gov.

RFI responses shall be submitted no later than 2:00pm ET on January 15, 2020 via email to Diana Zoppi at diana.zoppi@gsa.gov and Lisa Jobes at lisa.jobes@gsa.gov.

Contractors who do not respond to this RFI are not excluded from any resulting solicitation(s).