JCDC Planning Support RFI.pdf

REQUEST FOR INFORMATION

FOR

DEPARTMENT OF HOMELAND SECURITY

CYBERSECURITY & INFRASTRUCTURE SECURITY AGENCY

Joint Cyber Defense Collaborative Planning Support

1. INTRODUCTION

The Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA) is issuing a Request for Information (RFI) as a means of conducting market research to identify sources.

This RFI is for planning purposes only and shall not be construed as an obligation on the part of the Government. This is NOT a Request for Quotations or Proposals. No solicitation document exists, and the Government may or may not issue a formal solicitation resulting from the responses received to this RFI.

Respondents are advised that the Government will not pay for any response expenses. All costs incurred responding to this RFI will be solely at the interested party's expense. Failure to respond to this RFI will not preclude participation in any future solicitation. Any information received will become the property of the Government and will not be returned to the submitter. Interested parties are responsible for adequately marking proprietary or sensitive information.

Government technical experts drawn from staff within CISA, and other federal agencies may review responses. The Government may use selected support contractor personnel to assist in the review of the RFI responses. These support contractors will be bound by appropriate non-disclosure agreements to protect proprietary information.

2. PROGRAM BACKGROUND

As part of the overall CISA mission, the CSD (Cyber Security Division) actively engages with Government and critical infrastructure (CI) partners to help prepare for, prevent, and respond to incidents that could degrade or overwhelm strategic assets. Within CISA CSD, the Joint Cyber Defense Collaborative (JCDC) was established to unify cyber defenders from organizations worldwide. This diverse team proactively gathers, analyzes, and shares actionable cyber risk information to enable synchronized, holistic cybersecurity planning, cyber defense, and response to unify defensive actions and drive down risk in advance of cyber incidents occurring. One of the primary ways JCDC executes its responsibilities is through development of joint cyber defensive operations plans with industry and government stakeholders. JCDC continues to mature its ability to jointly establish planning priorities through the 2024 JCDC Priorities.

Respondents must demonstrate knowledge and expertise in cybersecurity related Government interagency programs, strategic direction, and experience in cybersecurity planning, response, and operations. Additionally, respondents must show the ability to identify, develop, and demonstrate an approach for maturation of Government capabilities needed for joint industry-government development of cyber defensive operations priorities.

Please respond to the following questions within your submission:

a. Provide two contracts in the last three years in which you have assisted in the development and maturation of an organization’s planning capabilities associated with interagency campaign plans, national cyber defense doctrine, and playbooks to guide development of future cyber operations plans or campaigns. For each contract, describe the complexity, scope, and duration of the work.

b. Provide two contracts in the last three years in which you have enhanced the Government’s ability to jointly develop defensive cyber operations plans by establishing and maturing planning priorities with government and industry partners. For each contract, describe the complexity, scope, and duration of the work.

c. JCDC’s mission cuts across all 16 critical infrastructure sectors, which means JCDC requires contract support that can offer on demand subject matter expertise on a wide range of changing topics on a regular basis. Provide two contracts in the last three years in which you have supported the development of joint cyber defense plans with the private sector and the US Government by providing on demand subject matter expertise and research on a broad set of emerging technology and cybersecurity risk topics related to one or more critical infrastructure sectors. Examples include, but are not limited to, artificial intelligence, pipelines cybersecurity, aviation security, telecommunications cybersecurity and countering ransomware.

d. JCDC’s joint public-private cyber planning mission is a relatively new concept for CISA and the US government and requires development and testing of new capabilities and process to identify topics of national significance, engage a wide selection of public and private partners in collaborative planning processes, and produce meaningful, metric-driven cybersecurity and resilience outcomes for national critical infrastructure. Provide two contracts in the last three years in which you have assisted enhancement of the Government’s ability to jointly develop defensive cyber operations plans by maturing Government ability to convene government and industry partners for cyber defense purposes. For each contract, describe the complexity, scope, and duration of the work.

e. JCDC’s work is dependent upon robust participation from public and private partners with authorities, visibility, and equities in critical infrastructure cybersecurity and resilience. Successful public-planning efforts require the nomination and coordination of proposed planning topics that are relevant to our partners and meaningful in terms of national security and resilience. Provide two contracts in last three years in which you have performed identification and recommendations of concepts and approaches to support the maturation of an organization in capabilities related to analytics and governance to develop planning agendas with government and industry partners. For each contract, describe the complexity, scope, and duration of the work.

3. INSTRUCTIONS FOR RESPONDENTS

All written submissions become the property of the United States Federal Government and will not be returned.

1. Each respondent’s capability statement shall demonstrate capabilities and expertise in each of the questions in Section 2. The information shall be in sufficient enough detail, but not exceed ten pages TOTAL, so that the Government can determine the experience and capability of your firm to provide the requirements above.

2. DO NOT include marketing or sales materials.

3. If your organization has the potential capacity to provide the required services, provide the following information:

a. Organization name, UEI, CAGE code, Business size (large or small) and socio-economic status (i.e., 8(a), Small Disadvantaged, HUBZone, Service-Disabled Veteran-Owned, Women-Owned Small Business, etc.), address, primary points of contact (POCs) and their email address, web site address, telephone number.

b. Identify any strategic sourcing vehicles or federal supply schedules your company holds.

c. State whether your company holds a Top-Secret facility clearance.

d. Tailored capability statements addressing the requirements of this RFI.

4. Responses shall be unclassified. DO NOT include any classified information in your capability statements.

5. Submit responses via email in an electronic format compatible with the Microsoft

Windows 11 operating system (e.g., Microsoft Word, Microsoft PowerPoint, and Adobe PDF). Responses are limited to TEN pages, excluding the cover page.

Furthermore, CISA’s preference is to procure services on a small business set-aside basis, to the extent possible, based on market research results.

We encourage all small businesses, in all socioeconomic categories (including, 8(a) Business Development Program, Small Disadvantage Business, Historically Underutilized Business Zone, Service-Disabled Veteran-Owned, Women-Owned Small Business concerns), to identify their capabilities in meeting the requirement at a fair market price.

All data received in response to this RFI that is marked or designated as corporate of proprietary will be fully protected from any release outside the Government.

Note: The Government reserves the right to hold one-on-one meetings resulting from RFI responses received as part of its market research. Meetings may be held with companies who provide comprehensive and relevant responses to the topic and questions in this notice.

ELIGIBILITY

The applicable North American Industry Classification System (NAICS) code for this requirement is 541330 – Engineering Services. The Product Service Code is AJ11 R&D - Other Research and Development (Engineering Development).

Note: In accordance with DHS Directive 060-01, Development and Use of Strategic Sourcing Contract Vehicles, dated 24 August 2012, strategic sourcing vehicles are mandatory for use, with limited exceptions. Therefore, a strategically sourced contract vehicle will take priority over awarding a standalone CISA contract.

4. DUE DATE

Please submit a response to Shawn Curro, shawn.curro@cisa.dhs.gov and Hannah Moussa, Hannah.Moussa@cisa.dhs.gov NLT 5:00 P.M. EST on May 17, 2024. The subject line of the email should state “PCCS-24-50005 RFI.”