M67854-24-I-4047 MCEN ZTA RFI.pdf

M67854-24-I-4047

REQUEST FOR INFORMATION (RFI)

MARINE CORPS ENTERPRISE NETWORKS (MCEN) ZERO TRUST ACCESS

THIS IS A REQUEST FOR INFORMATION: This RFI is issued solely for information and planning purposes and does not commit the Government to contract for any supply or service.

This RFI is intended solely for market research under Federal Acquisition Regulation (FAR) Part

10. No solicitation is available at this time. Issuance of this notice does not constitute any obligation on the part of the Government to procure devices or to issue a solicitation. Contractors are advised that the Government will not pay for any information received as a result of this RFI or accept any responses as offers. All costs associated with responding to this RFI will be solely at the interested party’s expense. Contractors should mark any proprietary information clearly and appropriately. The Government will not be held liable for any damages incurred if proprietary information is not properly identified. Responses will not be returned. The information provided in this RFI is subject to change and is not binding on the Government. The

Government may provide additional information and issue additional RFIs at its discretion.

Responses shall be submitted electronically to the Contract Specialist: Ms. Alexandra Diviney alexandra.diviney@usmc.mil, or Contracting Officer: Ms. Morgan Brady morgan.brady@usmc.mil no later than 14:00 PM Eastern Time on 15 May 2024.

BACKGROUND: Marine Corps Systems Command (MCSC), the predecessor to the current organization, Program Executive Officer Digital & Enterprise Services (PEO Digital), was tasked with deploying a solution to allow remote users the ability to connect back to the Marine

Corps Enterprise Network (MCEN) from any external location. Until recently, a Virtual Private

Network (VPN) solution existed that built an encrypted tunnel between the remote end users’ device, running client software, and the MCEN entry point. This provided the user access to internal MCEN resources once their device and the user were authenticated. Several vulnerabilities, which manifested within a short time span, led to the removal of these devices from operation in order to protect valuable resources from being targeted. PEO Digital requires a long-term solution that will authenticate and authorize remote users and their devices and then allow access to MCEN resources without the vulnerabilities of a VPN solution.

Concurrent with replacement of VPN functionality, the Government is also taking this opportunity to possibly incorporate some of the DoD Zero Trust Target activities. The initial scope will be the MCEN remote user community of roughly 30,000 concurrent users, with the long-term possibility of using this solution to enable Zero Trust Access for internal MCEN user requests to resources. This will require the ability to scale the solution up to approximately

100,000 concurrent users.

REQUEST FOR INFORMATION: PEO Digital, Portfolio Manager (PfM) Cybersecurity and

Operational Services (CaOS), is requesting responses to determine the availability and technical capability of sources to meet the listed set of requirements below.

INSTRUCTIONS: Responses to the following RFI questions should be submitted in no more than 15 pages. All responses shall include the following:

mailto:alexandra.diviney@usmc.mil mailto:morgan.brady@usmc.mil

1) Business name and address; Name of company representative, title, and contact information; CAGE code; Unique Entity Identity (UEI); and, NAICS codes your company operates under, Socio-economic status (including a list of NAICS codes, as they pertain to the socio-economic status), and Government-wide contracts or other Federal

Government contract vehicles your firm participates in (e.g. NASA SEWP, GSA Alliant, Federal Supply Schedules, etc.)

2) Please your company’s ability/willingness to negotiate license terms and conditions that account for unique Government procurement statutes, regulations, and limitations.

3) Describe your company’s ability to meet each of the capabilities listed in Table 1. Please include a detailed explanation of how your solution meets each requirement and which product, by name, would be used to meet each requirement.

4) Work on this contract will primarily be accomplished at the Government’s facilities. Indicate if you have a current Secret Facility Clearance, and if so, when does it expire.

5) Describe your company’s ability to provide product specific subject matter experts

(SME) to assist with the onsite design, test, and deployment of your product in the

Quantico, VA area.

6) Describe the upfront costs associated with deploying the product to include any initial procurement of hardware, software, licenses, and onsite support.

7) Describe annual sustainment costs associated with the maintenance of the product.

8) Describe annual costs of having a product specific SME onsite as needed.

9) Describe what training is available to the design and operations teams (in class, virtual, self-passed etc.) and what the cost would be for those options.

10) Describe your company’s ability to provide a demo of your product meeting each of the requirements in Table 1.

11) Describe how your product supports network segmentation.

12) Describe your company’s product roadmap that identifies future additional capabilities or improvements to the product.

13) Please provide feedback on the requirements in Table 1, particularly any that are unclear, any that raise other concerns, or any that seem to be missing in support of the Department of Defense (DoD) Zero Trust Target activities.

14) Please describe any other factors or considerations that Government should review before proceeding with any future solicitation.

TABLE 1: Marine Corps Enterprise Network Zero Trust Access Requirements:

Minimum Requirements of a Zero Trust Access Solution

The system should be capable of Standalone deployments.

The system should be capable of hybrid deployments, e.g., on-prem and IaaS.

The system should support various OS underlays, e.g., Windows and Linux.

The system should be capable of virtual or physical deployments.

The solution should support distributed Policy Decision Points and Policy Enforcement Points across the

MCEN providing High Availability without manual intervention.

The system should support 30,000 total concurrent remote users.

The system should be scalable to support up to 100,000 total concurrent users whether remote or on-prem.

The system should provide users the ability to access MCEN resources from external network connections.

The system should provide administrators the ability to access MCEN resources from external network connections.

The system should provide users the ability to access MCEN resources from internal network connections.

The system should provide System administrator access authentication using OIDC, SAML, or LDAP.

The system should provide System administrator access authenticated via USMC implementation of DoD PKI.

The system should allow multi-tunneling based on MCEN policy.

The system should integrate with the MCEN architecture and enterprise services.

The system should support client and clientless deployments.

The system should support centralized management of all components and policy.

The system should be configurable by administrators to back up configurations automatically.

The system should be capable of backing up configuration files to a remote server.

The system should be FIPs 140.2 or 140.3 certified.

The system should support operations in disadvantaged sites (local Policy Decision Point and Policy

Enforcement Point deployments).

The system should provide a minimum of 5GB throughput at each Policy Enforcement Point.

The system should support mutual TLS 1.3 between the client, Policy Decision Point and Policy Enforcement

Point.

The system should be approved for use in DOD IL-5 and IL-6.

The system should have a common criteria certification.

The system should have a NIAP certification.

The system should provide a dashboard for administration and reporting.

The system should authenticate users via OIDC, SAML, and LDAP.

The system should validate user certificates prior to granting access to resources.

The system should support the "always on" deployment of its client.

The system should continuously check for changes in users access rights to MCEN resources.

The system should be able to restrict access for non-compliant devices based on centrally defined policies.

The system should maintain continuous monitoring, validation, and policy (access) enforcement for both the user and the device.

The system should meet least-privilege access principles.

The system should be capable of continuously monitoring user activity.

The system should be capable of detecting anomalous user activity.

The system should ensure End User Devices possess valid machine certificates issued by the domain certificate authority prior to granting access to MCEN resources.

The system should log messages to the MCEN SIEM (Sentinel).

The system should support micro-segmentation principles.

The system should encrypt data between the system and the end user/MCEN resource.

The system should authorize the user prior to every resource request.

The system should be able to report every users resource request by source, destination, and date/time.

The system should be capable of Denying by default.

The system should obtain DoD APL certification.

The system should provide root level access/accounts for the base OS for vulnerability scanning purposes.

Please note, files sent by email must be limited to 2MB or less each. Multiple files may be submitted, however total file size should not exceed 8MB. Emails larger than 8MB will not be allowed to enter the government email system and will not be received. Files must not be submitted in a .ZIP file. Responses should be prepared in MS Word 2013 (or higher) or PDF format (compatible with Adobe Reader XI).

DISCLAIMER:

Proprietary information and trade secrets, if any, must be clearly marked on all materials. All information received that is marked Proprietary will be handled accordingly. Please be advised that submissions will not be returned. The Government shall not be held liable for any damages incurred if proprietary information is not properly identified.

Telephonic inquires or replies will not be entertained.