RFI_for_MCCAST_final.docx

MARINE CORPS CERTIFICATION & ACCREDITATION SUPPORT TOOL (MCCAST)

RSA Archer Suite Request for Information (RFI)

THIS NOTICE IS MARKET RESEARCH TO SUPPORT THE PROCUREMENT OF A BRAND NAME SUITE OF APPLICATION CYBER SECURITY SOFTWARE AND RELATED SUPPORT. THIS IS NOT A REQUEST FOR PROPOSAL. Marine Corps Systems Command (MCSC), Program Manager Information Systems and Infrastructure, Product Manager Total Force Information Technology Systems (TFITS) in Quantico, Virginia intends to procure on a brand name basis RSA’s Archer suite of application cyber security eGRC software, to include implementation, training, and maintenance support. This requirement is known as Marine Corps Certification and Accreditation Support Tool (MCCAST).

THIS NOTICE IS A SOURCES SOUGHT NOTICE AND NOT A REQUEST FOR PROPOSAL.

The current intent is to solicit quotes only from authorized resellers of the RSA’s Archer suite of application cyber security eGRC software brand name product in the mid first quarter FY15 timeframe. However, at this time the Government is also performing market research to determine if there exists any vendor who can provide an eGRC solution that meets the requirements of the MCCAST statement of need (see below).

Vendors who feel they meet the requirements of the MCCAST statement of need must provide factual data, capability statements, corporate literature, or any information with proof that their product/brand can provide an equivalent to meeting the requirements. Pricing information for purposes of this market research is encouraged. Any responses to this sources sought announcement are due by 1630 local time Quantico VA on 30 October 2014. Questions and/or concerns regarding this RFI must be submitted in writing to Ms. Penny O’Neil at mcsc_isi@usmc.mil. Please place "Attention: Response to RFI for MCCAST” on the subject line of your email.

PHONE CALLS WILL NOT BE ACCEPTED.

The Statement of Need for this requirement requires the operational attributes listed below. As a respondent to this RFI, you are required to include objective data supporting your product’s availability to meet these requirement:

· The product must be out of the box ready and require no development time or efforts.

· The MCCAST tool shall provide a capability to visibly track all C&A activities, including but not limited to, package creation, processing, automated advanced notification of expiring C&A package approval, testing, and risk acceptance;

· The MCCAST tool shall provide interoperable templates, workflows, and generate all reports and documents required by DIACAP, DoD Risk Management Framework, and Federal Information Security Management Act (FISMA);

· The MCCAST tool shall provide an export/import feature compatible with Enterprise Mission Assurance Support Service (eMASS) tool;

· The MCCAST tool shall provide capability to import data from National Vulnerability Database (NVD) and US Computer Emergency Readiness Team (CERT);

· The MCCAST tool shall provide a capability to import, manage, schedule, deploy and apply current DISA Security Technical Implementation Guides (STIGs), USMC policy, and National Institute of Science & Technology (NIST) Security Controls in an Extensible Configuration Checklist Description Format (XCDDF);

· The MCCAST tool shall provide an automated capability to accurately define Information Assurance (IA) Controls and trace the controls to the associated design architecture;

· The MCCAST tool shall provide an automated capability to align a system’s detailed test plans against the design architecture to the IA controls;

· The MCCAST tool shall provide digital signature and non-repudiation on all documents from authorized user/personnel;

· The MCCAST tool shall provide an automated capability to generate a Cyber Engineering Plan (CEP), Independent Verification and Validation (IV&V) test plan, Risk Assessment, IA Score Card, CCRI score, and POA&M;

· The MCCAST tool shall provide a user and an executive level point and click Graphic User Interface (GUI) dashboard to manage risk, organizational policy, total assets, across the MCEN;

· The MCCAST tool shall track remediation processes and solutions, and generate reporting on such activities;

· The MCCAST capability shall be open architecture compliant;

· The MCCAST shall provide a capability to integrate with USMC automated vulnerability management systems;

· The MCCAST shall provide an automated enterprise asset management visibility reflecting all assets, systems, and applications authorized on the MCEN;

· The MCCAST shall provide automation to support accountability of POA&Ms with traceability through the enterprise for IA control and risk compliance;

· MCCAST shall provide a capability to determine the Consequence of Loss (CoL) for systems and data;

· MCCAST shall provide a capability to important Common Vulnerability Scoring System (CVSS) ratings from DISA tool;

· MCCAST shall provide capability to integrate with Active Directory for the content managed within the framework;

· MCCAST shall provide the capability to track assets that are out of compliance through various views, including but not limited to, IP, MAC, serial, room, building and site location;

· MCCAST shall provide a capability to interface with Marine Corps enterprise trouble ticketing and service help desk system;

· MCCAST shall provide a capability to document and manage the security baseline for each system;

· MCCAST shall provide a capability to search on all projects for existing C&A packages;

· MCCAST shall be hosted on the Marine Corps SIPERNET domain;

· MCCAST shall be designated as a Mission Assurance Category (MAC) Level II;

· MCCAST shall be able to simultaneously support 100 users;

· MCCAST shall comply with DoD Public Key Infrastructure (PKI);

· MCCAST shall require a minimum of three terabytes of storage space.

Vendors who respond to this sources sought notice, must 1) indicate whether you hold a GSA Federal-Supply Schedule contract that covers this requirement, and if so, identify the contract number; and 2) Provide business size and socio-economic status; (a) indicate whether your business is large or small; (b) if small, indicate if your firm qualifies as a small, emerging business, or small disadvantaged business; (c) if disadvantaged, specify under which disadvantaged group and if your firm is certified under Section 8(a) of the Small Business Act; (d) indicate if your firm is a certified Service-Disabled Veteran Owned Small Business (SDVOSB) or Veteran Owned Small Business (VOSB); (e) include the DUNS number of your firm; and (f) state whether your firm is registered with the System for Award Management (SAM) at http://www.sam.gov, if applicable.

This RFI does not constitute a solicitation for proposals or the authority to enter into negotiations to award a contract. This RFI is for planning purposes only and shall not be considered as an obligation by the Government to acquire any products or services. No entitlement to payment of direct or indirect costs or charges by the Government will arise as a result of contractor submission of responses to this RFI or the Government's use of such information. The Government reserves the right to reject, in whole or in part, any contractor's input submitted in response to this RFI. Responses to this RFI will not be returned. The Government recognizes that proprietary information and data may be part of this effort and, if so included, such data should be clearly marked.

A determination by the Government to not compete this requirement on a full and open basis based on responses to this notice is solely within the discretion of the Government. Reference FAR 6.302-1(c), “Application for Brand Name Descriptions.”