Sources_Sought_Notice_M95494-18-004.pdf

SOURCES SOUGHT NOTICE

M95494-18-004 4 December 2017

Subject: Insider Threat Program and Analysis Center

THIS SOURCES SOUGHT IS FOR INFORMATIONAL PURPOSES ONLY. THIS IS NOT A

REQUEST FOR PROPOSAL. IT DOES NOT CONSTITUTE A SOLICITATION AND SHALL NOT

BE CONSTRUED AS A COMMITMENT BY THE GOVERNMENT. RESPONSES IN ANY FORM

ARE NOT OFFERS AND THE GOVERNMENT IS UNDER NO OBLIGATION TO AWARD A

CONTRACT AS A RESULT OF THIS ANNOUNCEMENT. NO FUNDS ARE AVAILABLE TO PAY

FOR PREPARATION OF RESPONSES TO THIS ANNOUNCEMENT. ANY INFORMATION

SUBMITTED BY RESPONDENTS TO THIS NOTICE IS STRICTLY VOLUNTARY.

NOTE: This sources sought notice is seeking 8(a) Participants ONLY.

DESCRIPTION:

1.0 INTRODUCTION

This is a non-personal services contract to provide support services for the United States Marine Corps

(USMC), Plans, Policy, and Operations (PP&O), Marine Corps Insider Threat Program (MCInTP). The

Identity Activities Branch (formerly Security Branch), operating under the Deputy Commandant, PP&O

Security Division, is responsible for generating, implementing, and measuring the effectiveness of service policy governing the MCInTP and serves as the advocate. The MCInTP is responsible for the development, implementation, oversight of Service doctrine and policy, training, tactics, technologies, and coordination with other Department of Defense (DoD) and interagency partners to support mission area across all

Marine Air Ground Task Force (MAGTF). The Marine Corps Insider Threat section is responsible for coordinating the development and execution of service plans and policies related to Insider Threat capabilities directed by the National Insider Threat Task Force (NITTF) under Executive Order 13587.

Executive Order 13587, Structural Reforms to Improve the Security of Classified Networks and the

Responsible Sharing and Safeguarding of Classified Information, requires the Marine Corps to develop a program to deter, detect, and mitigate insider threats. More specifically, the National Insider Threat Policy and Minimum Standards for Executive Branch Insider Threat Programs requires agency heads to establish an integrated capability to monitor and audit information for insider threat detection and mitigation that leverages counterintelligence, security, cybersecurity, human resources, law enforcement, and other relevant functions and resources to identify and counter the insider threat.

The MCInTP and its Analysis Center are envisioned as performing multiple functions, ranging from identification of data and events to education and training. Unifying disparate monitoring capabilities, aggregating data from multiple sources while complying with relevant laws and privacy policies, analyzing data and interpreting the meaning of personnel actions (behavioral indicators) realistically and ethically, providing actionable information to leaders, and self-assessing performance are all examples. The role of the Program and the Analysis Center, therefore, are to meet Executive Branch requirements by educating, training, informing, and supporting Marine Corps leaders.

2.0 SCOPE

The scope of this requirement is to provide behavioral, analytical, policy, and technical support along with the concepts, expectations, and performance requirements to the USMC, PP&O, Identity Activities Branch;

Insider Threat Section. The primary objective is to implement a MCInTP, to include an Analysis Center that effectively detects, deters, and mitigates intentional and unintentional insider threats among uniformed, government, and contracted personnel. This Analysis Center will leverage the experience of its analyst, alongside technical and non-technical controls, to mitigate insider threats and coordinate with appropriate

Insider Threat enterprise representatives (Defense Insider Threat Management and Analysis Center,

- 2 -

National Insider Threat Task Force, and other Services, etc.). In addition to its analytical capability, the

MCInTP will support training and awareness across the Marine Corps to assist in mitigation strategies and command interaction.

3.0 APPLICABLE DOCUMENTS

The Contractor shall be familiar with and be able to reference the following documents, instructions, and manuals. All applicable documents in support of this effort will be made available by the Government.

Executive Order 13587, Structural Reforms to Improve the Security of Classified Networks and the Responsible Sharing and Safeguarding of Classified Information, 07 October 2011

Presidential Memorandum, National Insider Threat Policy and Minimum Standards for Executive

Branch Insider Threat Programs, 21 November 2012

Executive Order 10450, Security Requirements for Government Employment, 27 April 1953

Executive Order 12829, National Industrial Security Program (as amended), 16 December 1993

Executive Order 12968, Access to Classified Information, 02 August 1995

Executive Order 13467, Reforming Processes Related to Suitability for Government Employment, Fitness for Contractor Employees and Eligibility for Access to Classified National Security

Information (as amended), 29 September 2016

Executive Order 13526, Classified National Security Information, 29 December 2009

Executive Order 12333, United States Intelligence Activities (as amended), 04 August 2008

DoDI 5200.08, Security of DoD Installations and Resources and the DoD Physical Security

Review Board (PSRB), 19 May 2010

DoD 5200.08-R, Physical Security Program, 09 Apr 2007

DoDD 5205.16, The DoD Insider Threat Program, 30 September 2014 Incorporating Change 1, Effective January 25, 2017

DoDD 5240.02, Counterintelligence (CI), 17 March 2015

DoDM 5240.01, Procedures Governing the Conduct of DoD Intelligence Activities, 08 August

DoDD 5240.06, Counterintelligence Awareness and Reporting (CIAR), W/Ch 1, 30 May 2013

DoDM 5105.21-V3, Sensitive Compartmented Information (SCI) Administrative Security

Manual: Administration Of Personnel Security, Industrial Security, and Special Activities, 19

October 2012

SECNAVINST 5510.37, Department of the Navy Insider Threat Program, 08 August 2013

SECNAV M-5510.30, Department of the Navy Personnel Security Program, 01 June 2006

OPNAVINST 5510.165A, Navy Insider Threat Program, 01 October 2015

MCO 5530.14A, Marine Corps Physical Security Program Manual, 05 June 2009

MCO 3302.1E, Marine Corps Antiterrorism Program

MCBul 5100, Marine Corps Insider Threat Program (MCInTP), 29 Sep 2017

4.0 TASK REQUIREMENTS

The Contractor shall assist the Marine Corps by developing, implementing, maintaining, assessing, modifying, and effectively implementing the MCInTP and Analysis Center.

4.1 Program Development Support:

The Contractor shall:

a) Research, identify, and make recommendations on best practices utilized within DoD agencies, other government agencies and corporate organizations, for implementing an insider threat program in line with the MCInTP strategic vision.

- 3 -

b) Provide support to the Marine Corps in achieving Full Operational Capability by assisting in the development of processes, information management, knowledge management, records management, and insider threat response actions, in accordance with the NITTF criteria.

c) Provide program management support for the MCInTP to include development, review, and coordination of all policies, directives, instructions, and alignment of existing programs as it relates to the InTP.

d) Conduct capability based assessments, program gap analysis, and Doctrine, Organization, Training, Material, Leadership and Education, Personnel and Facilities (DOTMLPF) assessment within the Joint Capabilities Integration Development System (JCIDS) process.

e) Provide support to the Government Program Lead with managing contract budget and costs, and the development of a comprehensive budgeting strategy, to include proposed funding levels for

Program Objective Memorandum (POM) efforts over the five-year Future Years Defense Program

(FYDP).

f) Review and assist with the establishment of annual reporting guidelines for Component

Departments to report relevant InTP information.

g) Develop and manage the capability to ingest, analyze, and safeguard relevant insider threat information from internal and external sources (User Activity Monitoring (UAM), law enforcement, security, continuous evaluation, human resources) as part of InTP Analysis Center operations.

4.2 Policy and Procedures Development Support:

a) Assist in development of Policy pertaining to InTP, ensuring compliance with higher (Department of the Navy, Department of Defense) authority directives.

b) Identify policy modifications or gaps in DoD, Navy, and Marine Corps policies to ensure all necessary Marine Corps components and departments can integrate with the InTP.

c) Provide policy recommendations for approval by Marine Corps leadership as it relates to InTP.

d) Coordinate with Government representative(s) with the execution of DoN Tracker coordination and responses.

e) Provide input to and assist with updating the InTP SharePoint web pages on the Security Division web site that contains information used by subordinate commands and others for execution of the program.

f) Assist in the development and execution of InTP records handling procedures.

g) Develop and execute procedures for insider threat response and reporting actions, both internally and externally, and procedures for documenting each matter reported and response action taken within the case management system.

h) Assist in the maintenance process for access control to and the protection of classified and controlled unclassified sensitive information in accordance with National Archives and Records

Administration (NARA), DoD Information Security Program, Navy Information Security

Program, Marine Corps Information and Personnel Security Program.

- 4 -

4.3 SOP and CONOP Development Support:

a) Develop Standard Operating Procedures (SOPs) and Concept of Operations (CONOPs) to assist with the implementation and operationalization of the program.

b) Determine and validate staffing requirements for Analysis Center operations, to include reporting lines and liaisons to efficiently support the program.

c) Determine, identify, and validate internal and external reporting requirements to DoD, Secretary of the Navy (SECNAV), Defense Insider Threat Analysis Center (DITMAC), leadership and commanders.

d) Develop and validate workflow processes associated with insider threat analysis, validation, adjudication, reporting, triage, and case management.

e) Develop and define business rules to ensure compliance with policy, adherence to applicable laws, ethical practices, privacy protection and safeguarding of sensitive information, and workflow.

f) Develop and support strategic communications plans that includes stakeholder communication strategy, program integration strategy, and enterprise communications strategy.

g) Develop Plan of Action and Milestones (POA&M) to ensure milestones, scheduling and timelines for program development are known and progress is accurately tracked.

4.4 Training and Education Support:

a) Assist the Government with the development of a training and education strategy as it relates to the InTP.

b) Coordinate and implement a continuing training program tailored to different training audiences

(uniformed, government, and contracted personnel.)

c) Develop the curriculum and media used for the initial indoctrination/preliminary training, annual refresher training, and special training designed to address insider threat policy, operations discrepancies, deficiencies, and promote awareness of insider threat policies, procedures and indicators of potential insider threat activities and behaviors.

d) Develop the curriculum and media for the Analysis Center staff, that includes insider threat awareness, analytical processes and procedures, counterintelligence fundamentals, personnel and information security fundamentals, records handing, safeguarding of sensitive information, civil liberties, privacy laws, and regulations, workplace violence, investigative referral procedures, insider threat analyst response actions and procedures.

e) Develop the curriculum and media for the MC enterprise, that includes insider threat awareness, counterintelligence fundamentals, personnel and information security fundamentals, records safeguarding of sensitive information, civil liberties, privacy laws, and regulations, workplace violence, reporting procedures.

- 5 -

f) Develop curriculum and media that is tailorable and in modular form to be included into professional military education courses, instructor led training events, and computer based training.

g) Coordinate with Marine Corps wide training coordinators to ensure annual InTP timelines are met, training is provided, and properly documented.

5.0 KEY PERSONNEL

The following positions have been identified as key personnel. Personnel should have specialized experience in the private or public sector developing and implementing insider threat, force protection, physical security, intelligence, and law enforcement functions to support the InTP requirements. The

Contractor shall designate one key personnel as the single point of contact to report to Section Heads on the

InTP efforts and progress.

The following minimum education, experience, knowledge, skills, and abilities are required to meet each key personnel qualification under this contract:

10.1 Program and Support Specialist:

Bachelor’s Degree in Business Administration or an equivalent field.

Minimum of 15 years of defense, national security, and homeland security experience.

Must have experience in leading and managing personnel, managing schedules, and monitoring work performance.

Must have experience in providing senior-level security, insider threat and violence prevention stakeholders with risk analytics, and program management support (experience with Program Management within the USMC is preferred.)

Must have experience in security and project management (education requirement can be waived with 7 years of policy related work experience).

Must have experience in Program Objective Memorandum (POM) efforts in support of program budget forecasting.

Must have experience with DoD process and procedures with regards to classified networks and environments.

Possess a TS/SCI Security Clearance

10.2 Social Scientist Subject Matter Expertise (SME)

Master’s Degree in Social Sciences (Anthropology/ Political Science), or an equivalent field with experience in social sciences and analysis.

Minimum of 10 years of experience working in the context of the American military and specifically the Marine Corps.

Must have experience with DoD process and procedures with regards to policy development, interpreting orders and directives, operation on and protection of classified networks and environments.

Must have experience with DoD violence prevention initiatives, programs and resources.

Must possess a clear understanding of DoD process and procedures with regards to policy development, interpreting orders and directives, operation on and protection of classified networks and environments.

Must possess extensive knowledge and skill to conduct comprehensive research to identify and characterize risk factors, develop strategies to reduce social threat incidence, evaluate and recommend methods of control as well as preventive measures; apply complex epidemiologic methods for assessing the risk among military beneficiaries.

Must be skilled in written and oral communications sufficient to prepare and present complex findings and recommendations to upper management, carry out specific actions regarding controversial issues, and for implementing new ideas and concepts.

- 6 -

Must be able to communicate with and advise high level managers regarding new behavioral science research.

Must possess a TS/SCI Security Clearance.

10.3 Analyst

Minimum of 8 years of experience in military, all-source intelligence analysis, supporting tactical and strategic levels.

Minimum of 5 years in demonstrated knowledge of intelligence processes, cycle and organizations; knowledge of and ability to use various research tools; procedures and methods of analyzing, compiling, reporting and disseminating intelligence data; and/or knowledge of organization(s) for and methods of collecting and analyzing intelligence data.

Minimum of 5 years demonstrated knowledge of research and analytical techniques as applied to difficult and complex assignments in security, law enforcement, and counterintelligence analysis.

Must possess a strong analytical background.

Must have excellent written and verbal skills with ability to deliver briefings to large professional groups.

Must possess the ability to successfully plan, coordinate, research and analyze all-source intelligence information for accuracy, timeliness and relevance to mission.

Must possess knowledge of current domestic and international threats to U.S. national security interests.

10.4 Policy Development and Support Specialist SME

Minimum of 10 years of experience in DoD, program and policy development (USMC-specific is preferred.)

Must have a comprehensive understanding of Joint Capabilities Integration Development

System (JCIDS) and the Doctrine, Organization, Training, Material, Leadership and education, Personnel and facilities (DOTMLPF) principles and process.

Must have comprehensive knowledge of how qualitative and quantitative measures can be applied to programmatic efforts in program development and analytics.

Must possess the ability to develop, implement, and monitor scientifically defensible qualitative and quantitative measures for program evaluation aligned with the strategic vision of the Marine Corps Insider Threat Program.

Must have excellent written and verbal skills, ability to construct briefs for senior leaders on material and non-material solutions for program development.

Must possess the ability to work both independently and on a team.

10.5 Program Support SME: Evaluation and Training

Minimum of 10 years of experience working with military populations, understanding of military culture (USMC experience preferred.)

Must have comprehensive knowledge of how qualitative and quantitative measures can be applied to programmatic efforts in scientifically defensible ways.

Must possess the ability to develop, implement, and monitor scientifically defensible qualitative and quantitative measures for program evaluation aligned with the strategic vision of the Marine Corps Insider Threat Program.

Must possess the ability to align program evaluation measures with DoD, DON, and Marine

Corps standards or requirements.

Must possess the ability to brief senior leaders on programmatic effectiveness and defend evaluation.

- 7 -

Must possess the ability to translate complex and technical concepts into non-specialist terms.

Must have knowledge of best practices for mixed population, non-intelligence community insider threat programs.

Must have the ability to develop comprehensive training content targeted at specific Marine

Corps populations, (e.g., different ranks, MOSs, uniformed/civilian/contractor, etc.)

Must have the ability to develop, implement, and monitor scientifically defensible qualitative and quantitative measures for training evaluation aligned with the strategic vision of the

Marine Corps Insider Threat Program.

Must possess a Top Secret Clearance.

10.6 Physical Security Specialist

Minimum of 7 years of experience in the Physical Security specialization

Must have completed physical security training courses via the Defense Security Service, U.S.

Army Military Police School Physical Security Course, and Federal Law Enforcement

Training Center Physical Security Course.

Must demonstrate the ability to apply systematic thinking principles to the field of material solution with regard to DoD requirements.

Must have USMC operation experience, knowledge of forward deployed and amphibious missions.

Must have an understanding of physical security systems, measures and equipment

In-depth knowledge of the identity intelligence analysis process.

Must have expertise in DoD, DoN and Marine Corps Physical Security, doctrine.

Must demonstrate expertise in work processes, optimization methods, and risk management.

Must possess a Secret Security Clearance.

6.0 SECURITY REQUIREMENTS:

All personnel supporting this contract must have at minimum a SECRET security clearance or TS/SCI, respectively, at time of award. A TOP SECRET/SCI security clearance for those key positions specified under Key Personnel are based on an SSBI/ SBPR/ PPR or Tier 5 investigation. All personnel performing tasks under this contract must be eligible for, and obtain, a DoD Common Access Card (CAC), and associated DoD PKI certificates for identity verification and encryption of transmitted correspondence.

7.0 PLACE OF PERFORMANCE:

Place of performance will be within the National Capital Region (NCR), specifically MCB Quantico and the Pentagon.

8.0 PERIOD OF PERFORMANCE:

This contract is for a one (1) one-year base period with two (2) one-year option periods. Performance is anticipated to begin in March 2018.

9.0 NAICS:

The anticipated North American Industry Classification System Code (NAICS) for this requirement is

541690 – Other Scientific and Technical Consulting Services. This Sources Sought Notice is requesting responses to the following criteria ONLY from sources that can provide the required services under the

NAICS Code.

10.0 RESPONSE INSTRUCTIONS:

- 8 -

Interested vendors are requested to include, at a minimum, the following information. Response shall not exceed a total of 10 pages.

i. Name of Organization, Cage Code, DUNS Number, Telephone Number, Address, and Email address for the primary point of contact.

ii. Description of your organization’s capabilities and experience with regards to the tasks outlined above and personnel requirements. This description should demonstrate ability to perform the services described in this notice.

iii. Include whether your company has provided similar services for commercial industry or other

Government agencies. Provide related past performance references including a summary of work involved and any notable accomplishments.

iv. Contract vehicles that would be available to the Government for the procurement of these services, to include General Service Administration (GSA) Federal Supply Schedules (FSS), GSA OASIS, or any other Government Agency contract vehicle. (This information is for market research only and does not preclude your company from responding to this notice.)

v. Additional comments or questions about the specifics of this requirement.

VENDORS WHO WISH TO RESPOND TO THIS SOURCES SOUGHT SHOULD SEND RESPONSES

VIA EMAIL NLT 13 DECEMBER 2017 1:00 PM (LOCAL D.C. TIME) TO

VIPHALAC.DICKOVER@USMC.MIL .

Proprietary information and trade secrets, if any, must be clearly marked on all materials. All information received that is marked Proprietary will be handled accordingly. Please be advised that all submissions become Government property and will not be returned. All government and contractor personal reviewing

RFI responses will have signed non-disclosure agreements and understand their responsibility for proper use and protection from unauthorized disclosure of proprietary information as described 41 USC 423. The

Government shall not be held liable for any damages incurred if proprietary information is not properly identified.

mailto:Viphalac.dickover@usmc.mil