Sources Sought_D40 Cyber Support.docx

Sources Sought Notice

N64498-25-RFPREQ-PD-40-0007

Requirement Title

Scope: The Naval Surface Warfare Center, Philadelphia Division (NSWCPD) anticipates a Task Order requirement to provide Propulsion, Power & Auxiliary Machinery Systems Cybersecurity Support. These services shall be located primarily at the Naval Surface Warfare Center Philadelphia Division (NSWCPD).

The NAICS: Primary North American Industry Classification System (NAICS) code for this procurement is 541330.

Contract Type: A Cost Plus Fixed Fee - Level of Effort, SeaPort Task Order is anticipated.

Period of Performance: The anticipated period(s) will span 5 years and include a 12-month base period and four 12-month option period(s) beginning at the time of award. It is anticipated that the Request for Proposal (RFP) will be issued in October of 2025 in SeaPort-e.

Incumbent: Opal Soft, Inc. is currently performing the work under Task Order N0017819D8233/N6449824F3012.

Personnel Security Clearance: Secret Clearance Required

Submission of Responses: It is requested that all Small Business concerns, including but not limited to HUBZone, 8(a) Small Disadvantaged Businesses (SDB), and Service Disabled Veteran-Owned Small Businesses (SDVOSB), respond with a Capability Statement of a maximum of 3-pages to be used to determine the availability of Small Business concerns for this requirement. Interested Small Business concerns must identify their small business socio-economic categories.

Requirement Summary: This Statement of Work is for the development, monitoring, and execution of the Cybersecurity Program in support of NSWCPD at Naval Surface Warfare Center, Philadelphia, PA, which includes Risk Management Framework (RMF) services. The effort includes writing Cybersecurity policy, reviewing Authorization & Assessment (A&A) artifacts, Assess Only (AO) artifacts, and non-Traditional device artifacts, performing validation, implementing security postures, providing Subject Matter Expertise in cybersecurity life cycle management, coordination, implementation, and sustainment of these systems.

Assess and Authorize (A&A), Assess Only (AO), and Non-Traditional Device are the processes that provide an approval to operate the information system. Cybersecurity solutions shall be obtained by satisfying the requirements of, and adhering/complying with, Defense Information Systems Agency (DISA) Security Technical Implementation Guides (STIGs) and Security Requirements Guides (SRGs). Secure-system-configuration and hardening entails Assured Compliance Assessment Solution (ACAS) vulnerability assessments, Security Content Automation Protocol (SCAP) tool, anti-virus (AV) scanning, and certifying-activities to demonstrate and prove a system’s capability and reliability within a secure environment. These approvals must be maintained through continuous monitoring of the systems. Additionally, validation of these systems is required prior to issuance of authorization/approval to ensure compliance with the RMF process.

Per NAVSEA Assessment and Authorization Business Rules for RMF via the Functioning Authorizing Official Construct, PIT and PIT Systems align to NAVSEA technical authority and NAVSEA has approval authority as the Authorizing Official (AO). This contract covers cybersecurity efforts for Afloat systems and PIT Ashore systems that do not fall under Research, Development, Test, and Evaluation (RDT&E) Enclaves Zone A, B, C, or D, where NSWCPD has approval authority as the Authorizing Official (AO).

Level of Effort (Magnitude) Estimate: 35,496 hours per year

The Capability Statement shall succinctly address the following two items to demonstrate the Contractor’s capability to perform the requirements (see Requirement Summary above):

(1) The Contractor’s capacity, or potential approach to achieving capacity, to conduct the requirements of the tasking. For the purposes of this Capability Statement, capacity shall refer to matters such as the magnitude and technical knowledge/ability to complete the tasking described above.

(2) Evidence that the contractor has at least one (1) certified Navy Qualified Validator. Sufficient evidence includes the individual(s) Navy Qualified Validator ID number and Expiration Date.

Demonstrated capacity may include citing and describing the same or similar relevant performance, but does not limit the interested Contractor’s approach to demonstrate capability.

Response Date: 13 June 2025 NOTE: Only information provided in the written Capability Statement shall be considered.

DISCLAIMER: THIS SOURCES SOUGHT NOTICE IS FOR INFORMATIONAL PURPOSES ONLY. THIS IS NOT A REQUEST FOR PROPOSAL. IT DOES NOT CONSTITUTE A SOLICITATION AND SHALL NOT BE CONSTRUED AS A COMMITMENT BY THE GOVERNMENT. RESPONSES IN ANY FORM ARE NOT OFFERS AND THE GOVERNMENT IS UNDER NO OBLIGATION TO AWARD A TASK ORDER AS A RESULT OF THIS ANNOUNCEMENT. NO FUNDS ARE AVAILABLE TO PAY FOR PREPARATION OF RESPONSES TO THIS ANNOUNCEMENT. ANY INFORMATION SUBMITTED BY RESPONDENTS TO THIS SOURCES SOUGHT NOTICE IS STRICTLY VOLUNTARY.

2 | 2