NOSC NCCS 2.0 RFI - 02192026 V1.pdf

REQUEST FOR INFORMATION

Title: Network Cyber and Cloud Support (NCCS) Services 2.0

NOTE: THIS IS A REQUEST FOR INFORMATION (RFI) ONLY. This RFI is issued solely for information and market research planning purposes. This RFI shall not be construed as an obligation on the part of the Government. This is NOT a Request for Quotations or Proposals. No solicitation document exists, and the Government may or may not issue a formal solicitation as a result of the responses received to this RFI.

The Government will not pay any for response or demonstration expenses. All costs incurred responding to this RFI will be solely at the interested party's expense. Failure to respond to this RFI will not preclude participation in any future solicitation. Any information received will become the property of the Government and will not be returned to the submitter. Interested parties are responsible for adequately marking proprietary or sensitive information.

The Government’s explicit intent, in this request for information, is to not receive from respondents any proprietary data, trade secrets, business sensitive information, or information considered CONFIDENTIAL under 18 U.S.C. §1905. The Government’s constraint does not in any way relieve contractors from their responsibility to properly mark proprietary data when it is provided, nor does it alleviate any requirement for the Government to protect marked data. The Government is not obligated to protect unmarked data.

The information provided in this RFI is subject to change and is not binding on the Government.

All submissions become the property of the Federal Government and will not be returned.

DESCRIPTION

The DHS information technology environment includes data centers; colocation facilities;

commercial and private cloud, and Gov-cloud resources interconnected by the Homeland Security Enterprise Network (HSEN) Wide Area Network (WAN). The HSEN WAN environment is supported by the DHS HSEN Hybrid Computing Environment (HCE), which includes on-premises infrastructure, network, compute, storage, and application support from DHS Data Center 1 (DC1) as well as multiple DHS Data Center Access Points (DCAPs) that leverage public cloud infrastructure for provisioning this support.

DHS is comprised of Headquarters and various Components, Offices, and Directorates. Each Component has unique and separate mission requirements and operates in a specific mission space; all are supported by a common unclassified, general purpose data transport network (A- LAN) that comprises the largest portion of the larger DHS HQ Network (HSEN). Some operational Components and/or mission-specific Offices (e.g., Office of the Inspector General, the St. Elizabeth’s Campus, etc.) also operate component- or location-specific networks or enclaves that are supported by the broader HSEN and A-LAN networks. The data traversing this network is typically considered Sensitive but Unclassified (SBU) or Controlled Unclassified Information (CUI).

Additional networks supporting HQ and comprising HSEN include the “B-LAN” at the secret classification level and the “C-LAN” which supports top secret classified data processing.

The Office of the Chief Information Officer (OCIO) has established Network Operations and Security Center (NOSC) that streamlines operations by merging these traditional Network Operation Center (NOC) is responsible for Identifying, Protecting and Detecting, Responding and Recovering from all Information Technology events in DHS HQ networks and information processing systems. In addition to HQ-specific NOC and SOC responsibilities, the NOSC has added systems monitoring, alerting, and administration support for physical and virtual infrastructure and systems located in data centers and cloud environments and coordination responsibilities for outages or incidents manifesting in DHS Component networks. In addition, the NOSC serves as the provisioning agent for DHS customers desiring to add HSEN network circuits.

The DHS NOSC combines the traditional functions and responsibilities of network and systems management, cloud management, and cybersecurity operations. At Tier 1, the DHS NOSC will detect and triage network, cloud, and cybersecurity operational issues, resolve those susceptible to rapid resolution, and escalate those requiring a more significant response to Tier 2. At Tier 2, the NOSC will coordinate the resolution of networking, cloud, and cybersecurity incidents requiring resources in excess of the limits placed on Tier 1. This consolidated model is designed to enable unified visibility and response across traditional NOC and SOC domains, positioning DHS to adopt emerging AI-enabled approaches that industry observers predict will further fuse operational and security disciplines over time.

To fulfill its mission, the DHS NOSC requires support that combines expertise in network and systems management, cloud management, and cybersecurity.

The Government prefers that personnel at both Tier 1 and Tier 2 each possess the skills necessary to perform Network and Systems management, cloud management, and cybersecurity operations.

The Government is seeking Industry feedback on this proposed approach, as well as suggestions and advice on alternative approaches or solutions, along with capable sources.

PURPOSE OF THIS RFI

The purposes of this RFI are:

1) To gain an understanding of Industry’s view of optimum approaches for providing network and system management, cloud management, and cybersecurity support services for operating the DHS NOSC facilities in the National Capital Region (NCR), Bluemont, VA, Mississippi, and Arizona.

2) Obtain Industry feedback on recruiting resources with expertise with network and systems management, cloud management, and cybersecurity expertise that leverages traditional tools and agentic AI.

3) Obtain feedback on the proposed DHS NOSC organizational approach described in this

RFI.

4) Obtain feedback on proposed costing structure as described in the RFI.

INFORMATION REQUEST

Interested parties should submit responses addressing one or more of the following areas:

1. Contract Type: DHS is contemplating a single award ordering type vehicle for providing network and system management, cloud management, and cybersecurity staffing services in support of the DHS NOSC operations in the National Capital Region (NCR), Bluemont, VA, Stennis, Mississippi, and Chandler, Arizona.

a. Please describe your capacity to deliver the required network and system management, Cloud management, and cybersecurity services including full time (24x7x365) and part time support and your ability to provide those services at the three DHS NOSC locations.

b. Please describe the recommended contract type (e.g., Labor Hour (LH), Time and Material (T&M), Firm Fixed Price (FFP), or Hybrid) that would be most effective for acquiring the required services and briefly explain why.

2. Required Technical Expertise: The DHS NOSC requires a mix of technical skills (network and system, cloud, and cybersecurity) in order to accomplish its mission.

a. Describe your capability to provide personnel with technical skills, knowledge, and experience in all of the following technical disciplines: 1) Network and systems management; 2) Cloud management; and 3) Cybersecurity.

b. Describe the approach for building and maintaining sufficient resources in each of the various DHS NOSC locations?

c. Do you consider the Government’s preference for staff expertise to be financially feasible? Why or why not? Please provide a detailed explanation.

d. How do you plan to approach the mix of traditional and agentic AI tools to support

DHS NOSC?

3. Staffing Approach: DHS envisions the DHS NOSC support would consist of junior and journeyman level personnel providing the necessary technical expertise. DHS is explicitly not seeking senior subject matter expert level personnel.

a. Provide feedback on the staffing approach envisioned by the Government.

b. Are the mix of skills the Government describes above technically feasible? If not, provide brief explanation.

4. Tier 1 and Tier 2 Operations: Tier 1 operations will be 24x7x365 with all technical areas represented. Tier 2 operations are also 24x7x365, but do not necessarily have all technical areas represented. What is the recommended minimum labor mix that should be deployed to support Tier 2?

5. NOSC Surge Support: Each DHS NOSC operating location will have continuing needs for support and normal, steady state operations. However, from time to time each location will have a need to increase support for a limited period of time due to a temporary increase or surge in workload such as response to a cyber threat or attack, implementation of a network design transition, or for other network or cybersecurity projects of limited duration. The Department’s expectation is to acquire these services for a specified period of time only and then discontinue those services at the end of that period.

a. What is your capability to provide personnel in response to a surge requirement?

b. How would surge requirements be filled?

c. What is recommended as the best approach for engaging temporary services in the shortest possible amount of elapsed time in response to a cyber threat or attack?

d. How much lead time is necessary to fill surge requirements?

e. Describe your capacity to provide qualified staff for temporary engagements in each of the three DHS NOSC operating locations.

f. How can agentic AI be leveraged to support surge support with reduced staff?

6. Personnel Security Requirements: TS/SCI cleared personnel will be required to be onsite and reside within commuting distance of each of the DHS NOSC locations. These personnel cannot be remote teleworkers and will be required to be onsite at minimum of one day per week and as mission dictates. Normal work may be performed onsite and via telework. Describe the capability to provide personnel with TS/SCI clearances for each of the DHS NOSC locations.

7. Other Considerations: Describe any additional considerations that should be considered by the Government in its planning for a contract for providing network and systems, cloud, and cybersecurity support services for the DHS NOSC operations.

SUBMISSION INSTRUCTIONS

Interested parties are invited to address the questions pertaining to the DHS NOSC network and systems management, cloud management, and cybersecurity operations services identified in this RFI. The total submission page count shall not exceed 15 pages, Times New Roman, Font Size 11, excluding the cover page. Only one submission will be reviewed per vendor for this RFI. That submission can respond to one or more questions above. Only electronic submissions will be accepted. Emails with attachments larger than 5 MB shall be broken down into multiple emails with no one attachment exceeding 5 MB. Each electronic submission shall include:

- RFI number and “Network Cyber and Cloud Support Services 2.0” in the Subject Line

- If the submission includes more than one electronic email, please include the file number and total files being submitted (e.g., File 1 of 4, File 2 of 4, etc.) in the Subject Line

- In the body of the email, include a Point of Contact (POC), phone number and email address of the person to be contacted regarding any correspondence between the Government and the Vendor. This person should be a primary contact and capable of addressing questions or issues associated with the submission in response to this RFI.

- Include a brief summary of email content, Vendor name and firm’s mailing address

- Business size (large or small) and socio-economic status (i.e. 8(a), small, disadvantaged business, HUBZone small business, service-disabled veteran-owned small business, Women- Owned Small Business, etc.)

- The Response Statement as an attachment to the email

Responses to this RFI may be reviewed by Government technical experts drawn from staff within DHS and other Federal agencies. The Government may also use selected support contractor personnel to assist in the review of the responses. These support contractors will be bound by appropriate non-disclosure agreements to protect proprietary and source selection information.

All Responses shall be submitted to the Office of Procurement Operations (OPO) Industry Liaison mailbox at the following email address: opoindustryliaison@hq.dhs.gov no later than 12:00p.m.

Eastern Time, Friday March 6, 2026.

The Government reserves the right to hold one-on-one meetings as a result of responses received from this RFI as part of its market research. Meetings may be held in particular with vendors who provide comprehensive responses to the questions posed.

mailto:opoindustryliaison@hq.dhs.gov