OIG233056-Mobile_App_Security_Training.pdf

The US. Health and Human Services (HHS)

Office of Inspector General (OIG) Request for Information Date: December 17, 2018

This Request for Information (RFI) is being released pursuant to the Federal Acquisition Regulations (FAR) Part 10 Market Research. The information collected through the process considered to be market research as described by FAR 2.101 and in accordance with FAR 10.002.

This Request for Information (RFI) is the initiation of market research under Federal Acquisition Regulation (FAR) Part 10. This is NOT a solicitation for proposals, proposal abstracts, or quotations. This announcement does not constitute an Invitation for Bids (IFB), Request for Quote (RFQ), or a Request for Proposal (RFP), and it should not be construed as a commitment of any kind by the Government to issue a formal solicitation or ultimately award a contract.

In addition, vendors responding to this RFI shall bear all risks and expenses of any resources used to provide the requested information. The submission of capability information in response to this market survey is purely voluntary.

The Health and Human Services (HHS) Office of Inspector General (OIG) is issuing this RFI to identify qualified and responsible business, to include Large Businesses and Small Business vendors (e.g., 8(a); Service-Disabled Veteran Owned Small Business; Historically Underutilized Business Zone (HUBZone) Small Business; Small Disadvantaged Business; Veteran-Owned Small Business, Women-Owned Small Business and Economically, Disadvantaged Women- Owned Small Business) having an interest in and possessing the resources and expertise to provide mobile application security training, to include mobile/web app penetration testing techniques.

The applicable North American Industry Classification System (NAICS) code assigned to these services is 511210. Contractors must be properly registered in the Government System for Award Management at https://www.sam.gov/portal/public/SAM/.

Background

The mission of the Health and Human Services (HHS) Office of Inspector General (OIG) is to protect the integrity of HHS programs, as well as the health and welfare of beneficiaries served by those programs. This statutory mission is carried out through a nationwide network of audits, investigations, and inspections. By conducting independent and objective audits, evaluations, and investigations, OIG provides timely, useful, and reliable information to Department officials, the https://www.sam.gov/portal/public/SAM/

Administration, Congress, and the public. The HHS OIG consists of five components – Office of Audit Services (OAS), Office of Evaluation and Inspections (OEI), Office of Investigations (OI), Office of Counsel to the Inspector General (OCIG), Office of Management and Policy (OMP) – plus the Inspector General’s Immediate Office (IO). The approximately 1,700 OIG employees are distributed throughout the United States and territories, in the headquarters at Washington DC, 9 regional offices and over 90 field offices.

Security of electronic information is of the utmost importance, and some networks and systems may not have the necessary safeguards or could be vulnerable to external and internal attacks or threats. An important component of OIG’s health IT portfolio of work involves cybersecurity that generally falls into two main categories: 1) internal cybersecurity—that is cybersecurity efforts related to OIG’s devices and networks, and 2) external cybersecurity—that is cyber security efforts related to the devices and networks of the Department, as well as certain providers, suppliers, grant recipients, and others that have a connection with the Department (this second category ranges from Federal agencies to individual hospitals and physician groups, among others). OIG currently engages in cyber assessments of HHS and its operating divisions’ networks and systems. HHS has 11 operating divisions, including eight agencies in the U.S. Public Health Service and three human services agencies. These divisions administer a wide variety of health and human services and conduct life-saving research for the nation, protecting and serving all Americans.

Purpose and Objectives

HHS OIG is seeking a fundamentals training course in mobile application security to include mobile/web app penetration testing techniques. The purpose of this RFI is (1) to describe the desired training service (2) to determine capabilities of vendors who can perform this type of training and (3) to determine the best contracting vehicles to meet our requirements.

The course may include the following subject matter, but is not limited to:

• Analyzing iOS applications for security vulnerabilities

• Exploiting iOS applications

• Securing iOS applications

• Analyzing Android applications for security vulnerabilities

• Exploiting Android applications

• Securing Android applications

• How to decompile, reverse and patch iOS and Android apps

• How to hack web-views, client-side databases and the keychain

• Instrument application runtimes using mobile app development tools

• Exploitation of IPC mechanisms, URL handlers, application extensions, broadcasts, activities and intents

• Bypassing security controls to allow rooting or jail-breaking of a device

• Common vulnerabilities in iOS and Android apps (e.g. OWASP Mobile Top 10)

Anticipated period of performance. Spring 2019

Capability statement /information sought. Respondents must provide a capability statement, to include the following information:

1. Respondent’s training course/syllabus, describing course schedule, modules, training requirements, etc.

2. Information regarding Respondent’s: (a) staff expertise, including their availability and experience; (b) current in-house capability and capacity to perform the work; (c) prior completed projects of similar nature; (d) ability to accommodate 25-50 students; (e) ability to travel and teach the course at an off-site location; and (f) training equipment requirements (i.e. whether this is to be supplied by respondent or course attendees)

3. A general rough order of magnitude of the effort, time, and travel that may be required for completion of the work. Do not submit detailed estimates;

4. Respondent’s DUNS number, organization name, address, point of contact, and size and type of business (e.g., 8(a), HUBZone, etc.) and NITAAC or GSA contract number (if applicable);

5. Information about any Government Wide Acquisition Contract (GWAC) (e.g., NITAAC) or Federal Supply Schedule Contract from which the training services could be procured.

6. Any other information the Respondent feels is pertinent to the potential requirement.

All responses to this RFI must be submitted electronically to Nicola Carmichael, Contract Specialist, at Nicola.Carmichael@oig.hhs.gov. Facsimile responses will not be accepted.

Telephone inquiries will not be accepted or acknowledged, and no feedback or evaluations will be provided to companies regarding their submissions. Interested vendors should monitor a government point of entry site for further information. Your firm’s response to this RFI is appreciated.

SUBMISSION TIME AND DATE

Responses to the information provided above are due no later than Monday January 7, 2019 at 1:00 PM Eastern Time. Responses received after this date and time may not be considered mailto:Nicola.Carmichael@oig.hhs.gov