CISA DTSS Prequotation Conference Briefing Slides FINAL.pdf

Empower • Collaborate • Innovate • Procure

Digital Transformation Support Services (DTSS)

Virtual Pre-Quotation Conference March 23, 2023

Hosted by the DHS Office of Procurement Operations (OPO) and

Cybersecurity and Infrastructure Security Agency (CISA) Chief of Contracting Office (COCO)

Welcome and Opening Remarks

Tisha Blue-Warren, DHS OPO Industry Liaison

Digital Transformation Support Services (DTSS) Virtual Pre-Quotation Conference Agenda

I. Welcome and Opening Remarks Tisha Blue-Warren

II. Rules of Engagement Tisha Blue-Warren

III. Program Overview Robert Costello

IV. Statement of Work (SOW) Overview Eva Shaw-Taylor

V. DHS High Level Suitability Process Gary Hardy

VI. Acquisition Strategy/Schedule Eva Shaw-Taylor

VII. Industry Comments/Questions DHS CISA OCIO/CISA COCO

VIII. Break

IX. Q&A Open Session DHS CISA OCIO/CISA COCO

X. Closing Remarks Tisha Blue-Warren

Rules of Engagement

• Please ensure you sign in with your first name, last name and company name.

• The information presented today is for informational purposes only.

• This presentation does not constitute a request for quotes or proposals.

• This presentation does not constitute a final version of the Government’s requirement and is not binding.

• Questions or comments during the presentation may be submitted via the MS

Teams chat icon.

• Any answers provided during this presentation may be subject to change.

• Event slides, Q&As, and attendees list will be posted to the original SAM.gov posting on or around Thursday, April 6, 2023.

Disclaimer

• The information we provide today reflects things as we know them today. Information and details may change as the acquisition process moves forward.

• Participation is not mandatory in order to participate in future CISA notices.

• Attendance does not confer preference for contract award.

Empower • Collaborate • Innovate • Procure6

Program Overview

Robert Costello, CISA Office of the Chief Information Officer (OCIO)

OCIO Mission and Vision:

Empower • Collaborate • Innovate • Procure8

CISA DTSS:

• CISA is seeking to establish innovative digital transformation technologies and support services to address several current and anticipated challenges, which include the need for the following:

oCentrally managed and delivered IT capabilities through cross-agency coordination and collaboration o Innovate and rapidly execute as a unified agency across mission areas oEmploy best engineering and security practices that support rapid responsiveness to emerging threats and technology capabilities oEstablish transparency and accountability in the planning, delivery, and completion of large-scale enterprise-wide IT initiatives

Empower • Collaborate • Innovate • Procure10

Statement of Work (SOW) Overview

Eva Shaw-Taylor, CISA COCO Contracting Officer

Statement of Work – Task Area One Program Management

• The Contractor shall provide services to continuously manage and track adequate levels of project management, technical resources, quality assurance, scheduling, cost, budget, and financial controls throughout the performance of this BPA.

• The Contractor shall plan, direct, control, measure, monitor, and report to the Government on all activities of the working requirements.

• The Contractor shall ensure that all personnel are provided the necessary program management tools, guidance, plans, processes, procedures, and resources that shall enable the Contractor to comprehensively manage the BPA and individual Call Orders.

• the BPA and individual Call Orders.

Statement of Work – Task Area Two Transformation Strategy, Enablement, and Service Experience Support

• CISA is seeking to establish cross-program consistency, reuse, common architectures, security standards and other scalable practices for solutions that are used across the agency.

• The contractor shall develop and implement a standardized framework for engaging CISA teams and stakeholders, CISA information system users, and mission stakeholders to identify priorities, improve service design effectiveness, and establish consistent end user experiences.

• The contractor shall provide design thinking and user experience strategy, consulting, design, and implementation support to CISA teams with a concentration on organizational effectiveness, accountability, and continuous improvement in service delivery.

Statement of Work – Task Area Three Digital Solution Development, Automation, and Infrastructure Support

• The Contractor shall support CISA with the adoption of new digital solutions to support achieving the economies of scale that support the business case for digital platforms and requires support to achieve CISA’s goals.

• The contractor shall employ Development, Security, and Operations (DevSecOps) with the use of principles such as Infrastructure as Code (IAC) and Continuous Integration/Continuous Deployment (CI/CD) pipelines to make infrastructure environments available on demand with the necessary security accreditation.

• Software development practices shall employ practices such as design and code in sections, automated testing, verifying code against Common Weakness Enumeration (CWE), Common Vulnerabilities Exposures (CVE), Open Worldwide Application Security Project (OWASP) to identify and remedy code vulnerabilities, test automation, issue resolution, and prototyping.

Statement of Work – Task Area Four Enterprise Data Management and Analytics Support

• CISA requires transparency into decision-making with data-driven technical and organizational approaches.

• The contractor shall support establishing and implementing a comprehensive

CISA data architecture, the design and engineering of consolidated and consistent cross-agency data management solutions, development and deployment of data integration analytics solutions, and the design and development of end-user data visualization capabilities for CISA stakeholder organizations.

• The Contractor shall provide technology solutions which enable development teams to work efficiently and enable services to scale easily and cost-effectively.

In particular, the vendor shall consider using open source, cloud-based, and commodity solutions across the technology stack.

Statement of Work – Task Area Five Operations and Sustainment

• The Contractor shall perform ongoing operations and standardization of CISA

Operations and Maintenance for cloud-based Software of a Service (SaaS), Platform as a Service (PaaS), and Infrastructure as a Service (IaaS) solutions, where required, to allow end-user insights and operational feedback to guide continuous improvement of the platform configurations and feature sets.

• Cloud-based solutions may include but is not limited to those utilizing Amazon Web Service (AWS), Microsoft Azure, Google Cloud Platform, ServiceNow, Atlassian, Appian, Apple AppStore, and Google Play Store.

• The Contractor shall perform defect resolution and corrective maintenance categorized as break/fix. In instances where newly developed or enhanced applications interact with legacy systems, the Contractor is expected to collaborate with the legacy maintainer to troubleshoot issues and provide information to the Government.

DHS High-Level Suitability Process Gary Hardy, CISA Office of the Chief Security Officer (OCSO)

Selection: Applicant selected for position; e-QIP completion; forms submission; and Fingerprinting

Checks: Criminal history; Financial history; Citizenship; previously completed investigations

Review: e-QIP acceptability (legibility, accuracy, completeness); Issue Resolution

EOD Decision: Favorable decision an applicant can start; Unfavorable decision an applicant cannot start

Investigation: Scheduled; field work completed; report of investigation back to DHS

Final Decision: Favorable decision an applicant continues to work; Unfavorable decision an applicant must be removed from contract

Empower • Collaborate • Innovate • Procure17

Acquisition Strategy

Eva Shaw-Taylor, CISA COCO Contracting Officer

• Sources Sought Notices (SSNs) were posted on GSA E-Buy and Sam.gov November 14, 2022 and January 11, 2023, respectively

• CISA reviewed the responses and determined that there was a reasonable expectation that quotes would be received from at least three (3) capable women-owned small businesses (WOSB), supporting a 100% WOSB set-aside

Acquisition Strategy - Highlights

Acquisition Strategy - Highlights

• Evaluation Highlights – Best Value

• Technical and Management Approach

• Past Performance

• Price

• Multiple Award Blanket Purchase Agreements (BPAs)

• CISA COCO expects to award approximately 4 BPAs

Acquisition Strategy – Notional Milestones

Milestone Date

Pre-Quotation Conference 23 March 2023

DRAFT Request for Quotation (RFQ) 3 April 2023

FINAL RFQ 17 April 2023

QUOTES DUE 15 May 2023

PLANNED AWARD DATE 1 July 2023

Empower • Collaborate • Innovate • Procure21

Q&A Session

DHS CISA OCIO and DHS CISA COCO

Q&A Session - Panel

Robert Costello, CISA OCIO Eva Shaw-Taylor, CISA COCO

1. (COCO) Would you please clarify if an offeror is required to have both SINs to be eligible, or if holding one of either SIN is all that is necessary for a potential offeror to bid?

2. (COCO) Does a bidder need to have both SINs referenced in the Sam.gov notice (MAS IT Professional Services SIN 54151S and Highly Adaptive Cybersecurity Services (HACS) SIN 54151HACS) to bid as prime? In reviewing the SOW, we believe that MAS IT Professional Services SIN 54151S supports all the requirements and is flexible enough to meet all staffing needs throughout the duration of the contract.

3. (COCO) Would the government consider opening the pool of qualified bidders to companies who have EITHER the IT Professional Services SIN (54151S) OR the Highly Adaptive Cybersecurity Services SIN (54151HACS)? Allowing a vendor to have either of the SINs would allow CISA to field from a larger pool of highly qualified vendors.

4. (COCO) Please confirm that only the resume for the “Program Manager for the BPA” will be required with the BPA proposal submission and confirm that any “Project Manager for the Call Order” resume(s) will only apply to each respective Call Order issued under this BPA.

5. (OCIO) Would the Government permit the substitution of 3 additional years of experience in lieu of the ITIL certification? Would the Government permit the substitution of 4 additional years of specific experience in lieu of a degree in Management, computer science, or information systems?

6. (OCIO) Is there an existing configuration management database (CMDB) or architecture library available, or will the Offeror be required to develop and implement the appropriate processes and artifacts?

7. (COCO) Please confirm CISA will require prime offerors to demonstrate a Top Secret Facility Clearance at the time of proposal submission to ensure awardee(s) have the necessary capabilities to support all future DTSS Call Orders.

8. (COCO) Can the government confirm it still intends to issue a multi-award BPA? If so, how many BPA awards does the government intend on awarding?

9. (COCO) Would CISA consider releasing this as a Total Small Business Set Aside (open to all socio-economic categories), allowing any small business who has been awarded Special Item Number (SIN) 54151HACS to submit a proposal for this opportunity?

10. (COCO) To achieve the Woman Owned Small Business (WOSB) goals, while still allowing innovative small businesses across other socio-economic categories to offer solutions, would CISA consider issuing the solicitation as a total small business set-aside with a dedicated award reserve for Woman Owned Small Businesses in the pool of awardees?

Empower • Collaborate • Innovate • Procure26

BREAK

We will return shortly for the Question & Answer period

Empower • Collaborate • Innovate • Procure27

Q&A Open Session

DHS CISA OCIO and DHS CISA COCO

Q&A Open Session - Panel

Robert Costello, CISA OCIO Eva Shaw-Taylor, CISA COCO

Q&A Open Sessions

1. (OSDBU) Please elaborate on the 100% WOSB decision.

2. (OCIO) Does CISA have cloud based solutions in place? Are they looking for new or is this contract to bring in and pay for cloud solutions like AWS?

3. (COCO) What is the estimated ceiling on this BPA?

4. (OCIO) Will CISA provide all the infrastructure for development etc. If the contractor has to provide infrastructure what is the normally ATO process and how will this be factored in?

5. (COCO) What would be the RFQ number?

Empower • Collaborate • Innovate • Procure30

Closing Remarks

Tisha Blue-Warren, DHS OPO Industry Liaison

Thank You for Attending the CISA Digital Transformation Support Services (DTSS)

Virtual Pre-Quotation Conference!