PCCS-24-30006_Request for Information.pdf

REQUEST FOR INFORMATION

FOR

DEPARTMENT OF HOMELAND SECURITY

CYBERSECURITY & INFRASTRUCTURE SECURITY AGENCY

Cyber Program Engineering

1. Introduction The Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA) is issuing a Request for Information (RFI) as a means of conducting market research to identify sources.

This RFI is for planning purposes only and shall not be construed as an obligation on the part of the Government. This is NOT a Request for Quotations or Proposals. No solicitation document exists, and the Government may or may not issue a formal solicitation resulting from the responses received to this RFI.

Respondents are advised that the Government will not pay for any response expenses. All costs incurred responding to this RFI will be solely at the interested party's expense. Failure to respond to this RFI will not preclude participation in any future solicitation. Any information received will become the property of the Government and will not be returned to the submitter. Interested parties are responsible for adequately marking proprietary or sensitive information.

Government technical experts drawn from staff within CISA, and other federal agencies may review responses. The Government may use selected support contractor personnel to assist in the review of the RFI responses. These support contractors will be bound by appropriate non-disclosure agreements to protect proprietary information.

2. Program Background As part of the overall CISA mission, the CISA Cybersecurity Division (CSD) actively engages with Government and critical infrastructure (CI) partners to help prepare for, prevent, and respond to incidents that could degrade or overwhelm strategic assets. Within CISA CSD, the Threat Hunting (TH) sub-division is responsible for understanding adversaries and how they carry out attacks, then exploiting that knowledge to improve stakeholder cybersecurity by sharing information with defenders via cyber threat intelligence and by using that information directly to help its stakeholders detect and respond to intrusions. However, there is currently a gap in CISA’s operational visibility into threats and vulnerabilities affecting critical infrastructure networks and its ability to address these threats and vulnerabilities more persistently. CSD,TH seeks to improve the ability to identify, analyze, and respond to threats in CI networks and provide more consolidated services to its government and CI partners. Through this RFI, CSD TH seeks to determine available sources with expertise focused on innovation, problem solving, and proficiency with U.S. Government and critical infrastructure (CI) partners.

Respondents must demonstrate expertise in cyber operations and support, cybersecurity concepts and capabilities, operational engagement and coordination, and National cyber strategy and policy. Additionally, respondents must show a track record of supporting development of effective tools to identify, analyze, and respond to threats in CI networks, increase persistent visibility into CI networks and understanding adversaries and how they carry out attacks, exploit that knowledge to improve stakeholder ability to detect and respond to intrusions.

Please respond to the following questions within your submission:

a. Provide up to two contracts performed within the last three years under which you have performed systems engineering and cybersecurity engineering to assist the Government in identifying and addressing gaps in functionality through future program enhancements. For each contract, describe the complexity, scope, and duration of the work.

b. Provide up to two contracts performed within the last three years under which you have improved an organization’s operation visibility into threats and vulnerabilities and how you addressed these threats and vulnerabilities. For each contract, describe the complexity, scope, and duration of the work.

c. Provide up to two contracts performed within the last three years under which you have staffed Top Secret-cleared (SCI-eligible) persons with knowledge and expertise about cybersecurity, program management, acquisition, solution, and system engineering. For each contract, describe the complexity, scope, and duration of the work.

d. Provide up to two contracts, performed within the last three years under which you have assisted the Government in maturing a cyber program as it moves through the Acquisition Lifecycle Framework (ALF). For each contract, describe the complexity, scope, and duration of the work.

e. Provide up to two contracts performed within the last three years under which you have improved an organization’s ability to identify, analyze, and respond to threats in critical infrastructure (CI) networks and provide more consolidated services to its offices and CI partners. For each contract, describe the complexity, scope, duration of the work.

3. Eligibility The applicable North American Industry Classification System (NAICS) code for this requirement is 541715 – Research and Development in the Physical, Engineering, and Life Sciences (except Nanotechnology and Biotechnology); with a Small Business Size Standard of 1,000 employees. The Product Service Code is AJ11- –General Science and Technology R&D Services; General Science and Technology; Basic Research.

Note: In accordance with DHS Directive 060-01, Development and Use of Strategic Sourcing Contract Vehicles, dated 24 August 2012, strategic sourcing vehicles are mandatory for use, with limited exceptions. Therefore, a strategically sourced contract vehicle will take priority over awarding a standalone CISA contract.

4. Submission Details Interested respondents should submit a capability statement package (up to ten 8.5 x 11-inch pages, font no smaller than 10 points, Microsoft Word, or Portable Document Format (PDF)) demonstrating the ability to provide the services listed in this announcement.

5. DUE DATE

Please submit a response to Nathalie Snyder, nathalie.snyder@cisa.dhs.gov and Hannah Moussa, Hannah.Moussa@cisa.dhs.gov NLT 5:00 P.M. EDT on May 10, 2024. The subject line of the email should state “PCCS-24-30006 RFI.”

Note: The Government reserves the right to hold one-on-one meetings resulting from RFI responses received as part of its market research. Meetings may be held with companies who provide comprehensive and relevant responses to the topic and questions in this notice.

6. Instructions for Respondents:

All written submissions become the property of the United States Federal Government and will not be returned.

1. Each respondent’s capability statements shall demonstrate capabilities and expertise in each of the scope in Section 2. The information shall be in sufficient enough detail, but not exceed ten pages TOTAL, so that the Government can determine the experience and capability of your firm to provide the requirements above.

2. DO NOT include marketing or sales materials.

3. If your organization has the potential capacity to provide the required services, provide the following information:

a. Organization name, UEI, CAGE code, Business size (large or small) and socio-economic status (i.e., 8(a), Small Disadvantaged, HUBZone, Service-Disabled Veteran-Owned, Women-Owned Small Business, etc.), address, primary points of contact (POCs) and their email address, web site address, telephone number.

b. Identify any strategic sourcing vehicles or federal supply schedules your company holds.

c. State whether your company holds a Top-Secret facility clearance.

d. Tailored capability statements addressing the requirements of this RFI.

4. Responses shall be unclassified. DO NOT include any classified information in your capability statements.

5. Submit responses via email in an electronic format compatible with the Microsoft

Windows 11 operating system (e.g., Microsoft Word, Microsoft PowerPoint, and Adobe

PDF).

mailto:nathalie.snyder@cisa.dhs.gov

Furthermore, CISA’s preference is to procure services on a small business set-aside basis, to the extent possible, based on market research results.

We encourage all small businesses, in all socioeconomic categories (including, 8(a) Business Development Program, Small Disadvantage Business, Historically Underutilized Business Zone, Service-Disabled Veteran-Owned, Women-Owned Small Business concerns), to identify their capabilities in meeting the requirement at a fair market price.

All data received in response to this RFI that is marked or designated as corporate of proprietary will be fully protected from any release outside the Government.