Request for Information_47QFRA23K0013 E1E2 Modernization.pdf

Request for Information (RFI) – E1/E2 Modernization

Agency: Cybersecurity and Infrastructure Security Agency (CISA)

Market Research Agency: General Services Administration (GSA), Federal Acquisition Service (FAS), Region 8 on behalf of Cybersecurity and Infrastructure Security Agency (CISA)

Notice Type:

Request for Information

Posted Date:

June 21, 2023

NAICS: 541512 Computer Systems Design Services

GSA Reference: Acquisition ID 47QFRA23K0013

I. GENERAL INFORMATION:

The General Services Administration (GSA), Federal Acquisition Service (FAS), Region 8 is issuing a follow-up Request for Information (RFI) on behalf of the Cybersecurity and Infrastructure Security Agency (CISA).

II. RFI OBJECTIVE:

The purpose of this RFI is to assist the Government in conducting market research. CISA is interested on gaining technical feedback from industry on techniques and technologies intended to detect and respond to threats within federal agency networks. CISA plans to modernize the legacy capabilities used under the EINSTEIN program to detect threats targeting federal networks. This information will be used for market research only. The Government is not obligated to release a future solicitation based on this market research. Interested respondents shall refer to the details of the response to this RFI under Section VI.

III. BACKGROUND:

Initially established in 2003, EINSTEIN 1 capabilities monitor the flow of network traffic transiting to and from Federal Civilian Executive Branch (FCEB) agencies. EINSTEIN 2, first deployed in 2008, is an intrusion detection system that identifies malicious or potentially harmful computer network activity in federal government network traffic based on specific known signatures. Both capabilities are fully deployed and screen all FCEB traffic routed through physical locations managed and hosted by agencies or vendors, where a federal civilian agency consolidates its external connections and has security controls to secure and monitor the connections. The evolutions of technologies and threat landscapes have highlighted limitations in the EINSTEIN capabilities and the benefits it provides.

IV. PURPOSE:

The visibility provided by existing EINSTEIN sensors remains a crucial enabler of CISA’s mission to protect FCEB agencies. It is one component that CISA uses to gain operational visibility, protect FCEB agencies, and respond to threats. With the limitations of EINSTEIN capabilities, CISA stands to lose that needed visibility. Consequently, a new solution may be necessary to compensate for this loss of visibility to protect FCEB agencies adequately.

For future CISA needs, the augmentation or replacement of this visibility must be considered within the current networking environment and how it may be combined and used with other data sources acquired by CISA analysts. The results will allow CISA to determine how to increase its operational visibility into and respond to malicious cyber activities against the nation and provide operationally relevant data to agencies to strengthen their networks.

The visibility provided by EINSTEIN capabilities was based on topology and physical hardware placement (sensors) placed at agency perimeters. Given changes to technology and agency architectures, this modernization effort needs to consider other broader strategies beyond replacing the existing footprint of EINSTIEN capabilities (e.g., optimal placements in federal agencies, new technologies/techniques to maximize visibility, etc.).

CISA continues to offer new cybersecurity services to FCEB Agencies, such as Protective DNS, with ongoing plans for other offerings and pilots. These services allow CISA to collect additional data to support their analysts and defense operations. CISA is seeking input on what the solution space to meet visibility needs without EINSTEIN capabilities may include.

The scope of this effort is limited to “on-premises" networks owned or managed by or on behalf of federal agencies. The scope does not include Contractor Owned/Contractor Operated (COCO) deployments, cloud environments, or any combination thereof.

V. REQUIREMENT OBJECTIVES:

1. Monitor network traffic: Capture and monitor network traffic to identify potential security incidents, including abnormal traffic patterns, unauthorized access attempts, and data exfiltration.

2. Detect and alert on anomalies: Automatically detect and alert network anomalies, including suspicious connections, unusual network traffic, and malicious activity.

3. Analyze network traffic: Analyze network traffic to identify the root cause of security incidents and assess the extent of any damage.

4. Identify and prioritize threats: Use threat intelligence and advanced analytics to identify and prioritize threats, including known and unknown threats.

5. Investigate incidents: Provide detailed information on security incidents, including the timeline of events, affected systems, and the scope of the incident.

6. Support incident response: Facilitate the incident response process by providing real-time data and context to security teams, including recommended remediation actions.

7. Enforce security policies: Ensure compliance with security policies and regulatory requirements by monitoring and enforcing network security controls.

8. Provide visibility and reporting: Provide visibility into network activity and security incidents and generate reports to demonstrate compliance and identify areas for improvement.

VI. RFI RESPONSE:

The Government welcomes feedback on the feasibility and utility of the stated objectives above. Responses are required to include the following information:

The RFI response shall be split into two Sections.

“Section 1” of the response is for administrative information and shall include the following as a minimum.

CONTRACTOR INFORMATION:

• Contractor Name and Facility Address (list all relevant or significant office locations)

• Facility clearance level

• UIE number, Cage code, and NAICS code

• Socio-economic status (HUBZone, Service-Disabled-Veteran-Owned, Woman-Owned, 8(a), Small Business, Large Business)

• POC Phone and Email

• Website URL

The number of pages in “Section 1” of the response shall be no longer than one (1) page in length.

“Section 2” of the submissions shall answer/address the below questions/requests as they relate to the requirement.

EXPERIENCE/CORPORATE CAPABILITIES:

1. Does your company have experience in implementing technologies consistent with the requirements identified in this RFI?

a. Describe relevant efforts withe similarities in size, scope, and complexity.

b. Please describe any experience with deploying your technology at federal agencies, including challenges.

2. Identify any existing Government contract vehicle (GWAC, Federal Supply Schedules, BPA, etc.) your company currently holds that could support E1/E2 Modernization. Please include a brief narrative why, in your determination, that vehicle would meet the needs of this possible requirement.

Information Requested:

1. What are effective strategies for deploying and managing network detection and response solutions in a complex, federated environment, such as a large government agency or multinational organization?

2. How can a network detection and response solution be architected and configured to provide comprehensive visibility and control over a large proportion of on-premises assets while allowing individual departments or business units to maintain autonomy and control over their resources? In your response, please include the following considerations:

a. Placement – Where are optimal placement locations for the Network Detection & Response (NDR) solution, primarily to ensure a reasonable tradeoff between costs and visibility, knowing that host-based visibility can be accomplished through other key CISA initiatives (e.g., EDR)? Include a discussion of potential blind spots.

b. Centralized oversight and control – It is desirable for the NDR capability to be controllable in a centralized manner, where many different deployments can be managed reasonably, including updating configurations, uploading custom signatures, etc.?

c. Centralized Visibility Opportunities – What types of data-flow architectures have been leveraged with the solution (e.g., Distributed, Fully-centralized, etc.), how have teams operationalized the sensor suite, and what types of data-centric integrations exist out-of-the-box (e.g., XDR, SIEM, Cloud Native Repositories [data lakes], etc.)?

3. What essential features and capabilities should a network detection and response solution have to meet the unique security requirements and compliance regulations of a federal agency or other large enterprises?

4. How can a network detection and response capability deal with ubiquitous encryption phenomenon that obfuscates the payload of “on the wire” traffic? What are any recommendations for dealing with this constraint (also elaborate on the cost and complexity of any recommendations)?

5. What data types should a network detection and response solution collect and analyze to detect and respond to advanced threats, and how long should this data be retained for optimal effectiveness? Include a discussion of recommended protocols, detail levels, and data formats (e.g., NetFlow, Zeek, PCAP).

6. What other costs, tools, or Agency infrastructure needs are considered pre-requisite for a successful operational deployment of the NDR capability (e.g., SPAN ports, bandwidth minimums, active or passive TAPs, etc.)?

7. What emerging trends and technologies should be considered when designing a long-term network detection and response strategy, such as cloud-native architectures, advanced threat-hunting techniques, and AI-driven analytics?

8. Which network detection and response solutions support cloud-based deployments, and if so, how does it integrate with other cloud security services and platforms? Please be specific, architecturally, how the solutions leverage cloud infrastructure, and what “on-premises” components still exist (if any).

9. How should a network detection and response solution plan to expand into other areas of security telemetry, such as network logs or Extended Detection & Response (XDR)/NDR capabilities, and if so, what is the roadmap for these developments?

10. What technical performance standards and best practices should be considered when evaluating network detection and response solutions, and how does your solution align with these standards?

11. What other features or capabilities does your company offer in addition to network detection and response, and how can these be integrated into a comprehensive security strategy?

12. How should a network detection and response solution be used in conjunction with other security tools and platforms, and if so, what is the level of interoperability and integration that can be expected?

13. How should a network detection and response solution prioritize and triage alerts to reduce alert fatigue and focus on the most critical threats?

14. Is network detection and response recommended as a standalone solution, or should it be integrated with other security activities, such as vulnerability management or threat intelligence?

15. How does your company leverage machine learning and automation techniques to continuously improve the effectiveness and efficiency of your network detection and response solution? Please include in your response how these techniques reduce the probability and frequency of false positive alerts.

16. What is the pricing model for your network detection and response offering, and what factors are considered when determining costs, such as hosting requirements, logging, and software development?

17. CISA, as a response to Executive Order 14028, has been coordinating an FCEB-wide response to ensure there are mature Endpoint Detection & Response (EDR) solutions at every agency. Please, if possible, describe if/how Network Detection & Response (NDR) functionality:

a. If strategic partnerships exist (or native capabilities contained within), which can be expanded out of existing EDR investment/platform in a complimentary fashion and/or

b. Integrated with NDR tools to provide network visibility and detection capabilities and still meet our endpoint detection requirements.

VII. CONTRACTOR NOTIFICATION:

This RFI is for information and planning purposes only and is not to be construed as a commitment by the U. S. Government. No award will be made as a result of this RFI. All information is to be submitted at no cost or obligation to the Government. Any information that the Contractor considers proprietary should be clearly marked as such. All submissions become Government property and will not be returned, including any proprietary information.

The Government may consider additional communications with submitting companies utilizing the contact information provided in the Corporate Overview to further the Government’s market research for the E1/E2 requirement.

• All responses are to use Times New Roman font, with a 12-point font, one-inch margins, and single spaced in all sections in Microsoft Word.

• Contractor Information section shall be no longer than 1 page in length (Section 1).

• Contractor Experience section shall be no longer than 2 pages in length (part of Section

2).

• Information Requested section should be no longer than 7 pages in length (part of

Section 2).

• All information submitted shall be UNCLASSIFIED.

• Any information that the contractor considers proprietary should be clearly marked as such.

• All submissions become Government property and will not be returned (including any proprietary information).

• Submissions longer than 10 pages may be dismissed (not including Cover Page and Table of Contents).

RFI responses shall be submitted no later than 02:00 pm EST on July 14, 2023, via email to Diana Zoppi at diana.zoppi@gsa.gov and Sabrina Kestell at sabrina.kestell@gsa.gov .

Contractors who do not respond to this RFI are not excluded from any resulting solicitation(s).