Request for Information - CPR Activity.pdf

Request for Information (RFI) Number:7200AA23RFI00002

Request for Information (RFI) Number:7200AA23RFI00002 Date of Issue: April 12, 2023 Issued by: USAID/M/Office of Acquisition and Assistance/RM/AEM Closing Date and Time for Comments/Questions: April 19, 2023, 3:00 PM EST Closing Date and Time for Submissions: April 26, 2023, 3:00 PM EST Activity Title: Cybersecurity Protection and Response (CPR) program

Subject: Information Sought on Draft Statement of Work and Contractor Capability

Notice to: Small Businesses, GSA Contract Holders MAS# 54151HACS, Highly Adaptive Cybersecurity Services (HACS) and Other Interested Parties.

Pursuant to FAR 52.215-3 “Request for Information,” the United States Government represented by the United States Agency for International Development (USAID), is seeking for feedback, comments and questions on the draft statement of work (SOW). Through this RFI, the USG is also seeking to identify potential contractor's capability to fulfill the requirements under the Cybersecurity Protection and Response (CPR) program. Specifically, the Government is seeking feedback from interested parties on the following:

1) Comments, suggestions, and enhancements on the draft scope of the activity as laid out in the DRAFT Statement of Work (SOW) (see Attachment 1).

2) Recommendations on the approval process and performance standards for the rapid response task.

3) Responders may add comments or suggestions to the draft SOW and provide the edited document as an attachment (does not count towards page limit).

4) Additional business documents or information that may be needed to clarify or support the execution of the SOW.

5) Brief statement of interest and capability statements of respondent’s team (not to exceed three (3) pages excluding attachments). Please do not include company brochures.

6) Provide up to three (3) contracts and major subcontracts (reference projects) completed within the last ten (10) years that are similar in size, scope and complexity to the statement of work in the Request for Information.

Responders should include the following information:

● Company Name

● Company address

● Company Point of Contact (phone and email address)

● Company Business Size (i.e. Small Business or Large Business)

This RFI is issued solely for information and planning purposes, and so it does not constitute a

Request for Proposal (RFP), a Request for Quotation (RFQ), an Invitation for Bids (IFB), or a Solicitation. Responses to this RFI are not proposals and will in no way be deemed to form any binding agreement with the RFI issuing authority. Not responding to this request does not preclude participation in future order requests, if such is issued under the GSA Schedule HACS.

Responses to this RFI will not be returned, and respondents will not be notified of the result of the review. There will be no debrief or evaluation letter to responders. It is the potential contractor’s responsibility to monitor the site for the release of any further information. It should be noted that responding to this RFI will not give any advantage to any organization in any subsequent procurement.

This RFI does not restrict the Government’s approach on a future Solicitation. Information from this RFI may lead to one-on-one market research discussions and other recommended approaches to industry engagement.

Interested parties wishing to respond to this request must submit their response via email, in Microsoft Word or Adobe Acrobat formats are acceptable. Please email responses to: Artaveya Carter at acarter@usaid.gov and Joseph Tembo at jtembo@usaid.gov no later than the closing date as referenced above. Please reference the subject title “Contractor’s Name, Response to RFI No. 7200AA23RFI00002.”

Thank you for your interest in partnering with USAID to deliver development technical assistance.

Sincerely, Artaveya Carter Supervisory Contracting Officer

M/OAA/RM/AEM

Attachment 1: Draft Statement of Work – Cyber Protection and Response (CPR)

/s/ mailto:jtembo@usaid.gov

ATTACHMENT I

Draft Statement of Work – Cybersecurity Protection and Response (CPR)

1. PURPOSE

The purpose of the CPR activity is to strengthen the cybersecurity capabilities of host governments and critical infrastructure operators in the E&E region to protect against and respond to cyberattacks on key civilian infrastructure.

2. BACKGROUND

In 2022, the Europe and Eurasia region experienced a significant increase in the number and severity of cyberattacks targeting critical infrastructure and host government networks. Despite increased awareness and prioritization of cybersecurity across the region, E&E countries remain inadequately prepared to protect and respond to cyber incidents. The region’s cybersecurity vulnerabilities pose a threat to host government operations and key public services (e.g., telecommunications, energy, finance, etc.), as well as to their partners and allies, including the United States.

USAID’s Bureau for Europe and Eurasia (E&E) has been an Agency leader in critical infrastructure cybersecurity. Support began with host government capacity building for energy regulators and energy sector utilities in 2016 in response to the growing number of cyberattacks throughout the region. Initial work supported electric utilities and energy regulators to address immediate vulnerabilities and develop standards / regulations for improved cybersecurity. In 2021, USAID expanded its footprint in cybersecurity via the Critical Infrastructure Digitalization and Resilience (CIDR) activity, supporting host governments and operators of critical infrastructure beyond energy – including sectors such as telecommunications, finance, health, water, etc. – to improve cybersecurity governance, operator preparedness, information sharing, and workforce development.

The Cybersecurity Protection and Response (CPR) activity is in direct response to the spike in cyberattacks that have proliferated in the E&E region, which necessitates sustained assistance to bolster cyber protection and response capabilities of key civilian government agencies and critical infrastructure operators, as well as provide a mechanism to selectively provide rapid response/recovery support in the event of especially deleterious attacks to key systems. In this respect, CPR will leverage the progress made by previous USAID cybersecurity programs with a greater emphasis on connecting with the private sector and catalyzing private sector potential to address needs that far outstrip the resource envelope of the donor community.

3. OBJECTIVES

The CPR activity’s key objectives are listed below:

1. To strengthen capabilities of host government agencies and critical infrastructure operators to identify, protect, detect, respond to, and recover from cyberattacks.

2. To equip host government agencies and critical infrastructure operators with the capabilities to procure, integrate and maintain hardware and software solutions that improve cyber defense of critical assets and systems.

3. To improve information sharing of threats and incidents, through established networks and formal/informal procedures, between national and industry counterparts throughout the region, Europe, and the United States.

4. To bolster the capabilities of cybersecurity personnel in Europe and Eurasia, both in host governments and critical infrastructure operators, to perform effective response and recovery from cybersecurity incidents, including the implementation of protection measures as part of ex-post remediation measures.

5. To establish mechanisms and policies to attract, train, and retain cybersecurity personnel within host government civilian agencies and critical infrastructure operators.

4. SCOPE OF WORK

The CPR activity includes multiple components that cover both immediate, rapid response support and mid- to longer-term assistance to help partner E&E countries develop the institutions, governance frameworks, and workforce to bolster the cyber-defense of critical infrastructure across the region.

The CPR will focus on the following tasks:

4.1. Task #1 - Deployment of Rapid Response and Recovery Teams At the sole direction of the USAID COR, the Contractor will respond to select cyber-attacks against host government civilian agencies and/or critical infrastructure operators, and provide immediate response, restoration and recovery support. The Contractor must provide response and recovery assistance to host government utilities and operators within the timeframe established by USAID.

The Contractor must:

● Perform diagnostics, including assessing the scope and nature of a cyber incident/event through effective detection processes, threat hunting, data/evidence preservation, and the broader deployment of tools that can analyze telemetry and detect suspicious activity.

● Assist beneficiaries with mitigating the effects of the attack/intrusion, prevent further damage to compromised networks, and support system restoration. Example actions include but are not limited to removing malicious code, restoring system access, scanning for additional vulnerabilities, etc.

● In coordination with entities that were subject to an attack, support the drafting and dissemination of information about the attack – e.g., incident reporting to CERTs (computer emergency response teams), ISACs (information sharing and action centers), etc. – either voluntarily or according to mandatory national information sharing and incident reporting requirements.

● Develop and support improved protection measures to defend against future attacks – e.g., bolstering system architecture, ensuring operators’ abilities to maintain critical operations, and improving internal incident response planning/execution by operators.

● After each incident for which a rapid response team has been deployed, the Contractor will develop a report documenting an analysis of the attack, response/remediation measures, and an assessment on core vulnerabilities that should be addressed by the affected entity. These reports will be incorporated into a registry maintained by the Contractor for all incident response activities undertaken as part of the contract.

The Contractor must mobilize and rapidly respond at short notice, and work outside normal working hours. The Contractor’s Key Personnel must have security clearances to have access to classified materials and send communication to USAID on USG’s classified systems and be able to have unescorted access to restricted spaces at USG facilities to brief USAID and USG personnel. The rapid response teams should have security clearances, unless local law or circumstance makes it preferable to enlist local or non-USG subcontractors to respond to an incident.

4.2. Task #2 - Strengthening Cybersecurity Capabilities of Host Government Agencies and Critical Infrastructure Operators

The contractor must:

● Develop/improve national cyber policies and regulatory frameworks. As directed by USAID, the Contractor supports appropriate host government Ministries and oversight bodies to draft, amend, and/or implement cybersecurity policies. Such support include:

o Performing regional, national, sectoral, and/or organizational threat/risk assessments that could be used by host governments or entities to prioritize critical assets for cyber protection and incorporated within national or sectoral strategies and registries defining critical infrastructure.

o Drafting host countries national strategies, policies, critical infrastructure protection policies/standards/minimum requirements.

o Developing structures, rules, and procedures – at the national level or within the operational processes of specific operators – for information sharing and threat analysis.

● Support various sectors and/or organizations with implementation of cybersecurity laws, regulations, and standards. As directed by USAID, the Contractor will support critical infrastructure operators, Computer Security Incident Response Teams (CSIRT), and other bodies in areas such as developing and/or implementing security controls based on minimum requirements established by local law or international cyber standards, etc.

To the maximum extent possible, the Contractor must include participation of critical infrastructure operators and other appropriate organizations (e.g., academia) in shaping cybersecurity-related laws, requirements and standards alongside to ensure they are tailored to the country’s legal framework and implementable by local actors.

4.3 Task #3 - Supporting Government Agencies and Critical Infrastructure Operators with Identification, Prioritization, and Procurement of Technology Solutions

The Contractor must support host government civilian agencies and critical infrastructure operators to ensure they have appropriate hardware and/ software solutions to detect and protect against cyberattacks. The Contractor shall support the entities to restructure internal policies and procedures to allow for procurement evaluations/decisions to incorporate security considerations in addition to cost and performance.

The contractor must:

● Review, draft, and propose amendments to national and organizational procurement rules and procedures to incorporate cybersecurity considerations in contract award (in addition to other factors such as cost, performance, etc.)

● Training procurement staff on application and evaluation of cybersecurity considerations such as supply chain risks, trusted vendors, etc.

● Identification and prioritization of entity-level hardware/software needs and solutions to inform an entity or national governments’ IT investment plans.

The Contractor may provide support, as directed by USAID, to procure cybersecurity-related hardware and software solutions. The contractor may:

● Advise host government agencies and/or critical infrastructure operators on individual procurements related to OT/IT procurement(s).

● Procure hardware and/or software upgrades for cybersecurity protection and/or response for select host government entities or bodies, with preference given to those procurements that can be scaled across the host government or to other critical infrastructure operators for application.

Procurement support will be directed by the USAID COR in response to needs assessments as conducted by the Contractor and validated by host government and critical infrastructure operator beneficiaries. All procurement requests must include an examination of corresponding needs, such as vendor training, maintenance requirements, and future licensing commitments that will be expected on behalf of beneficiaries. Specifically, USAID Authorization must be obtained prior to any IT purchases.

As the investment needs for hardware/software technology significantly exceed donors’ capability to support, the Contractor shall seek ways to leverage private sector partnerships in the provision of technical assistance and/or material support to USAID’s assistance partners.

4.4. Task # 4 - Establish and/or Improve Regional, National, and/or Sectoral Information Sharing Platforms

The Contractor must support host government civilian agencies and operators to improve information sharing (e.g., threat analysis, incident reporting, etc.) at the national, sub-national (sectoral or cross-sectoral), and/or regional basis.

The implementation of this task shall be implemented in conjunction with Task 4.5., which focuses on improving operator and government agency personnel’s detection and threat hunting capabilities.

The contractor must:

● Support the establishment and maintenance of multi-tiered, dynamic information-sharing and incident response teams, network(s) and platforms that provide timely and actionable threat information, assessments, warnings, and response actions to public-and private-sector security partners. The design for these platforms must incorporate relevant local requirements and/or international standards (e.g., ISO/IEC/NIST) for the protection and encryption of sensitive information. The Contractor must also evaluate the need for and deliver corresponding technical assistance – e.g., (1) staff personnel capabilities and training needs to manage/operate these platforms and (2) level of organizational maturity and the need for additional security controls.

● Support the incorporation of USAID assistance countries into broader coordination with established European and international bodies and threat sharing frameworks as opposed to creation of new organizations.

● Support the development and operationalization of security operations centers (SOC) or other platforms (e.g., ISACs) from design to implementation — e.g the development of an organizational staffing plan, training of staff, rules and procedures, procurement of equipment (e.g., security incident and event management systems or SIEMs, related threat intelligence hardware/software), etc.

● Develop and amend incident response plans and procedures within public and/or private organizations that own and operate critical infrastructure and information.

4.5. Task # 5 - Bolster the capabilities of host government and critical infrastructure cyber personnel in the E&E region to perform effective response and recovery from cybersecurity incidents

The Contractor must provide capacity-building support for personnel from host government civilian agencies and critical infrastructure operators. The Contractor shall consider options to scale capacity-building efforts across E&E countries, such as forming regional working groups by sector (e.g., energy companies, CSIRTs, etc.)

The contractor must:

● Conduct training for host government and critical infrastructure cyber personnel to improve situational awareness and detection capabilities within key agencies and critical infrastructure operators to understand threat intelligence, protect critical information and operational systems, and improve their tools for incident response/recovery.

● Organize and conduct national and/or regional table-top exercises to simulate incident response and analyze sector, cross-sector, and regional dependencies and interdependencies, focusing on incident response and resilience.

4.6 Task #6 - Establish mechanisms and policies to attract, train, and retain cybersecurity personnel across agencies and critical infrastructure operators

The Contractor shall address the Europe and Eurasia region’s critical workforce shortage and capability gaps, addressing both workforce supply and demand limitations.

The Contractor must:

● Develop and execute national workforce development frameworks.

● Develop and/or improve host government national and/or sectoral cybersecurity certification and training programs.

● Support the public sector with strategies to improve cybersecurity staff recruitment and/or to create mechanisms to contract select cybersecurity services from the private sector. This shall be implemented in conjunction with Task 4.2. to the extent that legislative changes are required.

● Support host country public and private universities to develop/improve training courses and curriculum, related to cybersecurity.

● Train personnel from government agencies, oversight bodies (e.g., sector regulators), critical infrastructure operators and other appropriate organizations on audit/certify compliance to international critical infrastructure protection standards.

● Develop talent recruitment strategies for host governments to include staffing needs assessments, job descriptions, etc. for select critical infrastructure operators or select sectors as a whole.

5. Programming Consideration

5.1 Environment Consideration

The implementation of CPR must adhere to the requirements of 2 CFR 216. Screening for environmental compliance ensures that the activity does not have any adverse impact on ecosystems, environmental resources, human health and welfare. The USAID Initial Environmental Examination (IEE) will guide the implementation of tasks under the CPR activity.

5.2 Gender Equality

The USAID gender equality policy mandates that all USG investments contribute to the following three outcomes:

● a) Reducing gender disparities in access to, control over and benefit from resources, wealth, opportunities, and services—economic, social, political, and cultural.

● b) Reducing gender-based violence and mitigating its harmful effects on individuals and communities.

● c) Increasing the capability of women and girls to realize their rights, determine their life outcomes, and influence decision-making in households, communities, and societies.

Effective infrastructure management takes account of the different knowledge, abilities, and approaches that men and women apply to the use and conservation of energy, transport, and water. Because gender issues vary greatly across communities and cultures, gender analysis is crucial for understanding resource access and control, decision making, and participation in civil society. The Contractor shall apply gender equality and track impact on various gender categories during implementation.

5.3 Inclusive Development

The Contractor shall ensure that USG funds create opportunities for all and everyone to contribute to and benefit from the development regardless of age, sex, ethnic origin, health status, family structure, sexual orientation, education, employment, income, housing, food security, safety, or any other dimensions of human diversity. To ensure the political, economic, and social rights of LGBTQI+, persons with disabilities (PWD), ethnic minorities, and other vulnerable persons are included in critical infrastructure cybersecurity. The Contractor shall intentionally establish an inclusive approach to implementation that addresses the unique needs of marginalized persons. Specifically, the contractor shall foster more diversity in the cybersecurity industry by attracting and retaining more LGBTI, PWD, and minorities through inclusive approaches focused on accessibility and opportunity.

5.4 Sustainability

The Contractor must ensure the involvement of the key stakeholders and local experts to promote sustainability and ensure investments pay off long after the CPR activity ends.

Specifically, the contractor shall encourage international experts to work with local counterparts in capacity building and, where appropriate, provide mentoring or other means of capacity building.

6. Geographic Coverage The CPR Activity will support USAID assistance countries in Europe and Eurasia (e.g., Albania, Armenia, Azerbaijan, Bosnia and Herzegovina, Georgia, Kosovo, Moldova, North Macedonia, Serbia, Ukraine), with the possibility of supporting and partnering with USAID non-presence countries in the region (e.g., Montenegro, Romania, etc.). USAID will direct and approve the Contractor’s engagement in additional countries in the E&E region not specifically listed.

7. Collaboration within the Agency and cross the Agency The Contractor shall close collaboration with USAID/Missions, their bilateral programs and other Bureau for Europe and Eurasia critical infrastructure programs that have critical infrastructure cybersecurity activities to implement the CPR activities.

[END OF RFI No. 7200AA23RFI00002]