RFI 24-IS-CM-MONITORING - Final.docx

Defense Counterintelligence and Security Agency

Request for Information #24-IS-CM-MONITORING

Requirement Title: DCSA Continuous Monitoring Cleared Company Monitoring Software

NOTICE: This is a Request for Information (RFI) issued by the Defense Counterintelligence and Security Agency (DCSA). This RFI is issued solely for informational and planning purposes – it does not constitute a Request for Proposal (RFP), Request for Quote (RFQ), or a promise to issue a solicitation in the future. Responses to this notice are not offers and cannot be accepted by the Government to form a binding contract.

This RFI does not commit the Government to contract for any supply or service whatsoever. Further, DCSA is not at this time seeking proposals/quotes and will not accept unsolicited proposals/quotes. Contractors are advised that the U.S. Government will not pay any costs associated with the preparation of responses to this RFI; all costs associated with responding to this RFI will be solely at the Contractor’s expense. Not responding to this RFI does not preclude participation in a future solicitation, if any is issued. If a solicitation is released, it will be via the governmentwide point of entry (GPE) at https://sam.gov or on the General Services Administration’s (GSA) eBuy website at https://www.ebuy.gsa.gov/. It is industry’s responsibility to monitor these websites for any information that may pertain to this RFI.

Contractors responding to this RFI should not anticipate feedback regarding their submission other than acknowledgment of receipt.

The information and insights obtained from responses to this RFI may be used in developing or refining procurement package documentation and any eventual solicitation action(s). All submissions become the property of the Federal Government and will not be returned. All submissions shall be unclassified and any proprietary information shall be clearly marked.

For the purposes of market research insight, this RFI was released in multiple locations, and the intention is that Contractors provide only one response. The RFI was placed in the following locations:

1. GSA eBuy Federal Supply Schedule IT – IT Software MAS 511210

2. GSA eBuy Federal Supply Schedule IT – Electronic Commerce MAS 54151ECOM

3. GSA eBuy Federal Supply Schedule IT – IT Solutions MAS 518210C

4. NASA SEWP – NAICS 541519

5. GPE

DCSA Mission: DCSA is the national security agency in the Federal Government dedicated to protecting America’s trusted workforce and trusted workspaces—real or virtual. DCSA combines two essential missions: Personnel Security and Industrial Security, which are supported by Threat/Counterintelligence and Training/Education/Certification functions.

Personnel Security includes distinct support through mission areas of Background Investigations, Adjudications, and Vetting Risk Operations.

Industrial Security (IS) conducts risk management activities with respect to the U.S. Government’s defense industrial base, including critical technologies and the defense supply chain. This is accomplished through oversight of the National Industrial Security Program (NISP), issuance of facility security clearances, foreign ownership, control, and influence mitigation measures, information system cyber security oversight, and other activities related to protecting classified and controlled unclassified national security information and related technology.

RFI Background: DCSA’s IS Continuous Monitoring (CM) Program is responsible for monitoring cleared companies under the NISP. CM Program Branch personnel utilize data collected from multiple commercial and Government sources to actively monitor for unreported risk events that may affect a facility’s security clearance level (FCL) or pose a potential risk to national security. CM Program Branch personnel apply analytic rigor to the identification, validation, and prioritization of identified risk events, resulting in alert referrals to IS Field Elements to facilitate early detection of a facility’s security risk in (near) real time.

Security/Other Requirements: System must be approved to the IL5 level in order to ingest CUI data.

Requirement Information: DCSA’s Contracting and Procurement Office seeks information on sources for risk monitoring software. DCSA’s CM Program Branch requires software for monitoring cleared companies under the NISP. The software would assist in actively monitoring for unreported risk events that may affect a facility’s security clearance level or pose a potential risk to national security. Currently, this mission is supported by cloud-based software. It is anticipated that 20 seats/user accounts/licenses are needed to meet mission requirements.

Required Features/Functions:

1. The source must have a capability to set up bulk alerting and monitoring without personnel having to manually run the searches each time.

2. The source must have the capability to monitor for risk events such as, changes in company ownership, legal structure, management, address, and Foreign Ownership, Control, or Influence (FOCI). The source must also have the capability to monitor for unreported mergers/acquisitions, company financial issues (bankruptcy, insolvency, unpaid debt), cyber breaches, criminal activity, sanctions, etc.

3. The source must be able to ingest DCSA’s list of approximately 15,000 facilities and their seed data, then return results on current issues and monitor that information for changes.

4. The source must be equipped to return monitoring results on a daily, weekly, or monthly basis.

5. The monitoring results must be returned to program personnel via Excel or .csv file.

6. The monitoring results must highlight keywords used to match article to relevant risk event, as well as provide a one or two sentence highlight (snippet) of the article or risk event.

7. The monitoring results must trace back to the originating source for the alert.

8. Monitoring results must have duplicates removed so that the same information is not reported multiple days, weeks, or months in a row. For example, information (alert) picked up from a major news outlet is not repeated the following week when the same information is released by smaller outlets.

9. The software must allow program personnel to update the list of monitored facilities on a daily or weekly basis as they are added/removed from the NISP.

Desired Features/Functions:

1. API Connection. As the program builds out a bridge solution for the alerts, the ability to connect to the software via an application programming interface (API) to assist with ingesting and assigning alerts is desired.

2. Keyword and Category Modification. The ability to add, modify, and remove key words and categories as needed is desired.

3. Comprehensive Analysis Report. The ability to have pull-out analysis and reports of specific alerts relevant to the mission is desired. This may be performed by a company data scientist, analyst, or other means.

Proposed NAICS Code: Based upon initial market research performed via SAM.gov and eBuy.gov searches, the Government identified three potential North American Industry Classification System (NAICS) codes for this requirement. Data collected on Attachment 1, RFI Response Form, will provide insight into the most appropriate NAICS code and posting location for any resultant solicitation.

Small Business Size Standard

SAM.gov/FPDS.gov

$47M

eBuy Federal Supply Schedule 54151ECOM

NASA SEWP V 541519

$34M

$40M

SUBMISSION REQUIREMENTS

RESPONSES are due via email to Cynthia.L.Hocott.civ@mail.mil by 11:00PM EST on Wednesday, May 22, 2024. Contractors shall utilize Attachment 1, RFI Response Form, for their electronic submissions in either Microsoft Word or Adobe pdf format. Responses to the RFI should contain the email subject line, “RFI Response to #24-IS-CM-MONITORING”. Responses to the RFI are not offers for contract, will not be used by the Government to form a binding contract, and will not be returned.

Questions about this RFI shall be submitted in writing, via email, to Ms. Cindy Hocott at Cynthia.L.Hocott.civ@mail.mil no later than 12:00PM EST Tuesday, 21 May 2024. DCSA reserves the right to respond, or not respond, to any questions at its discretion. Questions must not contain classified or proprietary information.

Contractors must be registered in the SAM database to be considered for Federal Government awards. Registration is free and can be completed online at http://www.SAM.gov. If your company is not already registered, it is suggested that the company be registered as soon as possible to maximize future award opportunities. If your company is registered, it is suggested that the registration be checked to confirm it is still considered active in the SAM database.

RFI respondents are asked to provide the following information in their response:

1. RFI Response Form: All Contractors responding to this RFI shall provide a completed Attachment 1, RFI Response Form.

2. Pricing: Respondents are asked to review the RFI and provide a rough order of magnitude estimate outlining fully burdened prices for the requirements/specifications outlined above and any other relevant pricing that may apply. This information must be provided via Attachment 1 as specified above.

3. Feedback/Suggestions: Contractors are encouraged to provide feedback and propose suggestions regarding this requirement. This information may be provided via Attachment 1 as specified above.

DISCLAIMER: THIS RFI IS NOT AN RFP OR RFQ AND NOT TO BE CONSTRUED AS A COMMITMENT BY THE GOVERNMENT TO ISSUE A SOLICITATION OR ULTIMATELY AWARD A CONTRACT. RESPONSES WILL NOT BE CONSIDERED AS PROPOSALS/QUOTES NOR WILL ANY AWARD BE MADE AS A RESULT OF THIS RFI.

This notice does not obligate the Government to award a contract or otherwise pay for the information provided in the responses. The Government reserves the right to use information provided by respondents for any purpose deemed necessary and legally appropriate. Any organization responding to this notice should ensure that its response is complete and sufficiently detailed. Information provided will be used to assess tradeoffs and alternatives available for the potential requirement and may lead to the development of a solicitation. Respondents are advised that the Government is under no obligation to acknowledge receipt of the information received or provide feedback to respondents with respect to any information submitted.

Any solicitation resulting from the analysis of information obtained will be announced as required under the FAR section used for this procurement; however, responses to this notice will not be considered adequate responses to a solicitation.

All information contained in the RFI is preliminary as well as subject to modification and is in no way binding on the Government. FAR clause 52.215-3, Request for Information or Solicitation for Planning Purposes, is incorporated by reference in this RFI. The Government does not intend to pay for information received in response to this RFI. Respondents to this invitation are solely responsible for all expenses associated with responding to this RFI. This RFI will be the basis for collecting information on services/supplies available. This RFI is issued solely for information and planning purposes and does not constitute a solicitation. Responses to the RFI will not be returned nor will receipt be confirmed. In accordance with FAR 15.201(d), responses to this RFI are not offers and cannot be accepted by the Government to form a binding contract.

No proprietary, classified, confidential or sensitive information should be included in your response. The Government reserves the right to use any non-proprietary technical information in any resultant solicitation(s).