RFI_Acquisition ID 47QFRA24K0002 Advanced Engineering 01.18.2024.pdf

Request for Information (RFI) – Advanced Engineering Services (AES)

Agency: Cybersecurity and Infrastructure Security Agency (CISA)

Market Research Agency: General Services Administration (GSA), Federal Acquisition Service

(FAS), APEX1 on behalf of Cybersecurity and Infrastructure Security Agency (CISA)

Notice Type: Posted Date:

Request for Information January 18, 2024

NAICS: 541512 Computer Systems Design Services

GSA Reference: Acquisition 47QFRA24K0002

I. GENERAL INFORMATION:

The General Services Administration (GSA), Federal Acquisition Service (FAS), APEX1 is issuing a

Request for Information (RFI) on behalf of the Cybersecurity and Infrastructure Security Agency

(CISA).

II. OBJECTIVE:

The purpose of this RFI is to assist the Government in conducting market research focused on identifying industry partners that have the ability to meet the objectives described below. This information will be used for market research only. The Government is not obligated to release a future solicitation based on this market research. Interested respondents shall refer to the details of the response to this RFI under Section IV.

III. BACKGROUND:

Established in 2012, the Continuous Diagnostics and Mitigation (CDM) Program is a dynamic approach to fortifying the cybersecurity of Government networks and systems. The CDM

Program provides cybersecurity tools, integration services, and dashboards to participating agencies (Chief Financial Officers [CFO] Act agencies and non-CFO Act agencies) to support them in improving their respective security postures by delivering better visibility and awareness of their networks and defending against cyber adversaries. In supporting CISA’s mission, CDM works closely with agencies to deploy capabilities that help agencies protect their hardware and software assets, networks, and the data they contain.

The CDM solution architecture, shown below in Figure 1: CDM Logical Architecture, illustrates the solution implementation supported at CDM-participating agencies:

• Layer A is composed of tools and sensors that, together, provide the coverage of the

CDM capabilities. Current Layer A tools vary by agency, and include Azure Update

Manager, BigFix, Carbon Black, Cisco ISE, CrowdStrike, ForeScout, Intune, McAfee, Microsoft Active Directory, Microsoft SCCM, Pulse Secure, Qualys, Rapid7, SailPoint, ServiceNow, Splunk, Tanium, Tenable, Tripwire, ZingBox, and others.

• Layer B is the integration layer, which aggregates data from agency Layer A tools, performs data normalization, and then transforms and conforms records. Historically, Layer B is often tailored to individual agency environments and is an agency and

CDM shared responsibility. The CDM PMO is pursuing a new approach, expected to be operational around the end of FY24, that will unify all agencies on one solution for data integration in Layer B.

• Layer C is the Agency Dashboard, which ingests data from Layer B and presents it to agency users in operationally relevant ways to promote the reduction of cybersecurity risk. The Agency Dashboard is standardized for participating agencies.

• Layer D, also known as the Federal Dashboard, presents a unified view of the cybersecurity posture of the entire FCEB enterprise. The Federal Dashboard is standardized for use by CISA analysts.

Figure 1: CDM Logical Architecture (Current State)

The CDM program implemented its mission through a combination of contracts known as the DEFEND series (grouped by agencies to support Layers A and B) and CDM Dashboard Ecosystem (Layers C and

D). The future state will consolidate responsibility for the functions of Layers B, C, and D in the CDM logical architecture via the CDM Data Services (also known as Baseline Extraction and Transformation

Security Information Environment or BETSIE) effort. The Government is currently conducting market research on how to best deliver capabilities (Layer A) via the recently released Deployment Services RFI.

The intent of this requirement, Advanced Engineering Services, is to provide the CDM program with specialized enterprise experience in the testing, development, implementation, and operational use of cybersecurity capabilities. This support will act in the capacity of a strategic advisor to the program, providing direct senior thought leadership to assist with setting programmatic targets on maturing complex cyber security solutions across the FCEB.

The Government believes that this requirement may introduce an Organizational Conflict of Interest

(OCI) that restricts the awardee from participating in other CDM, and possibly other CISA Capacity

Building, efforts.

IV. PURPOSE:

The purpose of this requirement is to advance CDM capabilities and technologies through the incremental assessments of products and formulation and/or evaluation of operational processes via continuous research and analysis of the cybersecurity marketplace and existing implementations of toolsets at agencies, to identify potential solutions to meet Government requirements. A clear repeatable framework should be utilized to define how solution and technology decisions are approved.

This requirement assists with the broad development of prototypes that are tested and once approved, maintained in a capability catalog for deployment at agencies. This work is executed prior to the technology implementation and can serve, in some cases, as the input for deployments across the FCEB.

V. REQUIREMENT OBJECTIVES:

The following provides initial requirement objectives for advanced engineering services.

1. Provide Technology Implementation Roadmap: Continuously review the cyber threat landscape, the cybersecurity tool marketplace, and any changes or innovations based on the

Government or industry cybersecurity best practices. The intent of this effort is to maintain awareness of the features, benefits, and limitations of current investments and potential future investments. This effort would look to fully analyze existing in operation solutions and identify areas for improvement/standardization. Roadmaps may be tailored based on CDM customers’ specific maturity and need.

2. Conduct Analysis of Alternatives: The Government plans to understand potential solutions to meet capability needs when the decision space is broad and could involve a combination of using existing tools, building a new custom solution or purchasing a new tool. An example of the type of request that would fall under an Analysis of Alternatives (AOA) would be to determine how the program can best assist agencies in measuring the transition to a zero-trust architecture.

3. Develop Trade Studies: The Government plans to analyze various tool sets for potential deployments. To support the decision-making process of the Government, the contractor shall perform and document via a trade study. The intent of the trade study is to provide a bounded analysis where the scope is narrow, such as analyzing what tool can best accomplish a specific task. An example could be which COTS tool(s) can best meet the Government’s EDR requirements.

4. Design, Build, and Test Solutions: Design, build and testing solutions to ensure it meets requirements. This effort would include developing a comprehensive design for each solution targeted for implementation, building a prototype of the targeted solution, including the provisioning of all necessary software, hardware, in a testing environment. Once a solution is built and configured, Government testing would occur, intending to satisfy the CDM program’s need to conduct developmental testing of capabilities within the program’s baseline. Fully built solutions would be implemented at agencies via other contracts. Piloting could occur under the

Advanced Engineering Services effort.

5. Support Solution Deployment: Support provided to stakeholders (Government and other contractors) in the implementation and deployment of approved solutions. In this support role, this requirements as reach-back support to stakeholders as they work to deploy solutions at agencies.

VI. RFI RESPONSE:

The Federal Government will only consider responses from Industry Partners/Interested Parties which intend to perform the work as a Prime contractor. Responses should be tailored in the following format and include the following information: Note: The RFI response shall be split into three Sections.

Section 1 - CONTRACTOR INFORMATION: this information is for administrative.

Interested parties are requested to provide the following as a minimum:

• Contractor name and facility address (list all relevant or significant office locations)

• UEI number, CAGE code, and NAICS code

• Socio-economic status (i.e., HUBZone, Service-Disabled-Veteran-Owned, Woman-Owned, 8(a), Small Business, Large Business, etc.)

• Facility clearance level

• POC name, phone, and email

• Website URL

• List of any GSA Vehicles, such as GWACs (i.e., Alliant 2, VETS 2, etc.) or GSA Multiple

Award Schedule that your company has access to, and that can support Advanced

Engineering Services requirement.

Section 2- CORPORATE EXPERIENCE: this information shall address the questions below as they relate to interested parties corporate experience with the requirement. Please provide your response to the following:

1. Does your company have experience in providing enterprise level cybersecurity support consistent with the purpose and requirements objectives identified above? (Note commercial experience is acceptable)

• Describe relevant efforts, similar in size, scope, and complexity.

2. Please identify any existing Government contract vehicle(s) (GWAC, Federal Supply

Schedules, BPA, etc.) that your company currently holds which could support the Advanced

Engineering Services requirement. Please include a brief narrative why, in your determination, that vehicle would meet the needs of this possible requirement.

Section 3- QUESTIONS: this information asks questions as they relate to the requirement.

1. Executive Order 14028: Improving the Nation's Cybersecurity, and subsequent guidance from OMB and CISA, have made Zero Trust Architectures (ZTA) a priority for the FCEB.

Given the confusion on how to implement Zero Trust, what methodology should the

Government consider as an approach towards tailoring security solutions (e.g., roadmaps) to a set of diverse customers to achieve an outcome-based solutions that are aligned to the mandates?

2. The CDM program has been successful in covering traditional asset classes (e.g., endpoint and mobile devices) with management and threat detection capabilities (i.e., EDR, MTD).

What next domain of technologies should the Government consider to be advanced to iterate on these successes in context of ZTA? Please be specific based on objective-based outcomes and integrations.

3. The cyber security tool market is abundant, with different vendors and platforms offering some variety in functionality and integration, but in many scenarios offering a solution that is intended to partially address the cyber security risk surface. Given the tool diversity expected in the FCEB, what should the Government consider as a technical approach to strike a pragmatic balance in ensuring there performant and maintainable integrations across a diverse landscape of tools to meet cyber relevant outcomes (e.g., reduce time to detect adversaries, build resilient architectures, adopt universal MFA across cyber critical terrain, etc.)?

4. A key value proposition of the CDM program is to maintain a standard baseline of performance characteristics of any capability solution recommended for deployment. This can be a challenging proposition in cases where there are “black box” features (e.g., Artificial Intelligence, Machine Learning, Behavior Analytics, etc.) that are intended to find the unexpected (i.e., adversaries).

a. In context to requirement objectives 2, 3, and 4, what should the Government consider as a practical way to evaluate the efficacy of these type of features and address the practical limitations or constraints to scaling this approach.

b. In context to requirement objectives 2, 3, and 4, are there partnerships with other organizations or data sources that can be leveraged to create a preponderance of analysis to support recommendations to the Government?

5. In context to requirement objective 1, what prioritization frameworks or other methodologies can be leveraged to help the Government project capability areas for the next 12-24 months as guided by the CISA Cybersecurity Strategy plan1, goals 1.1, 2.2, and 2.3.

6. How should the Government consider different delivery models2 for capabilities, in context of conducting AoA, trade studies, and/or determining an appropriate customer base?

7. Operational visibility is a key enabler to CISA as the operational cybersecurity lead for the

FCEB.

a. What data sets should the Government consider as essential to operational visibility and how are they used? How should the government prioritize the inclusion of these data sets within the CDM ecosystem?

b. How does operational visibility benefit from or compete with ZTA initiatives?

8. What is a recommended acquisition approach the Government should consider to address this requirement?

9. Is there any other information deemed relevant by the contractor for the Government’s consideration for this requirement?

1 https://www.cisa.gov/sites/default/files/2023-08/FY2024-2026_Cybersecurity_Strategic_Plan.pdf 2 “Delivery Models” in the context of this RFI refer to different levels of responsibility of deployment, operations, and maintenance; between offering party (e.g., CDM program) and customer; Examples could include a variety of arrangements including, but not limited to, a fully managed capability to a CISA maintained, but agency operated capability, to a capability that is exclusively deployed, operated, and maintained by agency staff, .

V. CONTRACTOR NOTIFICATION AND SUBMITTAL INSTRUCTIONS:

This RFI is for information and planning purposes only and is not to be construed as a commitment by the U. S. Government. No award will be made as a result of this RFI. All information is to be submitted at no cost or obligation to the Government. Any information that the Contractor (Interested parties) considers proprietary should be clearly marked as such.

All submissions become Government property and will not be returned, including any proprietary information.

Submission instructions and information retention:

• All responses are to use Times New Roman font, with a 12-point font, one-inch margins, and single spaced in all sections in Microsoft Word.

• Section1: Contractor Information section shall be no longer than 1 page in length.

• Section 2: Contractor Experience section shall be no longer than 2 pages in length.

• Section 3: Response to questions should be no longer than 5 pages in length.

• All information submitted shall be UNCLASSIFIED and marked as such, on each page.

• Any information that the Contractor considers “proprietary” should be clearly marked as such, on each page.

• All submissions become Federal Government property and will not be returned (including any proprietary information).

• Submissions that exceed 10 pages may be dismissed (including Cover Page and Table of

Contents).

• The Government may consider additional communications with interested parties that respond to this request for information utilizing the contact information provided in the Corporate Overview to further the Government’s market research for the Advanced Engineering Services requirement.

RFI responses shall be submitted no later than 5:00pm ET on February 9, 2024, via email to

Diana Zoppi at diana.zoppi@gsa.gov

Contractors who do not respond to this RFI are not excluded from any resulting solicitation(s).

mailto:diana.zoppi@gsa.gov