RFI - CIP Final.pdf

Request for Information (RFI) Cybersecurity Innovation Program

1. Introduction:

This Request for Information (RFI) is for planning purposes only and shall not be considered an Invitation for Bid, Request for Task Execution Plan, Request for Quotation or a Request for Proposal. Additionally, there is no obligation on the part of the Government to acquire any products or services described in this RFI. Your response to this RFI will be treated only as information for the Government to consider. You will not be entitled to payment for direct or indirect costs that you incur in responding to this RFI. This request does not constitute a solicitation for proposals or the authority to enter into negotiations to award a contract. No funds have been authorized, appropriated or received for this effort. Interested parties are responsible for adequately marking proprietary, restricted or competition sensitive information contained in their response. The Government does not intend to pay for the information submitted in response to this RFI.

The North American Industry Classification System (NAICS) for this requirement is 541512.

2. Submittal Information:

All responsible sources may submit a response in accordance with the below information.

There is a page limitation for this RFI of 20 pages. The Government will not review any other information or attachments included in excess of the 20-page limit. NO MARKETING MATERIALS ARE ALLOWED AS PART OF THIS RFI. Capability statements that do not address the specific requirements in the RFI may not be accepted or reviewed. Your response must include the following:

a. Interested Vendors shall at a minimum, provide the following information in the initial paragraph of the submission:

Name of Company

Address

Point of Contact

Phone Number

Email address

Company Business Size and Status

For VOSB and SDVOSBs, proof of verification in VetCert.

NAICS code(s)

Socioeconomic data

Data Universal Numbering System (DUNS) Number and SAM Unique Entity ID

Existing Contractual Vehicles (GWAC, FSS, MAC, SEWP etc.)

b. Provide a summary of your capability to meet the requirements as follows:

1. Please indicate whether you are qualified in all 5 GSA Highly Adaptive Cybersecurity Services (HACS) subcategories listed in Highly Adaptive Cybersecurity Services | GSA.

2. Please indicate whether you have achieved CMMI Level 3 certification or higher.

3. Provide a description of your experience in audit or audit support, subject to independence standards such as Independent Registered Public Accounting Firms.

4. Please indicate whether you are a member firms of American Institute of Certified

Public Accountants (AICPA).

5. Provide a description of your direct experience supporting cyber planning and program development at large scale Federal (i.e., Cabinet Level agency) and/or commercial industry organizations (i.e., Fortune 500 companies), as prime contractor.

6. Provide a description of your direct experience providing cybersecurity services to large scale commercial life sciences and healthcare organizations (e.g. hospital systems, medical device companies, insurance, or benefit providers), as prime contractor.

7. Provide a description of your direct experience supporting and implementing large scale (i.e., Federal Cabinet Level agency or Fortune 500 companies), enterprise level customer experience measurement mechanisms and programs, as a prime contractor.

8. Provide a description of your direct experience supporting and implementing large scale (i.e., Federal Cabinet Level agency or Fortune 500 companies) change management in support of technology or organizational modernization efforts, as a prime contractor.

9. Provide a description of your ability to provide dedicated physical lab and innovation spaces, such as IoT labs, innovation labs, and /or cyber fusion centers, where new concepts and capabilities may be explored and tested, and stakeholder workshops and engagement may occur.

10. Provide a description of your digital assets and products that can apply machine learning techniques and open-source monitoring capabilities to monitor, track, and analyze changes in emerging technologies and Federal policy that may impact the VA. Please indicate what tool(s) and how you charge or license customers.

11. Provide a description of your digital assets and products that support change management and measurement. Please indicate what tool(s) and how you charge or license customers.

12. Please summarize your existing partnerships with and / or memberships in leading cybersecurity and healthcare industry organizations (e.g. Cloud Security Alliance;

Health-ISAC; Advamed).

13. Please describe your ability to provide extensive reach back to trained cybersecurity professionals that have obtained leading industry certifications such as PMP, CISSP, CISA, CEH, CISM, OSCP, CompTIA Security+, Comp TIA A+, COMPTIA Advance Security Practitioner (CASP+), CompTIA Cyber Security Analyst (CySA+), CompTIA Network+. Please provide the number of professionals with these certifications within your organization.

14. Describe your experience and relationships with the following:

a. Strong existing alliances within the Silicon Valley, DC area, and other cybersecurity Innovation Hubs;

b. Partnerships with academic, political, and applied research institutions and think tanks;

c. Ability to apply matching learning techniques and open-source monitoring capabilities to monitor, track and analyze changes in emerging technologies and federal policies that may impact VA;

15. Has the draft PWS provided sufficient detail to describe the required technical support services?

___YES __NO (if No, answer question below)

If “NO”, please provide your technical and functional comments/recommendations on elements of the draft PWS that may contribute to a more accurate proposal submission and efficient, cost-effective effort.

c. Your company’s intent and ability to meet the set aside requirement in accordance with VAAR 852.219-73 VA Notice of Total Set-Aside for Verified Service-Disabled Veteran- Owned Small Businesses and 13 CFR §125.6, which states the contractor will not pay more than 50 percent of the amount paid by the Government to it to firms that are not SDVOSBs.

Responses are due no later than 3PM EST, February 9, 2024 via email to Leanne Kjesbu, Contract Specialist at Leanne.Kjesbu@va.gov and John Fields, Contracting Officer at John.Fields3@va.gov. Please note “Cybersecurity Innovation Program” in the subject line of your response. Mark your response as “Proprietary Information” if the information is considered business sensitive. The email file size shall not exceed 5 MB.