RFI - Tech Committee - Industry Day -16 June- Final.pdf

Request for Information: CIG21R0002

CIGIE Technology Committee Industry Day Series – Digital Forensics for Investigations Investigations Subcommittee

Council of the Inspectors General on Integrity and Efficiency (CIGIE) CIGIE Technology Committee

AGENCY CONTRACTING OFFICER: RFI RELEASED: APRIL 20, 2021

REBECCA MILLS RFI CLOSED: MAY 16, 2021

REBECCA.MILLS@CIGIE.GOV VIRTUAL INDUSTRY DAY: JUNE 16, 2021

REQUEST FOR INFORMATION

CIGIE Technology Committee Industry Day Series – Digital Forensics for Investigations

Council of the Inspectors General on Integrity and Efficiency Page 2 of 8

1.0 Introduction

1.1 Background. The Council of the Inspectors General on Integrity and Efficiency (CIGIE) is an independent entity established within the executive branch to address integrity, economy and effectiveness issues that transcend individual Government agencies and aid in the establishment of a professional, well-trained, and highly skilled workforce in the Offices of Inspectors General (OIGs). The CIGIE Technology Committee is a standing committee supporting the overall CIGIE mission, with their own mission to facilitate effective information technology (IT) audits, evaluations, inspections, and investigations by Inspectors General (IGs), and to provide a vehicle for the expression of the OIG community's perspective on Governmentwide IT operations. The CIGIE Technology Committee is releasing a Request for Information (RFI) to elicit responses from vendors and other interested parties on specific information technology tools, software, and services they can provide to OIGs. Specifically, the purpose of this RFI is to assist the CIGIE Technology Committee in obtaining information on digital forensics analysis and fraud detection tools, software, and services, which could assist OIG investigators to perform their oversight missions more effectively and efficiently.

1.2 Purpose. The CIGIE Technology Committee plans to hold a series of industry days on various topics throughout the year. On June 16, 2021, we will be conducting an industry day, which will cover specific law enforcement and investigative tools, software, and services that vendors can provide to OIGs for their investigative oversight missions. The information we receive from this specific RFI will be used to select vendors for participation in our industry day event. Future technology industry days are planned for the topic areas of emerging technology and data analytics / visualization. Please do not respond to this specific RFI with tools covering the additional listed topic areas. We will dispose of and not consider any responses for industry day that are not related to the current topic. Continue to monitor the beta.sam.gov for additional RFI announcements.

THIS IS A REQUEST FOR INFORMATION (RFI) ONLY. This RFI is issued solely for information and planning purposes – it does not constitute a Request for Proposal (RFP) or a promise to issue an RFP in the future. This RFI does not commit the Government to contract for any supply or service whatsoever.

Further, the CIGIE Technology Committee is not at this time seeking proposals and will not accept unsolicited proposals. Respondents are advised that the U.S. Government will not pay for any information or administrative costs incurred in response to this RFI; all costs associated with responding to this RFI will be solely at the interested party’s expense. Not responding to this RFI does not preclude participation in any future RFP, if any is issued. It is the responsibility of the potential offerors to monitor beta.sams.gov for additional information pertaining to this requirement.

2.0 Overview

CIGIE is an independent federal entity established within the executive branch under the authority of the Inspector General Act of 1978, as amended. CIGIE membership includes 75 statutorily created OIGs with the mission to address the integrity, economy, and effectiveness challenges that transcend individual government agencies. The CIGIE Technology Committee, one of the seven standing committees supporting the overall CIGIE mission, promotes effective teamwork in addressing Governmentwide initiatives, improving OIG IT activities, and safeguarding national IT assets and infrastructure.

Specifically, the CIGIE Technology Committee provides a forum for the OIGs to share information, Council of the Inspectors General on Integrity and Efficiency Page 3 of 8 including IT best practices and technology capabilities. The CIGIE Technology Committee also coordinates IT-related activities of CIGIE members, advises CIGIE and its members on IT issues, and conducts relevant IT educational and training activities.

OIG special agents regularly perform criminal, civil, and administrative investigations throughout the year. For example, the OIGs regularly investigate contract and procurement fraud, financial fraud, healthcare fraud, narcotics, official misconduct, public corruption, illegal transfer of sensitive technology, cybercrime and computer network intrusions, and issues related to product substitution or counterfeit parts.

3.0. Overview of Technologies and Solutions Sought

This RFI is intended to inform the CIGIE Technology Committee on the status of digital forensics analysis and fraud detection tools, software, and services to assist special agents in conducting criminal, civil, and administrative investigations of their organizations.

Responses to this RFI will be reviewed to assist the CIGIE Technology Committee in identifying best in class solutions, which will in turn allow the OIGs to meet their statutory requirements and effectively meet their oversight missions.

At a minimum, responses to this RFI must include a description of the tools, software, and services available and how they can be used by OIG investigators to accomplish their law enforcement and investigative missions. The tools or tools used and provided by servicers must be consistent with the National Institute of Standards and Technology (NIST) security content automation protocol.

If possible, responses to this RFI should also provide examples of how the tools, software, and services were previously used or are being utilized to support a government agency’s criminal, civil, and investigative mission.

3.1 Capabilities: Information Technology Oversight Support Tools

In this RFI, the CIGIE Technology Committee is interested in learning about digital forensics analysis and fraud detection tools, software, and services that could support special agents’ criminal, civil, and administrative investigative responsibilities:

• Primary Digital Forensic Analysis Suite of Tools - Software products that extract data from digital devices including but not limited to computers, laptops, or mobile devices, and can then analyze the extracted data to develop evidence.

• Cloud Data Collection and Analysis - Tools, software products, and services that provide capabilities and would allow forensic examiners including but not limited to the ability to reconstruct past cloud computing events through incident response, collection, analysis, and reporting of the multitude of cloud service providers.

• Digital Forensic Case File Management - Tools, software products and services that provide capabilities to store and track digital forensic examiners activities including but not limited to tracking evidence, activities, evidence, documents, notes, and tasks.

Council of the Inspectors General on Integrity and Efficiency Page 4 of 8

• Presentation of Electronically Collected Data for Non-Technical Users - Tools, software, and services that provide the capabilities to ingest, process, and deliver electronic records into a visual format or presentation mechanism for an investigator, auditor, analyst, or attorney who is not trained as a digital forensic examiner.

• Open-Source Data Collection, Analysis, Reporting, and Visualization - Tools, software, and services that provide the capabilities to ingest, process, and deliver open source gathered intelligence including but not limited to graphical link analysis, query between sources collected, provides data mining capabilities and visualization.

• Cutting Edge / Industry Specific – “Cutting edge” or industry digital forensics analysis and fraud detection oversight tools, software, or services used by OIG administrative and criminal investigators to perform their respective oversight missions.

4.0. Responses

The CIGIE Technology Committee will compile all the responses into a single PDF document that will become a reference directory for CIGIE and CIGIE member research. This material will be strictly for internal use by CIGIE and its member organizations only and will not be published on a public facing website. The document will be used for market research purposes.

By submitting an RFI response, you are consenting to be included in the reference directory.

All respondents who provide an RFI to the required specifications are not guaranteed a presentation slot at the referenced CIGIE Technology Committee Industry Day.

All respondents who provide an RFI to the required specifications are guaranteed to be included in the vendor reference directory that will be provided to the various CIGIE member organizations.

4.1 Submission Contents. Failure to follow the format below may remove your company for consideration of presentations and inclusion in the reference directory. The response must include the following components:

4.1.1 Top Sheet. Respondents are required to fill out the “Top Sheet” that has been included as Attachment A. This document will be attached to the front of the White Paper. The Top Sheet does not count towards the page requirement count. It will be included in the reference guide previously mentioned.

4.1.2 White Paper. The White Paper has a limitation of five (5) pages. It will be made up of two sections.

Section 1 shall provide administrative information and will not count towards the paper limitation of five

(5) pages. Information that will be included in this order are:

4.1.2.1. Name, mailing address, overnight delivery address (if different from mailing address), phone number, and e-mail of designated point of contact.

4.1.2.2. Business type. If small business, please select the title that reflects your category. If none is designated, it will be considered ‘small business – not specified’. (Responses may include: Large Business, Small Businesses [8(a), HUBZone, Woman-Owned, Service-Disabled Veteran-Owned]).

Council of the Inspectors General on Integrity and Efficiency Page 5 of 8

4.1.2.3. CAGE Code and DUNS Code; NAICS Codes

4.1.2.4. If applicable, the current governmentwide contracts, their sponsoring agency, and the period of performance for that contract.

4.1.2.5. List the capability titles that apply to the paper that were identified in Section 3.1. (For example – “Capabilities: Endpoint Security, Wireless assessment, Cutting Edge”)

Section 2 shall provide the technical response to the posted RFI. Responses must clearly identify the technology capability the tool supports that were identified in the Section 3.1.

Proprietary information, if any, should be minimized and MUST BE CLEARLY MARKED. To aid the Government, please segregate proprietary information.

4.2 Submitting. Interested parties are requested to respond to this RFI with their completed response to the contracting officer, Ms. Rebecca Mills, by mail to Rebecca.Mills@cigie.gov. The email MUST have the subject “CIGIE Technology Committee Industry Day Series – Digital Forensics for Investigations.”

Failure to comply with this naming convention will remove your company’s response from consideration.

White papers in Microsoft Word for Office 2013 or higher compatible format are due no later than 5:00 PM EST on Sunday, May 16, 2021 via email. Responses shall be limited to five (5) pages with font no smaller than 10-point. Graphics and charts are not required - if they are provided in the respondent’s submission, they will be counted towards the page limit. Please be advised that all submissions become Government property and will not be returned.

4.3 Industry Day. Respondents may be contacted based on their submission to be invited to present at the Committee’s Industry Day that will be held for approximately two (2) hours on June 16, 2021. The event will be held virtually utilizing a virtual audio and video conferencing platform (e.g., Zoom for Government). All responses submitted to the RFI are not guaranteed a presentation spot. The number of presentations will be limited due to schedule limitations and will be selected by the government based on submission time and RFI response. Vendors who are selected will be notified by June 2, 2021 by the Contracting Officer, Rebecca Mills.

Selected respondents will present the capabilities of their tools, software, or services (and may also be asked to perform a brief demonstration of a specific tool, software, or service). Presentations will be limited to PowerPoints and additional details will be made available in the future. Presentations will be due by 1 PM EST finalized by June 9, 2021. If a vendor does not meet the deadlines, they will forfeit their place and may be removed from the event lineup.

The PowerPoints that are selected for the presentation will be made available in PDF format in addition to the Vendor Reference Directory. The PDF will be made available in the same format and method as the Vendor Reference Directory.

If a member of the Industry is interested in securing an audience link to the event, please contact the CIGIE Contracting Officer, Rebecca Mills by 1 PM EST on June 11, 2021.

mailto:Rebecca.Mills@cigie.gov

Council of the Inspectors General on Integrity and Efficiency Page 6 of 8

4.3.1 Vendor Reference Directory. The CIGIE Technology Committee understands that the industry at large would like the government to review their submission. We appreciate the effort that companies are taking by responding to the RFI. There is an anticipation of a high-volume of responses. The number of presentation slots are limited due to time. To maximize the visibility of the White Paper, the Committee will create a single Reference Directory of ALL responses that meet the RFI requirements. This Directory will be a government market research reference tool that will be made available to all 75 of the OIGs.

5.0 Terms and Conditions, Disclaimers, and Important Notices

FAR 52.215-3 Request for Information or Solicitation for Planning Purposes (Oct 1997)

a) The Government does not intend to award a contract based on this solicitation or to otherwise pay for the information solicited except as an allowable cost under other contracts as provided in subsection 31.205-18, Bid and proposal costs, of the Federal Acquisition Regulation.

b) Although "proposal" and "offeror" are used in this Request for Information, your response will be treated as information only.

It shall not be used as a proposal.

c) This solicitation is issued for the purpose of gathering information on new cyber security and FISMA audit, inspection, and evaluation tools, software, and services to be used by auditors.

By submitting an RFI response, you are consenting to be included in the Reference Directory. This directory will be made available to all CIGIE member organizations. The directory will NOT be published on a public facing website.

All respondents who provide an RFI to the required specifications are guaranteed to be included in the vendor reference directory that will be provided to the various Office of the Inspectors General.

CIGIE Technology Committee representatives may or may not choose to meet with potential respondents. Such discussions would only be intended to get further clarification of potential capability to meet the requirements, especially any development and certification risks.

Council of the Inspectors General on Integrity and Efficiency Page 7 of 8

CIGIE Technology Committee representatives may or may not contact respondents for Industry Day presentation slots.

All respondents who provide an RFI to the required specifications are NOT guaranteed a presentation slot at the referenced CIGIE Technology Committee Industry Day.

Administration by Federal and Non-Federal Personnel:

Federal employees are subject to the non-disclosure requirements of a criminal statute, the Trade Secrets Act, 18 U.S.C. § 1905. The Federal Government may seek the advice of qualified non-Federal personnel.

The Federal Government also may use non-Federal personnel to conduct routine, nondiscretionary administrative activities. The respondents, by submitting their response, consent to CIGIE Technology Committee providing their response to non-Federal parties. Non-Federal parties given access to responses will be subject to an appropriate obligation of confidentiality prior to being given the access.

Proprietary, Confidential, or otherwise Sensitive Information:

Because information received in response to this RFI may be used to structure future programs and funding opportunity announcements or otherwise be made available to the public, respondents are strongly advised to NOT include any information in their responses that might be considered business sensitive, proprietary, or otherwise confidential. The Federal Government does not guarantee confidentiality of the information received. Although CIGIE Technology Committee asks that no confidential business information be submitted, it is CIGIE Technology Committee practice to protect the provided information and make it available on a need-to-know basis only to CIGIE and CIGIE member organization personnel and contractors who will be using this information on behalf of such entities.

However, CIGIE Technology Committee will have no liability whatsoever for disclosure of such information that is provided.

If a respondent chooses to submit business sensitive, proprietary, or otherwise confidential information, it must be clearly and conspicuously marked. Responses containing confidential, proprietary, or privileged information must be conspicuously marked as described below. Failure to comply with these marking requirements may result in the disclosure of the unmarked information under the Freedom of Information Act or otherwise. The Federal Government is not liable for the disclosure or use of unmarked information and may use or disclose such information for any purpose.

If your response contains confidential, proprietary, or privileged information, you must include a cover sheet with your response marked as follows identifying the specific pages containing the confidential, proprietary, or privileged information:

Notice of Restriction on Disclosure and Use of Data:

Pages [list applicable pages by number] of this response may contain confidential, proprietary, or privileged information that is exempt from public disclosure. Such information may be used or disclosed only for the purposes described in this RFI [list the RFI response name]. The Federal Government may use or disclose any information that is not appropriately marked or otherwise restricted, regardless of source.

Council of the Inspectors General on Integrity and Efficiency Page 8 of 8

In addition, (1) the header and footer of every page that contains confidential, proprietary, or privileged information must be marked as follows: “Contains Confidential, Proprietary or Privileged Information Exempt from Public Disclosure” and (2) every line and paragraph containing proprietary, privileged or trade secret information must be clearly marked with double brackets or highlighting.

6.0 Questions

Questions regarding this announcement shall be submitted in writing by e-mail to the agency’s Contracting Officer, Rebecca Mills at rebecca.mills@cigie.gov. We will only answer questions that have the subject of the email as “CIGIE Technology Committee Industry Day Series – Digital Forensics for Investigations.” Verbal questions will NOT be accepted. Questions shall NOT contain proprietary or classified information. Any questions submitted to anyone else other than the listed person will NOT be accepted. The Government does not guarantee that questions received after May 7, 2021 will be answered. Question answers will be sent to those who request them in one communication after the quote close.

7.0 Summary

THIS IS A REQUEST FOR INFORMATION (RFI) ONLY to identify sources that can provide information technology tools, software, and services to the CIGIE and its member organizations. The information provided in the RFI is subject to change and is not binding on the Government. CIGIE has not made a commitment to procure any of the items discussed, and release of this RFI should not be construed as such a commitment or as authorization to incur cost for which reimbursement would be required or sought. All submissions become Government property and will not be returned.

The CIGIE Technology Committee will be holding a quarterly series of sub-committee themed Industry Days that will correspond with published RFIs. All properly formatted RFI submissions will be guaranteed inclusion in the government directory for reference. Presentations for the Industry Day will be selected from the respondents. All RFI submissions are NOT guaranteed to present at the Industry Day due to capacity limitations. Vendors will be notified for presentations by June 2, 2021 by the Contracting Officer.

Industry Day will be held virtually on June 16, 2021. If a member of industry is interested in participating as an audience member, they must contact the Contracting Officer by June 11, 2021 for registration information.

Attachment 1: Vendor Top Sheet mailto:rebecca.mills@cigie.gov