RFI_TIES Final_47QFRA23K0002_09062023.pdf

Request for Information (RFI) for Threat Intelligence Enterprise Services (TIES)

Agency: Cybersecurity and Infrastructure Security Agency (CISA)

Market Research Agency: General Services Administration (GSA), Federal Acquisition Service (FAS), Region 8 (R8) on behalf of Cybersecurity and Infrastructure Security Agency (CISA)

Notice Type: Posted Date:

Request for Information (RFI) September 6, 2023

NAICS Code: 541512 Computer Systems Design Services

GSA Reference: Acquisition ID 47QFRA23K0002

I. GENERAL INFORMATION:

The General Services Administration (GSA), Federal Acquisition Service (FAS), Region 8 (R8) is issuing a Request for Information (RFI) on behalf of Cybersecurity and Infrastructure Security Agency (CISA).

II. RFI OBJECTIVE:

The purpose of this RFI is to assist the Federal Government in conducting market research focused on identifying interested parties that have the ability to meet the objectives in the attached draft requirement.

This information will be used for market research purposes only. The Government is not obligated to release a future solicitation based on this market research. Interested respondents shall refer to the details of the response to this RFI under Section IV: RFI RESPONSE. (PLEASE DO NOT SUBMIT A

CAPABILITY STATEMENT - IT WILL NOT BE REVIEWED NOR CONSIDERED)

III. BACKGROUND:

CISA leads the national effort to defend critical infrastructure against the threats of today, while working with partners across all levels of government and in the private sector to secure against the evolving risks of tomorrow.

CISA's mission includes protecting the Federal Government's networks and physical infrastructure, helping entities in the public and private sectors manage potential risk and enhancing public safety communications at all levels of government. Capacity Building (CB) serves as CISA’s enterprise cybersecurity services management arm for national stakeholders and the lead for federal enterprise cybersecurity governance. CB enables its customers to manage cybersecurity risk by building their capacity to implement effective cybersecurity policies, tools, and procedures. CB helps stakeholders better manage cybersecurity risk by defining expectations for stakeholder cybersecurity; leading implementation and enforcement of cybersecurity requirements; managing CISA’s cybersecurity services portfolio; building capacity; and enhancing collective defense and readiness.

Specifically, CB enhances stakeholder cybersecurity readiness, bolsters enterprise capabilities and protections, and increases the community’s capacity to adequately manage cyber risk by:

1. Defining critical requirements, needs, and performance expectations.

2. Overseeing and guiding the implementation of key cybersecurity initiatives and urgent actions, including federal cybersecurity policy, leading practices, cyber directives and operational guidance.

3. Managing CISA’s cybersecurity services portfolio; evolving shared services, capabilities and delivery models; and delivering tailored services and assistance based on customer needs.

CB’s Threat Intelligence Enterprise Services:

Members of the Federal Cyber Ecosystem face barriers through all stages of the Cyber Threat Intelligence (CTI) lifecycle. Fragmented information about critical cyber threats reduces analysts’ abilities to effectively generate, use, and share CTI to make timely and informed decisions to support their missions. Critical CTI is spread across disparate feeds and exists in inconsistent data formats, which limits the collaboration needed to develop an accurate, shared threat picture. Further, the cyber maturity levels of participants in the CTI ecosystem vary widely. Specifically, the Federal Cyber Ecosystem lacks:

• Efficient procurement of CTI and CTI tools and services;

• Effective tools, services, and capabilities for CTI collaboration and processing;

• Assessments to assess maturity or create a roadmap to build and grow CTI capabilities;

• Guidance to effectively use purchased CTI services and tools for network defense; and

• Awareness and centralization of CTI requirements.

To solve this, the CB Cybersecurity Shared Services Office (CSSO) is working to establish Threat Information Enterprise Services (TIES). TIES will offer customers a suite of complementary CTI Services, Standards, and Guidance to improve their CTI production, utilization, and sharing capabilities. TIES will also allow customers to easily determine their needs (via self-assessments), research offerings, and procure and effectively use CTI services and tools. The TIES objectives include:

• CTI Generation: Improve CTI generation capabilities (i.e., collection, processing, and analysis).

• CTI Use: Improve capabilities to use CTI for cybersecurity decisions and actions.

• CTI Sharing: Improve capabilities to collaborate with partners and the broader security ecosystem.

On November 16, 2022, CISA released an RFI requesting feedback and insight on the development and/or configuration of a CTI Exchange Platform. After reviewing industry responses to the Exchange Platform RFI, the Federal Government released a follow-on request on December 20, 2022, seeking feedback on the CTI Data and Information that would be made available for aggregation and integration into the platform. The Federal Government used feedback from both RFIs to guide the development of their approach and technical requirements.

As such, this new RFI is directly related to the previous market research efforts. This posting includes draft requirements documentation for industry to review and utilize in response to additional questions identified by the Federal Government (refer to Section IV: RFI RESPONSE).

As stated above, the Federal Government is continuing to conduct market research. The draft requirements documentation in this RFI is not final and should not be viewed as part of an official Request for Proposal (RFP).

IV. RFI RESPONSE:

The Federal Government will only review and consider responses from Industry Partners which intend to perform the work as a Prime Contractor. The RFI response shall be divided into three (3) separate Sections. Responses are required to include the following information:

“Section 1” of the response is for administrative information and shall, at a minimum, include the following:

Contractor Information:

● Contractor Name and Facility Address (list all relevant or significant office locations)

● Facility clearance level

● UEI number, CAGE code, and NAICS code

● Socio-economic status (i.e., HUBZone, Service-Disabled-Veteran-Owned, Woman-Owned, 8(a), Small Business, Large Business, etc.)

● Point of Contact Name, Phone and Email

● Website URL

● List of any GSA Vehicles, such as GWACs (i.e., Alliant 2, VETS 2, etc.) or GSA Multiple Award

Schedule that your company has access to and can support the TIES requirement. Please include a brief narrative why, in your determination, that vehicle(s) would meet the needs of this requirement.

“Section 2” of the response shall answer/address the below questions/requests as they relate to the technical requirement and attached documents:

Technical Questions:

1. Does your company currently have a unique CTI platform already established? If so, please describe.

a. If your company does not own and/or operate a platform with similar CTI capabilities, what would you recommend for the Government to consider as part of the approach to meeting the requirements (i.e., partnerships or teaming arrangements, etc.)?

2. Based on your understanding of the draft TIES Statement of Work (SOW) and Technical

Requirements Document (TRD), describe the degree to which your platform or affiliated platform through partnerships or teaming arrangements meets Government expectations for the TIES platform Minimum Viable Product.

3. What type of configuration and engineering level of effort should be expected to close the gap between your existing (i.e., partnerships or teaming arrangements) capabilities and the TIES platform Minimum Viable Product?

4. Given the Federal Civilian Executive Branch (FCEB) scope listed in the draft SOW, what would your recommended licensing structure be to support this enterprise requirement?

a. Please provide historical or commercially available pricing for this type of structure.

5. Based on your review of the draft SOW and TRD, please identify any recommendations or feedback that the Government should consider in terms of the requirements, operations, and execution of any future contract(s).

“Section 3” of the response shall answer/address the below questions/requests as they relate to the requirement and attached documents:

Commercial Market Questions:

1. Does a commercial or non-developmental solution already exist?

2. Is the requirement articulated clearly and unambiguously?

3. Is any information that you have provided to the Federal Government considered proprietary?

a. Please note that the Federal Government will not retain any proprietary information. Any proprietary information shall be provided to the Contracting Officer (CO) for safeguarding once market research is complete.

4. Please provide any information regarding usage rights and restrictions, if any, as they relate to

Intellectual Property Rights.

5. Are there any specific terms and conditions that should be addressed in any future contract (i.e., Warranties, Pricing, Licenses, etc.)?

Any information submitted that is not requested in Section 1, Section 2, and Section 3 as noted above, will not be reviewed, nor considered, by the Federal Government.

V. CONTRACTOR NOTIFICATION AND SUBMITTAL INSTRUCTIONS:

This RFI is for information and planning purposes only and is not to be construed as a commitment by the U.S.

Federal Government. No award will be made as a result of this RFI. All information is to be submitted at no cost or obligation to the Federal Government. Any information that the Contractor considers proprietary should be clearly marked as such. All submissions become Federal Government property and will not be returned, including any proprietary information.

The Federal Government may consider additional communications with submitting companies utilizing the contact information provided in Section 1: Contractor Information to further the Federal Government’s market research for the Threat Intelligence Enterprise Services

• All respondents are to use Times New Roman font, with a 12-point font, one-inch margins, and single spaced in all sections in Microsoft Word.

• Section 1: Contractor Information section shall be no longer than 1 page in length.

• Section 2: Technical Questions section shall be no longer than 4 pages in length.

• Section 3: Commercial Market Questions section shall be no longer than 2 pages in length.

• All information submitted shall be UNCLASSIFIED and marked as such, on each page.

• Any information that a Contractor considers “proprietary” shall be clearly marked as such, on each page.

• All submissions become Federal Government property and will not be returned (including any proprietary information).

• Submissions that exceed 10 pages may be dismissed (not including Cover Page and Table of Contents).

RFI responses shall be submitted no later than 03:00 pm MST on September 27, 2023, by e-mail to those included herein: Aaron Maddox at Aaron.Maddox@gsa.gov; Lauren Pfarr at Lauren.Pfarr@gsa.gov; and Sabrina Kestell at Sabrina.Kestell@gsa.gov.

Contractors who do not respond to this RFI are not excluded from any resulting solicitation(s).

mailto:Aaron.Maddox@gsa.gov mailto:Lauren.Pfarr@gsa.gov mailto:Sabrina.Kestell@gsa.gov