RF013024 SAM RFI- Phishing Resistant Authenticator 013024.pdf

REQUEST FOR INFORMATION (RFI)

RFI013024

Phishing Resistant Authenticator Products Market Research

ISSUED BY:

GENERAL SERVICES ADMINISTRATION (GSA)

Office of Internal Acquisition (OIA)

For the

Office of Government-wide Policy (OGP) Office of Technology Policy (OTP)

Identity Assurance and Trusted Access Division (IATAD)

Date Issued:

JANUARY 30, 2024

RESPONSE DUE BY: 4:00 PM EST, FEBRUARY 20, 2024

GENERAL INFORMATION

THIS IS A SOURCES SOUGHT NOTICE FOR THE PURPOSE OF MARKET RESEARCH ONLY -

NO AWARD WILL BE MADE AS A RESULT OF THIS NOTICE.

INTRODUCTION

This Request for Information (RFI) is issued for information and planning purposes only and does not constitute a solicitation nor does it restrict the Government as to the ultimate acquisition approach. In accordance with Federal Acquisition Regulation (FAR) 15.201(e), responses to this notice are not offers and cannot be accepted by the Government to form a binding contract.

The purpose of this RFI is to identify qualified contractors who can meet the General Services Administration’s (GSA) requirements for Federal Identity Credential and Access Management (FICAM) Phishing Resistant Authenticator in the Identity Assurance and Trusted Access Division (IATAD). IATAD is interested in learning about capabilities including but not limited to:

● Phishing Resistant Authenticators that meet or exceed FIDO2 or Kantara Initiative Assurance Program certification processes.

● Phishing Resistant products are interoperable within the diverse technology ecosystem.

● Products meet or exceed the NIST 800-63v3 or v4 authenticator assurance level requirements.

● Product form factor and compatibility with

○ Platforms, Linux, Windows, MacOS, Android, Open source

○ Mobile devices, Android, iOS, Linux based OS

○ Browsers

○ Applications

○ Other

● Meet or exceed federal government requirements for product vetting.

● Products that are Trade Agreements Act compliant.

Any contract/order that might be awarded based on information received or derived from this market research will be subject to the competitive process. In addition, the purpose of this RFI is to obtain market information on capable sources of supply, and industry practices. Contractors are required to respond with a capability package that is clear, concise, and complete. The Government is not responsible for any cost incurred by industry in furnishing this information. All costs associated with responding to this RFI will be solely at the interested vendor's expense. Not responding to this RFI does not preclude participation in any future Request for Proposal (RFP), if any is issued. Any information submitted by respondents to this RFI is strictly voluntary. All submissions become Government property and will not be returned.

REQUIREMENT BACKGROUND

Identity Assurance and Trusted Access Division is developing a product criteria to identify vendor products that are phishing resistant as outlined in OMB Memo 22-09. Phishing resistant is defined as an authentication method that is resistant to interception or replay attacks. Interception or replay attacks include:

1. credential replay (username/password and one time pin)

2. push bombing (push notifications or push notification with number matching)

3. SS7 protocol vulnerabilities (SMS one time pin)

4. SIM Swap (SMS one time pin)

The intent of this market research is to help federal agencies identify and aggressively replace insufficient authentication methods with either phishing-resistant or passwordless methods.

REQUIREMENT SCOPE & OBJECTIVE

● Fully functional and secure Phishing Resistant authenticators interoperable with cross platform technologies

● GSA OGP does not require assistance managing the resources.

● GSA OGP requires detailed description of the product.

ANTICIPATED TASKS

No anticipated tasks. This RFI is market research on vendor capabilities and available products in the market today.

INTERESTED VENDOR CAPABILITIES

The contractor shall provide a capability statement that is clear, concise and complete describing the firm's competencies and ability to meet the government’s requirements.

INFORMATION GATHERING FROM INDUSTRY

Please provide detailed responses to the following questions:

1. Provide a narrative for the phishing resistant or passwordless product.

2. Is the entity able to provide a cataloged price list of your products?

3. Which North American Industry Classification System (NAICS) Code do you believe is most appropriate for this requirement?

4. Offerors are required to comply with Section 889(a)(1)(B) of the John S. McCain National

Defense Authorization Act (NDAA) Part B requirement(s). Does the entity certify in the System for Award Management SAM that it is compliant with Section 889 Part B?

5. Offerors are required to comply with the Trade Agreements Act. What is the product's origin country?

6. Additionally, address these product specific questions: Product name

a. Form Factor (Security Key, platform authenticator, shared passkey, device bound passkey)

b. Certification Level or Approval Class with link to certification (e.g., FIDO2 level 1, FIDO2 level 2, Kantara NIST 800-63r3 AAL2, or Kantara NIST 800-63r3 Technical AAL3).

c. FIPS Certification Level with link to certification (e.g., FIPS 140-2 Level 1 or FIPS 140-3 Level 2)

d. Supports Smart Card Module (Yes or No)

e. USB Form Factor (A or C or other)

f. NFC Supported (Yes or No)

g. Bluetooth Supported (Yes or No and version supported)

h. If FIDO certified, what is the AAGUID

BUSINESS INFORMATION

a. Name of company:

b. URL of company:

c. DUNS number:

d. CAGE Code, if applicable:

e. NAICS (North American Industry Classification System) Codes:

f. POC, Telephone Number(s), Address, and e-mail address:

g. Business size:

h. Any business socio-economic categories applicable:

Note: Some firms may have more than one socio-economic category, identify all that apply such as: Small Business: Small Disadvantaged Business concerns (SDB) including, 8(a) business development participants, which includes: Alaskan Native Corporations, Indian-Owned concerns: and Native Hawaiian Organization-Owned:

HUBZone (HZ), Veteran-Owned Small Business concerns (VOSB): Service-Disabled Veteran-Owned Small Business concerns (SDVOSB): Economically Disadvantaged Women-Owned Small Business (EDWOSB) concerns: and Women-Owned Small Business (WOSB) concerns eligible under the WOSB Program.

i. URL of product(s):

j. Federal contract vehicle or vehicles under which the solution can be provided, including contract number:

k. Is the offered solution priced in your GSA Schedule contract?

l. Registered in the System for Award Management (SAM) (Yes/No):

RFI RESPONSE INSTRUCTIONS

NOTE: The capability package must be clear, concise, and complete. GSA is under no obligation to provide feedback to the company, or to contact the company for clarification of any information submitted in response to this RFI.

Contractor’s response shall consist of a narrative describing how services will be provided. Please note “Phishing Resistant Authenticator” in the subject line of your response. Please limit responses to no more than 5 pages (single-sided), using Times New Roman size 12 fonts.

GSA reserves the right to not respond to any or all emails or materials submitted. All GSA current requirements identified herein are subject to change at any time.

FINAL COMMENTS

This is an opportunity to provide meaningful feedback in the early stages of the market research and the pre-solicitation for Phishing Resistant Authenticator for GSA’s marketing automation tool solution.

Your thoughtful participation is encouraged. It is an opportunity for good corporate citizenship and to show your best interest in a more effective and efficient government. As a major conduit to many of your goods and services for federal agencies, states, and local/tribal governments, GSA’s improvement can also be realized in an improved marketplace for your company.

RESPONSE

All proprietary/company confidential material shall be clearly marked on every page that contains such.

Include: RFI No. RFI013024, name, email address and phone number of the appropriate representative of your company.

Responses are due no later than 4 PM EST, February 20, 2024. Submit your responses via email to the attention of the Contracting Officer, Bonnie Impastato, bonnie.impastato@gsa.gov and the Contract Specialist, Monica Golibart, monica.golibart@gsa.gov. Submit your responses with the header title: RF013024 - Phishing Resistant Authenticator SAM RFI Response - {your company name}”.

PLEASE NOTE: Information obtained in response to this RFI will be used to assist the government in defining its requirement and developing a requirements document; all submissions become government property and will not be returned.