Sources Sought GTI 832571592.pdf

Page 1 of 5 Pages

SOURCES SOUGHT NOTICE

Tracking Number 832571592

The Department of Defense Cyber Defense Command (DCDC) is seeking sources for Google Threat Intelligence (GTI).

CONTRACTING OFFICE ADDRESS:

DISA/Defense Information Technology Contracting Organization (DITCO) 2300 East Drive, Building 3600 Scott Air Force Base, IL 62225-5406

INTRODUCTION:

This is a SOURCES SOUGHT NOTICE to determine the availability and technical capability of small businesses (including the following subsets, Small Disadvantaged Businesses, Certified 8(a), Service-Disabled Veteran-Owned Small Businesses, HUBZone Small Businesses and Woman Owned Small Businesses) to provide the required products and/or services.

The DCDC - Department of Defense Information Network (DODIN) is seeking information from potential sources for: a globally interconnected end-to-end set of information capabilities for collecting, processing, storing, disseminating, and managing information on demand to warfighters, policy makers, and support personnel. The DODIN includes owned and leased communications and computing systems and services, software (including applications), data, security services, other associated services, and national security systems.

The DCDC is responsible for the Command and Control of DODIN Operations and Defensive Cyberspace Operations-Internal Defensive Measures (DCO-IDM) globally in order to synchronize the protection of DCDC component capabilities to enable power projection and freedom of action across all warfighting domains. For instance, the vendor will reduce vulnerabilities, eliminate threats, and defeat, deny, and disrupt attacks against the DODIN.

Two key mission essential tasks (METs) of DCDC are Synthesize Intel and Disseminate Operational Intelligence Intel. The purpose of synthesizing intelligence is to develop comprehensive intelligence products by integrating, evaluating, analyzing, and interpreting information from single or multiple sources, and fusing it into finished intelligence to meet known or anticipated production requirements. Disseminating operational intelligence involves conveying and integrating intelligence across the joint force. The organization is looking for a vendor to:

• Provide information about threats and threat actors to support these METs.

Page 2 of 5 Pages

• Provide case studies and describing recent incidents at similar organizations;

addressing trends across the industry and new or expanded descriptions of threat actors specifically target within this particular industry.

• Create Threat Analysis Reports describing new or evolving threats tied to DCDC business areas, partners, products, and services.

• Conduct Threat Landscape Briefings to provide situational awareness of current advanced persistent threats (for instance, financial and hacktivists groups). Most importantly, the vendor should provide support to access and apply the capability's knowledge base to improve and enhance the DCDCs Google threat intelligence.

PERIOD OF PERFORMANCE:

The anticipated period of performance for this contract is a 12-month base period with four, 1-year option periods.

PLACE OF PERFORMANCE:

The anticipate Place of Performance for unclassified work under this order shall be performed offsite at the contractor’s facilities. Secret and Top-Secret work under this order shall be performed at the Government site of designated facility for the security level.

DISCLAIMER:

THIS SOURCES SOUGHT NOTICE IS FOR INFORMATIONAL PURPOSES ONLY.

THIS IS NOT A REQUEST FOR PROPOSAL. IT DOES NOT CONSTITUTE A

SOLICITATION AND SHALL NOT BE CONSTRUED AS A COMMITMENT BY

THE GOVERNMENT. RESPONSES IN ANY FORM ARE NOT OFFERS AND THE

GOVERNMENT IS UNDER NO OBLIGATION TO AWARD A CONTRACT AS A

RESULT OF THIS NOTICE. NO FUNDS ARE AVAILABLE TO PAY FOR

PREPARATION OF RESPONSES TO THIS NOTICE. ANY INFORMATION

SUBMITTED BY RESPONDENTS IS STRICTLY VOLUNTARY.

CONTRACT/PROGRAM BACKGROUND:

Contract Number: NNG15SD80B/HC102822F0532 Contract Vehicle: NASA SEWP Incumbent and their size: August Schell Enterprises, Inc. (Small Business) Method of previous acquisition: SBSA Period of Performance: May 13, 2022 – May 12, 2026

Page 3 of 5 Pages

REQUIRED CAPABILITIES:

1) DCDC J2 is responsible for fusing intelligence products from multiple sources to include industry-specific products. Describe your experience with collecting industry-specific network analysis, targeting trends across the industry, and correlating new or expanded descriptions of threat actors specifically targeting the DoD.

2) DCDC J2 relies on industry-specific products and training to provide intelligence analysts with the training and tools to ensure DoD remains current on emerging software and trends. Describe your experience with providing foundational, advanced, and ad-hoc training on GTI capabilities and tools.

3) Multiple organizations within the DoD rely on DCDC J2’s ability to provide timely and predictive analysis of evolving threats against the DODIN. Cyber threat actors are continually changing and enhancing their tactics, techniques, and procedures, which DCDC reports on to other intelligence community partners and DoD organizations. Describe your experience with providing insight into current, past, and possible future threat activity as it pertains to the DoD and the ability to identify “false positives” and provide context behind the “false positives.”

4) Common Vulnerabilities and Exposures (CVEs) present a constant challenge for the DCDC J2, due to the significant time required to evaluate potential threats, assign risk scores and confidence levels, and ensure that various organizations are prioritizing the correct CVEs. Describe your experience with identifying software vulnerabilities and ranking vulnerabilities based upon criticality.

5) DCDC J2 often must share information with multiple DoD and United States Government organizations that do not always have the same data formats or systems to import or export data. Describe your experience with providing Application Programming Interface (API) ability to conduct automated extraction of indicators and reporting and exporting reports to multiple formats.

6) Data sharing is the pinnacle of the intelligence community to ensure organizations have the most up-to-date information about adversary intentions and movements.

DCDC J2 routinely must share priority information with other DoD organizations.

Describe your experience with allowing data to be shared and collaborated with other partners.

Page 4 of 5 Pages

SPECIAL REQUIREMENTS

All contractor personnel assigned to this task must have Top Secret Facility Clearance and will require Sensitive Compartmented Information (SCI) access eligibility. Please provide your current Facility Clearance level.

SOURCES SOUGHT:

The North American Industry Classification System Code (NAICS) for this requirement is 541519, with the corresponding sales size standard of $34 million.

In order to make a determination for a small business set-aside, two or more qualified and capable small businesses must submit responses that demonstrate their qualifications.

Responses must demonstrate the company’s ability to perform in accordance with FAR clause 52.219-14, Limitations on Subcontracting.

To assist DISA in determining the level of participation by small business in any subsequent procurement that may result from this Sources Sought Notice, provide information regarding any plans to use joint ventures or partnering. Please outline the company's areas of expertise and those of any proposed JV/partner who combined can meet the specific requirements contained in this notice.

SUBMISSION DETAILS:

Responses should include:

1) Business name and address;

2) Name of company representative and their business title;

3) Small Business Socio-economic status (if small);

4) CAGE Code;

5) Prime contract vehicles; to include ENCORE III, SETI, NIH CIO-SP4, NASA

SEWP V, General Service Administration (GSA): OASIS, ALLIANT II, VETS II, STARS III, MAS (including applicable SIN(s), groups or pools), or any other Government Agency contract vehicle that allows for decentralized ordering.

(This information is for market research only and businesses with a valid cage that lack prime contract vehicles are still encouraged to respond to this notice.)

Businesses who wish to respond must send a response via email NLT 4:00 PM Eastern Daylight Time (EDT) on September 9, 2025 to Carrie Bair, carrie.e.bair.civ@mail.mil.

Interested businesses should submit a brief capabilities statement package addressing the specific questions above (no more than five pages) demonstrating the ability to perform the services listed under Required Capabilities and Special Requirements.

Proprietary information and trade secrets, if any, must be clearly marked on all materials.

All information received that is marked Proprietary will be handled accordingly. All

Page 5 of 5 Pages submissions become Government property and will not be returned. All government and contractor personnel reviewing submitted responses will have signed non-disclosure agreements and understand their responsibility for proper use and protection from unauthorized disclosure of proprietary information as pursuant to 41 USC 423. The Government shall not be held liable for any damages incurred if proprietary information is not properly identified.

For information on DISA’s requirements, you can find current information on our home page: www.disa.mil – that includes current forecast and the current acquisition strategies. If there is no information regarding the requirement you may be inquiring about, then there is no additional publicly available information. Please continue to review www.disa.mil.

http://www.disa.mil/