Sources Sought Notice 19AQMM21N0033.docx

April 23, 2021

SOURCES SOUGHT – 19AQMM21N0033

Department of State, Directorate of Cyber and Technology Security, Office of Cyber Monitoring and Operations, Cyber Operations (DS/CTS/CMO/CO) division

Purpose

This is a Sources Sought as outlined in FAR Part 10. The purpose of this Sources Sought is to accomplish market research pursuant to Federal Acquisition Regulation (FAR) Part 10, and to identify sources capable of performing the services described herein. This notice is issued solely for information and planning purposes and does not constitute a Request for Proposal (RFP) or a commitment on the part of the Government to conduct a solicitation for the below-listed services in the future. Respondents are advised that the Government will not pay for information submitted in response to this Sources Sought, nor will it compensate interested parties for any costs incurred in the development/furnishing of a response.

Please note that a decision not to submit a response to this Sources Sought will not preclude a vendor from participating in any future solicitation.

Description of the Requirement

The Cyber Protection (CP) program within the Department of State’s Bureau of Diplomatic Security, Directorate of Cyber and Technology Security, Office of Cyber Monitoring and Operations, Cyber Operations (DS/CTS/CMO/CO) Division manages a comprehensive portfolio of cybersecurity tools deployed to secure the Department of State’s (DOS) networks and data. This document outlines the requirements supporting the technical refresh of the Department’s Enterprise Vulnerability Scanning Solution (EVSS).

The scope of the contract shall cover:

1. Security Posture

· The DOS Cyber Protection program requires the capability to rapidly scan, assess, and report on the security posture of the Department’s networks. The ideal solution will evaluate both IPv4 and IPv6 addressed endpoints, applications, and infrastructure for vulnerabilities. The Department needs a solution that will provide analysis, monitoring, reporting, configuration, as well as policy and device management.

2. Scanning Responsibilities

· The scope of the Department’s scanning responsibilities encompasses a hosted environment (network) that includes: 1) on-prem Sensitive but Unclassified (SBU); 2) Classified enterprise networks; 3) SBU Azure Cloud environment, and 4) SBU AWS cloud environment. Various applications and services are hosted through multiple cloud service models such as IaaS, PaaS, and SaaS.

3. Scalable Capacity

· In addition, the Department recognizes the need for any scanning solution to include a strategy and scalable capacity to scan multiple disparate environments. These environments include: air-gapped networks; dedicated internet networks (DINS); Demilitarized Zones (DMZs) hosted domestically and overseas (not connected to the enterprise network); and multiple, distinct Cloud Service Providers (CSPs) such as Google Cloud, AWS Commercial, AWS GovCloud, Azure Commercial, and Microsoft Azure Government (MAG).

Objectives

DS/CTS is seeking an Contract vehicle, with a Base Year plus up to ten (10) Option Years, that will enable a life-cycle refresh for the Department’s Enterprise Vulnerability Scanning Solution (EVSS) include the following: Functionality & Capabilities, Department System Integration, Services and Support, and Solution Training.

DS/CTS is seeking a Contractor that will provide the following:

1. FUNCTIONALITY & CAPABILITIES

The Functionality & Capabilities requirements define the minimum acceptable levels of operations and functionality that the Enterprise Vulnerability Scanning Solution (EVSS) shall be required to meet, as defined by industry-standard criteria, federal policies, and anticipated future needs of the Department of State.

2. SYSTEM INTEGRATION

The System Integration section set of requirements detail the required integrations between the Contractor’s unique solution and the Department’s existing hosted technologies critical to the EVSS solution.

3. INSTALLATION SERVICES

The Installation Services set of requirements define the minimum acceptable level of Contractor resource support necessary to complete the installation, configuration, and optimization of the Contractor’s solution.

4. SERVICES AND SUPPORT

The Services and Support set of requirements describes how the contractor will provision its professional resources to DOS for the Enterprise Vulnerability Scanning Solution, throughout the acquisition, installation, and operations phases of the solution lifecycle.

5. SOLUTION TRAINING

The Solution Training requirements define the minimum acceptable level of service from the contractor for administration, operation, and use of the solution.

Instructions

The Government is seeking responses from Small Business and Large Businesses in order to establish an effective acquisition strategy. Responses must be limited to 20 pages or less and be submitted in Microsoft Word or Adobe Portable Document format (PDF), using Times New Roman, 12-point font. The Government will not entertain telephone calls for this Sources Sought. The responses should include the following information:

A. Company Profile, to include:

1. All interested companies must have an active registration in the System for Award Management (SAM) and not be on the Excluded Party List.

2. If a Small Business, please identify the socioeconomic category of the business (e.g., Service Disabled Veteran Owned, Women Owned, HUBzone, Small Business, etc.).

3. Information regarding all Government wide acquisition contracts held, i.e., vehicle name, contract number, etc.

4. DUNS Number

5. CAGE Code to include National Industrial Security Program Clearance Information (if applicable).

6. Company Point-of-Contact and contact information, i.e., telephone number and email address.

7. The facility security clearance of the respondent.

B. Technical Capability, to include:

1. Summary of company’s technical capabilities which would support the services described herein. The Government would like to see information regarding whether or not the required knowledge exists in-house or if the company plans to subcontract.

2. A list of up to three (3) contracts under which the company has previously performed services similar to those described herein. The list shall include –

a. Agency name,

b. Contract number,

c. Contracting Officer name, email address, and telephone number,

d. Dates of performance; and

e. Brief description of work performed, including security clearance requirements.

Submit your response no later than Friday, May 7, 2021 at 03:00 PM Eastern Time, to Farzad Afrasiabi at AfrasiabiF@state.gov and Greg Moore MooreGC2@state.gov.

Industry Discussions

DoS representatives may or may not choose to meet with potential offeror(s). Such discussions would only be intended to get further clarification of potential capability to meet the requirements. The potential offeror(s) that are chosen for meetings would be at the complete discretion of the DoS. Information passed during those potential meetings will be in reference to the capabilities of potential offerors. No procurement information or strategy would be discussed.

Questions

Questions regarding this announcement shall be submitted in writing by e-mail to the Contracting Officer, AfrasiabiF@state.gov and the Contract Specialist, Greg Moore, MooreGC2@state.gov. Verbal questions will NOT be accepted. Questions will be answered by posting answers to the SAM website; accordingly, questions shall NOT contain proprietary or classified information. The Government does not guarantee that questions received after Friday, April 30, 2021 will be answered.

SBU - CONTRACTING AND ACQUISITIONS

image1.jpeg