Sources Sought Notice - 632469668.pdf

Page 1 of 5 Pages

SOURCES SOUGHT NOTICE

Tracking Number: 632469668

The Defense Information Systems Agency (DISA) is seeking sources for Enterprise Integration and Innovation (EII) Risk Management Executive (RME) and the Office of the Chief Information Officer (IO)’s Technical Assessment and Support Services requirement.

CONTRACTING OFFICE ADDRESS:

DISA / Procurement Services Directorate / Defense Information Technology Contracting Organization National Capitol Region 6914 Cooper Avenue Fort George G. Meade, MD 20755

INTRODUCTION:

This is a SOURCES SOUGHT NOTICE to determine the availability and technical capability of small businesses (including the following subsets: Small Disadvantaged Businesses, certified 8(a), Service-Disabled Veteran-Owned Small Businesses, HUBZone Small Businesses and Woman-Owned Small Businesses) and large businesses to provide the required products and/or services.

DISA EII is seeking information from potential sources for Technical Assessment and Support Services, which supports the missions of EII’s RME and IO directorates. The objective is to provide technical support for EII organizations to identify, assess, and prioritize computing risks to the enterprise, establish strategies to address risk, assure and secure the Agency’s systems, networks, programs, and data in the face of internal and external threats while appropriately balancing risk opportunity and cost.

The overarching objectives of this requirement are to:

Ensure a consistent and compliant path leading to the authorization of computers, systems, and networks by providing and developing information system cyber security strategies, design and evaluation guidance, and measures that validate and ensure that the security requirements and standards of this common body have been met.

Assure DISA’s information infrastructure and DoD’s cloud information infrastructure are properly configured, protected, and monitored against vulnerabilities or threats.

Protect, defend, and secure DISA’s information infrastructure to ensure data assets and information are visible, accessible, understandable, and trusted by all authorized users even in the face of a cyberattack. To reduce risk to the Defense Information Systems Network (DISN) by providing enhanced IA and security through balanced risk management.

The anticipated Period of Performance is 6 June 2025 – 5 June 2030.

The anticipated Place of Performance includes four primary mission locations: DISA Chambersburg, Building 1 (Letterkenny Army Depot, Chambersburg, PA), DISA Headquarters (Ft. Meade, MD), Marks Center (Alexandria, VA), and the Pentagon (Arlington, VA).

Page 2 of 5 Pages

DISCLAIMER:

THIS SOURCES SOUGHT NOTICE IS FOR INFORMATIONAL PURPOSES ONLY. THIS

IS NOT A REQUEST FOR PROPOSAL. IT DOES NOT CONSTITUTE A SOLICITATION

AND SHALL NOT BE CONSTRUED AS A COMMITMENT BY THE GOVERNMENT.

RESPONSES IN ANY FORM ARE NOT OFFERS AND THE GOVERNMENT IS UNDER

NO OBLIGATION TO AWARD A CONTRACT AS A RESULT OF THIS NOTICE. NO

FUNDS ARE AVAILABLE TO PAY FOR PREPARATION OF RESPONSES TO THIS

NOTICE. ANY INFORMATION SUBMITTED BY RESPONDENTS IS STRICTLY

VOLUNTARY.

CONTRACT/PROGRAM BACKGROUND:

Contract / Task Order (TO) Number: GS-35F-419CA / HC102819F0653 Contract Vehicle: GSA IT Schedule 70 Contract Type: FFP Incumbent and their size: IPKeys Technologies, LLC; Small business Method of previous acquisition: Women-owned Small Business Set-Aside Lifecycle Value: $151,546,935.83 Period of Performance: January 6, 2019 – July 5, 2025

Contract / Tasker Order Number: HC102820D0001 / HC102822F0003 Contract Vehicle: Global Solutions Management – Operations (GSM-O) II Incumbent and their size: Leidos Inc., Large Business Method of previous acquisition: Sole Source Lifecycle Value: $153,378,942.24 Period of Performance: January 31, 2022 – July 30, 2025

REQUIRED CAPABILITIES:

1) DISA RME’s Assessment and Authorization (A&A) Division (RE5) is tasked with conducting A&A visits worldwide in support of the DISA Authorizing Official (AO) and AOs who subscribe to RE5’s assessment services. The A&A is a comprehensive assessment and/or evaluation process of information system policies, technical/non-technical security components and controls, documentation, supplemental safeguards, policies, and vulnerabilities. The process establishes the extent to which a particular design and implementation meet a set of specified security requirements defined by the DoD, Government guidelines, and federal mandates into a formal authorization package.

RE5 conducts over 400 assessments per year, all of which require multiple contractor assessors. Describe and provide an example of your company’s experience conducting system, network, and capability vulnerability assessments, capturing results, and providing security vulnerability and risk analysis, guidance, and recommendations at a similar scale (400 assessments yearly).

2) DISA RME is tasked with overseeing and monitoring all DISA authorized information technology (IT) systems (re-authorization and new systems) throughout their life cycle

Page 3 of 5 Pages for changes that may impact the security posture of the system. This is achieved by analyzing proposed or actual changes to IT systems to determine the security impact, and periodically assessing security controls and their effectiveness. Describe and provide an example of your company’s experience providing continuous monitoring services and continuous monitoring assessments using Qmulos, Splunk, ACAS, Axonius, CheckMark, BURP, HBSS/ESS, and/or other similar tools.

3) DISA RME’s Risk Adjudication and Connection Division (RE4) supports the Warfighter and mission partners by approving connections for information systems, networks, and cloud services authorized to operate in the Department of Defense (DoD) Information Network (DoDIN). RE4's overarching function is to reduce risk to the DISN by providing risk management community jury decisions and approving connections to the DISN transport while also developing acceptance of risk mitigation strategies with various mission partners. Describe and provide an example of your company’s experience performing Federal/DoD policy and cybersecurity/network architecture analysis, assessing risk impact of all connections to the DoDIN, developing innovative outreach training programs, and managing and developing the automation of manual processes.

4) DISA RME’s Cloud Assessment Division (RE2) validates third-party assessments of

Cloud Service Offerings (CSOs) in support of the DoD CIO role with the FedRAMP Joint Authorization Board (JAB) and DISA's role in providing DoD Provisional Authorizations. They also provide process guidance to Cloud Service Providers (CSP), mission owners, cloud managers, and supporting security professionals to ensure clarity and efficiency in achieving assessment and authorization milestones related to cloud activities. Describe and provide an example of your company’s experience reviewing and analyzing Cloud Services documentation packages, conducting cloud services cybersecurity assessments and validations, and demonstrating a knowledge of cloud service models such as Infrastructure as Service (IaaS), Platform as Service (PaaS), and Software as Service (SaaS) and cloud deployment models (public, private and hybrid).

5) DISA RME Cross Domain Support (CDS) oversees, manages, and coordinates DoD commercial Cloud Enterprise CDS in coordination with Defense Counterintelligence and Security Agency (DCSA) as well as DISA CDSE and Point-to-Point CDS implementations. Describe and provide an example of your company’s experience reviewing and providing feedback on Cross Domain implementations, familiarization with SIPRNet Global Information Grid (GIG) Interconnection Approval Process (GIAP) System database and National Cross Domain Strategy & Management Office (NCDSMO) and validating and prioritizing Cross Domain and IA requirements throughout the System Development Life Cycle.

6) Office of the Chief Information Officer’s (OCIO) validates compliance with federal and DoD standards relating to IT, cyber, and personnel. Describe and provide an example of your company’s experience developing cybersecurity policy directives, strategies, and information using knowledge of DoD processes and policies, reviewing, processing, and tracking waivers and exceptions-to-policy request packages for assessment, and analyzing cybersecurity data to assess agency FISMA and cybersecurity compliance.

Page 4 of 5 Pages

SPECIAL REQUIREMENTS:

Travel Requirement: Cyber Security/IA Reviews: Cyber Security/IA reviews shall be conducted remotely from DISA Chambersburg, Building 1, DISA Headquarters (Ft. Meade, MD), Marks Center, and the Pentagon and on-site at Continental United States (CONUS) and Outside Continental United States (OCONUS) DoD mission partner locations. The contractor shall be expected to assign properly qualified and trained contractor personnel to conduct Cyber Security reviews utilizing more than half of the contractor personnel at any given time and traveling to conduct reviews and assessments approximately 85% of the year. Annual expenses to be reimbursed by the Government estimated to be more than $2,000,000.00. Please provide your approach to managing travel logistics and ensuring an adequate number of assessors on contract to support the 400+ assessments per year, while accounting for staff turnover with minimal impact on mission requirements.

Personnel Security Clearances: All personnel performing on or supporting DISA contracts will be U.S. citizens. Approximately 90% of the personnel supporting this contract are required to hold a minimum Top Secret (TS) clearance and will require Sensitive Compartmented Information (SCI) access eligibility upon date of hire. Please provide your current Facility Clearance level.

SOURCES SOUGHT:

The North American Industry Classification System Code (NAICS) for this requirement is 541519 – Other Computer Related Services with the corresponding size standard of $34 million (https://www.sba.gov/document/support--table-size-standards).

To make a determination for a small business set-aside, two or more qualified and capable small businesses must submit responses that demonstrate their qualifications. Responses must demonstrate the company’s ability to perform in accordance with FAR clause 52.219-14, Limitations on Subcontracting.

To assist DISA in determining the level of participation by small business in any subsequent procurement that may result from this Sources Sought Notice, provide information regarding any plans to use joint ventures (JVs) or partnering. Please outline the company's areas of expertise and those of any proposed JV/partner who combined can meet the specific requirements contained in this notice.

SUBMISSION DETAILS:

Responses should include:

1) Business name and address;

2) Name of company representative and their business title;

3) Small Business Socio-economic status (if small);

4) CAGE Code;

Page 5 of 5 Pages

5) Prime contract vehicles; to include ENCORE III, SETI, NIH CIO-SP4, NASA SEWP V, General Service Administration (GSA): OASIS, ALLIANT II, VETS II, STARS III, MAS (including applicable SIN(s), groups or pools), or any other Government Agency contract vehicle that allows for decentralized ordering. (This information is for market research only and businesses with a valid cage that lack prime contract vehicles are still encouraged to respond to this notice.)

Businesses who wish to respond must send a response via email NLT 4:00 PM Eastern Daylight Time (EDT) on June 14, 2024 to Karoline Schmal, karoline.k.schmal.civ@mail.mil and Robin Schuster, robin.n.schuster.civ@mail.mil. Interested businesses should submit a brief capabilities statement package addressing the specific questions above (no more than eight pages) demonstrating the ability to perform the services listed under Required Capabilities.

Proprietary information and trade secrets, if any, must be clearly marked on all materials. All information received that is marked Proprietary will be handled accordingly. All submissions become Government property and will not be returned. All Government and contractor personnel reviewing submitted responses will have signed non-disclosure agreements and understand their responsibility for proper use and protection from unauthorized disclosure of proprietary information as pursuant to 41 USC 423. The Government shall not be held liable for any damages incurred if proprietary information is not properly identified.