Sources Sought Notice_DARPA Program Security Services _4.8.21.pdf

Sources Sought Notice

DARPA Program Security Services

THIS IS A REQUEST FOR INFORMATION ONLY

The Defense Advanced Research Projects Agency (DARPA) seeks information for Program

Security services outlined in Attachment 1 (DARPA Program Security Services Summary).

To facilitate market research, the Government is looking to identify qualified sources under the

North American Industry Classification System (NAICS) 541690 “Other Scientific and

Technical Consulting Services”.

Responses are requested from both Small Businesses and Other Than Small Businesses.

The Government will analyze all responses to determine if a pool of qualified small business firms is sufficient for a set-aside competition restricted to small businesses. If there are not enough qualified small business firms to perform this requirement, the Government may solicit the acquisition as an unrestricted full and open competition.

A contract is anticipated to be awarded to a single firm with a period of performance starting in

February 2022. The contract will include a 12-month base period and four (4) 12-month option periods.

Submission Requirements

There is a maximum page limitation of four (4) typed pages using 12-inch Times New Roman font within an 8.5 x 11 inches page size. Cover letters and extraneous materials (brochures, general capabilities statements, etc.) will NOT be read.

Interested firms should submit their response to include the following (in this order):

1. Complete business name, including Data Universal Numbering System (DUNS) Number and

Commercial and Government Entity (CAGE) Code

2. Contact information (POC’s name and title, address, telephone, email)

3. Business size and classification (e.g., Small, SBA Certified 8(a), HUBZone, Service-

Disabled Veteran-Owned) under NAICS code 541690

4. List of GSA Schedules and/or other Multiple Award contract vehicles (if any) that interested party has been awarded and can be utilized for this requirement (e.g. GSA OASIS)

5. Confirmation of the ability to meet the following mandatory requirements:

o All individuals supporting this contract must possess at the time of assignment a Top

Secret personnel security clearance, based on a Single Scope Background

Investigation or Single Scope Background Periodic Reinvestigation, current within five (5) years, and adjudicated for SCI eligibility by an authorized Central

Adjudication Facility. Individuals outside the 5-year scope but entered into

Continuous Evaluation with a deferred investigation meet this requirement.

o The Contractor, and any subcontractors, must possess a Top Secret Facility Clearance at the time of proposal to this requirement’s solicitation. At the time of award, the

Contractor must also own, lease, or otherwise control office/storage space in the

National Capital Region that can be dedicated to storage of classified network backup data. This space must be at least 100 square feet in area and capable of supporting up to four GSA five-drawer containers (provided by DARPA). The space must be accredited (or constructed to applicable standards so as to be accreditable) as a

Special Access Program Facility (SAPF) and Sensitive Compartmented Facility

(SCIF). DARPA will coordinate any necessary co-utilization agreements after contract award and prior to contract start.

6. Identification of current or prior contracts for which you have provided similar program security services and description of how those services would enable you to fulfill DARPA requirements outlined in Attachment 1 o Limited to the past five (5) years o Any government contract examples must include contract numbers, project titles, dollar amounts, periods of performance, and Government POCs (telephone and/or email)

7. Feedback on the following as the Government develops its requirement:

o Does your firm have a DCAA-approved cost accounting system?

o If your firm cannot fulfill all of the requirements on its own, do you have a teaming partner identified? If so, what firm(s)?

o What additional information would you need from the Government to be able to provide an accurate proposal?

8. Identification of any potential Organizational Conflicts of Interest

9. Probability (high, medium, or low) of submitting a proposal for a requirement derived from

Attachment 1

This Sources Sought Notice is for market research purposes only and is NOT a Request for

Proposal (RFP) nor does it restrict the Government as to the final acquisition strategy. The

Government will not reimburse firms for any costs incurred in preparation of a response to this

Sources Sought Notice.

Due Date to submit a response to this Sources Sought Notice is April 19, 2021, before 2:00 PM

Eastern Time via email (Subject Line: DARPA Program Security Services SSN Response –

[Company Name]) to Ms. Mary Beth Colavito, Contracting Officer, at

ProgramSecurityRequirement@darpa.mil. No hard copy or facsimile submissions will be accepted.

Questions concerning submissions should be in writing and directed to the above point of contact. NO phone calls will be accepted.

Respondents are advised that DARPA is under no obligation to acknowledge receipt of the information received or provide feedback to respondents with respect to any information submitted under this notice. Responses to this notice do not bind DARPA to any further actions, to include directly requesting proposals from organizations responding to this notice.

mailto:ProgramSecurityRequirement@darpa.mil

Submissions may be reviewed by the Government (DARPA and partners) and Scientific

Engineering and Technical Assistance (SETA) contractors. All personnel with access to the submissions will be covered by a legally‐binding non‐disclosure agreement.

NO CLASSIFIED INFORMATION SHOULD BE INCLUDED IN SOURCES SOUGHT

NOTICE RESPONSES.

Enclosure:

DARPA Program Security Services Summary

BACKGROUND

DARPA’s mission is to maintain the technological superiority of the U.S. military and prevent technological surprise by sponsoring revolutionary, high-payoff research and development projects. This implies one imperative – radical innovation for national security. DARPA’s business philosophy is to bring in expert, entrepreneurial Program Managers (PMs) for the technical programs, empower them, protect them from red tape, and quickly make decisions about starting, continuing or stopping research projects. The DARPA technical staff organization is dynamic and changes as the projected requirements of the Department of Defense (DoD), the state of technology development, and adversarial threats evolve. To support this unique program management approach, DARPA requires program security personnel that are as expert in their own field as the PMs are in theirs.

The Security & Intelligence Directorate (SID) supports the DARPA mission through a proactive and flexible organization led by a small cadre of government security professionals supported by contractor subject matter experts. These services require personnel who can apply risk-managed, proactive program protection and related security services to the broad range of DARPA research & development projects at the fundamental research, controlled unclassified, collateral, special accesses program (SAP), and sensitive compartmented information (SCI) levels. These personnel must be subject matter experts across multiple security disciplines, must not be paralyzed by the unknown or unfamiliar, and must possess critical thinking and analytical problem-solving skills that foster the creation of innovative security solutions to support program timelines and objectives, while maintaining compliance with applicable national security requirements.

All personnel supporting the contract must have a Top Secret personnel security clearance, based on a Single Scope Background Investigation or Single Scope Background Periodic

Reinvestigation, current within five years, and adjudicated for SCI eligibility by an authorized

Central Adjudication Facility. Individuals outside the 5-year scope but entered into Continuous

Evaluation with a deferred investigation meet this requirement. While performance under the contract will occur primarily at DARPA Headquarters, contract performance involves significant

CONUS, and occasional OCONUS, travel.

PROGRAM SECURITY SERVICES

The SID Program Security Services Contract entails a unique set of requirements that goes well beyond traditional security disciplines such as Physical Security, Personnel Security, Information

& Industrial Security, and International Security. While these traditional services are an important part of the contract and the SID mission, the broad scope of technology and classification, along with DARPA’s rapid program pace and high-profile reputation, demand a unique type of program security professional.

The largest portion of the contract involves what DARPA terms Program Security

Representatives (PSRs). The DARPA PSR is unparalleled in any other contract position in the

DoD. They are not stove-piped into a specific type of program support (i.e., just collateral, just

SAP or SCI, or just CUI). As they are imbedded directly into the Technical Offices as part of a

DARPA PM’s team, they are the “tip of the spear” for execution of SID’s primary function, enabling the secure development of DARPA technologies.

Many DARPA projects not only involve more than one level of classification and/or SAP compartmentation, they are also frequently informed by or have transition activities that involve

Controlled Access Programs (CAPs), GAMMA sub-compartments, Sensitive Source Reporting

Programs (SSRPs), or Alternative Compensatory Control Measures (ACCMs). This broad range and combination of classification/compartmentation demands not just a sound understanding of the numerous security policies and procedures associated with these types of information, but an expert ability to develop and implement security architectures for technology spanning this spectrum.

DARPA PSRs are not simply rote executors of standard security processes. They must analyze and create protection strategies and tactics, frequently for technologies that exist nowhere else.

As such, they are a critical part of the program team responsible for development of program security objectives, to include: identification of critical and enabling technologies through the

Technology Decomposition process; determining applicable national security policy and existing related programs for horizontal protection; facilitating intelligence and counterintelligence support; projecting test and transportation security needs; and intelligently crafting and executing proposed security classification architectures and program protection plans that balance security requirements with program cost and schedule constraints. PSRs must also consider and address a program’s post-DARPA acquisition life cycle to ensure that security does not become an impediment during program transition to a Service or Agency partner.

Some other non-standard requirements of the Program Security Services contract include:

• Providing program security support to DARPA leadership, including the Director, Deputy Director, Chief of Staff, and Military Service Liaisons, in their classified activities managing DARPA programs and operations, coordinating with DoD civilian and military leadership, as well as providing technical advice and status updates on

DARPA programs to senior Executive Branch and Legislative Branch appointed and elected officials.

• Maintaining a Countering Foreign Intelligence Program (CFIP) for DARPA grants and other funded activities, providing analysis of individuals and entities who propose to

DARPA projects, and creating risk assessments associated with the research and/or the proposer.

• Maintaining an Insider Threat capability to correlate, analyze, and organize various data streams, triggers, and anomalous behaviors in order to provide SID leadership with insider threat baselines, items of interest, and focus issues.

• Providing a Program Information Technology (PIT) Security Controls Assessor (SCA) capability for PIT systems at all classification levels, supporting technology areas such as space systems, manned and unmanned aircraft systems, manned and unmanned surface/sub-surface vessels, cyber weapons development and operational platforms, weapons data links, RF communications systems, directed energy systems, and portable electronic devices for battlefield use.

• Providing a polygraph examination capability, in coordination with the NCIS Polygraph

Services Field Office (PSFO), to support program access requirements and a random polygraph program.

• Maintaining an archival system for current and completed DARPA classified projects, ensuring compliance with Information Security Oversight Office, National Archives and

Records Administration, and DoD historical recording keeping, declassification, and file series exemption requirements.

• Providing Freedom of Information Act (FOIA) services to support the DARPA and DoD

FOIA Program.

• Providing database administration/web development and technical support for a variety of SID database/data management systems to record, track, organize, and utilize information related to various SID functions, to include SAP management, oversight, and administration.

• Supporting the Director and Deputy Director, SAPCO in the administration of the

DARPA SAP portfolio as well as their responsibilities for ACCM and CAP activities.

• Providing a service/capability to destroy SAP IT equipment in accordance with current

DoD standards.