Sources Sought Notice Judiciary Personal Security Risk Reduction and VM Support.pdf

Administrative Office of the United States Courts Procurement Management Division

JUDICIARY SECURITY PERSONAL RISK REDUCTION AND VULNERABILITY

MANAGEMENT SUPPORT

Request for Information (RFI)/Sources Sought Notice (SSN)

1. REQUEST FOR INFORMATION/SOURCES SOUGHT:

THIS RFI/SSN IS RELEASED PURSUANT MARKET RESEARCH.

This RFI/SSN is issued solely for information and planning purposes only and shall not be construed as either a solicitation or the obligation on the part of Government. This is NOT a solicitation for proposals, proposal abstracts or quotations. This notice is for market research purposes only. Further, this SSN does not commit or guarantee the Government will issue any solicitation for the described requirements in the future.

The North American Industry Classification Systems (NAICS) Code proposed for the requirement is 519290 – Web Search Portals and All Other Information Services. The PSC that is intended for this acquisition is DJ01 IT and Telecom Security and Compliance Support.

No reimbursement will be made for any costs associated with providing information in response to this announcement or any follow-up information requests. This notice is published to gain knowledge of potential vendors capable of providing services for the draft Judiciary Security Personal Risk Reduction and Vulnerability Management Support Statement of Work (SOW), understand and evaluate the current marketplace for such services, and to receive industry feedback on the suitability and functionality of the SOW.

Vendors with the skill and capability necessary to perform the various requirements described in the attached draft SOW are invited to provide a response per the requirements listed below.

Respondents are advised that the Government is under no obligation to acknowledge receipt of the information received or provide feedback to respondents with respect to any information submitted. Respondents will not be notified of the results of this analysis. All data received in response to this RFI/SSN that is marked or designated as corporate or proprietary information will be fully protected from release outside the Government. The Government shall not be liable for or suffer any consequential damages for any proprietary information not properly identified.

Proprietary information will be safeguarded in accordance with all applicable Government regulations. All documentation shall become the property of the Government and will not be returned.

2. OBJECTIVES:

TECHNICAL CAPABILITIES

● The Administrative Offices of the U.S. Courts (AOUSC) seeks to identify potential vendors with the knowledge, skills, and capabilities necessary to perform the requirements outlined in the attached draft SOW.

3. BACKGROUND:

The AOUSC, Department of Administrative Services (DAS), Facilities and Security Office (FSO), Judiciary Security Division (JSD) – Threat Management Branch (TMB) is responsible for development and dissemination of emergency notifications and updates along with performing situational awareness during an emergency.

The JSD-TMB provides capabilities to identify, analyze, report, and support the management of judiciary mitigation actions to AOUSC, the Judiciary, and Probation & Pretrial Geospatial Services. These services facilitate the integrated delivery of natural hazards emergency notification and response along with facility and individual security including Vulnerability Management (VM) and Personally Identifiable Information (PII) reduction and redaction. The goal is to reduce and/or mitigate potential risks to approximately 33,000 employees, 900 facilities, 2,300 active judges, 300 retired judges, and 6,000 family members which are coverable within the JSD-TMB program.

Additionally, in February 2025, as part of the National Defense Authorization Act, the AOUSC was made responsible for the implementation of the Daniel Anderl Judicial Security and Privacy Act. In response, the JSD-TMB identified three principal activities:

• GEOSPATIAL RISK ANALYSIS:

Utilizing geospatial technologies and other services to provide relevant intelligence and information to JSD-TMB analysts for use in determining potential judiciary risks and vulnerabilities; providing any IT/Software services required for analysis purposes, licensing, and technical services developers to support development of services, data analytics, and reporting products; coordinating and constructing training services and products focused on data privacy and security; AOUSC and Judiciary emergency notification; and continued services to probation and pretrial officers to facilitate monitoring of clients.

• VULNERABILITY ANALYSIS REPORTING AND TRAINING:

Monitoring of the internet, dark web, and providing intelligence/information products for mentions of high-profile trials, other judiciary related risks, and online exposure of any “at-risk” individuals covered information; providing analysis of relevant findings to AOUSC and Judiciary leadership as appropriate; and forwarding potential threats to judiciary security partners.

• PII REDUCTION AND REDACTION:

Third-party data broker redaction; assessment of an individual’s online vulnerability towards the development of a personal mitigation strategy; provide training for any “at-risk” individuals in personal online/PII and home security; assessment and reporting on state and local public records redaction actions; and assessing and processing Daniel Anderl Act requests for AOUSC assistance with Department of Justice for injunctive relief.

4. CONTRACTOR CAPABILITY SURVEY:

See attached SOW for the draft requirements for Judiciary Security Personal Risk Reduction and Vulnerability Management Support. Responses shall address the following:

A. GENERAL INFORMATION:

1. Company Name

2. Company Address.

3. Company Point of Contact, Phone and Email address.

4. Unique Entity Identifier (UEI) Number.

5. List any contract vehicle along with the associated contract number and task area(s) appropriate for this notice; and list related North American Industry Classification System (NAICS) Code that you offer as it relates to this project.

6. Web Page URL.

B. TECHNICAL CAPABILITIES:

The vendor’s capability statement shall address the following to the contractor’s capability to perform the requirement of this performance work statement:

1. Vendor Viability and Fit:

Provide a brief overview of your company, including years in operation, ownership, and primary SaaS and services offerings. Describe your experience supporting enterprise IT environments comparable in size and complexity to ours. What differentiates your solution and delivery model from alternatives in this market?

2. SaaS Platform & Architecture:

Describe your SaaS architecture, including tenancy model, hosting environment, scalability, and availability. Describe how your platform integrates with enterprise systems (APIs, identity providers, data platforms). Identify any material technical constraints or prerequisites we should be aware of.

3. Security, Risk & Compliance (Gate Criteria):

Summarize your security and privacy program, including relevant certifications or attestations (e.g., SOC 2 Type II, ISO 27001, Fedramp). Describe how customer data is protected, isolated, and encrypted, and how access is controlled. Summarize your incident response, business continuity, and disaster recovery capabilities (include RPO/RTO where available). What industry-specific regulations (e.g., GDPR, HIPAA, PCI-DSS) do you comply with, and how do you ensure ongoing compliance?

4. Implementation & Transition from Existing Solution:

Describe your typical implementation approach and timeline for a new customer.

Describe your experience transitioning customers from an existing or legacy solution, including data migration and cutover strategy. How do you minimize business disruption, downtime, and risk during transition? What customer resources, dependencies, or prerequisites are required during implementation and transition? Is your solution a fully managed service (who owns the software licenses)?

5. Support, Roadmap & Commercial Model:

Describe your support and customer success model, including SLAs and escalation processes. Provide a high-level overview of your SaaS and professional services pricing model, contract terms, and product roadmap for the next 12–24 months.

6. Program Integration & Management:

Describe your organization’s approach to managing and integrating all five JSD-TMB program elements (Vulnerability Management, PII Reduction, Geospatial Services, Training, and Technology/Data Integration) under a unified program management framework.

7. Vulnerability Monitoring & Intelligence Fusion:

Explain your methodology for conducting continuous all-source monitoring (open web, dark web, social media, public records, and law enforcement feeds), and law enforcement and public safety agency intelligence and information collection to produce actionable vulnerability assessments for judiciary protectees and assets.

8. PII Reduction & Redaction Execution:

Describe your approach for identifying, prioritizing, and removing exposed PII across multiple platforms, including coordination with data brokers, public records agencies, and web content hosts.

9. Data Security & Compliance:

Outline your process for ensuring all tools and services (IaaS, SaaS, PaaS) meet Judiciary Information Security Framework requirements equivalent to NIST SP 800-53 Rev. 5, SOC 2, or FedRAMP Moderate.

10. Technology & Systems Integration:

Provide your technical approach to integrating existing JSD-TMB platforms (ArcGIS, DeleteMe, OnSolve, OutSystems or equivelent) into a secure, interoperable environment that supports case management, analytics, and reporting.

11. Personnel Expertise & Clearances:

Identify key personnel roles required to perform this work and describe your organization’s ability to recruit and retain qualified staff with Secret or TS/SCI clearances and experience in federal law enforcement or intelligence environments.

12. Training & Behavior Change:

Describe how you would design and deliver effective training and education modules that measurably change judiciary protectee behaviors related to personal data privacy and cyber hygiene.

13. Data Sharing & Inter-Agency Collaboration:

Explain your approach to establishing and managing formal data sharing agreements and secure information exchange with AO, judiciary, and partner agencies (e.g., USMS, FPS, DHS).

14. Performance Measurement:

Recommend specific Key Performance Indicators (KPIs) and metrics you would use to track progress, measure success, and demonstrate value across all JSD-TMB program areas.

15. Scalability & Surge Support:

Describe your organization’s ability to rapidly scale personnel and resources to support surge events or expanded program needs without compromising service quality or security compliance.

16. Scalability & Surge Support:

Describe your organization’s ability to rapidly scale personnel and resources to support surge events or expanded program needs without compromising service quality or security compliance.

C. CAPABILITY SURVEY QUESTIONS:

• Who do you consider to be your top competitors in this space?

• Why should we choose your solution over those provided by your competitors?

• Are there any alternative solutions to the current model outlined in the SOW, (including software or SaaS) or approaches that could effectively meet our needs?

• How do you stay ahead of the curve and remain at the forefront of industry trends and innovations?

• Can you provide examples of similar projects you’ve completed and their outcomes?

• What is your process for gathering and documenting client requirements?

• How do you handle change requests and scope creep during a project?

• What tools and technologies do you use to streamline project management and collaboration?

• How do you measure and report on project progress and success?

• How do you ensure client satisfaction and address any concerns that may arise?

• How do you control and monitor access to client data within your organization?

• What are your data handling and disposal policies, and how do you ensure compliance?

• Have you experienced any data breaches in the past, and if so, how did you respond and mitigate the impact?

• How do you stay informed about changes in regulatory requirements, and how do you adapt your processes accordingly?

5. DUE DATE:

Vendors capable of providing these services should submit a Statement of Capability containing the above reference information via e-mail to sjackson@ao.uscourts.gov with a copy to christina_carter-kurant@ao.uscourts.gov no later than 3:00pm EST, Friday, January 30, 2026. Any questions can be addressed to the above no later than 3:00pm EST. January 22, 2026.

Responses shall not contain any brochures, advertising or any other type of generic, extraneous, graphic literature or documents that have not been requested and are not relevant or essential in demonstrating the vendor’s ability to provide the required services.

Vendors may provide links to relevant websites, as appropriate. Vendors shall not provide exterior links for the US Courts to access its response to this SSN.

Vendors shall reference “SSN Response – Threat Mgmt” in the subject line of their response email as well as in the subject line of any e-mail correspondence referencing this notice.

** THE GOVERNMENT WILL NOT RESPOND TO PHONE CALLS

REGARDING THIS NOTICE **

Thank you for your interest.

mailto:sjackson@ao.uscourts.gov mailto:christina_carter-kurant@ao.uscourts.gov

5. DUE DATE: