Sources_Sought__Secure_Remote_Access_Solution_1.pdf

September 21, 2026

SOURCES SOUGHT NOTICE

SECURE REMOTE ACCESS SOLUTION

The U.S. Bureau of Reclamation is issuing this notice as a means of conducting market research to identify parties having an interest in and the resources to support this requirement for Secure Remote Access Solution. Additional information about the requirement is available in the Appendix accompanying this notice. The result of this market research will contribute to determining the method of acquisition. The applicable North American Industry Classification System (NAICS) code assigned to this acquisition is 518210 – Computing Infrastructure Providers, Data Processing, Web Hosting, and Related Services.

This is NOT a solicitation for quotations or proposals. This is a Sources Sought Notice only.

Submission of any information in response to this market survey is purely voluntary, and the government assumes no financial responsibility for any costs incurred to respond. The government will not provide feedback or evaluations to companies regarding their submissions in response to this notice.

If your organization has the potential capacity to perform these contract services, please provide the following information:

1) Organization name and point of contact information.

2) UEI number.

3) Size and type of ownership for the organization.

4) Tailored capability statements addressing the particulars of this effort, with appropriate documentation supporting claims of organizational and staff capability. If significant subcontracting or teaming is anticipated to deliver technical capability, address the administrative and management structure of such arrangements.

Submission Instructions: Interested parties who consider themselves qualified to perform the listed services are invited to submit a response to this notice by October 02, 2026, 5:00 PM PT All responses under this notice must be emailed to malena_sanderlin@ios.doi.gov.

mailto:malena_sanderlin@ios.doi.gov

APPENDIX 1: Work Requirements

SCOPE OF WORK (SOW)

1.0 Background

Reclamation Industrial Control System (ICS) operators and administrators currently use Dispel for their remote access solution. This contract continues the existing remote access solution for 1 year plus 4 option years.

Reclamation ICS are geographically dispersed, often with digital infrastructure that supports operations and data transmission hundreds of miles apart. Engineers and administrators are currently required to drive to remote locations to service digital �ield equipment. If permitted, much of this work could be performed remotely using a proven remote access solution. Additionally, engineers in the �ield can use the remote access solution to observe the SCADA application while programming/servicing gates and valves in the �ield and con�irm the SCADA application is reporting correctly. Remote access solutions are commonly used in other Federal, State, Municipal, and privately owned and operated ICS.

A long-standing Reclamation best practice is to isolate Reclamation ICS from the corporate network and the internet. Reclamation’s ICS Security Operations team has agreed to explore solutions that meet Reclamation’s business objectives and comply with Reclamation’s cybersecurity risk tolerance

This solution protects a mission critical system from unauthorized access, enforces NIST 800-53 boundary protection requirements, and provides continuous monitoring data to a centralized location for cybersecurity incident detection and response. If it is not awarded, the system will be exposed to the Internet, the attack surface will increase exponentially, and Reclamation will have no visibility at the system's perimeter. Additionally, existing remote access for district personnel will terminate.

2.0 Scope

This is a solution that will be deployed at the Ephrata Field Of�ice (EFO) in Ephrata, WA, CPN Region. EFO is the primary operations center for the Columbia Basin SCADA network, a water delivery project that services 671,000 acres, maintains over 300 miles of main canals, 2,000 miles of laterals, and 3,500 miles of drains and wasteways. The secure remote access solution will replace an existing Virtual Private Network (VPN) solution. This solution will provide continued secure remote access to the Columbia Basin SCADA network for approximately 50 Reclamation and Water District employees using the existing remote access solution.

3.0 Requirements and Salient Characteristics

1) The contract provides continued support to the existing remote access solution.

2) Vendor will provide a secure remote access solution that meets all the following salient characteristics listed below. Vendor response will include details as to how these requirements are met.

a) The solution must support multi-factor authentication. Multi-factor authentication

(MFA) requires a remote user to provide a secondary verification method, other than traditional username and password, before being granted access to the ICS network environment.

b) The solution must encrypt all data in accordance with Federal Information Processing Standard (FIPS) 140-3. Encryption for this use case refers to the protection offered to information while in transit between the remote user and the ICS network environment and prevents information that may be intercepted from being deciphered by a third party.

c) The solution must provide all granular access control requirements below. Granular access control refers to the ability to limit authenticated users to only the resources on the OT network necessary for the individual to perform their regular duties.

i) The solution must control access by user account.

ii) The solution must control access by endpoints.

iii) The solution must control access by time range (e.g. 2 hour session limit, other schedules).

d) The solution must protect the ICS environment from untrusted computers through the use of disposable virtual machines.

e) The solution must support a gold-disk image hardened to the Reclamation requirements.

f) The solution must support all remote session management requirements below.

Remote session management refers to the ability of an administrator or operator to monitor remote sessions, and immediately terminate the remote session should unauthorized activity be detected. Logging and recording of remote sessions provide a historical event trail and screen recording of activities conducted by the user during the remote session assures non-repudiation.

i) The solution must log all sessions.

ii) The solution must be capable of forwarding session logs to Splunk.

iii) The solution must be capable of recording sessions.

iv) The solution must be capable of storing recorded sessions.

v) The solution must provide a real-time view of remote sessions.

vi) The solution must provide the ability for administrators to terminate a real-time session.

vii) The solution must support simultaneous connections to the ICS environment.

g) The solution must provide redundancy and/or failover capabilities.

h) Cloud-hosted applications must be capable of being deployed in the Department of the Interior (DOI) Enterprise Infrastructure as a Service (IaaS) environment or a FedRAMP-approved IaaS provider.

i) The solution must provide Moving Target Defense. Moving Target Defense (MTD) involves a software defined wide area network (SD-WAN), a shifting network of virtual machines that bridges two or more points. MTD protects assets from targeted attack by continuously moving, making it harder for an attacker to locate its target.

j) The solution must support log ingestion and parsing into BOR Enterprise Splunk.

k) The solution must be compliant with Section 508 of the Rehabilitation Act.

3) The Vendor will provide the architectural details of their secure remote access solution to include:

a) Hardware components

b) Software components

c) General solution architecture

d) Solution security strategy

4) The Vendor must provide remote assistance to install and implement the approved system architecture for each task order.

5) The Vendor must provide end-user and system administrator training on their proposed solution to Reclamation employees that are responsible for the solution’s use and administration.

6) If the solution will be hosted in the DOI Enterprise IaaS environment, the Vendor employee(s) supporting the task order must pass a National Agency Check with Inquiries (NACI) background investigation and acquire DOI credentials.

7) The Vendor must provide technical support for the solution 24 hours per day, 7 days per week.

8) Vendor shall limit non-security updates to the installed product to November 1st through February 28th.

4.0 Tasks

1) Design, install, and implement secure remote access solution that meets all site speci�ications listed in Section 3.0 above.

2) Provide security documentation for �inal installation, including application layer and any cloud components, as requested by RMSD staff. Documentation may include, but is not limited to:

a) System Security Plan (SSP)

b) System architecture/network diagram

c) Access control con�igurations including user/group permissions

d) List of open ports, protocols, and services

e) Baseline con�iguration for golden image

f) Patch management process

g) Firewall rules

h) Con�iguration settings

3) Provide training to system administrators and end users

a) Training shall be individualized for each water district

b) Training shall be conducted once each calendar year

c) Training shall be conducted at each of�ice site for each of the following of�ices

i) Ephrata Field Of�ice

ii) Winchester Watermaster, 9930 WA-28, Quincy, WA 98848

iii) QCBID Main Of�ice/Quincy Watermaster, 1720 Central Avenue S, Quincy, WA

98848

iv) George Watermaster, 206 Frontage Rd W, Quincy, WA 98848

v) Mattawa Watermaster, 18897 Road 24 SW, Mattawa, WA 99349

vi) Blythe Watermaster, 12606 Adams Road, Royal City, WA 99357

vii) Royal Camp Watermaster, 11522 1st Avenue SE, Othello, WA 99344

viii) Moses Lake Watermaster/Communications Shop, 514 S Buchanan Street, Moses Lake, WA 98837

ix) ECBID Main Of�ice/Othello Watermaster, 267 N 7th Avenue, Othello, WA 99344

x) Wahluke Watermaster, 8620 Hendricks Road, Wahluke, WA 99349

xi) Mesa Watermaster, 200 Pepiot Road, Mesa, WA 99343

xii) Eltopia Watermaster, 921 Eltopia West Road., Eltopia, WA 99330

xiii) SCBID Main Of�ice, 1135 E Hillsboro Street, Pasco, WA 99301

5.0 Site Speci�ications

1) Support up to 50 concurrent users

2) Support 2 user types, Administrators and Operators, with unique access requirements

3) The Ephrata Field Of�ice shall have 5 workstations for administrative level roles

4) Each water district shall have 10 workstations for operational level roles

5) One outbound internet connection with no redundancy required

6.0 Delivery

All required hardware shall be delivered, installed, and con�igured in Ephrata, Washington.

7.0 Place of Performance

Vendor must provide remote support to on-site Reclamation staff located in Ephrata, Washington.

8.0 Period of Performance

1 year, plus 4 option years.