Splunk CISA COCO RFI.pdf

REQUEST FOR INFORMATION

FOR

DEPARTMENT OF HOMELAND SECURITY

CYBERSECURITY & INFRASTRUCTURE SECURITY AGENCY

SPLUNK ENTERPRISE LICENSES OR EQUIVALENT, AND

PROFESSIONAL SERVICES

INTRODUCTION

The Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA) is issuing a Request for Information (RFI) as a means of conducting market research to determine the availability of qualified sources.

This RFI is for planning purposes only and shall not be construed as an obligation on the part of the Government. This is NOT a Request for Quotations or Proposals. No solicitation document exists, and the Government may or may not issue a formal solicitation resulting from the responses received to this RFI.

Respondents are advised that the Government will not pay for any response expenses. All costs incurred responding to this RFI will be solely at the interested party's expense. Failure to respond to this RFI will not preclude participation in any future solicitation. Any information received will become the property of the Government and will not be returned to the submitter. Interested parties are responsible for adequately marking proprietary or sensitive information.

Government technical experts drawn from staff within CISA, and other federal agencies may review responses. The Government may use selected support contractor personnel to assist in the review of the RFI responses. These support contractors will be bound by appropriate non-disclosure agreements to protect proprietary information.

PROGRAM BACKGROUND

The DHS, CISA, Cybersecurity Division (CSD), Threat Hunting (TH) sub-division, and Capabilities, Data, and Integration (CDI) is CISA’s front line in proactively hunting for malicious cyber activity and responding to cyber incidents. CDI’s mission supports CISA by serving as the CISA’s primary operations arm in executing the asset response mission delegated to CISA in Presidential Policy Directive (PPD), PPD-41 United States Cyber Incident Coordination.

REQUIRED CAPABILITIES

CISA TH is seeking respondents that can provide Splunk Enterprise License or equivalent network analysis software tool to search, monitor, and analyze high volumes of machine generated data. The software has advanced searching capabilities, which allows analysts to quickly find, transform, and present data in ways that other tools cannot. Splunk also contains easy-to-use visualization tools for displaying the captured machine data in charts, graphs, and tables that can be used for dashboards and reporting. Additionally, Splunk is an integral part of CDI’s customized engagement kits. An engagement kit, also referred to as a customized “field kit” or “fly away kit”, is a collection of network taps, servers, and storage arrays, along with supplemental equipment used for hunt and incident response activities at a customer’s location.

These kits are designed and built in-house and are based on CDI’s unique requirements for each to be provisioned and deployed into networks of disparate sizes, to be able to collect an array of data at various capture rates, and to be able to sanitize the customer information from the kits after each engagement.

ELIGIBILITY

The applicable NAICS code for this requirement is 541519 - Other Computer Related Services;

with a Small Business Size Standard of $34M. The Product Service Code is 7A21 IT and Telecom - Business Application Software (Perpetual License Software)

Note: In accordance with DHS Directive 060-01, Development and Use of Strategic Sourcing Contract Vehicles, dated 24 August 2012, strategic sourcing vehicles are mandatory for use, with limited exceptions. Therefore, a strategically sourced contract vehicle will take priority over awarding a standalone CISA contract.

SUBMISSION DETAILS

Interested respondents should submit a capability statement package (up to five 8.5 x 11-inch pages, font no smaller than 10 points, Microsoft Word, or Portable Document Format (PDF)) demonstrating the ability to provide the services listed in this announcement.

Submit responses electronically to Edward Cho, edward.cho@cisa.dhs.gov and Hannah Moussa, hannah.moussa@cisa.dhs.gov on April 19, 2024, at 2:00 p.m. Eastern Standard Time (EST).

Note: The Government reserves the right to hold one-on-one meetings resulting from RFI responses received as part of its market research. Meetings may be held with companies who provide comprehensive and relevant responses to the topic and questions in this notice.

Please respond to the following questions within your submission:

1. Provide up to two contracts, performed within the last three years under which you have provided Splunk Enterprise Licenses or equivalent licenses to search, monitor, and analyze high volumes of machine generated data. For each contract, describe the complexity, scope, and duration of the work.

2. Has your company provided a variety of Splunk Enterprise Term Licenses for the use of Government’s field kits, lab environments, testing and development, and/or training proposes within the last three years? If yes, please provide an example.

3. Provide up to two contracts, performed within the last three years under which you have staffed TS-cleared (SCI-eligible) of Splunk professional services support for implementation and adoption of Splunk. For each contract, describe the complexity, scope, and duration of the work.

If your organization has the potential capacity to provide the required services, provide the following information:

1. Organization name, UEI, CAGE code, Business size (large or small) and socio-economic status (i.e., 8(a), Small Disadvantaged, HUBZone, Service-Disabled Veteran-Owned, Women-Owned Small Business, etc.), address, primary points of contact (POCs) and their email address, web site address, telephone number.

2. Identify any strategic sourcing vehicles or federal supply schedules your company holds.

3. State whether your company holds a Top-Secret facility clearance.

4. Tailored capability statements addressing the requirements of this RFI.

Furthermore, CISA’s preference is to procure services on a small business set-aside basis, to the extent possible, based on market research results.

We encourage all small businesses, in all socioeconomic categories (including, 8(a) Business Development Program, Small Disadvantage Business, Historically Underutilized Business Zone, Service-Disabled Veteran-Owned, Women-Owned Small Business concerns), to identify their capabilities in meeting the requirement at a fair market price.

All data received in response to this RFI that is marked or designated as corporate of proprietary will be fully protected from any release outside the Government.