SS_75F40126Q00036 Cybersecurity Compliance.pdf

SOURCES SOUGHT NOTICE # SS-75F40126Q00036 Cybersecurity Risk Management and Compliance Services Page 1 of 5

SOURCES SOUGHT NOTICE

Request # SS-75F40126Q00036

FOR: Cybersecurity Risk Management and Compliance Services

DEPT/AGENCY INFORMATION: Department of Health and Human Services U.S. Food and Drug Administration

Requiring Offices: Office of Digital Transformation (ODT) Office of Information Security (OIS)

GENERAL INFORMATION

The U.S. Food and Drug Administration (FDA) is issuing this source sought notice as a means of conducting market research, pursuant to FAR Part 10 Market Research, to identify potential parties from the marketplace capable of providing professional services for Cybersecurity Risk Management and Compliance Services.

This is a SOURCES SOUGHT ONLY, not a Request for Quote (RFQ) and does not commit the Government to award a contract now or in the future. The purpose of this sources sought is to identify SMALL BUSINESSES, specifically SBA certified 8(a) vendors, in the following GSA Multiple Award Schedule (MAS) categories with the capabilities to provide the services needed for this requirement.

▪ 54151S Information Technology Professional Services,

▪ 54151HACS Highly Adaptive Cybersecurity Services

Submission of any information in response to this market survey is purely voluntary and the Government assumes no financial responsibility for any costs incurred. Small businesses are encouraged to respond to this notice.

The FDA will use the results of the market research to determine if small business sources capable of satisfying the agency's requirements exist based on its response to the questions contained in this notice.

The FDA does not intend to make a selection decision or award a contract on the basis of responses.

Acknowledgement of receipt of responses will not be made, nor will respondents be notified of the outcome of the FDA's review of the information received. Additionally, the FDA does not intend to hold discussions concerning this Sources Sought with any interested parties. However, FDA reserves the right to contact vendors if additional information is required.

Respondents will not receive individualized feedback on any suggestions. No basis for claims against the United States government shall arise as a result of a response to this request for information or from the United States government's use of such information. Proprietary, classified, confidential, or sensitive information should not be included in your response. The Federal Government reserves the right to use any non-proprietary technical information in any resultant solicitation(s). Information obtained because of this notice may be used by the FDA for program planning on a non‐attribution basis.

SOURCES SOUGHT NOTICE # SS-75F40126Q00036 Cybersecurity Risk Management and Compliance Services Page 2 of 5

FDA will not award a contract based on responses nor otherwise pay for the preparation of any information submitted or FDA’s use of such information. Responses to this notice are not offers and cannot be accepted by the Federal Government to form a binding contract.

Eligibility in participating in a future acquisition does not depend upon a response to this notice.

Responses will be reviewed only by FDA personnel and will be held in a confidential manner. Requests for a solicitation will not receive a response.

While the Government anticipates establishing a contract for the FDA BIMO Inspections and Compliance Support which requires contractual support, A SOLICITATION IS NOT CURRENTLY AVAILABLE. The Government is not obligated and will not pay for any information received from potential sources as a result of this Sources Sought.

INSTRUCTIONS

Responses should not exceed 10 pages in length. A complete response should include answers to all the questions below. Please note that a respondent's failure to provide a complete response to a question will be interpreted to mean that it does not understand the question and does not demonstrate the capability to provide services required. Responses should demonstrate capability, not merely affirm the respondent's capability (i.e. the response must go beyond the statement that, "XYZ company can provide technical support").

Response Due Date/Time: February 4, 2026 by 2:00 PM ET

Email to: michelle.dacanay@fda.hhs.gov

Please include the sources sought number and requirement name in the subject line. No phone calls will be accepted for this notice.

CAPABILITY STATEMENTS

Interested, capable vendors (parties) are invited to submit a capability statement in response to this notice tailored to the information requested, taking into consideration the background information provided along with the draft statement of work provided.

Respondents should include, but are not limited to, addressing their experience and capabilities in the following areas:

1) Contact information:

▪ Company Name

▪ UEI

▪ Mailing Address

▪ Name, telephone number, and e-mail address of a point of contact having the authority and knowledge to clarify responses with Government representatives.

▪ Socio Economic Status mailto:michelle.dacanay@fda.hhs.gov

SOURCES SOUGHT NOTICE # SS-75F40126Q00036 Cybersecurity Risk Management and Compliance Services Page 3 of 5

▪ Company structure (Corporation, LLC, partnership, joint venture, etc.). Companies also must be registered in the SAM (www.sam.gov) to be considered as potential sources.

▪ GSA contract number(s) with period of performance to include option periods.

▪ Proposed NAICS for this effort

▪ Proposed GSA Schedule for this effort

▪ Provide publicly posted pricing such as price catalogs accordance with FAR Part 10 or a copy of your commercial price catalog as market research.

2) Please provide response to the following questions regard capability/experience relevant to conducting Cybersecurity Risk Management and Compliance Services:

a) Do you have experience as the primary contractor in performing security authorizations aligned with the Federal Information Security Modernization Act of 2014. If yes, please provide a brief explanation of the following:

o Contract number, Agency, Period of Performance o Activities (POA&M management, POA&M resolutions, ISCP Testing) o Provide any certifications you have for security authorizations such as DHS CISA

Assessment Evaluation and Standardization and/or FedRAMP Third Party Assessment Organization (3PAO).

o Number of Authorizations per year o Program improvements you provided

b) Regarding Ongoing Authorization (OA), explain your experience with Artificial Intelligence (AI), DHS Program Tools, and Automation and Orchestration to perform Security Assessments.

c) What experience do you have with FedRAMP?

d) Please explain your reach back to leverage partners and subcontracts for resources.

e) For a security program that consists of 100 security authorizations that are currently managed on a three year cycle, please propose:

o Staffing level o Labor categories o Approach

f) Please provide your experience as an auditor for Department of Homeland Security (DHS), HHS Office of Inspector General (OIG), Government Accountability Office (GAO), and A-123 activities.

3) Please provide any comments, feedback, or suggestions based on the information provided under this sources sought notice.

SOURCES SOUGHT NOTICE # SS-75F40126Q00036 Cybersecurity Risk Management and Compliance Services Page 4 of 5

BACKGROUND

The U.S. Food and Drug Administration (FDA) is responsible for protecting the public health by assuring the safety, efficacy and security of human and veterinary drugs, biological products, medical devices, the nation’s food supply, cosmetics and products that emit radiation. The FDA is also responsible for advancing the public health by helping to speed innovations that make biologics, medicines, and foods more effective, safer, and more affordable; and helping the public access accurate science-based information for drug products and foods.

The FDA’s mission is to ensure the safety purity, potency, and effectiveness of all regulated products.

The agency is committed to providing the public with accurate, timely and easy to understand information on agency policies, programs, and actions.

Cybersecurity is a top priority at the U.S. Food and Drug Administration (FDA), and we take seriously our responsibility to protect industry and public health information in today’s environment of increased cybersecurity risks. Our Cybersecurity, Counterintelligence, and Insider Threat Program is comprised of highly skilled cyber professionals actively identifying and thwarting cyber threats, vulnerabilities, and risks to FDA’s IT infrastructure encompassing over 20,000 end users, High-Value Assets, and almost 400 production/pre-production systems and applications.

Our Cybersecurity, Counterintelligence, and Insider Threat Program’s mission is to provide real-time cybersecurity capabilities and risk management methodologies to protect sensitive data and information systems in support of the FDA’s public health missions. Our vision is to provide a best-in-class, intelligence-driven cybersecurity program that directly supports the FDA’s mission to protect and promote U.S. public health. FDA’s cybersecurity program remains progressively focused on enterprise-wide cyber defenses.

Presidential Executive Order (EO) 14028, Improving the Nation’s Cybersecurity, issued May 2021, directs agencies to modernize their cybersecurity capabilities. FDA is enhancing our cybersecurity protections by implementing Zero Trust, secure cloud computing, multi-factor authentication, encryption, threat detection, vulnerability management, and other cyber defense capabilities. Our FDA Cybersecurity Modernization Action Plan (CMAP), Presidential Executive Order 14028 Improving the Nation’s Cybersecurity, Office of Management and Budget OMB M-22-09 Moving the U.S. Government Toward Zero Trust Cybersecurity Principles, and other cybersecurity initiatives align with the FDA’s Cybersecurity Strategic Plan 2024- 2027. These efforts also support the FDA’s Technology Modernization Action Plan, Data Modernization Action Plan, and Enterprise Modernization Action Plan.

Security Authorizations and Assessments represents the Governance pillar of the Zero-Trust framework and directly supports the Federal Information Security Modernization Act (FISMA) requires the FDA to officially authorize and maintain the authorization of systems (Major Applications, General Support Systems and supporting components) that store, process or transmit Federal data. As defined by FISMA, these “FISMA Reportable Systems” support the operations and assets of the FDA. The FDA Security Authorizations and Assessment is comprised of both on-premises and cloud system which require FedRAMP certifications.

The decision to authorize a system's operation is based on knowing the risks associated with its operation. To determine the risk, the system's applicable security controls must be tested and then analyzed against known threats and countermeasures installed on the system. This includes the

SOURCES SOUGHT NOTICE # SS-75F40126Q00036 Cybersecurity Risk Management and Compliance Services Page 5 of 5 assessment of systems technical, operational, and management controls; control deficiency tracking using plans of actions and milestones; validation of remediation; penetration testing; and privacy protections with incident detection, reporting, tracking, and mitigation assurance. After the initial and annual assessments, results are entered into the FDA’s FISMA tracking and inventory tool where identified vulnerabilities and pertinent system data is monitored on an ongoing basis.

BACKGROUND CYBERSECURITY COMPLIANCE

The FDA Cybersecurity Counterintelligence and Insider Threat Program provides governance and oversight of the FDA Information Technologies and provides assessments of risk to the FDA Information Technology program. The program provides a best-in-class, intelligence-driven cybersecurity program that directly supports the FDA’s mission to protect and promote U.S. public health.

The FDA has implemented a mature, successful cybersecurity program aligned with the federal NIST Cybersecurity Framework (CSF) and DHS Zero Trust framework with a focus on cyber capabilities, compliance, and workforce development. Success is defined by a commitment to excellence and the ability to provide strategic communications that support the FDA’s public health mission.

PURPOSE

The scope of this contract is to procure the technical and management services necessary to develop and provide system security authorization packages in accordance with the Federal Information Security Modernization Act (FISMA) 2014, HHS, OMB, NIST Special Publications 800 series guidance document and NIST Federal Information Processing Standards (FIPS). In addition to NIST SP 800-53 controls, the contractor must ensure that FDA High Value Asset’s comply with the Department of Homeland Security’s High Value Asset Control Overlay.

The purpose of the FDA’s Cybersecurity Compliance Blanket Purchase Agreement is to achieve the following objectives:

1) Ongoing security authorization services

2) Learning Management System (LMS) support services for mandatory training

3) Security Policy and Data Call Support

4) Enterprise Governance Risk and Compliance (eGRC) Support Services

5) Cybersecurity Risk Management Documentation Services

6) Transition In or Out Services