Amendment_1 Sources Sought .pdf

SOURCES SOUGHT NOTICE # FDA- Page 1 of 6

SOURCES SOUGHT NOTICE

Amendment_1 Request # FDA-SS-75F40126Q00333

FOR: Office of Digital Transformation (ODT)

DEPT/AGENCY INFORMATION: Department of Health and Human Services/U.S. Food and Drug Administration

Requiring Offices: Office of Information Security (OIS)

GENERAL INFORMATION

The U.S. Food and Drug Administration (FDA) is issuing this source sought notice as a means of conducting market research, pursuant to FAR Part 10 Market Research, to identify potential small business from the marketplace capable of providing professional services for the Office of Digital Transformation as well as the Office of information Security (OIS) to provide NextGen Cyber Engineering, Operations, AI, and Unified Services.

This is a SOURCES SOUGHT ONLY, not a Request for Quote (RFQ) and does not commit the Government to award a contract now or in the future. The purpose of this market research is to identify SMALL BUSINESS OFFERORS on GSA MAS Schedule 54151S Information Technology Professional Services or 54151HACS Highly Adaptive Cybersecurity Services with the capabilities to provide the services stated herein.

Submission of any information in response to this market survey is purely voluntary and the Government assumes no financial responsibility for any costs incurred.

The FDA will use the results of the market research to determine if small business sources are capable of satisfying the agency's requirements based on their response to the questions contained in this notice. The FDA does not intend to select or award a contract based on responses.

Acknowledgement of receipt of responses will not be made, nor will respondents be notified of the outcome of the FDA's review of the information received. Additionally, the FDA does not intend to hold discussions concerning this sources sought with any interested parties. However, FDA reserves the right to contact vendors if additional information is required.

BACKGROUND

Cybersecurity is a top priority at the U.S. Food and Drug Administration (FDA), and we take seriously our responsibility to protect industry and public health information in today’s environment of increased cybersecurity risks. Our Cybersecurity, Counterintelligence, and Insider Threat Program is comprised of highly skilled cyber professionals actively identifying and thwarting cyber threats, vulnerabilities, and risks to FDA’s IT infrastructure encompassing over 21,000 end users, 4 prominent public-facing applications, and 413 production/pre-production systems and applications. The FDA Office of Digital Transformation (ODT) recognizes the risks associated with operating a global information technology enterprise in support of our public health mission. Over the past decade, our FDA Cybersecurity, Counterintelligence, and Insider Threat Program has evolved from a program under congressional scrutiny to an award-winning organization at the forefront of federal healthcare cybersecurity.

SOURCES SOUGHT NOTICE # FDA- Page 2 of 6

FDA is a prime and persistent target for cybercrime and economic espionage due to trillions of dollars of value in industry trade secrets, confidential, and other commercial and intellectual property within our IT enterprise. Nation state actors, such as Russia, China, and Iran, along with trusted insiders and transnational criminal organizations are continuously developing advanced technical capabilities to thwart FDA’s cyber defenses and those of partner agencies via third party contractors, as evidenced by the massive SolarWinds hack, the ransomware attack on a third party hired by the Centers for Medicare and Medicaid Services (CMS) that resulted in the loss of PII of over 2.8 million individuals, and the zero-day exploit targeting two HHS contractors at the Center for Disease Control and Prevention (CDC) and the National Institutes of Health (NIH) that resulted in the loss of PII for over 1.88 million individuals. Additionally, we have witnessed significant increases in ransomware and other cyberattacks within the healthcare sector, to include hospitals, pharmacies, and health care providers. The threats, vulnerabilities, and risks to our critical assets remain high and pose significant risk to our FDA public health mission and reputation as a world health leader, as well as to U.S. National and Economic Security.

In January 2022, the FDA Cybersecurity program established the “FDA Zero Trust Cybersecurity Network Defense Implementation Plan” to transform the program toward Zero-Trust principles. Zero Trust is a cybersecurity paradigm shift focused on asset protection and the premise that trust is never granted implicitly but must be continually evaluated. Zero Trust architecture is an end-to-end approach to enterprise resource and data security that encompasses identity and access management, operations, endpoints, hosting environments, and the interconnecting infrastructure. Traditionally, an agency’s cybersecurity construct focuses on perimeter defense and authorized users are given access to a broad collection of resources once inside the internal network, whereas Zero Trust is a new framework designed to meet the security considerations of our hyper-connected digital world as perimeters have essentially dissolved for most modern enterprises. The FDA has implemented a mature, successful cybersecurity program aligned with the federal Cybersecurity Framework and a focus on cyber capabilities, compliance, and workforce development. Success is defined by a commitment to excellence and the ability to provide strategic communications that support the FDA’s public health mission.

SCOPE

The FDA Cybersecurity Program requires a scalable, enterprise-wide solution to support cybersecurity engineering, operations, identity management, artificial intelligence (AI), and emerging technologies across a complex hybrid environment.

The FDA is looking for an offeror to provide the following services:

• Cybersecurity Engineering and Platform Modernization

• Cybersecurity Operations (SOC/NOC) and Threat Management

• Identity, Credential, and Access Management (ICAM)

• Artificial Intelligence (AI) and Automation

• Post-Quantum Cryptography (PQC)

The BPA will support a Zero Trust-aligned, data-driven, and highly automated cybersecurity environment to protect FDA’s mission-critical systems and sensitive public health data.

PURPOSE

SOURCES SOUGHT NOTICE # FDA- Page 3 of 6

This is a Sources Sought Notice issued by the U.S. Food and Drug Administration (FDA) to determine the availability and technical capability of qualified small businesses to support NextGen Cyber Engineering, Operations, AI, and Unified Services.

The purpose of this notice is to:

• Conduct market research in accordance with the Federal Acquisition Regulation Part 10

• Assess industry capabilities to deliver integrated, enterprise-wide cybersecurity services

• Evaluate the feasibility of a small business set-aside acquisition strategy

• Obtain feedback on technical approaches, innovation, and teaming structures

INSTRUCTIONS

Responses should not exceed 15 pages in length. including any appendices. A complete response should include answers to all the questions below. Please note that a respondent's failure to provide a complete response to a question may limit FDA’s ability to fully assess the respondent’s capabilities in that area.

Merely stating that the organization can perform the work, without supporting information, may limit the Government’s ability to assess the respondent’s capabilities for market research purposes.

Respondents will not receive individualized feedback on any suggestions. No basis for claims against the United States government shall arise as a result of a response to this request for information or from the United States government's use of such information. Proprietary, classified, confidential, or sensitive information should not be included in your response.

Confidentiality No proprietary, classified, confidential, or sensitive information should be included in your response. The Government reserves the right to use any non-proprietary technical information in any resultant solicitation(s).

Notice of Intent Responses to this source sought announcement will assist the Government in determining whether or not any future requirement similar to this one should be set aside for small business or made available to full and open competition or procure through sole-source acquisition procedures.

Disclaimer and Important Notes This notice does not obligate the Government to award a contract or otherwise pay for the information provided in response. The Government reserves the right to use information provided by respondents for any purpose deemed necessary and legally appropriate. Any organization responding to this notice should ensure that its response is complete and sufficiently detailed to allow the Government to determine the organization’s qualifications to perform the work. Respondents are advised that the Government is under no obligation to acknowledge receipt of the information received or provide feedback to respondents with respect to any information submitted. After a review of the responses received, a pre-solicitation synopsis and solicitation may be published in sam.gov. However, responses to this notice will not be considered adequate responses to a solicitation.

How to Respond

Interested Parties shall submit their capability statement no later than September 10, 2026, by 2:00pm ET

SOURCES SOUGHT NOTICE # FDA- Page 4 of 6 p.m. (Eastern Time). Reference FDA-SS-75F40126Q00333, via email to Nakita.Archibald@fda.hhs.gov and CC. Natasha Abbington at Natasha.Abbington@fda.hhs.gov

Requested Information

1. Provide a brief corporate profile of your company to include the following:

Contact information:

1. Organization's official name and dba name, if applicable.

2. Length of time the Organization has been in business.

3. Types of services provided by your organization.

4. Types of clients by industry (i.e. Federal, Commercial, Local Government, etc).

5. Is the Organization, U.S. based or International.

6. Is the Organization a subsidiary of another Organization.

7. Unique Entity Identifier (UEI), DUNS number and CAGE number.

8. Organizations website address.

9. Main point of contact name, phone number, and email address.

10. SBA size designation information and small business socioeconomic status, including whether the organization is certified or self-certified (e.g., Small Business, Woman- Owned Small Business (WOSB), Economically Disadvantaged WOSB (EDWOSB), 8(a), HUBZone, Service-Disabled Veteran-Owned Small Business (SDVOSB), Veteran-Owned Small Business (VOSB), or other applicable designation);

11. Number of employees in the organization.

12. Organization's most recent annual receipts amount as defined by the SBA.

13. Relevant Experience and Organizational Maturity: Describe your organization’s experience as the prime contractor that is comparable in scope, complexity, and scale to the requirements described in Attachment #1, Statement of Work (SOW), for the NextGen Cyber Engineering, Operations, AI, and Unified Services BPA.

Provide one (1) example of a Federal-scale Cyber operations effort where your organization served as the prime contractor. Offerors should identify the Federal organization(s) where similar work was performed and describe demonstrated successes relevant to SOW task areas.

The example should be high level and focus on the similarity of the work performed, rather than contract performance evaluation. At a minimum, include:

• Contract or project title and sponsoring Federal organization

• General scope of work and services provided as the prime contractor

• Period of performance

• How the effort is comparable in size, scope, and complexity to the NextGen Cyber

Engineering, Operations, AI, and Unified Services BPA requirements mailto:Roosevelt.walker@fda.hhs.gov mailto:Vivianna.Diaz@fda.hhs.gov

SOURCES SOUGHT NOTICE # FDA- Page 5 of 6

In addition, indicate whether your organization currently holds any of the following certifications for market research purposes only:

• ISO/IEC 9001:2015 and 27001:2022 Certification: Indicate whether your organization holds a current ISO/IEC 9001:2015 and 27001 certifications issued by an accredited certification body that is applicable to the organizational entity proposed to perform work similar to this BPA.

• CMMI Certification: Indicate whether your organization holds a current Capability Maturity Model Integration (CMMI) certification at Maturity Level 3 or higher, applicable to Development and/or Services.

Please provide high level response to the following questions regarding capability/experience relevant to NextGen Cyber Engineering, Operations, AI, and Unified Services as referenced in the BPA SOW.

A. Integrated Cybersecurity Delivery Across all Domains

Describe your approach to delivering integrated cybersecurity services across engineering, operations (SOC/NOC), ICAM, and AI/automation domains and environments (on-premises, cloud, hybrid).

• Cybersecurity Platform Integration & Data Strategy

Describe your methodology for integrating enterprise cybersecurity platforms, including SIEM, SOAR, EDR, ICAM, cloud platforms, and vulnerability management tools.

B. Automation and Orchestration - Security Orchestration, Automation, and Response

(SOAR)

Describe your approach to implementing enterprise-wide automation workflow and orchestration.

• Provide examples of automated workflows (e.g., incident response, vulnerability remediation, identity enforcement).

C. AI/ML-Enabled Cybersecurity

Describe how your organization applies Artificial Intelligence (AI) and Machine Learning (ML) to cybersecurity operations, including SOC/NOC monitoring, incident response, threat hunting, and ICAM.

D. Teaming & Small Business Participation

Provide your proposed teaming structure, including roles and responsibilities of partners. How will the prime maintain programmatic and technical control?

E. Identity, Credential, and Access Management (ICAM)

ICAM is a foundational capability underpinning all Zero Trust pillars within the FDA. Describe your organization's experience designing, implementing, integrating, and operating enterprise ICAM programs in a federal agency.

F. Contractor Staffing for 24x7x365 (Remote and On-Site)

SOURCES SOUGHT NOTICE # FDA- Page 6 of 6

The FDA requires 24x7x365 cybersecurity operations. provide a brief description how you would support a 24x7x365 workforce for cybersecurity operations, including shift coverage, surge capacity planning, and key personnel succession.

Attachment: DRAFT SOW