USDA RFI_Cybersecurity Supply Chain Risk Management.pdf

Request for Information Supply Chain Risk Management

USDA/OCIO/Cybersecurity and Privacy Operations Center (CPOC)

1. Purpose

The Government is conducting Market Research to identify potential sources that possess the expertise, capabilities and experience in establishing a comprehensive scalable Cybersecurity Supply Chain Risk Management (C- SCRM) Program that ensures compliance with federal regulations and mitigates the risk of compromised devices on the USDA network.

This RFI is meant to obtain information regarding the availability and capability of qualified businesses that can provide support for Cyber-Supply Chain Risk Management (C-SCRM). The information from this market research will help the government develop a firm set of requirements by understanding industry as it relates to establishing a C-SCRM program and will assist USDA in determining the appropriate acquisition method(s).

Note: This RFI is not a request for proposal (RFP). The government does not intend to award a contract based on this notice or otherwise pay for any information solicited. No solicitation is being issued at this time. Anticipated place of performance is TBD; work could possibly be done remotely and could require the contractor to have a Public Trust Background Investigation (at a minimum).

2. Background

This notice is being issued to assist the Government in market research about industry capabilities to provide supply chain risk information through provision of due diligence research based on publicly and commercially available unclassified data. Possible subjects of due diligence research include all companies directly involved in delivery of products, services, and solutions to the agency, through all tiers of the supply chain.

Cyber Supply Chain Risk Management (C-SCRM) is the process of identifying, assessing, and mitigating the risks associated with the distributed and interconnected nature of information and communications technology (ICT) product and service supply chains. It covers the entire lifecycle of a system (including design, development, distribution, deployment, acquisition, maintenance, and destruction) as supply chain threats and vulnerabilities may intentionally or unintentionally compromise an ICT product or service at any stage of the lifecycle.

The government seeks information from industry on how people, processes and technologies are complying with or preparing to incorporate C-SCRM laws, regulations, standards, policies and reporting requirements into products and services.

The government seeks information about C-SCRM as a managed service where an industry partner is expected to define the people, processes and technology necessary for the C-SCRM program’s success, outlining the roles and responsibilities, workflow processes, and technical solutions to be implemented.

The government seeks information about capabilities that enable visibility into global multi-tier supply chains, identification and mitigation of ICT C-SCRM risks in products (e.g., hardware, software, firmware, devices) that may contain potentially malicious functionality, are counterfeit, are vulnerable due to deficient manufacturing practices within the supply chain, have been tampered with or are otherwise determined to enable or constitute a threat to the United States;

capabilities that enable identification and mitigation of supply chain risks presented by ICT-based services (e.g., cloud services, managed services), as well as service providers that use ICT and the ICT contains, transmits, or processes information provided by or generated for the stakeholder to support the operations or assets of a stakeholder entity (e.g., professional services).

Capability Statement Information

Please provide a capability statement addressing your company’s knowledge, expertise and ITC C-SCRM experience, within the last three (3) years, for each of the following requirements (A) through (D) listed below. The vendor shall provide enough information for USDA to determine the capability to perform the same or similar scope of work and complexity.

Capability statements shall be limited to ten (10) pages or less in length, 12-point font with 1-inch margins, and unclassified to include cover sheet(s)

(A) Federal Regulations:

• Describe how industry’s offerings have developed and shifted with regards to the following Executive Orders: Cybersecurity Supply Chain Risk Management (C- SCRM) and Supply Chain Risk Management (SCRM); E.O. 14028, E.O. 13873

• Describe your company’s awareness of and implementation of the NIST 800- 161r1 and NIST 800-53 r5 control family frameworks, specifically the system and information integrity and supply chain risk management security control families.

(B) Describe your Cyber Supply Chain Risk Management capability:

• Describe the automated process supported by ICT C-SCRM provenance and corresponding analysis to include risk assessments and threat analysis.

• Describe how or if digital marker technology is used as an anti-counterfeit mechanism.

• Describe the scalability and extensibility – to facilitate growth and ability to add capabilities.

• Describe how your offering will promote consistency and a common approach (e.g. classification, standards and processes).

• Describe how your offering will enable information-sharing.

• Describe how your offering will minimize duplication of effort and cost from better decision-making, using a shared solution, centralized data sets, and reuse of due diligence information.

• Describe how your offering will align with ICT C-SCRM laws, policy, regulations and guidance, industry best practices and address emerging ICT C-SCRM threats.

• Describe the scalability and extensibility – to facilitate growth and ability to add capabilities; the Government would like to understand to what extent the current offering is scalable (e.g., to meet spikes in demand, accommodate increased in utilization) and “extensible” (e.g., able to be augmented with additional functionality).

• Describe “scalability” current capabilities and constraints. Description should demonstrate the respondent’s success in increasing volume of services provided without any deterioration in the quality of service.

• Describe “extensibility” current capabilities and constraints. Description should demonstrate the respondent’s success in increasing volume of services provided without any deterioration in the quality of service.

• Describe successful experience with establishing these seven SCRM Foundational Practices for agencies identified by the U.S. Government Accountability Office (GAO):

1. Executive oversight of ICT C-SCRM

2. Development of an agency-wide ICT C-SCRM

3. Identify and document agency ICT supply chain(s)

4. Department-wide Risk Assessments

5. ICT SCRM review of prospective suppliers

6. Development of organizational ICT C-SCRM requirements for suppliers

7. Detect counterfeit and compromised ICT products prior to their deployment

• Describe how your capability both inspects and evaluates AI technology or report as not applicable.

• Describe if/what AI capabilities are included in your solution as native “out of the box” functionality.

• What roadmap is available to describe the onboarding or maturing of AI related service(s) and/or capabilities?

(C) Provenance (chain of custody) Capability:

• Describe any scalable solutions and interfaces have been successfully implemented in the Federal Government market with the intent of strengthening the compliance and security of supply chain and thwart tampering, counterfeiting and grey market offerings.

• Are there solutions available to track ICT products?

• Is the solution an integrated and portable tool set, through which the Federal

Government monitors performance metrics and that allows management through roles and business rules rather than physical control of assets and direct software licensing?

(D) Due Diligence Information Capability

• Describe any options or constraints regarding accessing, aggregating, storing, reusing, or retaining due diligence information by the government.

• Do you currently offer a due diligence capability? If yes, describe, including what types of information the capability includes (e.g., financial, cybersecurity, physical security, personnel, legal, etc.).

• Describe the tool, product or system solution used to deliver due diligence information.

• Is your offering cloud-based? If yes, do you have a current FedRAMP authorization?

• Describe how you establish confidence in the authenticity of the source(s) of the data used to develop due diligence information.

• Describe the capability including information about any of following subjects.

• Testing and Evaluation

• Product or Component Vulnerability(ies)

• Search functions

• APIs

• User-Controlled Data or Files Import/Export

• Database

• Data Aggregation

• Risk Scoring

• Dashboard

• Analytics

• Network Mapping

• Other Visualizations (Describe)

• Alerts

• Automated Report Creation

• Automated Workflow

• Continuous monitoring and updating

• Archives – Access to Historic Data/Information

• Incident Management

• Describe the supporting testing and evaluation activities and support for information system authorizations.

• Describe the support provided for detailed supply chain risk assessments, audits, or investigations.

• Describe how due diligence information may be shared and/or delivered to the user and stakeholders

References (not counted towards page limit)

Interested parties having the capabilities necessary to perform this requirement may submit a capability statement. If it requires teaming with another company as prime/sub, provide both company’s information.

Business Information-

a) Company Name

b) List of related contract vehicles with associated contract number

c) Business size

d) Identify role on referenced contract as prime/sub

Include the following information for each reference utilized to demonstrate experiences and capabilities:

• Name of Contracting Activity

• Contract Number, If applicable

• Period of Performance

• Total Contract Value

• Contracting Officer, Telephone Number and email address, as applicable

• Contract Program Manager, Telephone Number and Email Address, as applicable.

Note: Please include federal government and non-government contracts that are relevant to the

RFI.