VDP Follow On RFI.pdf

REQUEST FOR INFORMATION (RFI)

Subject: Market Research for Vulnerability Disclosure Program (VDP) Enterprise Management System

1.0 INTRODUCTION

This is a Request for Information (RFI) only. This RFI is issued solely for information and planning purposes and does not constitute a solicitation. It shall not be construed as a commitment by the Government to enter into a contractual agreement. Submission of any information in response to this RFI is voluntary, and the Government will not reimburse respondents for any costs associated with the preparation or submission of responses.

The Government is conducting market research to determine the availability and technical capabilities of potential sources for an enterprise management system to support the Department of Defense (DoD) Cyber Crime Center's (DC3) Vulnerability Disclosure Program (VDP) and Defense Industrial Base (DIB) VDP. This market research will assist in determining the acquisition strategy for this requirement.

2.0 BACKGROUND

The DoD's computer networks and systems are critical to national security. Maintaining the security, confidentiality, availability, and integrity of these networks and systems requires the continuous identification and remediation of vulnerabilities. The DC3 Security office manages a comprehensive VDP to enhance the security of the DoD Information Network (DoDIN) and Defense Industrial Base (DIB) networks, leveraging crowdsourced cybersecurity expertise.

3.0 REQUIREMENT

The Government is seeking information on enterprise management systems that can facilitate collaboration, compliance, and management of a VDP. Please refer to the attached draft Performance Work Statement (PWS) for a detailed description of the requirements.

4.0 INFORMATION REQUESTED

Interested parties who believe they are qualified to provide the required products and services are invited to submit a response to this RFI. Responses should include the following information:

4.1 Company Information:

• Company Name

• Address

• Cage Code

• Website URL

• Point of Contact (including phone number and email address)

• Business Size (Small or Large Business) – Please specify any applicable socio-economic categories (e.g., SDVOSB, WOSB, etc.)

4.2 Statement of Capabilities: Provide a clear and concise statement of your company's capabilities to meet the requirements outlined in the attached draft PWS. This should include:

• A description of your company's experience providing similar solutions.

• A detailed explanation of how your solution addresses the specific requirements in the PWS, including:

o Seamless integration, via API, with Atlassian Jira-based systems (DC3’s Vulnerability Report Management Network (VRMN) on the NIPRNet and SIPRNet and the DIB VRMN server). Please describe your experience integrating with Atlassian Jira via API.

o The ability to exchange vulnerability report data and associated artifacts in JSON format. Please specify the ability to handle artifacts that are text, images, Python script, JavaScript, GO, video, dlls.

o Mediation service capability as described in the PWS.

o Implementation of CVSS scoring.

o The ability to provide a project page that outlines DC3-VDP policy, rules of engagement, and lanes in the road for researchers to read and accept.

o Support for the full lifecycle of vulnerability reports (receiving, triaging, and closing).

o The ability to set a severity level to a report and communicate with the researcher who issued the report.

o The ability to provide analytics and reporting on the specific criteria listed in the PWS (reports received, time to close, time to remediate, severity types, CVSS scores).

o A description of your proposed account team structure, support response times, and meeting schedule to ensure they meet the PWS requirements.

• Information on your solution's key features and functionalities.

• Information on your security certifications and compliance with relevant standards (e.g., FedRAMP, SOC 2).

• Any innovative approaches or technologies that differentiate your solution.

4.3 Feedback on Draft PWS: The Government is particularly interested in receiving feedback on the attached draft PWS. Please provide any comments, suggestions, or concerns you may have regarding the requirements.

4.4 Inability to Bid: If your company does not believe it can bid on this requirement as currently written, please explain the reasons why. Specifically, identify any aspects of the PWS that would prevent you from submitting a proposal and provide suggestions for how the PWS could be modified to make it more suitable for competition.

5.0 NAICS CODE

The Government anticipates that the appropriate North American Industry Classification System (NAICS) code for this requirement is 541519. The size standard is $34M. Please provide comments on this NAICS code and suggestions for an alternative NAICS code, if applicable, with supporting rationale.

6.0 SUBMISSION INSTRUCTIONS

Interested parties should submit their responses electronically via email to the Contracting Officer, Phelicha D. Silva, at phelicha.silva@us.af.mil and the Contract Specialist, Ryan D.

Amos, at ryan.amos.ctr.5@us.af.mil.

Responses must be received no later than 10 July 2025 at 2:00 pm Eastern Time.

7.0 IMPORTANT NOTES

• Email submissions are subject to size and type restrictions (typically limited to less than 3 pages and only non-executable attachments such as .doc, .docx, .pdf files, etc.) as well as any other appropriate network security measures.

• It is the respondent's responsibility to verify that the email was received and can be viewed.

• Proprietary information should be clearly marked. The Government will protect proprietary information to the extent permitted by law.

• All data received in response to this RFI that is marked or designated as corporate or proprietary will be fully protected from release outside the Government.

8.0 ATTACHMENTS

• Draft Performance Work Statement (PWS)

We appreciate your time and effort in responding to this RFI. Your input will be valuable in shaping the Government's acquisition strategy for this requirement.