VDP Request for Information.pdf

Request for Information (RFI) – CISA Vulnerability Disclosure Platform (VDP)

Agency: Cybersecurity and Infrastructure Security Agency (CISA)

Market Research Agency: General Services Administration (GSA), Federal Acquisition Service (FAS), Region

Notice Type: Posted Date:

Request for Information May 12, 2020

NAICS: 541519 Other Computer Related Services

GSA Reference: ID08200VDP1

I. GENERAL INFORMATION:

The General Services Administration (GSA), Federal Acquisition Service (FAS), Region 8 is issuing a follow-up Request for Information (RFI) on behalf of the Cybersecurity and Infrastructure Security Agency (CISA) that was posted on December 20, 2019.

II. OBJECTIVE:

The purpose of this RFI is to assist the Government in conducting market research focused on identifying potential vendors that have the ability to perform the tasks identified in the attached draft PWS. This information will be used for market research only. The Government is not obligated to release a future solicitation based on this market research. Interested respondents shall refer to the details of the response to this RFI under Section V.

III. BACKGROUND

The scope of this requirement is to provide CISA and participating Federal Civilian Executive Branch (FCEB) agencies access to an existing, commercially available SaaS platform that will provide FCEB agencies a centralized vulnerability disclosure policy platform that will standardize the submission, tracking, and routing of vulnerability reports from security researchers to the FCEB agencies for resolution. The attached draft PWS describes the task that will be performed as a part of this requirement.

IV. DUE DILIGENCE SEASSIONS:

Based on responses provided by industry, additional information may be requested. As a result, GSA with CISA, at the Government’s discretion, may schedule one-on-one meetings with industry to discuss responses to this RFI. In order to be eligible for due diligence sessions, potential offerors shall provide evidence of an existing SaaS platform. An example of sufficient evidence includes, but is not limited to, a link for a publicly accessible website where the SaaS platform is operating or via login access to a site where the SaaS platform is operating. Participation in the due diligence will be at the discretion of the Government based on evidence presented.

If a follow-up meeting is required, the Government will reach out directly to the industry partner point of contact.

Meetings could begin as early as May 27, 2020 and are not anticipated to exceed June 2, 2020.

V. RFI RESPONSE:

The Government will only consider responses from Industry Partners which intend to do the work as a Prime contractor. Responses are required to include the following information:

CONTRACTOR INFORMATION:

Contractor Name and Address

DUNS Number and NAICS Code

Socio-economic status (HUBZone, Service-Disabled-Veteran-Owned, Woman-Owned, 8(a), Small

Business, Large Business)

POC Phone and Email

GSA Schedule/GWAC Presence

Website URL

Evidence of existing SaaS platform

Contractor Notification: This RFI is for information and planning purposes only, and does not constitute a RFQ, and is not to be construed as a commitment by the U. S. Government. No award will be made as a result of this RFI. All information is to be submitted at no cost or obligation to the Government. Any information that the Contractor considers proprietary should be clearly marked as such. All submissions become Government property and will not be returned, including any proprietary information. The Government may consider additional communications with submitting companies utilizing the contact information provided in the Corporate Overview to further the Government’s market research for the Vulnerability Disclosure Platform requirement.

• All responses are to use Times New Roman font, with a 12 point font, and one inch margins, single spaced in all sections in Microsoft Word.

• Contractor Information section shall be no longer than 1 page in length.

• Contractor response to questions shall be no longer than 5 pages.

• Response to questions should be no longer than five pages.

• All information submitted shall be UNCLASSIFIED.

Questions pertaining to this RFI shall be submitted no later than 5:00pm ET on May 15, 2020, via email to Diana Zoppi at diana.zoppi@gsa.gov and Lisa Jobes at lisa.jobes@gsa.gov.

RFI responses shall be submitted no later than 5:00pm ET on May 26, 2020 via email to Diana Zoppi at diana.zoppi@gsa.gov and Lisa Jobes at lisa.jobes@gsa.gov.

Contractors who do not respond to this RFI are not excluded from any resulting solicitation(s).

mailto:diana.zoppi@gsa.gov mailto:lisa.jobes@gsa.gov mailto:diana.zoppi@gsa.gov mailto:lisa.jobes@gsa.gov