Firmware Analysis
Limited / Sole Source Justification Posted
- Solicitation number
- FY23-00337
- Agency
-
Office of Procurement Operations
Department of Homeland Security
- Set-aside
- No set-aside
Opportunity facts
- NAICS code
- 541715 Research and Development in the Physical, Engineering, and Life Sciences (except Nanotechnology and Biotechnology)
- PSC
- B544 Special Studies/Analysis- Technology
- Place of performance
- Austin, Texas 78702, United States
Notice details come from SAM.gov. Updated .
About this opportunity
The U.S. Department of Homeland Security's Office of Procurement Operations intends to procure research and development services for novel firmware analysis methods, including identification and decomposition of firmware components, development of a firmware bill of materials, and creation of a cross-correlated library of firmware, devices, and supporting open-source software projects. The goal is to understand the prevalence of open-source software in order to inform decisions on prioritization and resource allocation for securing such software. The contract is expected to be awarded to an unknown vendor for an unknown amount on September 30, 2023.
List of products and services to be provided:
- Research and development services in firmware analysis methods.
- Identification of firmware components of IT and OT in post-deployment devices.
- Decomposition of firmware into various sub-components of open-source software.
- Development of firmware bill of materials.
- Analysis and decomposition of firmware.
- Identification of dependencies amongst open-source software.
- Development of a cross-correlated library of firmware, associated devices, and supporting open-source software projects and libraries.
- Capability to analyze firmware images at scale.
- Library of cross-correlated software dependencies with a platform to execute firmware image analysis at scale.
- Production of Software Bill of Materials in Software Package Data Exchange format.
- API-centric solution for interoperability with other platforms.
Notice text
The U.S. Department of Homeland Security's (DHS) Office of Procurement Operations (OPO) intends to procure research and development services in the area of novel firmware analysis methods. The scope of work includes the idenfiticaiton of firmware components of information technology (IT) and operational technology (OT) amongst post-deployment devices, along with decomposing firmware into various sub-components of open-source software (OSS) for development of firmware bill of materials (FBOM) across a prevalence of OSS in use.
This effort addresses requirements to analyze and decompose firmware, identify dependencies amongst OSS, and develop a cross-correlated library of firmware, associated devices, and supporting OSS projects and libraries used in OT and IoT. Expertise in firmware image analysis and identification of nested dependencies, including OSS dependencies, is a necessary skillset required for this potential scope of work. Analysis of firmware, while predominantly based on the vendor-provided or otherwise available images, should allow for the possibility of firmware image capture from devices post-deployment.
Succesful fulfillment of this requirement is expected to build a capability to analyze firmware images at scale with a horizontal and vertical lookup of what assets run software and firmware that calls the same OSS. This requires a library of cross-correlated software dependencies with a platform to execute the requisite firmware image analysis at scale and produce SBOMs in Software Package Data Exchange (SPDX) format. In addition, it requires an API-centric solution for interoperability with other platforms.The overarching goal is to understand OSS prevalence in order to inform decisions on OSS prioritization and resource allocation to securing OSS.
The market research for this requirement demonstrates that only one responsible source is available, and no other supplies or services will satisfy agency requirements.
Awarded contract (TBD) to unknown vendor for unknown amount on 2023-09-30.
On GovTribe
Work this opportunity
- Track it in your pipeline
- Find teaming partners
- Similar opportunities
- Ask GovTribe AI about this opportunity