FY24 Cyber Assessment Tool – Automated (Picus Security)

The Marine Corps Tactical Systems Support Activity (MCTSSA) is publicizing this SOURCES SOUGHT NOTICE as a means of conducting strategic market research. 

THIS IS NOT A REQUEST FOR PROPOSAL (RFP) OR INVITATION FOR BID (IFB) and shall not be construed as a commitment by the Government to issue a solicitation or ultimately award a contract.  Responses will not be considered as proposals, nor will any award be made as a result.  The Marine Corps will not be responsible for any costs incurred by interested parties in responding to this notice. 

This is a RFI only to determine potential business sources that are interested-in and capable-of providing the Picus Security brand name automated software tool products listed below:

• Air-gapped Platform | Maintenance support for air-gapped deployments (Qty: 1)
   
• Attack Path Validation Base | Reveals and validates high-risk attack paths to critical assets, limiting the number of hosts discovered during assessments to the maximum number of hosts licensed. (Qty: 1,000)
   
• Attack Surface Validation | Cyber Asset Inventory for subscribed devices (includes integrations with AD, SCCM, Crowdstrike EDR,Tenable.sc and more coming) Up to 2500 assets. (Qty: 1)
   
• Complete Security Posture Bundle with Detection Analytics | Includes all attack modules (Network Infiltration, Email, Web Application, Endpoint, Data Exfiltration). Agents included: 10 simulation, 2 attacker. (Qty: 1)

These Picus Security brand name products will be utilized by the MCTSSA Cyber Assessment Branch to increase the effectiveness of cyber assessments by automating adversarial actions that could target United States Marine Corps (USMC) programs of record. The tools also include custom integrations that allow operators to upload custom scripts.

The information provided in this Sources Sought is subject to change and is not binding on the Government.  MCTSSA has not made a commitment to procure any of the items discussed, and release of this Sources Sought should not be construed as such a commitment or as authorization to incur costs for which reimbursement would be required or sought. All submissions become Government property and will not be returned.

The Government is seeking to identify qualified, experienced, and interested potential business capable of providing the Picus Security brand name or equal to the products listed above. 

The responses received from interested contractors will assist the Government in determining the appropriate acquisition method.

All interested parties are invited to respond and must be currently registered in System for Award Management (SAM). 

The information requested by this Sources Sought will be used within the Government to facilitate decision making and will not be disclosed outside the Agency.  Should a future requirement evolve from this preliminary planning process, it is anticipated that a Firm-Fixed Price contract will be awarded.

RESPONDENTS MUST NOT INCLUDE CLASSIFIED INFORMATION IN THEIR RESPONSE TO THIS RFI.

Telephone inquiries will not be permitted, entertained, accepted, or acknowledged, and respondents should not expect feedback regarding their capability submissions.  However, entities may be invited to participate in a follow-on meeting with the Government for a question/answer session to further assist in the overall market research for this requirement. 

Entities that consider themselves to be qualified to providing the brand name or equal to the products listed above are encouraged to submit their responses to this Sources Sought Notice via email with the Subject line:  Response to M68909-24-I-7613 to kendel.phillips@usmc.mil. 

RESPONSES DUE:  12:00 PM (PACIFIC STANDARD TIME), 8 APRIL 2024

Capability Statements must address the following:

• Company Name and Address
• Business Size
• Point of Contact (POC) information and email
• Telephone Number and Fax Number
• Set-aside, CAGE Code, DUNS Number and UEI Number
• Part numbers of each product

Any organization responding to this Sources Sought Notice should ensure that its response is complete and sufficiently detailed to allow the Government to determine the organization's qualifications to providing the brand name or equal to the products listed at the beginning of this RFI. 

Formatting:

Entities responding to this Sources Sought Notice MUST identify any data submitted that must not be disclosed outside the Government or that must not be duplicated, used, or disclosed – in whole or in part – for any purposes other than for the purposes set forth herein.

Please provide all responses in searchable .PDF Format.  There is no specified format for the responses and shall not be limited to any length of pages but type font shall be no smaller than 12 point.  All responses should be unclassified and reviewed to ensure consideration of operational sensitivities.  Proprietary information will be accepted and handled appropriately.  Responders should indicate which portions of their responses are proprietary and should mark them accordingly.