ICS Support

Added: Jul 20, 2016 1:05 pm Modified: Aug 29, 2016 8:59 pmTrack Changes This requirement is a total SDVOSB Set Aside. 

Please see attachments for information on terms/conditions, evaluation factors and performance work statement.

Questions are due on September 2, 2016 11:00AM MT.
Quotes are due on September 9, 2016 11:00AM MT. 

Christina Mohamed
CMohamed@usbr.gov
(303) 445-2110

 

Added: Jul 20, 2016 1:05 pm THIS IS NOT A SOLICITATION FOR PROPOSALS. THIS IS A SOURCES SOUGHT SYNOPSIS ONLY.

This requirement is being set aside for SDVOSB.

This Request for information (RFI) is for the USBR Risk Management Services Group (RMSG).

The USBR Risk Management Services Group (RMSG) is responsible for implementing and maintaining compliance with Federal cybersecurity requirements. The RMSG leads the Industrial Control System (ICS) Cybersecurity Program, which is responsible for establishing risk-based, consistent and repeatable processes for securing ICS based on system function and the risk the system poses to human life, property, the environment. These processes will consider ICS currently in operation and subject to improvement and modification, ICS currently in development or under construction, and new ICS deployments being considered or within the planning stage.
This RFI shall not be considered as a request for proposal or as an obligation on the part of the Government to acquire any products or services. No entitlement to payment of direct or indirect costs or charges by the Government will arise as a result of the contractor submission of this RFI or the Government's use of such information. The Government reserves the right to reject, in whole or in part, any contractor's input resulting from this RFI. No contract will be awarded as a result of this announcement. Data submitted in response to this RFI will not be returned.

• Perform ICS security assessments in support of Security Assessments and Authorizations (A&A).
• Conduct technical evaluations of ICS to identify weaknesses and recommend appropriate countermeasures.
• Conduct ICS vulnerability, risk, and threat assessments and recommend risk reduction measures.
• Identify ICS capabilities, dependencies, and component level vulnerabilities.
• Conduct security impact analyses of changes to ICS.
• Evaluate effectiveness of ICS contingency and recovery plans, exercises and training and recommend improvements to improve system resilience.
• Develop and document minimum ICS cybersecurity requirements and best practices.
• Develop continuous monitoring plans, metrics for ICS.
• Develop options and recommendations for performing centralized continuous monitoring activities on ICS that reside on isolated networks.
• Support cybersecurity process improvement initiatives to include task automation.
• Support efforts to develop ICS cybersecurity dashboards.
• Support efforts to identify, document and categorize ICS asset inventories.
• Support the development and implementation of an ICS cybersecurity strategy and implementation plan.
• Support the development of a cybersecurity framework for implementation across ICS deployments, leveraging existing cybersecurity guidance.
• Support ICS training initiatives.
• Prepare ICS-relevant briefing materials and presentations.
• Provide expertise, guidance and recommendations on ICS-relevant processes, procedures, guidance, standards and instructional materials.
• Provide periodic assistance with ICS-related data calls, analyses or other requests for information.

INSTRUCTION FOR RFI SUBMISSION:

After review of the attached documentation, interested parties may submit a response in an electronic format only via email to Christina Mohamed at cmohamed@usbr.gov no later than 25 July 2016. Electronic files should be in Microsoft Office Word or PDF format. All information should be UNCLASSIFIED material only.

Respondents should include as part of their submission:

a. A synopsis of the company's capabilities in this area. Adequate information showing these capabilities for services needed.

b. DUNS Number

c. Company Name

d. Company Address

e. Business size, SDVOSB as validated via the System for Award Administration (SAM). All offers must register on the SAM located at http://www.SAM.gov

f. Company point of contact, phone and email address.

g. Past work experience. If you have experience working with other Federal Agencies and/or commercial businesses of similar size and scope, please include agency and/or business name contract number (if applicable), amount and type of contract (e.g. FFP, T&M, Labor hour etc).

Any company proprietary information must be marked as such, the RFI information should not exceed a total of 10 one-sided 8 1/2x11 pages, with one inch margins, and font no smaller than 12 point.