Network Detection and Response
Closed Pre-Solicitation Posted
- Solicitation number
- CTS000010
- Agency
-
Office of Acquisition Management
Department of State
- Responses due
- Set-aside
- No set-aside
Opportunity facts
- NAICS code
- Not on record
- PSC
- Not on record
- Place of performance
- Rosslyn, Virginia, United States
- Points of contact
Notice details come from SAM.gov. Updated .
About this opportunity
The Department of State's Office of Acquisition Management is seeking a Network Detection and Response (NDR) solution to enhance its cybersecurity capabilities across multiple network environments. The procurement targets a cloud-hosted Software as a Service (SaaS) solution that must be FedRamp certified and capable of monitoring diverse network types including on-premises, Azure, and AWS cloud networks. The solution must leverage advanced artificial intelligence and machine learning technologies to detect and rapidly respond to anomalous network activities, with capabilities spanning real-time traffic analysis, threat intelligence integration, and automated incident response. Key technical requirements include analyzing raw network packet traffic, aggregating alerts into structured incidents, performing behavioral detection, and integrating with external cybersecurity tools like EDR, SOAR, and Splunk. The pre-solicitation notice was posted on May 29, 2025, with responses due by June 12, 2025, indicating a relatively short response window for potential contractors.
The procurement has no specific set-aside designation, which suggests it will be open to a broad range of qualified contractors. The solution must support monitoring across multiple cloud service providers, including Google Cloud, AWS Commercial, AWS GovCloud, Azure Commercial, and Microsoft Azure Government, demonstrating the complex and comprehensive nature of the Department's cybersecurity needs. The contractor's solution must be designed for turnover to the Department's internal management, with no managed service elements beyond SaaS hosting. While specific award values are not disclosed in the pre-solicitation notice, the technical complexity and wide-ranging monitoring requirements suggest a significant contract value. The solution must cover both North/South and East/West traffic monitoring, provide forensic tools, support SSL packet inspection, and monitor assets across on-premises and cloud environments, indicating a robust and sophisticated cybersecurity procurement initiative.
Notice text
The Office of Cyber Monitoring and Operations within the Department of State’s Bureau of Diplomatic Security, Directorate of Cyber and Technology Security manages a comprehensive portfolio of cybersecurity tools deployed to secure the Department of State’s (DOS) networks and data. This document outlines the requirements supporting the technical replacement and maturation of the Enterprise Network Detection and Response.
- SCOPE
-
- Security Posture
- The DOS Cyber Protection program requires the capability to monitor network traffic to rapidly detect, assess and act upon anomalous activity on the Department’s networks. The ideal solution will baseline normal network activity, evaluate network packet metadata, and leverage threat intelligence to identify and escalate potential threat activity. The Department needs a solution that will leverage advances in Artificial Intelligence and Machine Learning to streamline threat detection and response actions.
- Monitoring and Incident Response Responsibilities
- The scope of the Department’s monitoring and incident response responsibilities encompasses a hosted environment (network) that includes but is not limited to: 1) on-prem Sensitive but Unclassified (SBU); 2) SBU Azure Cloud environments, and 3) SBU AWS cloud environments. Various applications and services are hosted through multiple cloud service models such as IaaS, PaaS, and SaaS.
- Scalable Capacity
- In addition, the Department recognizes the need for any network detection and response capability to include a strategy and scalable capacity to monitor multiple disparate environments. These environments include: air-gapped networks; dedicated internet networks (DINS); Demilitarized Zones (DMZs) hosted domestically and overseas (not connected to the enterprise network); and multiple, distinct Cloud Service Providers (CSPs) such as Google Cloud, AWS Commercial, AWS GovCloud, Azure Commercial, and Microsoft Azure Government (MAG).
- Contractor solutions shall not include managed service elements outside the scope of SaaS hosting. The contractor solution shall be turned over to the Department for daily management and operations.
- Security Posture
See attached sources sought for further details
Files
| File | Type | Posted |
|---|---|---|
| NDR Sources Sought Notice.pdf |
On GovTribe
Work this opportunity
- Track it in your pipeline
- Find teaming partners
- Similar opportunities
- Ask GovTribe AI about this opportunity