NOTICE OF INTENT TO SOLE SOURCE - Defensive Cyber Operations (DCO) Research and Supporting Elements

Synopsis - J&A for Other than Full and Open Competition & Request for Information (RFI)

NOTICE OF INTENT TO SOLE SOURCE - Defensive Cyber Operations (DCO) Research and Supporting Elements

The Government intends to solicit and negotiate with ICF Incorporated, LLC. 9300 Lee HWY Fairfax, VA 22031-6050 for research and development (R&D) and technical services to support Cyber Security Service Provider (CSSP) and its evolution in the face of a changing threat environment.

The United States Government intends to solicit and negotiate with only one source under the authority of FAR 6.302-1, Only One Responsible Source and No Other Supplies of Services will Satisfy Agency Requirements based upon the Government¹s expertise, historical knowledge and understanding of the mission space, it is estimated that it would take approximately 18 months or longer to transition a new, unfamiliar contractor with Commercial Off the Shelf (COTS) experiences and basic skills to meet Government-based applications in CSSP analysts and operational skills utilizing Government Off the Shelf (GOTS) developed analytics and technology. Breaking the transition timeline down, when considering the distributed and geographically dispersed nature of the infrastructure it will take two to three (2-3) months to merely transition control of the infrastructure. It will take another nine to twelve (9-12) months for the new staff to achieve journeyman proficiency with the infrastructure, and upwards of another year to achieve true expertise. Finally any major turnover in personnel (a real risk given the loyalty ICF staff have for their company), will require substantial time to identify, hire, and train replacements. Based on timeframes associated with normal personnel turnover, this will add an additional nine (9) months to the transition. In the very near term, the shortfall in the initial period of performance would deleteriously impact ARL's ability to sustain a high level of cyber defensive services and critically jeopardize our covered Federal Government and Department of Defense (DoD) agencies. Without direct and uninterrupted contractor support in this arena, the real time cyberattacks would be accomplished without identification, notifications, response and recovery. Systems would be allowed to exist at a lower security posture without notice, increasing the realistic opportunities to compromise them without interception. Looking further out, this delay in capabilities would have a ripple affect across the entire DoD. There are multiple initiatives and development projects, such as the Information Security Continuous Monitoring (ISCM) analytics, that ARL is specifically performing for the Department, which would not be able to be accomplished if not for the ongoing work. This transition of the ISCM is currently on-going and is slated to take between eighteen months to two (2) years. Once the transition is complete, those frameworks will be DoD-standard and thus readily available to others for future competition for this action. Delaying these types of abilities for up to two (2) years will do nothing but set the entire department back and ensure that the Department is not ready to meet the adversary of the future in cyber space falling short of the mission.

This notice of intent is not a request for competitive proposals. However, this notice functions as a Request for Information (RFI) for offeror's who believe they can meet the Government's requirement. Any responsible source who believes it is capable of meeting the requirement may submit a capability statement, proposal, or quotation, which shall be considered by the agency, only if received by the closing date and time of this notice. A determination not to compete the proposed requirement based upon the responses to this notice is solely within the discretion of the Government.

The Government does not intend to use Part 12 for this acquisition.

Responses to this notice are due on or before 17:00 EST, 01 February 2017 by email at Jessica.r.camunez.civ@mail.mil

Point of Contact for this notice is Jessica Camunez; 575-678-8283; Jessica.r.camunez.civ@mail.mil

The purpose of amendment 0003 to the subject synopsis is to extend the closing date until 16 December 2016 in order to allow all questions to be submitted concerning the industry day held 13 December 2016. This amendment will also include the powerpoint slides and interested parties list as attachments.  Submit any questions via email to Jessica Camunez at jessica.r.camunez.civ@mail.mil by 16 December 2016.

Sources Sought Synopsis:

(1) Action Code: SOURCES SOUGHT
This is a Sources Sought Notice only. This is not a request for proposal, but a survey to locate potential sources. This Sources Sought does not constitute an Invitation for Bids, Request for Proposals, or a Request for Quotations, and is not to be construed as a commitment by the Government to issue an order or otherwise pay for the information solicited, nor is it a guarantee of a forthcoming solicitation or contract. It is for market research purposes only. Respondents will not be notified of the results of the evaluation.
The purpose of this Sources Sought Notice is to gain knowledge of interest, capabilities, and qualifications of various businesses in advance of a planned solicitation for Research and Development (R&D) and technical services needed to support the CyberSecurity Service Provider (CSSP). Additionally, this Sources Sought Notice is to inform interested parties of an upcoming industry day being hosted at the Adelphi Laboratory Center, Building 205, 2800 Powder Mill Rd, 20783-1197 tentatively scheduled for 13 December 2016 at 9:00AM. The Government must ensure there is adequate competition among the potential pool of responsible contractors. As detailed below, RSVPs for the Industry Day are due NO LATER THAN 3:00 pm EST on 01 December 2016.
(2) Date : 14 November 2016
(3) Classification Code : AC62
(4) NAICS Code: 541712
(5) NAICS Size Standard: 1000 employees
(6) Contracting Office Address: US Army Contracting Command - Aberdeen Proving Ground, Adelphi Contracting Division
2800 Powder Mill Road
Adelphi, Maryland 20783
(7) Subject: Defensive Cyber Operations (DCO) Research and Supporting Elements
(8) Proposed Solicitation Number: W911QX-17-R-0006
(9) Sources Sought Closing Response Date: 1 December 2016
(10) Contact Point: Jessica Camunez, Contract Specialist, Jessica.r.camunez.civ@mail.mil
(11) A. Objective: To find sources that are qualified to meet the requirements in section 11B and 11C within the attached Performance Work Statement (PWS). Note that the specific requirements are subject to change prior to the release of any solicitation.

B. Requirements:  The Army Contracting Command-Aberdeen Proving Ground (ACC-APG), Adelphi Division on behalf of the Army Research Laboratory (ARL), is conducting market research in accordance with Federal Acquisition Regulation (FAR) Part 10. The purpose of this Market Research is to identify concerns that have the skills, experience, knowledge, and capabilities necessary to provide Research and Development (R&D) and technical services needed to support the CyberSecurity Service Provider (CSSP) and its evolution in the face of a changing threat environment. This Sources Sought is issued to communicate the ARL's program requirement to industry. ARL intends to use information gathered from these responses to gain awareness of capabilities, determine interested parties, and to support formulation of an acquisition strategy. Early industry involvement in creating a properly scaled enterprise solution is critical to the success of this contemplated acquisition.

C. Specifications:  This effort is for the Research and Development (R&D) and technical services needed to support the CyberSecurity Service Provider (CSSP) and its evolution in the face of a changing threat environment. This work includes research and technical services supporting mission areas defined in Technology Program Agreements with Research, Development and Engineering Command (RDECOM) centers in information assurance (IA) and computer network operations. ARL collaborates with partners in other CSSPs, the law enforcement and counter intelligence communities in the areas of technology development and computer security research. The focus across the effort is defense against the sophisticated cyber adversaries to ARL, the Army, DoD, and the United States (US) Government. This effort strives to improve the state of the art in cyber defense. Cyber defense R&D is reliant on raw data from real-world networks that contain vital evidence of the threats being perpetrated by hostiles against the network. Analysis of the data and the ability to improve attack detection accuracy and timeliness is intrinsically coupled with the agile development of new tools and techniques to combat adversaries. This ARL cyber defense effort partners with many organizations; some of which use the ARL CSSP services to provide primary or supplementary network defense services. Some are research partners using ARL-developed cyber defense tools and test-beds, and others are intelligence and law enforcement organizations that leverage ARL technology and share vital information about current threats. The extensive network view is a key enabler to the cyber research and technology enhancement mission. This effort's initiative is particularly focused on improving capabilities to combat sophisticated cyber adversaries as well as investigating the next generation of Defensive Cyber Operational Tools, Techniques, and Procedures (TTP), tactical network security, exploring prospective sensor capabilities, executing components of the Information Security Continuous Monitoring (ISCM) strategy, risk measurement and monitoring, improving adversary attribution, and insider threat analysis. The ARL cyber mission uniquely derives its strength from the close synergistic bond between research and the technical services answering operational necessities. These activities demand skilled, forward-thinking staff at every position.

The objective of this effort is research and develop a fundamental understanding of the dynamic cyber domain while providing 24x7 Cyber Defense Operations and Services within the environment of the Department of Defense

D. Industry Day: Additionally, this Sources Sought is to inform interested parties of an upcoming Industry Day being hosted at Building 205 2800 Powder Mill Rd, 20783-1197 tentatively scheduled for 13 December 2016 at 9:00AM.
All parties interested in the Industry Day shall notify this office by email
NO LATER THAN 3:00 pm EST on 01 December 2016. This is a firm response date and Industry Day RSVPs and response information will not be accepted after 3:00 pm EST on 01 December 2016. If you are unable to attend the Industry Day, but still interested in submitting capabilities briefing documents, you must do so by the close of 14 December 2016. Submissions should be emailed to Jessica.r.camunez.civ@mail.mil
The Industry day will allow for one-on-one meetings with the first ten (10) responding prospective offerors. Each one-on-one meeting will be limited to thirty (30) minutes. The intent of the one-on-one meetings is the opportunity to discuss technical capabilities. It is recommended technical representatives from prospective offerors attend. If a one-on-one meeting is granted capabilities briefing documents are required by 06 December 2016 3:00 pm EST.

(12) Industry Day RSVP responses shall also include the following information:
Security Clearance Eligibility - This notification provides an opportunity for all potential offers to submit their current clearance information for verification. Those offerors who can confirm their eligibility of meeting the security requirements for this effort will be allowed to participate in the one-one one meetings. The closing date for clearance information to be submitted to participate in this clearance verification process by 01 December 2016. Security clearances are not required to attend the industry day and technical overview presentation but are a requirement for being granted a one-on-one meeting.
Offerors must have a valid U.S. facility clearance of Top Secret, Secret storage capability, and have technical personnel with Top Secret/ Special Compartmented Information (SCI) Clearance in order to be granted a one-on-one meeting. In order for this information to be verified, the offeror must provide the following:

(1) company name and address,
(2) contact information for their Facility Security Officer,
(3) CAGE code for their Top Secret Facility Clearance, and
(4) the name, social security number and email address of one (1) of their Top Secret/Special Compartmented Information (SCI) cleared technical personnel.

Responses to this notice are due on or before 3:00 pm EST 01 December 2016. Offerors must provide the required information to Jessica Camunez, Contract Specialist, at jessica.r.camunez.civ@mail.mil The offeror is encouraged to provide this information in an encrypted zip file using a 256-bit AES encryption (ex. Winzip) and submitting via encrypted email. No phone calls will be accepted.
(13) Place of Contract Performance:
Army Research Laboratory (ARL), Adelphi, MD
Aberdeen Proving Ground (APG), Maryland
(14) Estimated Contract Period of Performance (POP): One (1) base year and four (4) option years.

Note: This amendment removes the reference to the PWS and includes a maximum number of attendees.

Sources Sought Synopsis:

(1) Action Code: SOURCES SOUGHT
This is a Sources Sought Notice only. This is not a request for proposal, but a survey to locate potential sources. This Sources Sought does not constitute an Invitation for Bids, Request for Proposals, or a Request for Quotations, and is not to be construed as a commitment by the Government to issue an order or otherwise pay for the information solicited, nor is it a guarantee of a forthcoming solicitation or contract. It is for market research purposes only. Respondents will not be notified of the results of the evaluation.
The purpose of this Sources Sought Notice is to gain knowledge of interest, capabilities, and qualifications of various businesses in advance of a planned solicitation for Research and Development (R&D) and technical services needed to support the CyberSecurity Service Provider (CSSP). Additionally, this Sources Sought Notice is to inform interested parties of an upcoming industry day being hosted at the Adelphi Laboratory Center, Building 205, 2800 Powder Mill Rd, 20783-1197 tentatively scheduled for 13 December 2016 at 9:00AM. The Government must ensure there is adequate competition among the potential pool of responsible contractors. As detailed below, RSVPs for the Industry Day are due NO LATER THAN 3:00 pm EST on 01 December 2016.
(2) Date: 14 November 2016
(3) Classification Code: AC62
(4) NAICS Code: 541712
(5) NAICS Size Standard: 1000 employees
(6) Contracting Office Address: US Army Contracting Command - Aberdeen Proving Ground, Adelphi Contracting Division
2800 Powder Mill Road
Adelphi, Maryland 20783
(7) Subject: Defensive Cyber Operations (DCO) Research and Supporting Elements
(8) Proposed Solicitation Number: W911QX-17-R-0006
(9) Sources Sought Closing Response Date: 1 December 2016
(10) Contact Point: Jessica Camunez, Contract Specialist, Jessica.r.camunez.civ@mail.mil

(11)  A. Objective:  To find sources that are qualified to meet the requirements. Note that the specific requirements are subject to change prior to the release of any solicitation.

B. Requirements:  The Army Contracting Command-Aberdeen Proving Ground (ACC-APG), Adelphi Division on behalf of the Army Research Laboratory (ARL), is conducting market research in accordance with Federal Acquisition Regulation (FAR) Part 10. The purpose of this Market Research is to identify concerns that have the skills, experience, knowledge, and capabilities necessary to provide Research and Development (R&D) and technical services needed to support the CyberSecurity Service Provider (CSSP) and its evolution in the face of a changing threat environment. This Sources Sought is issued to communicate the ARL's program requirement to industry. ARL intends to use information gathered from these responses to gain awareness of capabilities, determine interested parties, and to support formulation of an acquisition strategy. Early industry involvement in creating a properly scaled enterprise solution is critical to the success of this contemplated acquisition.

C. Specifications: This effort is for the Research and Development (R&D) and technical services needed to support the CyberSecurity Service Provider (CSSP) and its evolution in the face of a changing threat environment. This work includes research and technical services supporting mission areas defined in Technology Program Agreements with Research, Development and Engineering Command (RDECOM) centers in information assurance (IA) and computer network operations. ARL collaborates with partners in other CSSPs, the law enforcement and counter intelligence communities in the areas of technology development and computer security research. The focus across the effort is defense against the sophisticated cyber adversaries to ARL, the Army, DoD, and the United States (US) Government. This effort strives to improve the state of the art in cyber defense. Cyber defense R&D is reliant on raw data from real-world networks that contain vital evidence of the threats being perpetrated by hostiles against the network. Analysis of the data and the ability to improve attack detection accuracy and timeliness is intrinsically coupled with the agile development of new tools and techniques to combat adversaries. This ARL cyber defense effort partners with many organizations; some of which use the ARL CSSP services to provide primary or supplementary network defense services. Some are research partners using ARL-developed cyber defense tools and test-beds, and others are intelligence and law enforcement organizations that leverage ARL technology and share vital information about current threats. The extensive network view is a key enabler to the cyber research and technology enhancement mission. This effort's initiative is particularly focused on improving capabilities to combat sophisticated cyber adversaries as well as investigating the next generation of Defensive Cyber Operational Tools, Techniques, and Procedures (TTP), tactical network security, exploring prospective sensor capabilities, executing components of the Information Security Continuous Monitoring (ISCM) strategy, risk measurement and monitoring, improving adversary attribution, and insider threat analysis. The ARL cyber mission uniquely derives its strength from the close synergistic bond between research and the technical services answering operational necessities. These activities demand skilled, forward-thinking staff at every position.
The objective of this effort is research and develop a fundamental understanding of the dynamic cyber domain while providing 24x7 Cyber Defense Operations and Services within the environment of the Department of Defense

D. Industry Day: Additionally, this Sources Sought is to inform interested parties of an upcoming Industry Day being hosted at Building 205 2800 Powder Mill Rd, 20783-1197 tentatively scheduled for 13 December 2016 at 9:00AM.

All parties interested in the Industry Day shall notify this office by email NO LATER THAN 3:00 pm EST on 01 December 2016. This is a firm response date and Industry Day RSVPs and response information will not be accepted after 3:00 pm EST on 01 December 2016. If you are unable to attend the Industry Day, but still interested in submitting capabilities briefing documents, you must do so by the close of the Synopsis period (by 01 December 2016). Submissions should be emailed to Jessica.r.camunez.civ@mail.mil

The Industry day will allow for one-on-one meetings with the first ten (10) responding prospective offerors. Each one-on-one meeting will be limited to thirty (30) minutes. The intent of the one-on-one meetings is the opportunity to discuss technical capabilities. It is recommended that at least one (1) technical representatives from prospective offerors attend. Due to the high interest, the maximum number of attendees is limited to three (3) representatives per Contractor.

(12) Industry Day RSVP responses shall also include the following information:
Security Clearance Eligibility - This notification provides an opportunity for all potential offers to submit their current clearance information for verification. Those offerors who can confirm their eligibility of meeting the security requirements for this effort will be allowed to participate in the draft and/or formal solicitation process. The closing date for clearance information to be submitted to participate in this clearance verification process by 01 December 2016.

Offerors must have a valid U.S. facility clearance of Top Secret, Secret storage capability, and have technical personnel with Top Secret/ Special Compartmented Information (SCI) Clearance in order to have access to details under this draft and/or formal solicitation process. In order for this information to be verified, the offeror must provide the following:
(1) company name and address,
(2) contact information for their Facility Security Officer,
(3) CAGE code for their Top Secret Facility Clearance, and
(4) the name, social security number and email address of one (1) of their Top Secret/Special Compartmented Information (SCI) cleared technical personnel.
Responses to this notice are due on or before 3:00 pm EST 01 December 2016. Offerors must provide the required information to Jessica Camunez, Contract Specialist, at jessica.r.camunez.civ@mail.mil The offeror is encouraged to provide this information in an encrypted zip file using a 256-bit AES encryption (ex. Winzip) and submitting via encrypted email. No phone calls will be accepted.

(13) Place of Contract Performance:
Army Research Laboratory (ARL), Adelphi, MD
Aberdeen Proving Ground (APG), Maryland
(14) Estimated Contract Period of Performance (POP): One (1) base year and four (4) option years.

Sources Sought Synopsis:
(1) Action Code : SOURCES SOUGHT
This is a Sources Sought Notice only. This is not a request for proposal, but a survey to locate potential sources. This Sources Sought does not constitute an Invitation for Bids, Request for Proposals, or a Request for Quotations, and is not to be construed as a commitment by the Government to issue an order or otherwise pay for the information solicited, nor is it a guarantee of a forthcoming solicitation or contract. It is for market research purposes only. Respondents will not be notified of the results of the evaluation.
The purpose of this Sources Sought Notice is to gain knowledge of interest, capabilities, and qualifications of various businesses in advance of a planned solicitation for Research and Development (R&D) and technical services needed to support the CyberSecurity Service Provider (CSSP). Additionally, this Sources Sought Notice is to inform interested parties of an upcoming industry day being hosted at the Adelphi Laboratory Center, Building 205, 2800 Powder Mill Rd, 20783-1197 tentatively scheduled for 13 December 2016 at 9:00AM. The Government must ensure there is adequate competition among the potential pool of responsible contractors. As detailed below, RSVPs for the Industry Day are due NO LATER THAN 3:00 pm EST on 01 December 2016.
(2) Date : 14 November 2016
(3) Classification Code : AC62
(4) NAICS Code: 541712
(5) NAICS Size Standard: 1000 employees
(6) Contracting Office Address: US Army Contracting Command - Aberdeen Proving Ground, Adelphi Contracting Division
2800 Powder Mill Road
Adelphi, Maryland 20783
(7) Subject: Defensive Cyber Operations (DCO) Research and Supporting Elements
(8) Proposed Solicitation Number: W911QX-17-R-0006
(9) Sources Sought Closing Response Date: 1 December 2016
(10) Contact Point: Jessica Camunez, Contract Specialist, Jessica.r.camunez.civ@mail.mil
(11) A. Objective:

To find sources that are qualified to meet the requirements in section 11B and 11C within the attached Performance Work Statement (PWS). Note that the specific requirements are subject to change prior to the release of any solicitation.

B. Requirements:
The Army Contracting Command-Aberdeen Proving Ground (ACC-APG), Adelphi Division on behalf of the Army Research Laboratory (ARL), is conducting market research in accordance with Federal Acquisition Regulation (FAR) Part 10. The purpose of this Market Research is to identify concerns that have the skills, experience, knowledge, and capabilities necessary to provide Research and Development (R&D) and technical services needed to support the CyberSecurity Service Provider (CSSP) and its evolution in the face of a changing threat environment. This Sources Sought is issued to communicate the ARL's program requirement to industry. ARL intends to use information gathered from these responses to gain awareness of capabilities, determine interested parties, and to support formulation of an acquisition strategy. Early industry involvement in creating a properly scaled enterprise solution is critical to the success of this contemplated acquisition.

C. Specifications:
This effort is for the Research and Development (R&D) and technical services needed to support the CyberSecurity Service Provider (CSSP) and its evolution in the face of a changing threat environment. This work includes research and technical services supporting mission areas defined in Technology Program Agreements with Research, Development and Engineering Command (RDECOM) centers in information assurance (IA) and computer network operations. ARL collaborates with partners in other CSSPs, the law enforcement and counter intelligence communities in the areas of technology development and computer security research. The focus across the effort is defense against the sophisticated cyber adversaries to ARL, the Army, DoD, and the United States (US) Government. This effort strives to improve the state of the art in cyber defense. Cyber defense R&D is reliant on raw data from real-world networks that contain vital evidence of the threats being perpetrated by hostiles against the network. Analysis of the data and the ability to improve attack detection accuracy and timeliness is intrinsically coupled with the agile development of new tools and techniques to combat adversaries. This ARL cyber defense effort partners with many organizations; some of which use the ARL CSSP services to provide primary or supplementary network defense services. Some are research partners using ARL-developed cyber defense tools and test-beds, and others are intelligence and law enforcement organizations that leverage ARL technology and share vital information about current threats. The extensive network view is a key enabler to the cyber research and technology enhancement mission. This effort's initiative is particularly focused on improving capabilities to combat sophisticated cyber adversaries as well as investigating the next generation of Defensive Cyber Operational Tools, Techniques, and Procedures (TTP), tactical network security, exploring prospective sensor capabilities, executing components of the Information Security Continuous Monitoring (ISCM) strategy, risk measurement and monitoring, improving adversary attribution, and insider threat analysis. The ARL cyber mission uniquely derives its strength from the close synergistic bond between research and the technical services answering operational necessities. These activities demand skilled, forward-thinking staff at every position.

The objective of this effort is research and develop a fundamental understanding of the dynamic cyber domain while providing 24x7 Cyber Defense Operations and Services within the environment of the Department of Defense

D. Industry Day:
Additionally, this Sources Sought is to inform interested parties of an upcoming Industry Day being hosted at Building 205 2800 Powder Mill Rd, 20783-1197 tentatively scheduled for 13 December 2016 at 9:00AM.
All parties interested in the Industry Day shall notify this office by email
NO LATER THAN 3:00 pm EST on 01 December 2016. This is a firm response date and Industry Day RSVPs and response information will not be accepted after 3:00 pm EST on 01 December 2016. If you are unable to attend the Industry Day, but still interested in submitting capabilities briefing documents, you must do so by the close of the Synopsis period (by 01 December 2016). Submissions should be emailed to Jessica.r.camunez.civ@mail.mil

The Industry day will allow for one-on-one meetings with the first ten (10) responding prospective offerors. Each one-on-one meeting will be limited to thirty (30) minutes. The intent of the one-on-one meetings is the opportunity to discuss technical capabilities. It is recommended technical representatives from prospective offerors attend.

(12) Industry Day RSVP responses shall also include the following information:
Security Clearance Eligibility - This notification provides an opportunity for all potential offers to submit their current clearance information for verification. Those offerors who can confirm their eligibility of meeting the security requirements for this effort will be allowed to participate in the draft and/or formal solicitation process. The closing date for clearance information to be submitted to participate in this clearance verification process by 01 December 2016.
Offerors must have a valid U.S. facility clearance of Top Secret, Secret storage capability, and have technical personnel with Top Secret/ Special Compartmented Information (SCI) Clearance in order to have access to details under this draft and/or formal solicitation process. In order for this information to be verified, the offeror must provide the following:

(1) company name and address,
(2) contact information for their Facility Security Officer,
(3) CAGE code for their Top Secret Facility Clearance, and
(4) the name, social security number and email address of one (1) of their Top Secret/Special Compartmented Information (SCI) cleared technical personnel.

Responses to this notice are due on or before 3:00 pm EST 01 December 2016. Offerors must provide the required information to Jessica Camunez, Contract Specialist, at jessica.r.camunez.civ@mail.mil The offeror is encouraged to provide this information in an encrypted zip file using a 256-bit AES encryption (ex. Winzip) and submitting via encrypted email. No phone calls will be accepted.
(13) Place of Contract Performance:
Army Research Laboratory (ARL), Adelphi, MD
Aberdeen Proving Ground (APG), Maryland
(14) Estimated Contract Period of Performance (POP): One (1) base year and four (4) option years.