Palo Alto Unit 42 Public Sector Expertise on Demand Subscription

The Department of the Treasury Office of the Comptroller of the Currency seeks a Palo Alto Unit 42 Public Sector Expertise on Demand Subscription for investigative cyber analysis and threat intelligence support, with proposals due September 14 at 2:00 p.m. Eastern time. This is a sole source procurement under simplified acquisition procedures, foreclosing open competition; contracting officer Marlon Holland approved the justification citing Unit 42's unique combination of dedicated threat research capability and enhanced detection and attribution services not available from evaluated competitors.

Place of performance is Washington, DC 20219. The contract is firm-fixed-price with a base year period from August 2026 through September 2027 and four optional one-year extensions through September 2031. Services include investigative analysis using identity and threat hunting methodologies, log analysis on OCC's SIEM platform (Splunk or Microsoft Sentinel), identity and access management review via identity provider tenant access portals, and endpoint detection and response (EDR) analysis using Trellix EDR or equivalent platforms. The subscription provides 8-hour remote response time and up to 1,600 consulting hours per performance period. The NAICS code is 541519, and the PSC code is DA10.

All deliverables are Controlled Unclassified Information and must remain within U.S. borders. Security requirements include compliance with FISMA, FIPS 140-2/140-3 encryption standards, NIST guidelines, and OCC policies. All contractor personnel must execute non-disclosure agreements and complete mandatory security training with a minimum of 8 hours annual role-based IT security training. Contractors must report incidents to the OCC Cyber Defense Center within one hour of discovery. Offerors must submit an Initial Staffing Plan with personnel detail and provide monthly workforce reports during performance.