Ushmm-RFI-2027-mssp
Closed Pre-Solicitation Posted
- Solicitation number
- 95476727RFI-MSSP
- Responses due
- Set-aside
- No set-aside
Opportunity facts
- NAICS code
- 541512 Computer Systems Design Services
- Place of performance
- Washington, District of Columbia 20024, United States
- Points of contact
Notice details come from SAM.gov. Updated .
About this opportunity
The United States Holocaust Memorial Museum (USHMM) is issuing Request for Information USHMM-RFI-2027-MSSP to conduct market research for re-procuring integrated CISO and Managed Security Service Provider (MSSP) services, with responses due October 30, 2026 at 5:00 PM EDT. No set-aside is used. The RFI is for information gathering only and does not constitute a solicitation, and the Q&A document states that non-U.S. firms cannot respond directly, though qualified U.S.-based subcontractors and partners may participate. The Q&A document also states that no firm solicitation timeline is established.
The scope covers managed IT security, multi-cloud/DevSecOps architecture, network engineering, and MSSP operations for an environment with 4,000+ monthly security tickets, 1,200 endpoints, 800 users, and 25+ integrated tools. The four-phase lifecycle runs from supporting current operations, through gap analysis against NIST SP 800-53 r5, FISMA, and CISA Zero Trust standards, to recommending a to-be posture with tool consolidation and a co-managed SOC model. Phase 4 implements transition within 30-60 days while maintaining 24/7 compliance. Vendors must demonstrate capability across five domains: AWS/GCP security, Active Directory and privileged access management, storage access governance, endpoint/MDM/server hardening, and network/WiFi infrastructure.
Required certification baselines include AWS Certified Security - Specialty, Jamf Certified Admin Level 300, Certified IAM Specialist, and CISSP/CISM/CISA. The Q&A document states that personnel security clearances and Public Trust background investigations are required and that limited onsite presence is anticipated, with a hybrid model for certain labor categories.
Pricing benchmarks are requested for the Washington, DC Metropolitan Area for CISO, Security Architect, DevSecOps Engineer, Security Analyst, and Network/System Engineer labor categories, along with feedback on a Firm-Fixed-Price monthly fee structure. Responses may be submitted by email to Mary Green, USHMM Contracting Officer, at magreen@ushmm.org in PDF or Word format, limited to 15 pages excluding the cover page and labor rate tables. Responders bear all response costs.
Notice text
DISCLAIMER / MARKET RESEARCH NOTICE:This Request for Information (RFI) is issued solely for information gathering and planning purposes. It does not constitute a Request for Proposal (RFP), Invitation for Bid (IFB), or an obligation on the part of the United States Holocaust Memorial Museum (USHMM) to acquire any products or services. Responses to this notice are not offers and cannot be accepted by USHMM to form a binding contract. Responders are solely responsible for all expenses associated with responding to this RFI.
The United States Holocaust Memorial Museum (USHMM) is conducting formal market research to evaluate commercial vendor capabilities, industry pricing benchmarks, federal/commercial labor rates, and available contract acquisition vehicles (e.g., GSA MAS SIN 54151HACS, NASA SEWP, CIO-SP3/4, SAM.gov) for re-procuring comprehensive Managed Information Technology (IT) Security, Multi-Cloud/DevSecOps Architecture, Network Engineering, and specialized Managed Security Service Provider (MSSP) operational activities. The primary objective of this market research effort is to evaluate whether competitive commercial marketplace capabilities exist to:
- Sustain, support, and execute day-to-day operations across USHMM's existing "As-Is" securityinfrastructure without operational disruption or increased organizational risk.
- Perform rigorous security architecture evaluations, threat modeling, gap analyses, and complianceassessments against industry-best security and privacy standards (NIST SP 800-53 r5, FISMA, PCI DSSv4.2.1, CISA Zero Trust Maturity Model, CSF 2.0).
- Architect and recommend a modernized, cost-effective "To-Be" security state incorporating ZeroTrust architecture, automated orchestration, tool consolidation, and a Government OwnedContractor Operated (GOCO) Security Operations Center (SOC) framework.
- Execute a seamless, structured transition lifecycle from the "As-Is" state to the "To-Be" operationalmodel within strict schedule and budget parameters.
Pricing Benchmarks & Market Rate Expectations
- Provide feedback on the commercial feasibility of managing this scope under a Firm-Fixed-Price (FFP)monthly fee structure.
- Provide fully burdened hourly commercial labor rates or GSA schedule rates in the Washington, DCMetropolitan Area for equivalent labor categories (CISO, Security Architect, DevSecOps Engineer,Security Analyst, Network/System Engineer).
Submission Instructions & Response Format
- Response Deadline: All responses shall be submitted electronically no later than October 30, 2026, at 5:00 PM EDT.
- Submission Format: Responses must be submitted in PDF or Microsoft Word format, strictly limited to no more than fifteen (15) pages (excluding cover page and labor rate tables).
- Point of Contact: Submissions and any clarifying technical inquiries must be emailed to Mary Green, USHMM Contracting Officer at magreen@ushmm.org with the subject line "RFI Response - USHMM Managed IT Security & MSSP Services".
Files
| File | Type | Posted |
|---|---|---|
| MSSP Questions and Responses.pdf | ||
| USHMM_RFI Managed IT Security and MSSP Services.pdf |
On GovTribe
Work this opportunity
- Track it in your pipeline
- Find teaming partners
- Similar opportunities
- Ask GovTribe AI about this opportunity