Assessment & Authorization (A&A) Support Services

DISCLAIMER: "THIS SOURCES SOUGHT IS FOR INFORMATIONAL PURPOSES ONLY. THIS IS NOT A "REQUEST FOR PROPOSAL (RFP)" TO BE SUBMITTED. IT DOES NOT CONSTITUTE A SOLICITATION AND SHALL NOT BE CONSTRUED AS A COMMITMENT BY THE GOVERNMENT. RESPONSES IN ANY FORM ARE NOT OFFERS AND THE GOVERNMENT IS UNDER NO OBLIGATION TO AWARD A CONTRACT AS A RESULT OF THIS ANNOUNCEMENT. NO FUNDS ARE AVAILABLE TO PAY FOR PREPARATION OF RESPONSES TO THIS ANNOUNCEMENT. ANY INFORMATION SUBMITTED BY RESPONDENTS TO THIS TECHNICAL DESCRIPTION IS STRICTLY VOLUNTARY. RESPONSES WILL NOT BE RETURNED TO THE RESPONDER. NOT RESPONDING TO THIS NOTICE DOES NOT PRECLUDE PARTICIPATION IN ANY FUTURE REQUEST FOR QUOTE (RFQ) OR INVITATION FOR BID (IFB) OR RFP, IF ANY ISSUED. IF A SOLICITATION IS RELEASED, IT WILL BE SYNOPSIZED ON THE GOVERNMENT-WIDE POINT OF ENTRY (GPE). IT IS THE RESPONSIBILITY OF POTENTIAL OFFERORS TO MONITOR THE GPE FOR ADDITIONAL INFORMMATION PERTAINING TO THIS REQUIREMENT." INTRODUCTION: The purpose of this Request for Information (RFI)/Sources Sought is to identify potential sources that can provide support to the CECOM SEC Services Directorate, Infrastructure Division, Cyber Security Branch. This requirement is for Assessment & Authorization (A&A) Support Services, and covers support of a Security Control Assessor - Validator (SCA-V) team as part of the Assessment Phase of the Risk Management Framework (RMF) for Department of Defense (DoD) information systems. The primary support requirements will be assessment of the Cyber Security posture of DoD information systems. This will involve assessment of the management, operational, and technical security controls employed within or inherited by information systems to determine the overall effectiveness of the controls (i.e., the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security requirements for the system). SCA-Vs also provide an assessment of the severity of weaknesses or deficiencies discovered in the information system and its environment of operation and recommend corrective actions to address identified vulnerabilities. This will include review of the appropriate assessment procedures, proper execution of the security tools and test methods identified, for example: Defense Information Systems Agency (DISA) Security Technical Implementation Guides (STIGs), Security Readiness Review (SRR), and Assured Compliance Assessment Solution (ACAS). This will also include reviews of procedures, after action reports, and the implementation of the documented security measures. The requested information will be used by the Government for market research purposes only and is not a Request for Proposal or a Request for Quote in that it will not be used to place an order with any vendor directly. This is for informational purposes only and the Government will not be obligated to award to any interested vendors that present information in response to this RFI. QUESTIONS: 1. Please provide the following Point of Contact information: Company: Address: Point of Contact: Phone Number: Fax Number: Email Address: 2. Please identify your company's small business size standard based on the applicable NAICS code of 541 -- Professional, Scientific, and Technical Services/541330 -- Engineering Services. The Small Business Size Standard for this NAICS code is $14 Million dollars. For more information refer to http://www.sba.gov/content/table-small-business-size-standards. 3. Please describe the knowledge and operational experience your workforce has in the performance of security accreditations and identify whether that knowledge and experience is related to Risk Management Framework (RMF) and the DoD Information Assurance Certification and Accreditation Process (DIACAP). 4. Please describe the knowledge and operational experience your workforce has in performing security accreditations in one or more of the following system areas: a. Command, Control, Communications-Tactical (C3T) b. Enterprise Information Systems (EIS) c. Intelligence, Electronic Warfare & Surveillance (IEW&S) d. Local Area Networks (LANs) 5. Please describe the number of and types of systems with which your workforce has experience in performing security accreditations. Examples include small enclaves, large enclaves, stand-alone networks, tactical, etc... 6. Please describe your proposed approach to supporting the CECOM Software Engineering Center in the performance of RMF Security Accreditations. 7. Please describe your quality assurance program to ensure high quality deliverables. 8. Please describe your approach to handling inconsistent workloads as it is not uncommon for the workload in this area to vary from time to time. SUBMISSION DETAILS: Your response to this Sources Sought, including any capabilities statement, shall be electronically submitted to the Contract Analyst, Rebecca Zarrillo, in either Microsoft Word or Portable Document Format (PDF), via email. Submissioins are requested to consist of no more than six (6) pages in length in Arial font of not less than 12 pitch font. All data received in response to this Sources Sought that is marked or designated as corporate or proprietary will be fully protected from any release outside the Government. No phone calls will be accepted. All questions must be submitted to the Contract Analyst identified above. The Government is not committed nor obligated to pay for the information provided, and no basis for claims against the Government shall arise as a result of a response to this Sources Sought.