B -- Computer Security Incident Response Capabilities (CSIRC)

The U. S. Department of the Treasury (Department), Office of Chief Information Officer is issuing a Request for Information (RFI) to identify industry suggestions and best practices regarding Computer Security Incident Response Capability (CSIRC). The Department is seeking sources for a possible future acquisition to conduct a study of the Treasury Computer Security Incident Response Capability (TCSIRC). This RFI solicits industry's interest and capability to meet stated objectives and is for information and planning purposes only. This does not constitute a Request for Proposal (RFP) or an Invitation for Bid (IFB) or a promise to issue one in the future. Furthermore, the Department is not liable for any costs incurred as a result of vendor responses to this RFI. The Government does not intend to award a contract for any supply or service on the basis of this request or to otherwise pay for the information. This request is issued for the purpose to 1) receive information and feedback on interest and capabilities of potential sources; 2) inform the Government on the type and scope of work involved in conducting a study of the CSIRC within the Department of Treasury. BACKGROUND: The U.S. Department of the Treasury (Department) operates a Treasury Computer Security Incident Response Capability (TCSIRC), which provides a single organizational point of contact for 1) vulnerability and incident information dissemination and 2) facilitates incident reporting with external reporting entities including US-CERT. The TRSIRC interacts with the CSIRC's at the various Treasury bureaus and, in that sense, does not routinely interact with end users, but operates primarily through the CSIRCs. The TCSIRC's role and responsibility is primarily associated with unclassified systems; however, TCSIRC may be associated with classified systems in the near future. SCOPE: The Department is seeking information from private entities that currently possess expert and detailed knowledge of the operation of CSIRCs in a substantial and representative sample of government agencies and private sector. The Department is interested in making a determination as to whether the TCSIRC services currently being provided adequately address the needs of the Department, its constituents and the requirements levied upon the Department by external authorities. The purpose of this RFI is not to obtain information regarding the performance of the TCSIRC current service provider to the Department but to request information regarding the services that a CSIRC should provide. To that end, the Department is interested in various CSIRC capabilities within the Federal arena as well as the private sector. Responders are requested to address the following questions: 1) Describe your knowledge and expertise regarding CSIRCs in the Federal and private sector. 2) What is the nature and type of security incidents CSIRCs must address? 3) What are the services that should be provided by a CSIRC capability? 4) What are potential problems that arise in managing a CSIRC program? 5) What are the key cost elements that will drive a vendor's cost proposal in response to a solicitation for conductng a study of a CSIRC program? 6) What are suggested evaluation criteria or factors that the Government should consider in the development of a Request for Proposal to conduct a study of TCSIRC should it choose to issue one? RESPONSE: Your response should be no more than seven (7) pages total, one-sided pages with print no smaller than 12 point. Responses must be submitted in Microsoft Word 2000 or later. Interested parties may submit their responses this RFI to Tammy McLeod, Contracting Officer via e-mail at tammy.mcleod@do.treas.gov. Responses to the RFI should address how the responder would meet the Government's requirements, in the form of questions for clarification and suggestions for additional requirements that the Government should consider. Responses should refer to RFI-06-0001. Responses must be received via e-mail by 5:00 p.m. EST on Monday, March 6, 2006.