Cross Domain Enterprise Service - Engineering & Program Management Support

INTRODUCTION: This is a SOURCES SOUGHT NOTICE to determine the availability and technical capability of small businesses (including the following subsets: Small Disadvantaged Businesses, Certified 8(a), Service-Disabled Veteran-Owned Small Businesses, HUBZone Small Businesses and Woman-Owned Small Businesses) to provide the required products and/or services. The DISA Program Executive Office Cyber/Perimeter/Special Protections organization is seeking information from potential sources for: Provide enterprise, enterprise-hosted, and mission specific Cross Domain Solutions (CDS) for Department of Defense (DoD) customers in a secure, consolidated, and well-managed enterprise environment. Cross Domain capabilities supporting multiple customer requirements and leveraging shared equipment within the enterprise infrastructure necessitates some level of customization/development (i.e., a data transfer specification and filter) and accreditation per customer. DWCF Reimbursable Cost Model Services include structured file transfers, Web Services, and Data Streaming. Cross Domain capabilities integrated with standard enterprise front ends (e.g., Defense Enterprise Email (DEE)), also leverage shared equipment within the enterprise necessitates little customization/development per user/organization - Defense Information Systems Network (DISN) Subscription Services (DSS)Cost Model. The anticipated Period of Performance Base Year: September 16, 2024 - September 15, 2025 Option Year One: September 16, 2025 - September 15, 2026 Option Year Two: September 16, 2026 - September 15, 2027 Option Year Three: September 16, 2027 - September 15, 2028 Option Year Four: September 16, 2028 - September 15, 2029 The anticipated Place of Performance is (Defense Information Systems Agency, Fort Meade, MD). DISCLAIMER: THIS SOURCES SOUGHT NOTICE IS FOR INFORMATIONAL PURPOSES ONLY. THIS IS NOT A REQUEST FOR PROPOSAL. IT DOES NOT CONSTITUTE A SOLICITATION AND SHALL NOT BE CONSTRUED AS A COMMITMENT BY THE GOVERNMENT. RESPONSES IN ANY FORM ARE NOT OFFERS AND THE GOVERNMENT IS UNDER NO OBLIGATION TO AWARD A CONTRACT AS A RESULT OF THIS NOTICE. NO FUNDS ARE AVAILABLE TO PAY FOR PREPARATION OF RESPONSES TO THIS NOTICE. ANY INFORMATION SUBMITTED BY RESPONDENTS IS STRICTLY VOLUNTARY. CONTRACT/PROGRAM BACKGROUND: Contract Number: HC102819F0904 Contract Vehicle: (CIO SP3 III SB) Incumbent and their size: (ASRC Federal, small business) Method of previous acquisition: (full and open competition) Period of performance: (September 16, 2019 - September 15, 2024) Contract Number: HC102820F0678 Contract Vehicle: (GSMO II Large Business Direct Award) Incumbent and their size: (Leidos, large business) Method of previous acquisition: (sole source - direct award) Period of performance: (October 1, 2020 - September 30, 2025) REQUIRED CAPABILITIES: 1. The CDES team supports comprehensive area in product integration and operations support. Our mission is to support Combatant Commands, Services, and Agencies not only with the on-boarding process and current/future DoD Cross Domain Assessment and Authorization (A&A) process, but will also support the engineering, deployment/installation, and support of DISA CDES assets, as requested by the COR/ACOR. Describe and provide an example of your company's experience handling and maintaining all security and accreditation material (i.e. Risk Management Framework (RMF)), all A&A efforts in support of the DoD Cross Domain process and lifecycle updates which will include System Security Sustainment, Software Assurance, interoperability, Federal Information Processing Standards certification, and Annual Information Assurance (IA) Compliance Reviews & Exercises. Also describe your company's ability to provide Information System Security Officer (ISSO) support with tracking vulnerabilities, conducting system risk management analysis, and providing information security strategies. 2. A primary objective of the CDES program office is to continue providing high quality cross domain services to the department and its mission partners and meet DoD Raise the Bar (RTB) initiatives. Describe and provide an example of your company's experience supporting mission partners to remain compliant with appropriate DoD-approved architectures, programs, standards and guidelines, such as: National Cross Domain Strategy and Management Office (NCDSMO) Raise the Bar (RTB), Defense Information Systems Network (DISN), DoD Assessment & Authorization (A&A) guidelines, and Shared Data Environment. 3. The CDES Program provides Enterprise Management capability that enables and assures control of governance, organization, integration, assurance, compliance, and management for DoD customers in a secure, consolidated, and well-managed enterprise environment. The program also provides Enterprise Engineering that includes software installation, maintenance, patch and upgrade support, filter development, network management, testing, configuration management, Integration and Operations utilizing a wide variety of cross domain solutions (CDS) and Application Programming Interface (API) Gateway. The capabilities of the Engineering Services range from Web Services, Structured File Transfers, Email and Data Streaming. Describe and provide an example of your company's experience to cost effectively support CDS, Enterprise technologies and equipment designed to improve cross domain capabilities and functions (i.e., Web Services, structured file transfers, data streaming). 4. The CDES team develops and integrates custom, scalable filters for the Cross Domain Solution request from multiple mission partners. CDES is responsible for installing and integrating filters to satisfy the requirements of the affected cross domain solution upon technical update. Additionally, the team conducts performance and functional testing on various CDS in an environment that meets NCDSMO requirements. Describe and provide an example of your company's experience supporting customers to complete questionnaires that enabled an Engineering team collect artifacts to finalize Data Transfer Specifications (DTS). The requirement for filter development will also need to be assessed for cost associated with business rules directly related to sizing options. Also state your company's capability of analyzing and conducting preliminary risk ratings established with Authority to Operate (ATO). 5. CDES maintains current Standard Operating Procedures (SOP) in support of obtaining, testing, and coordinating the deployment and implementation of all patches to mitigate and/or remediate all assets in the development, test and production environments affected by open findings to include vulnerability and Enterprise Mission Support Service (eMASS) data entry. The program provides monitoring and reporting processes and technologies within the production environment. In addition, the program identifies and implements performance monitoring and reporting technology within the production environment to validate system performance and usage. This technology enables the CDES lab space and CDES production environment to monitor the CDES performance data, status, and health for complete analysis with subsystem granularity globally. Describe and provide an example of your company's experience with providing support in a production environment that provides monitoring and reporting for processes and technologies. 6. Describe and provide an example of your company's experience using Cross Domain Solutions and/or Enterprise Services to advance the U.S. government's cybersecurity mission. SPECIAL REQUIREMENTS: Must have Top Secret//SCI clearance. Please provide your current FCL. SOURCES SOUGHT: The North American Industry Classification System Code (NAICS) for this requirement is 541519 (https://www.census.gov/naics/), with the corresponding size standard of $34M (https://www.sba.gov/document/support--table-size-standards). In order to make a determination for a small business set-aside, two or more qualified and capable small businesses must submit responses that demonstrate their qualifications. Responses must demonstrate the company's ability to perform in accordance with FAR clause 52.219-14, Limitations on Subcontracting. To assist DISA in determining the level of participation by small business in any subsequent procurement that may result from this Sources Sought Notice, provide information regarding any plans to use joint ventures (JVs) or partnering. Please outline the company's areas of expertise and those of any proposed JV/partner who combined can meet the specific requirements contained in this notice. SUBMISSION DETAILS: Responses should include: Business name and address; Name of company representative and their business title; Small Business Socio-economic status (if small); CAGE Code; Prime contract vehicles; to include ENCORE III, SETI, NIH CIO-SP4, NASA SEWP V, General Service Administration (GSA): OASIS, ALLIANT II, VETS II, STARS III, MAS (including applicable SIN(s), groups or pools), or any other Government Agency contract vehicle that allows for decentralized ordering. (This information is for market research only and businesses with a valid cage that lack prime contract vehicles are still encouraged to respond to this notice.) Businesses who wish to respond must send a response via email NLT 4:00 PM Eastern Daylight Time (EDT) on February 23, 2024 to kenric.l.phillips.civ@mail.mil and tara.s.simmons-gulck.civ@mail.mil. Interested businesses should submit a brief capabilities statement package addressing the specific questions above (no more than five pages) demonstrating the ability to perform the services listed under Required Capabilities. Proprietary information and trade secrets, if any, must be clearly marked on all materials. All information received that is marked Proprietary will be handled accordingly. All submissions become Government property and will not be returned. All government and contractor personnel reviewing submitted responses will have signed non-disclosure agreements and understand their responsibility for proper use and protection from unauthorized disclosure of proprietary information as pursuant to 41 USC 423. The Government shall not be held liable for any damages incurred if proprietary information is not properly identified.