Cyber Red Team Command and Control (C2) Platform Support

SOURCES SOUGHT ANNOUNCEMENT Tracking Number: 832118475 All previously sent sources sought responses and new sources sought responses should be sent to the new POC of Tara Simmons-Gulck at Tara.S.Simmons-Gulck.civ@mail.mil. The Defense Information Systems Agency (DISA) is seeking sources for Joint Force Headquarters - Department of Defense Information Network (JFHQ-DODIN) CYBER RED TEAM COMMAND AND CONTROL (C2) PLATFORM SUPPORT CONTRACTING OFFICE ADDRESS: DISA/DITCO-SCOTT-PL83 2300 EAST DRIVE, BUILDING 3600 SCOTT AFB IL 62225-5406 INTRODUCTION: This is a SOURCES SOUGHT ANNOUNCEMENT to determine the availability and technical capability of small businesses (including the following subsets, Small Disadvantaged Businesses, Certified 8(a), Service-Disabled Veteran-Owned Small Businesses, HUBZone Small Businesses and Woman Owned Small Businesses) to provide the required products and/or services. The JFHQ-DODIN is seeking information for potential sources to provide support services and capabilities of a C2 Cyber Red Team Platform to support JFHQ-DODIN Cyber Red Team Operations for the performance period of April 10, 2022 to April 9, 2026. JFHQ-DODIN is a Joint operational headquarters and is a component-command of United States Cyber Command (USCYBERCOM) based in Fort Meade, MD. The JFHQ-DODIN exercises command and control of DODIN operations and defensive cyber operations-internal defense measures (DCO-IDM) globally in order to synchronize the protection of DoD component capabilities and to enable power projection and freedom of action across all warfighting domains. JFHQ-DODIN ensures a unity of command between USCYBERCOM and subordinate headquarters, and unity of effort with all other organizations conducting DODIN operations and DCO-IDM. The Cyber Red Team will aid in the identification and mitigation of identified vulnerabilities across the DODIN. The Cyber Red Team aims to protect end-point devices, networks, Programs of Record, Cloud Platforms, Internet of Things (IoT), and other connected devices from accidental or malicious harm by detecting potential risks, threats, and attacks. Protection from the cyber threats and attacks are essential to the resilience and reliability of the DODIN that each Area Operation (AO) Commander/Director relies on to execute their mission on a daily basis. Adequately countering cyber threats and attacks requires the Cyber Red Team operations within JFHQ-DODIN's inspection program delegated from USCYBERCOM. The JFHQ-DODIN Cyber Red Team must have the capability to provide tailored and realistic cyber threat emulation engagement, which assesses the inspected organization's ability to conduct their mission, defend their mission cyberspace, and defend the DODIN in a contested environment. A comprehensive C2 Cyber Red Team Platform and associated services and capabilities are critical in the Command supporting our SECURE, OPERATE, and DEFEND mission. The place of performance for all unclassified work is DISA Headquarters located in Fort Meade, MD or at the vendor's facility. All classified work will be accomplished from DISA HQ's at Fort Meade, MD or another approved DoD secure facility approved by the COR. DISCLAIMER: THIS SOURCES SOUGHT ANNOUNCEMENT IS FOR INFORMATIONAL PURPOSES ONLY. THIS IS NOT A REQUEST FOR PROPOSAL. IT DOES NOT CONSTITUTE A SOLICITATION AND SHALL NOT BE CONSTRUED AS A COMMITMENT BY THE GOVERNMENT. RESPONSES IN ANY FORM ARE NOT OFFERS AND THE GOVERNMENT IS UNDER NO OBLIGATION TO AWARD A CONTRACT AS A RESULT OF THIS ANNOUNCEMENT. NO FUNDS ARE AVAILABLE TO PAY FOR PREPARATION OF RESPONSES TO THIS ANNOUNCEMENT. ANY INFORMATION SUBMITTED BY RESPONDENTS TO THIS SOURCES SOUGHT ANNOUNCEMENT IS STRICTLY VOLUNTARY. CONTRACT/PROGRAM BACKGROUND: Contract Number: HC102821F0470 Contract Type: Firm Fixed Price (FFP) Incumbent and their size: Jackpine Technologies Corporation (SDVOSB) Method of previous acquisition: Sole Source due to Limited Sources Period of performance: May 11, 2021 - May 10, 2022 The incumbent contractor provides the Government with high quality, secure C2 Cyber Red Team Platform and associated services and capabilities that are critical to the Command supporting our SECURE, OPERATE, and DEFEND mission. REQUIRED CAPABILITIES: JFHQ-DODIN Cyber Red Team relies on a readily available and secure C2 Cyber Red Team platform to conduct its mission. This includes (1) an unclassified node at Ft. Meade, hosted on Defense Research and Engineering Network (DREN) and accessible from Non-classified Internet Protocol Router (NIPR), DREN, and commercial internet; and (2) a secret S-node at Ft. Meade, hosted on Secret Defense Research and Engineering Network (SDREN) and accessible from Secret Internet Protocol Router (SIPR), SDREN. Please describe your experience providing Infrastructure as a Service (IaaS) Cloud related technologies, best practices and governance. This should include delivering an accredited IaaS with the ability to host operational mission applications and support Development, Security and Operations (DevSecOps) orchestration simultaneously across multiple public & private clouds with automation and validation across a user's favorite tools and the entire software lifecycle. What is your experience developing and maintaining a Cyber Red Team C2 platform that synchronizes various Red Team tools and capabilities in an automated manner? Please include examples of how you developed, maintained, sustain and configured the hardware, software, equipment, devices, services, etc. for Cyber Red Team C2 Platforms as a service. What is your knowledge of mission assurance systems, such as but not limited to, Host Based Security System (HBSS), Assured Compliance Assessment Solution (ACAS)? Please describe your recent and relevant experience with deploying and supporting different versions of Windows, UNIX, mobile, network device Operation Systems and Databases. SPECIAL REQUIREMENTS Please provide your current Facility Clearance level. The work to be performed under this task order is up to the Top Secret level and requires SCI access eligibility for some personnel. All classified work will be accomplished from DISA HQ's at Fort Meade, MD or another approved DoD secure facility approved by the COR. SOURCES SOUGHT: The North American Industry Classification System Code (NAICS) for this requirement is 541511 (https://www.naics.com/search/), with the corresponding size standard of $30,000,000 (https://www.sba.gov/document/support--table-size-standards). To assist DISA in making a determination regarding the level of participation by small business in any subsequent procurement that may result from this Sources Sought, you are also encouraged to provide information regarding your plans to use joint venturing (JV) or partnering. Please outline how you would envision your company's areas of expertise and those of any proposed JV/partner would be combined to meet the specific requirements contained in this announcement. In order to make a determination for a small business set-aside, two or more qualified and capable small businesses must submit responses that demonstrate their qualifications. Responses must demonstrate the company's ability to perform in accordance with the Limitations on Subcontracting clause (FAR 52.219-14). SUBMISSION DETAILS: Responses should include: Business name and address; Name of company representative and their business title; Type of Small Business; CAGE Code; Your contract vehicle(s) that would be available to the Government for the procurement of the product and/or service, to include ENCORE III, SETI, NIH, NASA SEWP, General Service Administration (GSA): OASIS, ALLIANT II, VETS, STARS II, Federal Supply Schedules (FSS) (including applicable SIN(s)), or any other Government Agency contract vehicle that allows for decentralized ordering. (This information is for market research only and does not preclude your company from responding to this notice.) Vendors who wish to respond to this should send responses via email no later than August 2, 2021@ 4:00 PM Eastern Daylight Time (EDT) to Gena Spray at norma.j.spray.civ@mail.mil. Interested businesses should submit a brief capabilities statement package addressing the specific questions (no more than five pages) and demonstrating ability to perform the services listed under Required Capabilities. Proprietary information and trade secrets, if any, must be clearly marked on all materials. All information received that is marked Proprietary will be handled accordingly. Please be advised that all submissions become Government property and will not be returned. All government and contractor personnel reviewing submitted responses will have signed non-disclosure agreements and understand their responsibility for proper use and protection from unauthorized disclosure of proprietary information as described 41 USC 423. The Government shall not be held liable for any damages incurred if proprietary information is not properly identified.