Cyber Vulnerability

SOURCES SOUGHT ANNOUNCEMENT 832118188 The Defense Information Systems Agency (DISA) is seeking sources for Cyber Services Information Assurance Services: Ecosystem Acquisition for SEL7 Cyber Services Enclaves and Systems Certification. CONTRACTING OFFICE ADDRESS: DISA/ Defense Information Technology Contracting Organization (DITCO) - Scott, 2300 East Drive, Scott Air Force Base, Illinois, 62225-5406 INTRODUCTION: This is a SOURCES SOUGHT ANNOUNCEMENT to determine the availability and technical capability of small businesses (include the following subsets, Small Disadvantaged Businesses, Certified 8(a), Service-Disabled Veteran-Owned Small Businesses, Historically Underutilized Business Zone Small Businesses (HUBZone), and Woman Owned Small Businesses (WOSB)) to provide the required products and/or services. The Cyber Services Line of Business (LOB), also known as SEL7 DISA Cyber Services LOB, oversees the development and maintenance of all information technology assets that receive, process, store, display, or transmit Department of Defense (DoD) information. This information technology will be acquired, configured, operated, maintained, and disposed of consistent with applicable DoD cybersecurity policies, standards, and architectures. These programs include Program Services, Network Program Services, Mission Partner Engagement, Internal Program Services, Defense Information Systems Network programs, and Communication Security. DISA Cyber Services LOB SEL7 is seeking information for potential sources to support Cyber Vulnerability Management Services, which includes: training; audits; review, creation, and execution of policies, orders, and guidance; vulnerability scanning, detection, and analysis; compliance monitoring, reporting, and mitigation; and Cyber Systems management and automation configuration, change, and account management for DoD managed information systems. The anticipated period of performance is a one-year base with three one-year option periods beginning October 1, 2022. The anticipated places of performance are Chambersburg, PA, Oklahoma City, OK, Mechanicsburg, PA, Montgomery, AL, and Ogden, UT. DISCLAIMER: THIS SOURCES SOUGHT ANNOUNCEMENT IS FOR INFORMATIONAL PURPOSES ONLY. THIS IS NOT A REQUEST FOR PROPOSAL. IT DOES NOT CONSTITUTE A SOLICITATION AND SHALL NOT BE CONSTRUED AS A COMMITMENT BY THE GOVERNMENT. RESPONSES IN ANY FORM ARE NOT OFFERS AND THE GOVERNMENT IS UNDER NO OBLIGATION TO AWARD A CONTRACT AS A RESULT OF THIS ANNOUNCEMENT. NO FUNDS ARE AVAILABLE TO PAY FOR PREPARATION OF RESPONSES TO THIS ANNOUNCEMENT. ANY INFORMATION SUBMITTED BY RESPONDENTS TO THIS SOURCES SOUGHT ANNOUNCEMENT IS STRICTLY VOLUNTARY. CONTRACT/PROGRAM BACKGROUND: Contract Number: 47QTCA18D00K3 / HC102819F1096 Contract Type: Firm-Fixed Price Incumbent and their size: Cinteot, Inc. - WOSB, 8(a), and HUBZone Method of previous acquisition: HUBZone Set Aside on General Services Administration Information Technology Schedule 70 Period of performance: One-year base and two one-year options (October 1, 2019- September 30, 2022) These cybersecurity services include application administration, support for Commercial-Off-The-Shelf and Government-Off-The-Shelf tools, incident response, network defense, security posture validation, and vulnerability analysis. Work accomplished under this task order shall include cybersecurity support in Non-classified Internet Protocol Router Network, Secret Internet Protocol Router Network, isolated and Joint Worldwide Intelligence Communications System environments. REQUIRED CAPABILITIES: SEL7 Cyber team supports endpoint management and vulnerability protections, scans, remediation and automation support. Please describe your experience in supporting Cyber Vulnerability Scanning & Detection, maintaining Operational Security, supporting DoD audits, and supporting any other Information Assurance Enabled Devices (IAED) managed by DoD for both unclassified and classified networks in accordance with DoD regulations, guidelines, and orders. SEL7 Cyber teams provide automation and monitoring, analyzing, and reporting security threats both internally and externally to protect our IT environments from threats or security incidents and remediate any discrepancies that are found through the proper DoD guidance and regulations. Please describe your experience monitoring, analyzing, reporting, and improving cyber security posture throughout the entire lifecycle of managed Information Systems with all available tools/cyber systems. This includes ensuring insider/external threats and incidents are appropriately detected, monitored, and remediated per DoD Guidance and regulations. SEL7 Cyber teams continually monitors each IT environment through DISA approved scanning and vulnerability tools to monitor, analyze, evaluate and report any deficiencies across all applications, databases, operating systems and other network platforms to assist in the cyber security compliance. SEL7 Cyber Team supports developing, analyzing, maintaining, monitoring and reporting security compliance to support DoD Risk Management Framework (RMF) and Federal Information Security Management Act (FISMA) requirements. Please describe your experience and ability in developing, utilizing/managing cyber systems to include: tools, applications, databases, and other software/network platforms; developing, analyzing, maintaining, monitoring and completing RMF and FISMA requirements. SEL7 Cyber team supports, reviews, and submits recommendations for improvements in efficiencies and effectiveness for cybersecurity activities, processes, and documentation. SEL7 Cyber team members also obtain the appropriate DoD-approved Information Assurance certifications. Please describe your experience in providing a comprehensive management approach for the appropriate mix of skilled/qualified labor categories, hours/schedules/shifts, and certifications (i.e. DoD 8570, DoDD 8140.01). SPECIAL REQUIREMENTS Clearance Required: Final Top Secret Sensitive Compartmented Information Secret and Secret Clearances are required Facility Clearance Required: Secret Clearance SOURCES SOUGHT: The North American Industry Classification System Code (NAICS) for this requirement is 541519, with the corresponding size standard of $30M. To assist DISA in making a determination regarding the level of participation by small business in any subsequent procurement that may result from this Sources Sought, you are also encouraged to provide information regarding your plans to use joint venturing (JV) or partnering. Please outline how you would envision your company's areas of expertise and those of any proposed JV/partner would be combined to meet the specific requirements contained in this announcement. In order to make a determination for a small business set-aside, two or more qualified and capable small businesses must submit responses that demonstrate their qualifications. Responses must demonstrate the company's ability to perform in accordance with the Limitations on Subcontracting clause (FAR 52.219-14). SUBMISSION DETAILS: Responses should include: Business name and address; Name of company representative and their business title; Type of Small Business; CAGE Code; Your contract vehicles that would be available to the Government for the procurement of the product and/or service, to include ENCORE III, SETI, NIH, NASA SEWP, General Service Administration (GSA): OASIS, ALLIANT II, VETS, STARS II, Federal Supply Schedules (FSS) (including applicable SIN(s)), or any other Government Agency contract vehicle that allows for decentralized ordering. (This information is for market research only and does not preclude your company from responding to this notice.) Vendors who wish to respond to this should send responses via email NLT May 26, 2021 4:00 PM Central Time (CT) to amy.ford6.civ@mail.mil. Interested businesses should submit a brief capabilities statement package addressing the specific questions (no more than five pages) and demonstrating ability to perform the services listed under Required Capabilities. Proprietary information and trade secrets, if any, must be clearly marked on all materials. All information received that is marked Proprietary will be handled accordingly. Please be advised that all submissions become Government property and will not be returned. All government and contractor personnel reviewing submitted responses will have signed non-disclosure agreements and understand their responsibility for proper use and protection from unauthorized disclosure of proprietary information as described 41 USC 423. The Government shall not be held liable for any damages incurred if proprietary information is not properly identified.