Domain Name System (DNS) Security Support

Request for Information (RFI) for Defense Information Systems Agency (DISA) Domain Name System (DNS) Security Support Contracting Office Address: Defense Information Systems Agency, DITCO-Scott PL8313, P.O. 2300 East Drive, Bldg 3600, Scott AFB, IL, 62225-5406 Description: PURPOSE: The Defense Information Systems Agency (DISA), Program Executive Office - Mission Assurance/ (PEO-MA), is conducting this Request for Information (RFI) as market research to determine sources with competencies to promote information assurance by supporting the Domain Name System (DNS) Security program. Weaknesses in the DoD DNS infrastructure potentially allow attackers to steer users to malicious web sites or execute Distributed Denials of Service (DDOS) attacks. Furthermore, DNS can be subverted by attackers to remotely control compromised hosts and exfiltrate extract data. To address these issues, PEO-MA has developed a plan to improve monitoring and management of the DoD DNS. This plan includes isolating the inner workings of the DoD DNS from the Internet by deploying proxy servers and enterprise recursive servers; enabling the authentication of transactions between DNS servers by deploying DNS Security Extensions (DNSSEC); increasing the robustness of the "G Root" by implementing Anycast; and enhancing policy conformance through improved enforcement, doctrine, and education. Additionally, PEO-MA will continue to support the development of the Berkeley Internet Name Domain (BIND). BIND is developed and maintained by the Internet Software Consortium (ISC) and is the most common software used for DNS both on the Internet at large and within the Defense Information Systems Network (DISN). THE GOVERNMENT DOES NOT INTEND TO AWARD A CONTRACT ON THE BASIS OF THIS RFI OR REIMBURSE ANY COSTS ASSOCIATED WITH THE PREPARATION OF RESPONSES TO THIS RFI. This RFI is issued solely for information and planning purposes and does not constitute a solicitation. All information received in response to this RFI marked Proprietary will be handled accordingly. Responses to the RFI will not be returned. Whatever information is provided in response to this RFI will be used to assess tradeoffs and alternatives available for determining how to proceed in the acquisition process for DNS Security Support contracts. In accordance with FAR 15.201(e), responses to this RFI are not offers and cannot be accepted by the Government to form a binding contract. This RFI is a request for interested parties to describe their technical capabilities and demonstrated experience with support for DNS Security. All interested contractors are requested to provide written response to the questions below. A response to this RFI is necessary in order to assist DISA in determining the potential levels of interest, adequate competition, and technical capability within the Small Business Community to provide the required services. In addition, this information will also be used to assist DISA in establishing a basis for developing any subsequent potential subcontract/small business participation plan and/or small business goal percentages. Sources Sought: This Sources Sought Synopsis is requesting responses to the following criteria from small businesses that can provide the required services under the North American Industry Classification System (NAICS) Code 541712. In addition to Small Businesses, this Synopsis is encouraging responses from qualified and capable Service Disabled-Veteran Owned Small Businesses, Veteran-Owned Small Businesses, Women-owned Small Businesses, HUBZone Small Businesses, Small Disadvantaged Small Businesses, Historically Black Colleges and Universities/Minority Institutions, Small Business Joint Ventures, Consortiums and Teaming Partners. This Sources Sought Synopsis is issued to assist the agency in performing market research to determine whether or not there are two or more qualified and capable Small Businesses to provide the aforementioned service. Please note that personnel with current DoD Secret clearances (minimum) and specified personnel with current DoD Top Secret clearance will be required at contract award. Responses must demonstrate the company's ability to perform in accordance with the Limitations on Subcontracting clause (FAR 52.219-14). Interested small businesses meeting the small business standard of NAICS code 541712 are requested to submit a response to the Contracting Officer within 7 calendar days of issuance of this RFI. Late responses will not be considered. Responses should provide the business's DUNS number and CAGE code and include a statement of self certification under the NAICS code. Additionally, responses should include recent (within the past three years or work that is on-going) and relevant experience (work similar in type, scope, and complexity) to include contract numbers, project titles, dollar amounts, and points of contact with telephone numbers where the responder performed the relevant work. Provide a list of the current contract vehicles your services may be procured from, to include the General Service Administration (GSA), Federal Supply Schedule (FSS) and any other government contract vehicle. Marketing brochures and/or generic company literature will not be considered. Not addressing all the requested information may result in the Government determining the responder is not capable of performing the scope of work required. Requested Information: Interested vendors are requested to submit a maximum 15 page statement of their knowledge and capabilities to perform the following: - a) Describe your experience managing the technical and functional activities associated with BIND and DNS security engineering and deployment. Explain your experience engineering solutions that incorporate DNSSEC. The experience should include, but not be limited to: staffing which possess, at a minimum, a current DoD Secret clearance and specified personnel with current DoD Top Secret clearance; and maintaining a skilled contract workforce. What is the timeframe it would take to get those resources in place with the required skill sets? - b) Describe your experience in providing the Government with management and technical support for research and analysis of current and emerging design concepts and technologies in a DNS infrastructure. Include experience in engineering, integration, technical and operational support services for DNS. - c) Describe your experience with implementing and supporting systems incorporating DNS Security capabilities. - d) Describe your experience with the DISA Certification and Accreditation (C&A) process, to include an ability to successfully execute the DoD Information Assurance Certification and Accreditation Process (DIACAP) by providing examples of successfully fielded system deployments. - e) Describe your experience and ability to provide Operations and Maintenance Engineering Support to deployed DNS Security capabilities. Support shall include testing (including test plan and report development), implementing (including implementation and operational assessment plans), and assessing impacts of software/hardware patches and upgrades (Information Assurance Vulnerability Assessment (IAVA) releases), preparing Engineering Change Proposals (ECP), Software Change Proposals (SCP), analyzing Trouble Reports (TR)), maintaining replicated lab solutions, and executing Configuration Management processes. Contractor should demonstrate Tier 3 technical and engineering support for operational issues. - f) Describe your experience in establishing repeatable processes and providing online resources to support DoD users with the standards, technologies, and guides for implementing DNS Security solutions. Responses: Responses should include the (1) business name and address; (2) name of company representative and their business title; (3) cost estimate for the technical services described above (broken out by base year and 4 option years); and (4) contract vehicles available that would be available to the Government for the procurement of the product and service, to include General Service Administration (GSA) Federal Supply Schedules (FSS), or any other Government Agency contract vehicle and (5) contract type recommended (FFP, CPFF, CPIF, etc.) to satisfy the requirements for this program. The responses should be in a white paper format, no longer than fifteen (15) pages in length. Address the capabilities posed in section 1.2 and 1.3, and add one (1) appendix that consists of at least two past performances to include Government points of contact describing the vendor's capabilities. Firms who wish to respond to this should send responses via email NLT 13 October 2009 at 5:00 PM Eastern Daylight Time (EDT). The response should not exceed a 5 MB e-mail limit for all items associated with the RFI response. Interested vendors should forward their capabilities and other information to be considered to PEO_IANACQUISITION@disa.mil. Proprietary information and trade secrets, if any, must be clearly marked on all materials. All information received that is marked Proprietary will be handled accordingly. Please be advised that all submissions become Government property and will not be returned. All government and contractor personal reviewing RFI responses will have signed non-disclosure agreements and understand their responsibility for proper use and protection from unauthorized disclosure of proprietary information as described 41 USC 423. The Government shall not be held liable for any damages incurred if proprietary information is not properly identified. Points of Contact: Contracting Officer: Jane Uhles Phone: 618-229-9458 E-Mail: jane.uhles@disa.mil Program Manager: Sherry M. Green Phone: 703-882-1546 E-Mail: Sherry.Green@disa.mil