Information Security Analysis & Recommendations

The Transportation Security Administration (TSA) is requesting information concerning those sources capable of providing and maintaining a Public Transportation Information Security & Analysis Center (PT-ISAC) or its technical equivalent, while developing Mass Transit and Passenger Rail security-related recommended practices, guidelines, or white papers. Providing and maintaining a fully-operational PT-ISAC or its functional equivalent entails an operational, 24/7 incident reporting and threat-monitoring/information sharing mechanism. Daily, situational engagement of the full spectrum of public and private-sector transportation is expected - indeed, required. This includes areas of over-the-road bus, light rail, commuter rail, subways, waterborne services and inter-city and high-speed passenger rail. Likewise, the development of security-related recommended practices, guidelines, or white papers for the Mass Transit and Passenger Rail industry is an integral piece to TSA's Mass Transit and Passenger Rail counter-terrorism mission. This is a sources sought notice only and vendors will not be compensated for the information provided. No solicitation will be issued at this time. Please describe your organization's capabilities by answering the following Questions: ? Has your firm ever worked on or within an Information Sharing and Analysis Center (ISAC)? Is your company prepared to demonstrate a depth of experience, expertise and capability to produce, and disseminate analytical products such as security recommendations, summaries, and analytical assessments as described in the draft SOW? Does your company currently offer or is positioned to offer any or all of the following? If so, please describe what your company has or can offer. - Transit and Rail Intelligence Awareness - Daily Open Source Cyber Reports (Cyber Daily) - Monthly Cyber Threat Trends Analysis - Special Analysis of Major Incidents or Events ? Can your firm support a legacy system while at the same time demonstrating an efficient means of receiving/communicating threats and alerts? Does your company possess a secure means of sharing security information - anonymously or otherwise? Please describe both your previous experience as well as your current capability. ? There are numerous, Information Sharing and Analysis Centers (ISACs) operating in the U.S. today. In specific, has your company ever partnered or shared information with the Surface Transportation (ST) ISAC? Has your firm ever served or participated as an active member of the National Council of ISACs (NCI). When? Does your company have - ready-access' to unique intelligence sources not normally available? Does your company currently share close intelligence exchanges with the U.S. Intelligence Community? If so, please describe your experience in this context. Does your firm engage in intelligence exchanges or analysis sharing with any of the following? If so, please describe your firm interfaces with the following: - U.S. and foreign governments/International forums? - National and International Computer Emergency Response Teams (CERTs)? - Federal Agencies/Law enforcement entities? - Other, Independent research firms? ? Does your firm possess the capability and the experienced personnel to "Push" information to a wide swath of subscribers, or members? Is your firm familiar with the Homeland Security Information Network (HSIN)? Has your company ever accessed the government's HSIN system? For what purpose? What is your company's experience with managing and working in environments like the Homeland Security Information Network (or similar entities)? ? Describe your firm's current relationships with the Mass Transit and Passenger Rail and Over-the-Road Bus Community and how it would handle distribution lists of members, partners, and support contacts; whether or not your firm maintains membership in the NCI; and your working relationship - past, present, or pending - with the ST ISAC. ? Describe your firm's ability to obtain intelligence and information from sources and organizations with which you have professional rapport: Please demonstrate your firm's current, working relationship between your company and any of the following: - Private Sector Resources (Rail Information Security Committee, Railway Alert Network, 3,500 + members) - Department of Homeland Security, including Transportation Security Administration - Department of Transportation - Federal Bureau of Investigation - DHS National Cybersecurity & Communications Integration Center (NCCIC) - DHS US Computer Emergency Readiness Team - DHS Industrial Control Systems Cyber Emergency Response Team - U.S. Department of State Cyber Threats and Analysis Division - Inter-ISAC Teleconference Calls and Monthly Meetings - Canadian Computer Emergency Response Team (CanCERT) - Regional, State, Local Fusion Centers and Law Enforcement Agencies ? What is your company's depth of expertise in developing recommended practices, guidelines, and/or white papers in areas such as Public Transportation? Describe the state of your company's current relationship with representatives of the Mass Transit and Passenger Rail community? Are these relationships extensive, national in scope? ? How would your company develop recommended practices, guidelines, and/or white papers to address a wide variety of mass transit and passenger rail security initiatives? ? Describe parameters related to any necessary transition period required should TSA enter into a business arrangement with your firm to fulfill the requirements of the Draft Statement of Work: - Would a transition period be necessary for your firm to begin to fulfil the requirements? - What would be the estimated duration of any required transition? Please furnish any and all recommendations and or questions related to the draft Statement of Work. ADMINISTRATIVE All interested parties shall clearly answer the above Questionnaire and include a brief company profile to the TSA Office of Acquisition (OA). In answering the above questions, interested contractors should clearly explain their abilities and experience as they relate directly to the questions being asked and to the attached Statement of Work. Submissions shall not exceed fifteen (15) pages in length. A company must identify its business size status, type of small business, and applicable NAICS code(s) in its response. Responses must be sent electronically via email to edwin.pasha@tsa.dhs.gov. Subject: TSA PT-ISAC, no later than Friday, 07/01/2016, at 5:00 p.m. EDT. Responses received after this deadline will not be reviewed. TSA's primary point of contact is the Contract Specialist, Edwin Pasha, who can be reached via e-mail at edwin.pasha@tsa.dhs.gov. Any questions regarding this notice shall be directed to Mr. Pasha in writing, via email no later than Wednesday, 06/22/2016, at 5:00 p.m. EDT. Companies responding to this Request for Information are responsible for all expenses associated with responding to this Notification. (Note: TSA will not pay any costs associated with this effort). TSA is not seeking or accepting unsolicited proposals. Since this notification is for information, market research and planning purposes, no evaluation letters or results will be issued to respondents.