Joint Enterprise License Agreement (JELA) to fulfill a requirement for Palo Alto Products and Services

The Defense Information Systems Agency (DISA) is seeking sources for a new Joint Enterprise License Agreement (JELA) to fulfill a requirement for Palo Alto Products and Services. CONTRACTING OFFICE ADDRESS: DISA/Defense Information Technology Contracting Organization (DITCO) 2300 East Drive, Building 3600 Scott AFB, IL 62225-5406 INTRODUCTION: This is a SOURCES SOUGHT NOTICE to determine the availability and technical capability of small and large businesses (including the following subsets: Small Disadvantaged Businesses, Certified 8(a), Service-Disabled Veteran-Owned Small Businesses, HUBZone Small Businesses and Woman-Owned Small Businesses) to provide the required products and/or services. On January 24, 2022, the Government awarded an Other Transaction Authority (OTA) contracting vehicle for the Thunderdome Zero Trust Solution to Booz Allen Hamilton, Inc. The objective of the OTA was to implement key Zero Trust concepts on an existing network. Specifically, the Government intended to design, develop, and demonstrate the operational utility of Secure Access Service Edge (SASE) and Customer Edge Security Stacks at the Defense Information System Network customer points of presence, along with scalable Application Security Stacks deployed in front of one or more application workloads. DISA announced a successful completion of the Thunderdome Prototype OTA, a zero-trust security model that leverages commercial technologies. DISA's Thunderdome prototype successfully proved that commercial technologies could improve both security and network performance in an existing enterprise environment. DISA's Thunderdome solution provides a comprehensive Zero Trust Architecture with several integrated, but distinct components whose independent adoption will drive growth uniquely across the solution. The licenses required to deploy and operate DISA's Thunderdome solution are largely the same for the Non-classified Internet Protocol (IP) Router Network (NIPRNet) and Secure Internet Protocol Router Network (SIPRNet) implementations. Both implementations will have the same solution components and therefore the same licensing requirements, though each will have unique scale and growth patterns. SASE licensing will only be applicable to the NIPRNet implementation. The DISA JELA Program Management Office is seeking information from potential sources for Palo Alto Products and Services. The specific area of focus are the resources that offer commercial licenses in the functional areas of Public/Private/Hybrid Cloud Security, Container Security, Secure Remote Access, Internet Landscape Intelligence, and Security Operations Center (SOC) Operational Tools. These products must be able to integrate into the existing infrastructure. The information gathered will be in support of the development of a Department of Defense (DoD) JELA. The DoD-wide JELA is a contracting vehicle that will be used to procure the required products in support of the functional areas stated above. The anticipated Period of Performance is January 29, 2024 - January 29, 2029 The anticipated Place of Performance is the Continental United States (CONUS) and outside the (CONUS) DISCLAIMER: THIS SOURCES SOUGHT ANNOUNCEMENT IS FOR INFORMATIONAL PURPOSES ONLY. THIS IS NOT A REQUEST FOR PROPOSAL. IT DOES NOT CONSTITUTE A SOLICITATION AND SHALL NOT BE CONSTRUED AS A COMMITMENT BY THE GOVERNMENT. RESPONSES IN ANY FORM ARE NOT OFFERS AND THE GOVERNMENT IS UNDER NO OBLIGATION TO AWARD A CONTRACT AS A RESULT OF THIS ANNOUNCEMENT. NO FUNDS ARE AVAILABLE TO PAY FOR PREPARATION OF RESPONSES TO THIS ANNOUNCEMENT. ANY INFORMATION SUBMITTED BY RESPONDENTS TO THIS SOURCES SOUGHT ANNOUNCEMENT IS STRICTLY VOLUNTARY. CONTRACT/PROGRAM BACKGROUND: N/A REQUIRED CAPABILITIES: The DoD has a need for a license agreement that can support the implementation of a zero-trust approach that can integrate within the existing infrastructure to outpace cyberthreats. This effort will provide DoD with access to numerous products and services that will provide an offering to meet our core defensive cyber operations capabilities. The DoD further requires the Palo Alto Software-as-a-Service (SaaS) solution that has a minimum of DoD Impact Level 5 (IL5) certification as defined within the DoD's Cloud Security Requirement Guide (SRG). Once implemented DoD Agencies and Military Departments (MILDEPs) (all of the MILDEPS and agencies will be known as - Agencies in the remainder of the document) will potentially utilize the same toolset reducing redundancy, lowering tool costs, and enabling the organization to operate more effectively. This will enable the Agencies to leverage the various products that are prevalent within the DoD directed by policies, organized, and structured in processes, and supporting procedures towards the goal to design, plan, deliver, operate, and control Information Technology. Describe and provide an example of your company's experience supporting the three areas of requirements below utilizing the products and services listed in Attachment 1. Tab 1. A comprehensive suite of security services to effectively predict, prevent, detect, and automatically respond to security and compliance risks without creating friction for users, developers, and security and network administrators. Tab 2. Software firewalls protect private and public cloud deployments with segmentation and threat prevention, secure Kubernetes environments, and protect deployments with network security delivered as a managed cloud service. Tab 3. A portfolio of services to assist with the implementation of next-generation firewall for prevention and detection of cyber threats to millions of customers globally by offering a comprehensive portfolio with visibility, trusted intelligence, automation, and flexibility to help organizations advance securely across clouds, networks, and mobile devices with a modernized, future-proof security framework and can integrate within a network. Remote IT asset management must be provided to facilitate recording, tracking, and monitoring assets covered under this agreement. Additionally, please describe and provide an example of tracking all software licenses via an asset management tool. SPECIAL REQUIREMENTS Must be able to provide a Palo Alto SaaS solution that has a minimum requirement of DoD IL5 certification as defined within the DoD's Cloud SRG. Must have Top Secret Facility Clearance. Provide your current Facility Clearance level. SOURCES SOUGHT: The North American Industry Classification System Code (NAICS) for this requirement is 513210 with the corresponding size standard of $47M. In order to make a determination for a small business set-aside, two or more qualified and capable small businesses must submit responses that demonstrate their qualifications. Responses must demonstrate the company's ability to perform in accordance with the Limitations on Subcontracting clause (FAR 52.219-14). To assist DISA in deciding the level of participation by small business in any subsequent procurement that may result from this Sources Sought, you are also encouraged to provide information regarding your plans to use joint venturing (JV) or partnering. Please outline the company's areas of expertise and those of any proposed JV/partner who combined can meet the specific requirements contained in this notice. SUBMISSION DETAILS: Responses should include: Business name and address. Name of company representative and their business title. Type of Small Business. CAGE Code. Prime contract vehicles; to include ENCORE III, SETI, NIH CIO-SP4, NASA SEWP V, General Service Administration (GSA): OASIS, ALLIANT II, VETS II, STARS III, MAS (including applicable SIN(s), groups, or pools), or any other Government Agency contract vehicle that allows for decentralized ordering. (This information is for market research only and businesses with a valid cage that lack prime contract vehicles are still encouraged to respond to this notice.) Businesses who wish to respond must send responses via email NLT 9:00 AM Eastern Daylight Time (EDT) on June 26, 2023 to carmelynanne.bryan.civ@mail.mil and carene.v.simon.civ@mail.mil. Interested businesses should submit a brief capabilities statement package addressing the specific questions (no more than five pages) and demonstrating ability to perform the services listed under Required Capabilities. Proprietary information and trade secrets, if any, must be clearly marked on all materials. All information received that is marked Proprietary will be handled accordingly. Please be advised that all submissions become Government property and will not be returned. All government and contractor personnel reviewing submitted responses will have signed non-disclosure agreements and understand their responsibility for proper use and protection from unauthorized disclosure of proprietary information as described 41 USC 423. The Government shall not be held liable for any damages incurred if proprietary information is not properly identified.