Public Key Enabling (PKE) Engineering Support

Request for Information (RFI) for Defense Information Systems Agency (DISA) Public Key Enabling (PKE) Engineering Support Contracting Office Address: Defense Information Systems Agency, DITCO-Scott PL8313, P.O. 2300 East Drive, Bldg 3600, Scott AFB, IL, 62225-5406 Description: PURPOSE: The Defense Information Systems Agency (DISA), Program Executive Office - Mission Assurance (PEO-MA), is conducting this Request for Information (RFI) as market research to determine sources with core competencies and demonstrated experience in Net-Centric Information Assurance and Identity Management capabilities. The specific area of focus is Public Key Enabling (PKE). The DoD PKE team is chartered with helping DoD customers leverage existing and emerging Public Key Infrastructure (PKI) capabilities for increased productivity and improved Information Assurance posture. The DoD PKE team provides engineering consultations, develops enterprise solutions, creates collaboration environments, and works to make commercial products interoperate with the DoD PKI. The DoD PKE team is committed to increasing the security posture of the DoD by providing a seamless security environment supporting Identity Management efforts with the overarching goal of defending and protecting the United States of America. THE GOVERNMENT DOES NOT INTEND TO AWARD A CONTRACT ON THE BASIS OF THIS RFI OR REIMBURSE ANY COSTS ASSOCIATED WITH THE PREPARATION OF RESPONSES TO THIS RFI. This RFI is issued solely for information and planning purposes and does not constitute a solicitation. All information received in response to this RFI marked Proprietary will be handled accordingly. Responses to the RFI will not be returned. Whatever information is provided in response to this RFI will be used to assess tradeoffs and alternatives available for determining how to proceed in the acquisition process for PKE contracts. In accordance with FAR 15.201(e), responses to this RFI are not offers and cannot be accepted by the Government to form a binding contract. This RFI is a request for interested parties to describe their technical capabilities and demonstrated experience with Public Key Enabling product evaluations, and technical support of deployed systems. All interested contractors are requested to provide written response to the questions below. A response to this RFI is necessary in order to assist DISA in determining the potential levels of interest, adequate competition, and technical capability within the Small Business Community to provide the required services. In addition, this information will also be used to assist DISA in establishing a basis for developing any subsequent potential subcontract/small business participation plan and/or small business goal percentages. TARGET AUDIENCE: Only small businesses are requested to respond to this RFI to assist DISA in formulating an acquisition strategy that fairly considers small business ability to participate in the acquisition, either as prime contractors or as subcontractors. Sources Sought: This Sources Sought synopsis is requesting responses to the following criteria ONLY from small businesses that can provide the required services under the North American Industry Classification System (NAICS) Code 541519. In addition to Small Businesses, this synopsis is encouraging responses from qualified and capable Service Disabled-Veteran Owned Small Businesses, Veteran-Owned Small Businesses, Women-owned Small Businesses, HUBZone Small Businesses, Small Disadvantaged Small Businesses, Historically Black Colleges and Universities/Minority Institutions, Small Business Joint Ventures, Consortiums and Teaming Partners. This Sources Sought synopsis is issued to assist the agency in performing market research to determine whether or not there are qualified and capable small businesses to provide the aforementioned service. Small businesses must submit responses that demonstrate their qualifications to make a determination for a small business set-aside. Please note that personnel with current DoD Secret clearances (minimum) and specified personnel with current DoD Top Secret clearance will be required at contract award. Responses must demonstrate the company's ability to perform in accordance with the Limitations on Subcontracting clause (FAR 52.219-14). Interested small businesses meeting the small business standard of NAICS code 541519 are requested to submit a response to the Contracting Officer BY 11 March 2010. Late responses will not be considered. Responses should provide the business's DUNS number and CAGE code and include a statement of self certification under the NAICS code. Additionally, responses should include recent (within the past three years or work that is on-going) and relevant experience (work similar in type, scope, and complexity) to include contract numbers, project titles, dollar amounts, and points of contact with telephone numbers where the responder performed the relevant work. Provide a list of the current contract vehicles your services may be procured from, to include the General Service Administration (GSA), Federal Supply Schedule (FSS) and any other government contract vehicle. Marketing brochures and/or generic company literature will not be considered. Not addressing all the requested information may result in the Government determining the responder is not capable of performing the scope of work required. Requested Information: Interested vendors are requested to submit a maximum 15 page statement of their knowledge and capabilities in the areas of Enterprise IT Policy and Planning, Integrated Solutions Management, Requirements Analysis and Operations Support in support of the DoD PKE program office in order to perform the tasks as highlighted in the questions below. In all answers, Relate your understanding of the problem to knowledge of as well as direct experience with the same or similar work.. Be specific in the scope and size of the project and customer base. If a government customer, please include the customer name. Include specific technologies / hardware / software used, what networks(s) were involved, types of PKI certificates used, and any challenges encountered and how they were overcome. - a) The DoD PKE team supports an extremely broad yet technically in-depth focus area. Our mission is to support DoD customers in leveraging existing and emerging PKI capabilities for increased productivity and an improved Information Assurance posture. Our work extends to PK enabling varied operating systems, networks, hardware, applications and mobile devices used throughout DoD. Describe your engineering experience in these areas. - b) DOD PKE exists to support our DoD customers, therefore customer support and outreach are our top priorities. Our community collaboration consists of virtual training, conference support, several web presences, virtual DoD technical interchange meetings and quarterly newsletters. Describe your experience in these areas. - c) The main focus of the DoD PKE team is engineering support to DoD customers. One area of engineering support is direct consultation to end users, system owners, system developers and help desk personnel for all issues concerning the use of PKI. This can include a basic support question such as "how to send an encrypted email" all the way up to a request for on-site support for a DoD Program of Record to assist with designing the security architecture to accept and pass PKI identity credentials. Please state your experience with providing these services. - d) PKE engineering support also expands to evaluation of commercial PKE products and interfacing with product vendors to ensure their current and future products support DoD PKI. When commercial products are not available to meet specific DoD enterprise needs, the PKE team will develop tools to support requirements such as installing the DoD roots into trust stores or certificate validation solutions. Describe your experience in these areas. . - e) The results of DoD PKE engineering work are communicated to our customers through information papers and quick reference guides. The information papers are often used to inform decision makers of technical issues, risks and recommendations. The reference guides are also used by System Administrators to implement recommended configuration of OS and applications. As a result, Technical writing skills at multiple audience levels are key to communicating our work and protecting DoD networks. Describe your experience in these areas. . - f) DoD PKE supports the DoD PKI by recommending enhancements to the infrastructure as well as testing emerging PKI capabilities and integrating them into customers' operational environments. Please describe your experience in these areas. . - g) Non-Person Entity (NPE) certificates is an upcoming DoD PKI capability that PKE will support with testing, integration and use within the DoD community. Please describe your related experience with NPE certificates. - h) DoD PKE supports the integration of PKIs external to the DoD that have been cross-certified with the Federal Bridge and successfully completed interoperability testing. Describe your experience with working with Federal Bridge partners and integrating the use of multiple PKIs - technically and culturally. - i) Certificate Validation within the DoD PKI is extremely challenging given the size of its revocation lists. Describe your experience with certificate validation technologies, solutions, configurations and implementations. - j) PKE often expands to other identity management technologies including enterprise directories, privilege management and other net-centric solutions. Describe your experience with these capabilities. - k) PKE leverages the Host Based Security System (HBSS) to monitor and audit devices for PKE compliance. Describe your experience with using HBSS or other technologies to audit PK enabled devices. - l) Describe your knowledge and experience of PKI policy and standards. Describe a situation where in an implementation, you were faced with competing standards and the approach taken to mitigate the conflict. - m) Describe your experience managing the programmatic and functional activities of a contract to include task order management, schedules, invoicing, control progress and status reporting. Responses: Responses should include the: (1) business name, address and date; (2) name of company representative and their business title; (3) cost estimate (with applicable date/duration) for providing the capabilities described above; and (4) contract vehicles available that would be available to the Government for the procurement of the product and service, to include General Service Administration (GSA), NASA Solutions for Enterprise-Wide Procurement (SEWP), Federal Supply Schedules (FSS), or any other Government Agency-Wide Contract vehicle. The responses should be in a white paper format, no longer than fifteen (15) pages total in length (including past performance citations). The response should address the capability questions posed above, and should include an appendix that consists of at least two past performance citations. The past performance citation should include Contract Number; Government POC and contact information; and list prior installations and deployed solutions. Firms who wish to respond to this should send responses via email NLT 11 March 2010 at 5:00 PM Eastern Daylight Time (EDT). The response should not exceed a 5 MB e-mail limit for all items associated with the RFI response. Interested vendors should forward their capabilities and other information to be considered to PEO_IANACQUISITION@disa.mil. Proprietary information and trade secrets, if any, must be clearly marked on all materials. All information received that is marked Proprietary will be handled accordingly. Please be advised that all submissions become Government property and will not be returned. All government and contractor personal reviewing RFI responses will have signed non-disclosure agreements and understand their responsibility for proper use and protection from unauthorized disclosure of proprietary information as described 41 USC 423. The Government shall not be held liable for any damages incurred if proprietary information is not properly identified. Point of Contact: Program Manager: Ms. Carmella Webster Phone: 703-882-1119 E-mail: carmella.webster@disa.mil