R--Information technology security support services

Response Date Changed From: 07/09/2009 To: 7/10/2009 11 am EST. This is a Sources Sought notice to support the Drug Enforcement Administration's (DEA) effort to provide information security services on the agency's information technology enterprise architecture. The DEA's Information Security Section (ISI) provides information security oversight and support to information technology program management offices and operational program areas by performing the below five complementary functions. ISI requires a contractor to support these areas: 1) Information Security Program Management: This program is primarily focused on external compliance requirements. 2) Information Assurance: This program is critical for ensuring that information technology systems' security controls are implemented correctly, operating as intended, and producing the desired outcome; and that remaining risks are properly identified to senior decision makers. The program also ensures that security controls are continuously monitored and reaccreditations occur periodically or whenever there is a significant change to the system or its operational environment. 3) Communication Security (COMSEC): This program is responsible for providing COMSEC custodian training, supporting secure communications equipment, and is the Central Office of Record for all cryptographic equipment. This program provides field offices, both domestic and foreign, with a means to communicate securely among each other as well as with other government organizations. 4) The Information Security Governance: This program primarily identifies and develops situational or program specific information technology security policies to clarify or address gaps in Federal regulations. New and existing policies are reinforced through comprehensive training, inspections, and security violations programs. 5) The Incident Management: This program is responsible for intrusion detection system monitoring support, password compliancy, vulnerability assessments, identity management, and audit log analysis. This program also serves as the technical implementation of the organization's strategic incident response process. It identifies and mitigates weaknesses, rapidly detecting and investigating incidents, minimizing loss and destruction of data, and quickly restoring computer operations, thereby maintaining the confidentiality, availability, and integrity of DEA's mission critical information. REQUIREMENT: The DEA requires contractor support to focus on external compliance requirements, such as management support; audit and liaison support; documentation review; tool evaluation; Department of Justice (DOJ) Security Assessment and Management Tool education; coordination and scheduling security compliance functions that supports reporting deadlines demanded by DOJ and executed in accordance with Federal Information Security Management Act (FISMA) legislation; coordination for plans of actions and milestones project management; and review of federal legislation and guidance. The contractor will also be responsible for preparing certification packages; providing risk management recommendations; and tracking plan of action and milestones. The contractor will also provide support for certification and accreditation, the security assessment and management tool, technical evaluation and assessment, and configuration management change reviews. Additional duties include configuration and programming secure communication equipment; cryptographic keying material; equipment shipping and receiving; inventory inspections; and equipment maintenance and support. The DEA will also require contractor support in the area of information security policy; compliance inspections; training and education; and classification management program support. The contractor will also be required to provide incident response support; identity management program; intrusion detection system monitoring; incident identification and handling; incident reporting; incident response investigations; vulnerability assessment; application and database development support; information technology security engineering; operations and maintenance support; and hardware and software management. ADDITIONAL INFORMATION: The North American Industry Classification System Code (NAICS) is 541513, entitled Computer Facilities Management Services, with a corresponding size standard of $25 million average annual receipts. RESPONSES: Interested sources are asked to provide their responses in Times New Roman, 12 point font. Responses must include the following information: 1. Company name; mailing address; physical address; point of contact; telephone number; fax number; e-mail address; DUNS number; NAICS code; company business size, if small, indicate type; and GSA schedule number (if applicable). 2. A corporate capability statement between one and five pages that includes relevant experience within the past three years. Relevant experience is defined as possessing the experience described in the 'Requirement' section above. 3. A representative sample of contracts your firm was awarded to provide services as described in this notice within the past three years. For each contract listed, include the type of contract; total estimated value; contract period of performance (e.g., base and number of option periods); customer (i.e., federal agency) and respective point of contact (e.g., point of contact's name, phone number, fax number, and email address). SUBMISSION: All responses to this notice shall be submitted in writing to Eliana Zavala, Contract Specialist, at contact@example.gov no later than 11:00 AM EST on July 10, 2009. NOTE: The information provided in this Sources Sought notice is to be used for acquisition planning purposes to determine the available sources for the services described herein. This is not a solicitation and proposals are not being requested at this time. This notice is not to be construed as a commitment by the Government to issue a solicitation or award. Responses will not be considered proposals. The DEA will not be responsible for any costs incurred by interested sources responding to this Sources Sought notice.