Risk Management Framework Support Services

Naval Surface Warfare Center Carderock Division (NSWCCD) requires Risk Management Framework (RMF) services for the Naval Sea Systems Command (NAVSEA) Enterprise. These services include the creation of RMF authorization packages, providing RMF maintenance services, and Navy Qualified Validator (NQV) support. NSWCCD anticipates a firm fixed price (FFP) contract for this requirement and intends on soliciting as a set-aside for the Historically Underutilized Business Zone (HUBZone) Program. Due to the services being required, interested parties shall have an office within 50 miles of the Washington Navy Yard and possess a Top Secret Facility clearance. This requirement requires a wide range of packages to be created and maintained using RMF. This range is broken down into three categories, which are defined below: - Category I - made up of Information Systems (IS) that consist of up to five operating systems, up to 10 servers, and up to 200 workstations - Category II - made up of Information Systems (IS) that consist of six or more operating systems, 11 or more servers, and more than 200 workstations - Category III - Inheritance Provider packages that are made up of no ISs. They consist of physical, environmental, and procedural controls associated with ISs associated by type or location The contractor shall be capable of creating RMF packages in all categories, provide RMF package maintenance on all RMF packages created, and provide NQV validator for all categories. Additionally, the contractor shall be capable for creating Platform Information Technology (PIT) and Research, Development, Test, and Evaluation (RDT&E) packages throughout the RMF process. PIT consists of computer resources, both hardware and software, that are physically part of, dedicated to, or essential to the mission performance of special-purpose systems. It does not include general purpose systems. The contractor shall develop and update documents as required by Department of Defense (DOD), Department of Navy (DON), NAVSEA, and Navy Enterprise Mission Assurance Support Services (eMASS). The contractor shall be capable of scanning for and applying remediation in accordance with the Defense Information Security Agency (DISA) Security Technical Implementation Guides, Security Requirements Guide, Security Readiness Reviews and generate DISA checklists and artifacts. The contractor shall register new systems in the Vulnerability Remediation Asset Manager (VRAM) database, import ACAS scans and maintain the VRAM database for all ISs in accordance with DOD, DON, and NAVSEA. All contractor personnel supporting this requirement will be part of the DON Cybersecurity Workforce (CSWF). Interested HUBZones shall respond to this announcement by closing date/time to the primary point of contact by email with the following information: - HUBZone certificate - Location of its office within 50 miles of Washington Navy Yard - Confirmation that it can perform this requirement on FFP basis pursuant to FAR 16.202 and a recommended contract line item number (CLIN) structure and any assumptions it would require to perform on a FFP basis - Its capabilities to meet the requirements above and ability to perform up to the following range of packages within a 12 month period: RMF Package Creation: Category I - up to 12, Category II up to 15 and Category III up to six packages RMF Package Maintenance: Category I - up to 12, Category II up to 15, and Category III up to six packages RMF Package NQV Validation: Category I - up to 12, Category II up to 15, and Category III up to six packages - Evidence that it has Level III NQV validators, with active validator certifications, on staff that could support this requirement - Ability to handle up to - Its approach to perform RMF package creation and NQV services - Its ability to provide at least one individual who would be capable to perform in each of the following specialty areas: - Master Proficiency Level in Category Specialist Area 451 of the DON Cybersecurity Workforce Qualification Matrix of the SECNAV M-5239.2, Cyberspace Information Technology and Cybersecurity Workforce Management and Qualification Manual - Master Proficiency Level in Category Specialist Area 441 of the DON Cybersecurity Workforce Qualification Matrix of the SECNAV M-5239.2 Note: This is a request for information (RFI) notice only. This RFI is for informational planning purposes and is not be construed as a commitment by the Government for any actual procurement of materials or services. This notice does not constitute a solicitation or a promise of a solicitation in the future nor does it does not commit the Government to contract for any supply or service. Respondents are advised the Government will not pay for any information or administrative costs incurred in response to this RFI. All costs associated with this RFI are solely at the responding parties' expense. Respondents are solely responsible for properly marking and clearly identifying any proprietary information or trade secrets contained within their response. The Government will not be liable for, or suffer any consequential damages for any proprietary information not properly marked and clearly identified.