SEC Crowdsourced Security Testing Services

SOURCES SOUGHT NOTICE FOR U.S. SECURITIES AND EXCHANGE COMMISSION TITLE: CROWDSOURCED VULNERABILTY DISCOVERY NAICS CODE: 541519 OTHERCOMPUTER RELATED SERVICES PRODUCT SERVICE CODE: D310 CYBER SECURITY AND DATA BACK UP I. INTRODUCTION To facilitate market research, the U.S. Securities and Exchange Commission (SEC or Commission) is requesting capability statements from all interested vendors, in particular small businesses. Information received will be used to obtain information regarding the availability and capability of small businesses (e.g., 8(a), small disadvantaged businesses, veteran-owned small businesses, HUBZone small businesses, women-owned small businesses, and small businesses) to provide the services described in the attached draft Statement of Work. The SEC will use the information received to determine if the work described herein will be set-aside for small business or if the work should be competed on an unrestricted basis. This notice is for INFORMATIONAL PURPOSES ONLY. This is not a Request for Proposal (RFP) and does not commit the SEC to award a contract now or in the future. As such, the government is not obligated to pay for any information received in response to this notice. II. BACKGROUND The SEC is an independent Federal agency established pursuant to the Securities Exchange Act of 1934. The mission of the SEC is to protect investors, maintain fair, orderly, and efficient markets, and facilitate capital formation. In connection with this mission, the SEC is seeking information on capabilities from Vendors with proven experience in providing crowdsourced security testing services on networks, systems, environments, data stores, applications, appliances, source code, and other technologies used throughout the SEC. III. DESCRIPTION The SEC intends to partner with a commercial firm that has extensive experience with administering crowdsourced vulnerability discovery. The Government intends to use existing commercial crowdsourcing expertise and practices to support the SEC in the application of crowdsourcing to enhance its information security. The SEC anticipates a contract type of a hybrid of Firm Fixed Price (FFP) and Firm Fixed Price Not to Exceed (NTE). IV. SUBMISSION OF RESPONSE Submit responses to this RFI no later than 2:00 PM Eastern Time, Thursday, February 7, 2019 to Melissa Rivera-Weedin, riveraweedinm@sec.gov, and Takela Morris at morrist@sec.gov. Responses to all or part of the RFI will be accepted. Proprietary information must be clearly marked. Responses must not exceed 10 pages. The Government will NOT be responsible for any proprietary information not clearly marked. Responses should include, at a minimum, the information identified in each of the following: 1. Business Information: a. Company Name; b. Company Address; c. Company Point of Contact (Name, Phone, E-mail Address) d. DUNS Number; and e. Current GSA or GWAC contract(s) and/or schedules(s) that you possess which are appropriate to this Request for Information. f. Type of company (e.g., small business, 8(a), veteran-owned small business, service disabled veteran owned small business, HUB Zone small business, small disadvantaged business, and women owned small business) as validated via the System for Award Management (SAM); and g. Identify your organization NAICS code for this requirement and whether or your organization is considered a small business under the applicable NAICS code. 2. The attached draft Statement of Statement (SOW) describes the work required of the crowdsourced vulnerability discovery contractor. Please provide feedback on technical information that should be included or excluded based on industry practices for the requested services. Identify areas of ambiguities, limitations, or inconsistencies that could impede successful execution of the work or exclude a prudent contractor from providing an adequate response to the work required. 3. The attached draft SOW reflects the minimum functionality the SEC seeks. Respondents are encouraged to provide information on alternative and innovative solutions, functions, and designs, particularly if a respondent thinks it would produce superior results. 4. RFI respondents must respond in the form of a Capability Statement that addresses: a. The solution's ability to fulfill the above functionality, b. The company's profile and experience in providing crowdsourced vulnerability discovery if any, c. The company's ability to comply with the requirements set forth in the draft attached SOW to be considered capable of satisfying the Government's requirement, d. The size of the company's vetted and unvetted researcher communities. e. Any other relevant information that would enhance the staff's understanding of the information submitted. f. Identify any risks associated with the government requirement. g. Provide a technological overview of the company's solution. h. Propose an effective Contract Line Item structure. i. Provide feedback on the requirement for the Government to verify the severity of a vulnerability discovery prior to a bounty payment. j. Provide feedback on the requirement for vendors to provide both a vetted and unvetted community of researchers.