Secure Ingest Service (SIS)

**Please note changes in submission instructions Subject: (U) Request for Information (RFI) Secure Ingest Service (SIS) Capabilities A. (U) Introduction (U) This RFI is being issued solely for information and planning purposes and does not constitute an Invitation for Bids (IFB), a Request for Proposals (RFP), a Request for Quotations (RFQ) or an indication that the Government will contract for any of the items and/or services contained in this notice (FAR 15.201(e)). In accordance with FAR 52.215-3 - Requests for Information or Solicitation for Planning Purposes (Oct 1997), the Government will not pay for any information/items submitted in response to this RFI. Any data provided will not be returned. This RFI does not commit the Government to award a contract. No determination as to the viability of this requirement has been made at this point and there is currently no solicitation for this effort. Any solicitation resulting from this RFI will be announced separately. B. (U) Background (U) NGA ingests large volumes of geospatial intelligence (GEOINT) data to include raster and vector types transmitted via a variety of protocols. Given that, NGA, would like to understand technologies, that are currently available or in development, that can be used to efficiently ingest large data files, and provide protection capabilities against digital image-based malware. (U) NGA uses various applications/systems to interface with the received data. The data must conform to stringent GEOINT standards. Any proposed process or technology must maintain these standards in the post-processed products. NGA will verify that any processing does not degrade the processed image or file. (U) NGA is interested in information from Industry, Academia, and those within the Intelligence Community on approaches to mitigate any inherent risk that comes with ingesting GEOINT data. Some of those risks or threats identified via open sources include, but are not limited to: viruses, trojans, worms, insertion, altering, hiding, digital image-based steganography, and tracking. NGA is also interested in technologies or designs which can be developed or adapted to support ingest of a wide variety of file formats including imagery files. (U) NGA encourages thoughtful, complete and innovative solutions to the questions in Section D. If interested parties are unable to respond to the entire RFI, NGA will accept responses to specific individual questions. NATIONAL GEOSPATIAL-INTELLIGENCE AGENCY 7500 GEOINT Drive Springfield, VA 22150 C. (U) Desirable Characteristics of Technology of Interest (U) NGA is interested in the following technology characteristics of any proposed solution that addresses the questions in Section D: - (U) Modularity that allows individual services to be tailored to support multiple interfaces to web services. - (U) Implementation flexibility that allows individual capabilities or modules to be orchestrated based on current needs. - (U) Scalability that allows a mix of small and large data files (up to 10GB each) to be processed in a timely manner while supporting an overall high data volume (at least 5TB/day). - (U) Innovation that provides efficient data file ingest and protection from malware. D. (U) Information Desired (U) NGA is interested in information on technical approaches to: (1) Mitigate any inherent risk that comes with ingesting GEOINT data and (2) Process large data volumes or bundled files (that are inherent in ingest of satellite imagery) against current and future digital image-based malware threats. Request interested and qualified parties address the following in accordance with the submittal instructions: 1. (U) NGA would like to understand vendor approach to any and all state-of-the art steganalytical techniques. If those technologies are available, describe how they might be employed to satisfy the NGA problem set generally described in section B, and how their characteristics meet the desired solution characteristics, identified in Section C above. 2. (U) Describe technologies for scalable processing of large imagery files or bundled imagery files and the protective capabilities provided by the technologies. 3. (U) Describe available technologies for monitoring GEOINT applications in a virtual machine implementation. 4. (U) Describe your capability to provide malware threat assessments specific to digital imagery files, to include both common and unique attack vectors. 5. (U) Describe in detail, via a use case, if/how digital image-based malware can be aggregated and eventually triggered to execute unauthorized code. Identify whether existing commercial data security practices can prevent such execution. 6. (U) Describe how you would mitigate digital image-based threats. 7. (U) Describe your technology/approach (and its technical readiness level) to ensure that digital image-based malware is not ingested within the GEOINT data. 8. (U) Describe if you have collected or created samples of image-based malware; have tested your current and proposed technology, and have documented your test methodology and results in order to verify the efficiency and accuracy of your steganalytic technologies. 9. (U) Describe characteristics of your approach that differentiate it from other comparable solutions. 10. (U) Describe the false error rate, reliability, and computational complexity of your technology. 11. (U) Describe your proposed solutions for processing common file types, such as National Imagery Transmission Format, Joint Photographic Experts Group, Moving Picture Expert Group, Portable Document Format, and Tagged Image File Format. 12. (U) Describe how your solution can be implemented via easily upgradeable modules. Provide examples of each modular upgradeability and interfaces supported. 13. (U) Describe any limitation of integrating your solution with Intrusion Detection, Host Monitoring systems, and enterprise monitoring capabilities. 14. (U) Describe technology available to ensure and monitor the integrity of files. 15. (U) Describe technologies that can be scaled to meet processing needs for very large and very small files, with very high overall volume. 16. (U) Describe the limiting factors of your approaches for scalable processing of large data files within the minimum time limits. 17. (U) NGA receives both raster as well as vector data. Please supply a full list of data types with which you have experience. 18. (U) Describe the technical means you offer for forensic analysis of digital images. 19. (U) Do you have a GSA vehicle appropriate for this effort? If yes, provide the contract number. 20. (U) Are you aware of FAR part 52.219-14, Limitation of Subcontracting? 21. (U) Are you interested as a prime or a subcontractor? 22. (U) Can you perform all of the required work? 23. (U) What portion of the work could be set-aside for small businesses? 24. (U) Would you propose on this requirement if released? 25. (U) Is there another suggested NAICS code? If yes, please provide it 26. (U) If you wish to be included on our Interested Party/Vendor list, which will be posted on line, please provide your Company's name and a Point of Contact (POC) with title, email address, and phone number. E. (U) Due Date and Submittal Instructions (U) Responses to this Request for Information (RFI), whether complete or partial, MUST BE Submitted/Received by the Due Date, and Method for Submittal specified below without exception. 1. (U) Due Date. All responses to this RFI MUST BE received by 12 Jan 2012 5PM ET. 2. (U) Method for Submittal. All responses MUST BE Submitted to Ryan Roe, Contract Specialist (ryan.w.roe@nga.mil) or Douglas Verseman, Contracting Officer (douglas.h.verseman@nga.mil). (U) The Government will entertain questions on a case by case basis. Respondents should be advised that all questions submitted to the ARC will be posted for all respondents to view, although the identity of the requesting organization will be withheld. The deadline for submitting questions is WED - 21 DEC 2011, By NLT 0900 ET. Questions must be submitted via the ARC Question and Answer (Q&A TAB) feature. To expedite processing, no other form of submittal will be accepted. Questions submitted should reference appropriate sections within the RFI. Should you have questions regarding use of the ARC, please contact the ARC Web Team at dev@ticom.npa.gov. (U) To aid in Government review, the total pages for the entire submission are limited to not more than 18 pages, submitted electronically in Portable Document Format (PDF). File size shall not exceed 9MB. The first page of the submission must state the RFI title and provide the name, e-mail address and telephone number for an individual that can be contacted for clarification of questions regarding this submission. The first page should also provide a short description of the company to include capabilities, company size and category (e.g. large, small, small disadvantaged). The response format is 8.5" x 11", 12 pt, Times New Roman font. (U) Any proprietary information contained in responses should be clearly marked as such, by paragraph, such that proprietary information and non-proprietary information are clearly distinguished. Any clearly marked proprietary information received in response to this request will be properly protected from unauthorized disclosure. In addition, respondents are hereby notified that more than one Government Agency may be provided the responses for review, and the Government may utilize a Federally Funded Research and Development Center (FFRDC) and/or Support Contractors to provide technical advice on the responses. Any FFRDC or Support Contractor employee given access to proprietary information shall be subject to an appropriate obligation of confidentiality prior to being given access to proprietary information. (U) The Government may use the information provided to develop a comprehensive procurement strategy and solicitation. Any information used will be on a non-attribution basis. Proprietary information submitted from any one source will not be used to establish the capabilities or requirements for any future acquisition so as not to inadvertently restrict competition. (U) The anticipated North American Industry Classification System (NAICS) code for this effort is 541519, Other Computer Related Services. The small business size standard for this code is $25M. Your response should identify your size (large or small) in relation to this NAICS code. F. (U) POINTS OF CONTACT Ryan Roe Douglas Verseman 314-676-1857 314-676-0195 Ryan.W.Roe@nga.ic.gov Douglas.H.Verseman@nga.ic.gov Ryan.W.Roe@nga.mil Douglas.H.Verseman@nga.mil