Subscription to Global Threat Intelligence Data

Sources Sought - Subscription to Global Threat Intelligence Data. RFI Number: 2032H325N00008 Notice Type: Sources Sought SYNOPSIS Treasury is Sector Specific Agency (SSA) for the financial services sector and the Domestic Finance Office of Cybersecurity and Critical Infrastructure Protection (OCCIP) is the organization assigned to perform the responsibilities of the SSA. The role of the SSA is to collect, analyze, and share cyber threat information with Financial Services Sector (FSS) to prevent and/or recovery from cyber threats to the sector and improve the sectors resiliency to those threats. OCCIP requires access to the global threat intelligence data with a platform to reach the public and private customers in the database. This allows OCCIP to efficiently perform its SSA responsibility efficiently communicate cyber threats to the FSS. The North American Industry Classification System (NAICS) code for this request may likely include: 519290 - Web Search Portals and All Other Information Services. SMALL BUSINESSES ARE ENCOURAGED TO RESPOND. Include whether or not you are a small business; 8(a) small business; HUB Zone small business; service-disabled veteran-owned or veteran-owned small businesses; women-owned or economically disadvantaged women-owned small business; or small disadvantaged business in order to assist the Treasury in determining the appropriate acquisition method, including whether a set-aside is possible. GENERAL PURPOSE 1.0 Purpose Treasury may have an upcoming opportunity for a subscription service which provides access to the global threat intelligence data. This platform must provide all requirements listed in Section 2.1 of this Sources Sought Notice. The purpose of this Sources Sought is to gather information that will assist the Departmental Offices in planning, formulating, and evaluating contractor capability to provide the service described in the Technical Requirements. The Treasury Departmental Offices are also open to alternative ideas and respondents are encouraged to provide information about alternative solutions that may assist in better meeting future needs. Acquisition Approach The Treasury has not determined the acquisition approach. Any results of this Sources Sought will assist the Treasury Departmental Offices and the Office of Business Solutions Acquisition (OBSA) Treasury Operations Branch (TOB) Procurement Office in determining an acquisition strategy about how to proceed. SOURCES SOUGHT REQUIREMENTS 2.0 Description of Information Requested OBSA TOB is requesting information regarding the respondents capabilities in providing the aforementioned required. Provide company information, to include: Company name and address; Size of company (number of personnel, total revenue, ownership, parent corporation, etc.); Unique Entity Identifier (UEI) Company point(s) of contact including name, phone number, address, and email; length of time in business; Geographic presence; Company experience in providing valuation services to government or commercial entities; Provide any pertinent information that will assist us in this assessment. Contract Number and value/capacity; and Available Strategic Contracts (e.g., GSA, Indefinite Delivery Indefinite Quantity (IDIQ) contract allowing decentralized ordering, etc.). Please identify type of - ordering contract (e.g., GSA Multiple Award Schedule, GSA Professional Service Schedule, etc.). 2.1 Technical Requirements/Scope The purpose of this requirement is to provide a subscription service which provides the following: 2.1 Product, Service or Outcome Needed. OCCIP requires access to the global threat intelligence data available with a platform to reach the public and private customers in the membership database. This allows OCCIP to efficiently perform its SSA responsibility efficiently communicate cyber threats to the FSS. 2.2 Scope of the Product, Service, or Outcome Globally sourced, enriched and actionable industry-specific cyber intelligence Support before, during, and after high visibility cyber incidents Member-only hands-on-training, exercises, community events including regional briefings, summits, and other events Access to an Intelligence Exchange platform and apps Eligibility for CISO Congress and Threat Intelligence Committee(s) Global Intelligence Office regional threat calls STIX/TAXII connectivity Technical Requirements/Tasks/Outcomes 2.3 Membership The Contractor shall provide Level membership to a robust global threat intelligence data available through the platform to the U.S. Treasury. Membership shall include: Intelligence: Sector-specific security alerting and finished intelligence analysis Critical vulnerability notifications Technical analysis reports Trending of member-reported security events and incidents Threat actor profiles Strategic level trend reports for executive briefings IntelX: Access intelligence offerings Share: Access intelligence alerts and extensive topical reports with tactical, operational, and strategic analysis for a greater understanding of the tools, methods, and actors targeting the sector 75 Credentials Connect: Secure peer-to-peer chat app with subject, incident, and community-based channels Unlimited Video: Wide array of content including threat intel briefings, partner trainings, exercise overviews, Summit keynotes, and platform guides Automated Feeds Ingest intelligence through automated feed options using the industry standard protocols STIX/TAXII and MISP Regional Threat Calls Briefings about regional and global threats and trends from intelligence analysts, leading security experts, and public-private partners; twice a month Spotlight Calls Global Intelligence Office and industry experts alert and inform the membership of emerging sector-wide threats as well as incident response strategies Threat Intelligence Committee Regional committees who guide the intelligence services strategy for analysts, decide on regional cyber threat levels, and provide further insight into trending incidents and vulnerabilities. Security CISO Congress Monthly meeting with CISO peers at firms (Tiers S, 1-3) to discuss current issues in a confidential and trusted setting. Communities of Interest (COIs) Standing member groups dedicated to sub-sector and functional interests, e.g. insurance, securities, payments, clearing houses and exchanges, community institutions, insider threat, business security executives, etc. Working Groups Topical member groups focused on specific deliverables, e.g. AI risk, post- quantum cryptography, cloud security, threat hunting, etc. Community Lists Dedicated email lists for regional and global sharing Summits and Regional Events Live events for in-depth knowledge sharing and community building 8 Passes for Americas Spring Summit Unlimited complimentary attendance at all other Summits and member events Expert Webinar Series Bi-weekly, in-depth thought leadership presentations by partners and financial sector suppliers on a wide variety of security and resilience topics. Resilience Exercises CAPS: on-demand, discussion-based exercises with scenarios informed by FS-ISAC threat intelligence, customized for banking, securities, and insurance sub-sectors Cyber-range: technical, hands-on-keyboard exercises to improve tactical incident response Additional fee Functional: Act out policies and procedures at firm and sector levels in real time in response to large-scale attack Tabletop: Strategic discussions based on wide-ranging plausible scenarios with fellow members and other sector partners Cross-Sector: FS-ISAC coordinates member participation in exercises such as NATO's Locked Shields, Tri-Sector, CyberStorm, GridEX and more. Incident Response TLP Red support for targeted organization Communication channels to inform and support impacted members and wider membership as appropriate One-to-many conduit for commonly used third parties to reach entire sector with real-time intelligence and mitigation advice Cross-border, sector-wide coordination during incidents Development and refinement of sector-level incident response playbooks and firm-level playbook templates Critical Providers Program Sector-wide insights from key sector suppliers (e.g. Akamai, Google Cloud) as well as direct, real-time communication channels during an incident Business Resilience Committee Steers regional resilience efforts, helps organize and develop scenarios for regional exercises, votes on sector's current operational resilience risk level, contributes to incident response playbook. INSTRUCTIONS AND RESPONSE GUIDELINES Responses to this Sources Sought may be provided through a capabilities statement which shall include the information listed in 2.0 and 2.1. This Sources Sought is for information and planning purposes only and shall not be construed as a solicitation or an obligation on the part of the Treasury to issue a request for proposal or award a contract. Treasury does not intend to award a contract on the basis of responses nor otherwise pay for the preparation of any information submitted. Contractors responding to this Sources Sought should submit the information necessary for the Treasury to make a determination that the source is capable of satisfying the Government's anticipated need. Treasury reserves the right to contact individual companies for additional information. This notice does not obligate the Treasury to provide acknowledgment or receipt of all responses received resulting from this notice. Should such a requirement materialize, no basis for claims against the Treasury shall arise as a result of a response to this Sources Sought or the Government's use of such information as either part of our evaluation process or in developing specifications for any subsequent requirement. Responses should be identified with Sources Sought #2032H524N00005 and are due no later than Thursday, December 5, 2024 at 12:00 PM EST. All interested parties must submit their responses via email to: Angela C. Gallo, Contracting Officer via email at Angela.C.Gallo@irs.gov. Questions (oral or written) regarding this Sources Sought will NOT be accepted, nor responses to such questions provided. This Sources Sought is for planning purposes only and does not commit the government to pay for the information requested, issue a solicitation, or award a contract. No solicitation document exists at this time.