Technical Services in Support of DHS Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) Operations

Technical Services in Support of DHS Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) Operations I. INTRODUCTION: As the recognized leader for control systems security, Battelle Energy Alliance (BEA), the Management and Operations Contractor of the Idaho National Laboratory (INL) is contracted by the Department of Homeland Security (DHS), as the prime contractor for the DHS Industrial Control Systems Cyber Emergency Response Team (ICS-CERT). DHS ICS-CERT is tasked with reducing the cyber risk to industrial control systems in the Nation's Critical Infrastructure and Key Resources (CIKR). ICS-CERT is a multi-year project dedicated to the protection of U.S. Critical Infrastructure assets from cyber-based attack. BEA is requesting an Expression of Interest from Prospective Offerors (Subcontractors) that are qualified and capable to provide support to existing BEA staff as part of the operational watch floor and coordination with the multiple agencies represented on the National Cyber and Communications Integration Center (NCCIC) watch floor in Arlington, VA. Prospective Offerors shall demonstrate their qualifications and capabilities by their responses to the submittal requirements listed in Section Three. Only Prospective Offerors that meet all submittal requirements herein should respond to this Expression of Interest. II. SUPPORT DESCRIPTION: BEA is requesting subcontractor support to provide the ICS-CERT with unique technical services and products in industrial control systems cyber security incidents management, threats analysis, and vulnerabilities disclosure. The Subcontractor's personnel will be under the direct supervision of the BEA NCCIC Task Lead. Specifically, the subcontractor shall provide technical expertise to BEA as follows: a. Cyber-physical and embedded control systems analysis; b. Enterprise computer security architecture expertise and analysis capabilities; c. Firewall integration and configuration understanding and analysis capabilities; d. Intrusion Detection/Prevention Systems integration and operation; e. Understanding of penetration testing using tailored exploits and tools such as Metasploit, Core Impact, Nessus, Nikto, and nmap; f. Vulnerability analysis and coordination with system vendors to develop mitigation strategies for customers; g. Application security assessment and controls development (including control systems applications) using tailored exploits and tools such as WebInspect, AppScan, and AppDetective; h. Network protocol analysis (including control systems protocols); i. Hardware based encryption implementations; j. Incidents response support, development of situational awareness products, and provide vulnerability and threat analysis; k. Private industry interface to respond to incidents; l. Prepare and present classified threat awareness briefings to industry and DHS leadership; m. Interface with intelligence community to collect data and provide decision makers with input; III. QUALIFICATIONS a. Knowledge and experience in planning and participation in national level exercises specifically in cyber exercises. b. Hold a current security clearance at the TS/SCI level. c. Ability to Pass DHS "Suitability Criteria" check and possess DHS facility access credentials. d. Staff able to work on location in Washington, DC. - IV. SUBMITTAL REQUIREMENTS Offerors should limit their entire response to less than five pages. The response should provide the details on ability to provide support as outlined in the Support Description Section and also the ability to meet the Qualifications as identified above. Note: The formal RFP and SOW will contain additional and more specific submittal requirements. Please provide your expression of interest by email to George Wood (George.Wood@inl.gov) by 8:00 am Thursday morning, April 9, 2014. Please contact George Wood (via email) with questions.