This is a Request for Information (RFI). It is not a solicitation, not an announcement of a solicitation, and not a notice of intent to later issue a solicitation. Do not attempt to request or register to receive a solicitation at this time as that is not the purpose of this announcement. No vendor(s) will be selected for a contract award based on their response to this RFI, it is for market research and procurement planning purposes only. US-CERT was established in September 2003 as a public-private partnership charged with improving computer security preparedness and response to cyber attacks in the United States. As an institution, US-CERT is responsible for: analyzing and reducing cyber threats and vulnerabilities; disseminating cyber threat warning information; coordinating incident response activities. US-CERT is the nation's focal point for preventing, protecting against, and responding to cyber security and vulnerabilities. US-CERT interacts with all federal agencies, private industry, the research community, state and local governments, and others on a 24x7 basis to disseminate reasoned and actionable cyber security information. To provide security information to the public, US-CERT: integrates content contributed by numerous organizations from both the public and private sectors; aggregates and analyzes the various types of data provided by contributing organizations; serves as the focal point for promoting common and comprehensive analysis of security trends and risks; maintains quality control standards and works to ensure technical accuracy as well as timeliness.This RFI is related to automated data collection and analysis methods. This information is necessary in order to obtain a more complete picture and find out what capabilities currently exist in the marketplace. Within the Cyber Security community, there are vendors and organizations that collect, analyze and distribute early warning and analytical information for a variety of purposes and clients. US-CERT would like to hear from organizations or vendors with current, functioning early warning collection efforts. In addition, and in order to have a more complete picture of capabilities and assets, the US-CERT requests the following information of existing operations (keeping in mind constraints of National Security classified information and proprietary restrictions): 1. Describe your existing early warning capability? 2. What are the sources of data you are currently collecting (e.g., firewall, IDS, syslogs, connectivity, etc.) as part of your early warning capability? 3. What volume of data do you collect currently and what is your volume capability? 4. How are you providing analysis of the data? 5. What correlation methods do you use? 6. How is the data presented and visualized? 7. What types of early warnings are provided to your current customers and what is the communications method (i.e., email, phone, pager, etc.)? 8. “How early is early,” i.e., turn around time for collection, to analysis, to client warning? Please provide your response to
[email protected]. Your responses will be treated as confidential and your organization will not be publicly connected with the information you provide. (One or more support contractors may be utilized as subject-matter-expert technical consultants in reviewing your RFI submissions. Please note that each support contractor’s employee having access to responses submitted in response to this RFI will be required to sign a non-disclosure statement.)