SOURCES SOUGHT NOTICE OAM20025S- Security Operations Center 2/3/2020 This is NOT a solicitation for a proposal, proposal abstract, or quote. The purpose of this notice is to obtain information regarding qualified business sources. The responses to the information requested will assist the Government in determining the appropriate acquisition method. The Office of Cybersecurity’s Information Security directorate (INFOSEC) is seeking contractor support for a 24 X 7 Security Operations Center (SOC) that can meet functional and technical requirements as described herein. INFOSEC provides a wide range of information security support services to U.S. House of Representatives (House) Members, Committees, Leadership Offices, and staff. Chief among them is ensuring the continued operation of the systems that protect the House network against unauthorized access, modification of data, and malicious activity. These systems require continuous management and monitoring to ensure they are functioning as expected and to analyze and respond to alerts as they occur. The SOC should be staffed 24 X 7 either onsite, remote or hybrid. The House has two primary SOC locations in Washington, located around the DC Metropolitan area. Staff can be located at either location. The SOC should be able to handle on average 150 tickets/event analysis weekly. Responses to this source sought will be used to determine if the support will be on-site full time, provide full time support off-site, or a combination of onsite and offsite support. Offsite support will need to occur within the U.S. The contracted SOC will be an extension of and will work closely with an existing House information security team. The contractor SOC team must consist of US Citizens, have the ability to pass a detailed criminal background check and have the ability to obtain and maintain a SECRET clearance. The 24 X 7 SOC Contractor support will provide the following functions (at a minimum): Complete analysis of events recorded in security information and event management systems, to include identification of the root cause of the event, to include all stages of the cyber kill chain, description of how the event transpired, and estimate of possible system impact and mitigation recommendations through: Log Analysis SIEM / Event correlation Intrusion detection Host, Network and NetFlow based monitoring Detect threats and activity with known malicious hosts Perform DNS Blackholing Perform analysis on suspicious mail, web links and documents Create incident status reports in the House ticketing system Prepare shift and incident reports to document events and actions taken Identify and create metrics reports related to the operations of the team Identify and create and report on project status related operations of the team/tools Execute event and incident response processes and procedures in line with NIST 800-61 Communicate and collaborate with both House and contractor colleagues to investigate incidents Ability to work in a high-pressure environment with changing priorities. Demonstrate an understanding of the current threats and tactics being used to attack systems. Questions may be submitted at any time. However, due to the nature of a Sources Sought the Government will do its best to answer questions in a fair/efficient manner and may not be able to answer all questions. If interested, please submit a capability statement demonstrating your capacity to complete the requirement outlined above to
[email protected] and
[email protected] no later than (NLT) Friday February 28, 2020 at 2 PM EST. The Capability Statement shall meet the following criteria: On page one (1) of the Capability Statement, begin by providing your company information as follows: Company name, address, phone number, CAGE code, DUNS number, GSA Contract Number (if applicable) and point of contact (name, phone and e-mail). Capability Statement must be in Microsoft Word, Microsoft Excel or Adobe PDF format, single spaced, 11-point font (excluding charts and graphics) and the entire document shall not to exceed 5 pages in length to include all attachments, charts, etc. Capability Statement must include but is not limited to (a) companies core capabilities (b) corporate experience and management capability; and examples of prior completed Government contracts (if any), references, and other related information; and (c) Rough Order of Magnitude in terms of pricing for the various scenarios (onsite, remote, hybrid). (Pricing that is provided is not legally binding, will be only used for budgeting and potential solicitation purposes.) Disclaimer and Important Notes This Sources Sought does not obligate the Government to award a contract or otherwise pay for the information provided in response. The Government reserves the right to use information provided by respondents for any purpose deemed necessary and legally appropriate. Any organization responding to this notice should ensure that its response is complete and sufficiently detailed to allow the Government to determine the organization’s qualifications to perform the work. Respondents are advised that the Government is under no obligation to acknowledge receipt of the information received or provide feedback to respondents with respect to any information submitted. However, responses to this notice will not be considered adequate responses to a solicitation. Please note that the United States House of Representatives is not subject to Federal Acquisitions Regulations (FAR) or any of its supplements. Confidentiality No proprietary, classified, confidential, or sensitive information should be included in your response. The Government reserves the right to use any non-proprietary technical information in any resultant solicitation(s).