Inactive SBA Certified Women-Owned Small Business (WOSB) Program Sole Source (FAR 19.15)

The Strategic Systems Programs (SSP) intends to solicit and negotiate a contract on a sole-source basis to Craytek, Inc., located at 8136 Old Keene Mill Rd, West Springfield, VA 22152, for highly spec... The Strategic Systems Programs (SSP) intends to solicit and negotiate a contract on a sole-source basis to Craytek, Inc., located at 8136 Old Keene Mill Rd, West Springfield, VA 22152, for highly specialized application systems security assessment and vulnerability mitigation support services. The effort requires current and unique capabilities, expertise, and in-depth knowledge of five (5) SSP applications along with the SSP information technology (IT) systems architecture. The anticipated contract will contain a base year effort for FY 2023 and include a total of four (4) option year periods for FY 2024 through FY 2027, with an estimated value, inclusive of all options, of <$4M. The contract will contain Level-of-Effort (LOE) Line Items on a Firm-Fixed-Price (FFP) basis. Each LOE line item is estimated to cover a twelve (12) month period of performance and will include option provisions to increase the LOE up to thirty percent (30%), in accordance with SSP terms and conditions. The anticipated award date is October 1, 2022. Pursuant to Federal Acquisition Regulation (FAR) Subsection 19.1506, the ordering activity shall consider contract award to a Women-owned Small Business (WOSB) concern on sole source basis before considering small business set-asides. The North American Industry Classification System code (NAICS) assigned for this scope of work has been identified as a code substantially underrepresented in Federal procurement by WOSB concerns. Craytek, Inc., has been identified as a WOSB with the critical experience, expertise, personnel, and in-depth knowledge of the SSP applications and IT architecture required to perform this new effort. Consequently, SSP intends to solicit and negotiate a contract on a sole source basis per the authority of 10 U.S.C. 2304(c)(5) (FAR Subsection 6.302-5 -- Authorized or Required by Statute, Subpart (b)(7) Sole source awards under the WOSB Program (15 U.S.C. 637(m))) and FAR 19.1506 Women-Owned Small Business Program sole source awards. This notice in posted in accordance with FAR Subsection 5.201. This NOTICE OF INTENT IS NOT A REQUEST FOR COMPETITVE PROPOSALS. The proposed contract action is for supplies or services for which the Government intends to solicit and negotiate with only one source under authority of FAR 6.302-5. Interested persons may identify their interest and capability to respond to the requirement. A determination by the Government not to compete this proposed action based upon responses to this notice is solely within the discretion of the Government.

Inactive SBA Certified Women-Owned Small Business (WOSB) Program Set-Aside (FAR 19.15)

This is a SOURCES SOUGHT notice. This notice is NOT a Request for Proposal (RFP). No solicitation exists at this time. The Strategic Systems Programs (SSP) seeks a Firm-Fixed-Price (FFP-LOE) type cont... This is a SOURCES SOUGHT notice. This notice is NOT a Request for Proposal (RFP). No solicitation exists at this time. The Strategic Systems Programs (SSP) seeks a Firm-Fixed-Price (FFP-LOE) type contract with a Certified Women Owned Small Business (WOSB) for subject matter expertise regarding the SSP application systems security assessment and vulnerability mitigation. The applicable NAICS code for this requirement is 541511- Custom Computer Programming Services. The assigned NAICS code is one in which the Small Business Administration (SBA) has determined that WOSB concerns are substantially underrepresented in Federal procurement, as specified on the SBA’s Web site at http://www.sba.gov/WOSB and as further defined in FAR Subpart 19.15 – Women-Owned Small Business Program. Therefore, SSP is hereby requesting only qualifying WOSBs (including Economically Disadvantaged Women-Owned Small Business (EDWOSB) concerns) respond to the following market research tool for the collection and analyses of information to determine WOSB/EDWOSB's capability to provide the Security Assessment and Vulnerability Mitigation Service Requirement based on the description of the requirement provided below. PURPOSE OF NOTICE: The Sources Sought is being used as a Market Research tool to determine potential sources prior to determining the method of acquisition and issuance of a possible RFP. The Government is not obligated and will not pay for any information received from potential sources as a result of this notice. We are only requesting capability statements from potential contractors at this time. Responders should indicate which portions of their response are proprietary and should mark them accordingly. Failure to provide a response does not preclude participation in any possible future competitive RFP for which a business is eligible to participate in, if any is issued. It is the responsibility of the interested businesses to monitor the FEDBIZOPS website for additional information pertaining to any potential acquisition and provide security clearances, if necessary, to perform the statement of work (SOW). REQUIREMENT: The Strategic Systems Programs (SSP) Chief Information Officer (SPCIO) is seeking responsible, single, integrated vendor sources to support all actions associated with maintaining mission assurance and providing security vulnerability mitigation for five SSP Application systems. Potential sources must possess an understanding of the architecture and have experience with the technologies used for the five SSP specific application systems listed below: 1) SSP Enterprise Archives Service (SEAS) application – SEAS is SSP’s web based records management system utilizing networked document scanners. An instance of SEAS is also running on the Navy’s Classified network to support SSP’s classified record management activities. It allows the SPHQ and PMO offices to archive both paper and electronic financial records and official correspondence. SEAS was developed using Java, Apache Struts/Tiles framework, JSP technology and Oracle Database. 2) Contract Action Tracking System Web (CATS Web) application –CATS Web is the Contract Branch Action Tracking System. This system allows SSP’s contracting branch to document and track their action routing process and validate required contract artifacts for each procurement. The new CATS Web architecture includes Java, STRUTS and J2EE components as well as Oracle database. 3) SSP Service Desk system – SSP Service Desk is a COTS product used for the management of SSP’s service desk tickets. SSP Service Desk system was customized to support SSP’s business processes. It uses Microsoft SQL Server and administration suite of tools. This application is used by the SPHQ Helpdesk as well as the SSP Program Management Offices. 4) SSP Logistics Planning System (i.e., SPOSE) – The Logistics Planning application is primarily used to gather raw data for the production and publication of SSP’s annual budget/planning document. This application is used by SSP to plan for their current and future program resource allocations. The application was converted from a standalone PowerBuilder system to a web based application currently operational on the Navy’s classified network. SSP’s web based Logistics Planning System was developed using Java Framework and Oracle database. 5) Quality and Reliability Information Management System (QRIMS) – QRIMS is a report processing application hosted at SSP and sponsored by the SSP Navigation branch for use by external contractors to track trouble and failure reports, corrective action reports as well as trouble failure repair and return reports and preventative maintenance action reports. QRIMS was developed using Struts 2 MVC framework and Oracle database. The security management of these applications shall require detailed knowledge and a thorough understanding of the SSP information systems’ business, data, applications and technical architecture. The contactor must provide subject matter expertise for the above application systems in the following areas: 1. Transitioning of applications from the DIACAP Certification and Accreditation Process to the DoD Risk Management Framework (RMF) 2. Information Security assessments, mitigation and control monitoring 3. Application development framework 4. Library dependency End-of-Life management 5. Vulnerability monitoring and mitigation 6. Security Penetration testing and remediation 7. Structured security patch management 8. Application unit testing, integration testing, and automated code review testing 9. Re-factoring and patching of source code, unit tests and integration tests 10. Database schema design and configuration changes 11. Application release and deployment management 12. System audit logs analysis 13. Port and Protocol management 14. Maintaining application configuration management data in accordance with the Software Configuration Management Plan for SSP Enterprise Applications The above application security management actions require detailed knowledge and experience using specific technologies, interfaces, development and scripting languages, Software Development Life-Cycle (SDLC) processes and tools. The contractor shall have experience and maintain skills proficiency in the key subject areas required to perform the security management actions, which include: 1) OpenText Livelink application Programming Interface (API) 2) Hewlett Packard Digital Sender workflow programming 3) HEAT trouble ticketing system database configuration and administration 4) Business Process definition and analysis using BPMN 2.0 5) Fusion Charts reports (using XML, HTML5 and JavaScript) 6) DoD Records Management application design standards 7) Development languages & interfaces: Java, Apache Struts, Apache Tiles, PL/SQL, iText, XML, HTML5, JavaScript, CSS, SVG, UML, LDAP, SMTP 8) Web Server Technologies: Internet Information Services (IIS) 9) SDLC Tools: PortsWigger Burp Suite, Enterprise Architect UML, Eclipse IDE, JIRA Issue & Project Tracking, Subversion Revision Control, Unit Test, Code overage, automated Code Review 10) DoD Information Assurance Certification and Accreditation Processes (DIACAP) and DoD Risk Management Framework (RMF) 11) Public Key Infrastructure (PKI) 12) Security Assertion Markup Language (SAML) 13) Web Services 14) XML Digital Signature Programming 15) Common Access Card (CAC) authentication 16) Cryptography protocols and their usage 17) Security threat modeling and mitigation strategies 18) HTTPS Web session monitoring Potential contractor must possess a complete understanding of SSP’s information systems environment and must have demonstrated knowledge and experience working with the Navy accreditation processes for the SPCIO’s application systems. Potential contractor’s proposed staff must be fully DOD 8570 compliant and have a complete understanding of DISA Security Technical Implementation Guidelines (STIG) and Security Requirements Guides (SRG) for hardware, software, and applications. FAQs: 1. Is the network on DREN, NREN or dedicated SSP network? a. This is on and will remain on a SSP Network 2. For transitioning applications from DIACAP to Navy RMF accreditation, is there a separate dev stack planned or needed? a. For transitioning applications from DIACAP to Navy RMF accreditation, there is no separate development stack planned or needed. 3. One of the requirements is for source code manipulation, is the code owned by SSP or is this COTS? a. Several applications listed in the sources sought document, are custom developed and maintained (i.e. owned by SSP). The Service Desk system is COTS, but it is highly configurable. 4. Is there intent to move off of Oracle DB and onto newer platforms? a. For those applications using Oracle, there are currently no plans to move to a different database or newer platform. PERIOD OF PERFORMANCE: The current proposed period of performance is estimated to be one base year plus four (4) option years. RESPONSE DEADLINE: Interested sources shall submit a capability package by COB 07 Jan, 2022 (10 pages or less) containing: 1) company name and address, 2) company point of contact, 3) email address, 4) phone number, 5) specifics addressing the work listed above including a current list of related past performance within the past 5 years. Proposed contractor must have a Secret Facility clearance. Electronic responses are acceptable if prepared in Microsoft 2007 or newer or .pdf compatible format. Email electronic responses to Lucas Medlock (email:lucas.medlock@ssp.navy.mil) and Marge Niedzwicz (email:marge.niedzwicz@ssp.navy.mil) with "Sources Sought" in the subject line of the email.