Inactive

The Defense Information Systems Agency (DISA) is seeking sources for Endpoint Detection and Response (EDR) CONTRACTING OFFICE ADDRESS: IT CONTRACTING DIVISION BUILDING 3600 2300 EAST DRIVE Scott AFB I... The Defense Information Systems Agency (DISA) is seeking sources for Endpoint Detection and Response (EDR) CONTRACTING OFFICE ADDRESS: IT CONTRACTING DIVISION BUILDING 3600 2300 EAST DRIVE Scott AFB IL 62225-5406 US INTRODUCTION: This is a SOURCES SOUGHT ANNOUNCEMENT to determine the availability and technical capability of small businesses (including the following subsets, Small Disadvantaged Businesses, Certified 8(a), Service-Disabled Veteran-Owned Small Businesses, HUBZone Small Businesses and Woman Owned Small Businesses) to provide the required products and/or services. The Endpoint Security Portfolio is seeking information for potential sources for Endpoint Detection and Response (EDR) capability allowing cyber defenders to quickly detect and investigate security incidents and automatically detect malicious system activities and behaviors. EDR capabilities continuously record significant events occurring on managed systems for the purpose of identifying, reporting, and investigating malicious activity; thereby reducing and adversary’s dwell time on DoD networks. Recorded data accessible through a management console query interface. The EDR capability complements other endpoint security measures and capabilities; the ability to restrict execution of high-risk applications and computer processing. DISCLAIMER: THIS SOURCES SOUGHT ANNOUNCEMENT IS FOR INFORMATIONAL PURPOSES ONLY. THIS IS NOT A REQUEST FOR PROPOSAL. IT DOES NOT CONSTITUTE A SOLICITATION AND SHALL NOT BE CONSTRUED AS A COMMITMENT BY THE GOVERNMENT. RESPONSES IN ANY FORM ARE NOT OFFERS AND THE GOVERNMENT IS UNDER NO OBLIGATION TO AWARD A CONTRACT AS A RESULT OF THIS ANNOUNCEMENT. NO FUNDS ARE AVAILABLE TO PAY FOR PREPARATION OF RESPONSES TO THIS ANNOUNCEMENT. ANY INFORMATION SUBMITTED BY RESPONDENTS TO THIS SOURCES SOUGHT ANNOUNCEMENT IS STRICTLY VOLUNTARY. REQUIRED CAPABILITIES: For the purposes of this Sources Sought, endpoints are described as follows: Thick Client – Network clients running on fully-capable systems - Local storage and processing capability; can operate independently if not connected to a network. Thin Client – Network client running on minimally-capable system - Minimal local storage and processing capability. Zero Client – Client with no capability outside of network context. Server – Respond to client requests; provide enterprise services (typically in data centers). Users are System Administrators. Virtual Client – Client running virtually on a host platform; no physical resources. The target is an endpoint (excluding devices like phones and tablets) security and management solution that mitigates prevalent adversary attack vectors, tactics, and techniques used to compromise a system. The proposed solution must automatically isolate the execution of high risk applications interacting with untrusted content from more trusted portions of the endpoint (e.g. host operating system); and/or the solution must facilitate incident detection, investigation, response and threat hunting. Any proposed solution must continue to be effective in disconnected, virtual, intermittent, and low bandwidth network conditions without a dependence upon regularly recurring (e.g. daily, weekly, monthly) content updates. The proposed solution must be capable of scaling to millions of endpoints and provide information in near real-time. Any proposed solution must be ready for testing and subsequent deployment. In order for the Government to evaluate the technical merits of the vendors’ solution(s), the solution(s) shall be capable of meeting the following technical requirements: EDR The solution shall provide the ability to automatically capture, record and analyze a user-selectable range of endpoint parameters and events in order to assess system operations, support risk management and enable hunt and forensic activities. Examples of data the solution shall be capable of capturing include: - Windows Registry - Changes to Keys (and their associated processes; including auto-run keys), Access Control Lists (ACLs), license keys, ownership, and administrative rights. - User Activity - Authentication and privileged user activities. - Network Activity - File transfers, connections opened and closed, destination (Uniform Resource Locator, Internet Protocols, type of traffic and encryption method (e.g., File Transfer Protocol, Secure File Transfer Protocol, Server Message Block, Transport Layer Security, and Secure Sockets Layer. - Processes and Services - Automatic and manual starts and stops. Process parent and child relationships. Loaded and unloaded Dynamic Link Libraries, and record of their associated processes and files on the file system. - Software Changes – Operating System, driver and program installation, uninstall, patching, and modification information (e.g., software versions, software identification tags, patch information and mutex data). - Peripheral Connections - Wired and wireless connections to peripheral devices. - Other File Activity - Files created, opened, closed, saved, modified, moved, or deleted. - In-memory Activities - In-memory activities associated with potentially malicious activity; including mutexes and named pipes associated with processes. - Hardware Changes - Peripheral device detection, removal, or modification. The solution shall not impair authorized system operations (e.g., patching, scanning, business software usage, information assurance tools/initiatives (secure host baseline, assured compliance assessment solution, etc.) nor shall it degrade managed system performance in any way, which may adversely impact a system’s primary business/mission functions. The solution shall encrypt all data in transit or data at rest with FIPS 140-2 compliant cryptographic modules. The solution shall, at a minimum, operate on the most common vendor supported operating systems approved for use in the DoD environment (e.g., Microsoft Windows 8.1, Windows 10 (including secure host baseline) and Exchange Server 2016). The solution shall support automated/scheduled transfer of endpoint data to Government approved data archives (e.g., commercial cloud, DoD-owned, federal data center, etc.) The solution shall provide time stamping of all collected data and events based on a single time standard (e.g., coordinated universal time). The solution shall securely store and transmit data in a manner that ensures the confidentiality, integrity, availability, and source authenticity of the data. The solution shall provide the ability to automatically discover and alert on previously unknown external and/or internal hardware/peripheral devices (such as storage) connected to endpoints for the purpose of retrospective/post-event analysis. The solution shall provide integrated and customizable search with, at minimum, the ability to, from the central management server or other authorized consoles, search data from all systems for information relevant to an incident investigation or risk analysis. The solution shall have the ability to execute manual and scheduled scans of specified systems for indicators derived from threat intelligence or other sources. The solution shall provide integrated analytics (including visualization) and support the creation of custom analytics, in order to identify anomalous endpoint behaviors, support incident investigation, and perform event analysis. The solution shall have the ability to pull locally stored data from specified endpoints in near real time to support high priority hunt and forensic operations. The solution shall provide automatic hardware-level, operating system-level, and application-level monitoring. The solution shall allow administrative functions to be delegated to users based on roles/permissions and or groupings of endpoints they are responsible for managing. The solution shall provide automated analysis and visualization of an attack; including production of an event timeline and initial assessment of severity/impact. The solution shall support delegation (i.e., user-specified) of who can access/view collected endpoint data. The management and analytic components of the solution shall scale to support an endpoint client load of at least 500,000 endpoints. The solution shall support the Department's currently mandated means of authentication (e.g., PKI). The solution shall automatically report detection of potentially malicious events to a common management server and provide actionable information in non-proprietary, standard formats (e.g. STIX). The solution shall generate reports based on pre-saved user-defined formats and datasets to facilitate rapid analysis, decision making, and follow-up actions following events. The solution shall, through a central management server, provide options for configurable automated or manual remediation actions in response to detected potentially malicious events. The solution's uninstall capability shall ensure no artifacts are left behind following execution of the uninstall processes. The solution shall support the rapid push (objective: within 30 seconds) of configuration changes from the management server to all installed agents. The solution shall protect managed endpoints operating in Connected, DIL bandwidth networked, and standalone environments. All solution components shall have the ability to be automatically deployed and configured based on predefined configurations. The solution shall report to the common management server all potentially malicious events encountered while the managed endpoint was without network connectivity. All components shall be protected against unauthorized/malicious access and modification. This applies to executable code, data, and component settings. SPECIAL REQUIREMENTS Must have Secret Facility Clearance. Please provide your current Facility Clearance level. SOURCES SOUGHT: The North American Industry Classification System Code (NAICS) for this requirement is 511210, with the corresponding size standard of $41.5 million. To assist DISA in making a determination regarding the level of participation by small business in any subsequent procurement that may result from this Sources Sought, you are also encouraged to provide information regarding your plans to use joint venturing (JV) or partnering. Please outline how you would envision your company's areas of expertise and those of any proposed JV/partner would be combined to meet the specific requirements contained in this announcement. In order to make a determination for a small business set-aside, two or more qualified and capable small businesses must submit responses that demonstrate their qualifications. Responses must demonstrate the company’s ability to perform in accordance with the Limitations on Subcontracting clause (FAR 52.219-14). SUBMISSION DETAILS: Responses should include: Business name and address; Name of company representative and their business title; Type of Small Business; CAGE Code; Your contract vehicles that would be available to the Government for the procurement of the product and/or service, to include ENCORE III, SETI, NIH, NASA SEWP, General Service Administration (GSA): OASIS, ALLIANT II, VETS, STARS II, Federal Supply Schedules (FSS) (including applicable SIN(s)), or any other Government Agency contract vehicle that allows for decentralized ordering. (This information is for market research only and does not preclude your company from responding to this notice.) Vendors who wish to respond to this should send responses via email NLT 4:00 PM Eastern Daylight Time (EDT) on February 17, 2020 to Taylor Rakers, taylor.j.rakers.civ@mail.mil and Cody Seelhoefer, cody.r.seelhoefer.civ@mail.mil. If you feel your company has a solution that meets the requirements above, submit a brief capabilities package (no more than ten pages) demonstrating that ability. Proprietary information and trade secrets, if any, must be clearly marked on all materials. All information received that is marked Proprietary will be handled accordingly. Please be advised that all submissions become Government property and will not be returned. All government and contractor personnel reviewing submitted responses will have signed non-disclosure agreements and understand their responsibility for proper use and protection from unauthorized disclosure of proprietary information as described 41 USC 423. The Government shall not be held liable for any damages incurred if proprietary information is not properly identified.