Endpoint Protection Platform (EPP) to fulfill a requirement for Endpoint Protection Program software for the Department of Defense (DoD) - Amendment 1

SOURCES SOUGHT NOTICE Amendment 1 to the Sources Sought Notice is provided to update the response due date in the posting to April 3, 2024, matching the date in the description and Sources Sought document, and also to include Attachment 1 with answers to questions received by the contracting office. The Defense Information Systems Agency (DISA) Endpoint Security Division (ID3) is seeking information from potential sources for existing commercial products that fully meet DoD requirements as specified in the attached Endpoint Security Requirements Matrix. CONTRACTING OFFICE ADDRESS: DISA/Defense Information Technology Contracting Organization (DITCO) 2300 East Drive, Building 3600 Scott AFB, Illinois 62225-5406 INTRODUCTION: This is a SOURCES SOUGHT NOTICE to determine the availability and technical capability of small businesses (including the following subsets: Small Disadvantaged Businesses, Certified 8(a), Service-Disabled Veteran-Owned Small Businesses, HUBZone Small Businesses and

Woman-Owned Small Businesses) and large businesses to provide the required products and/or services. The Department of Defense (DoD) is seeking information from potential sources for an Endpoint Protection Platform (EPP) through DISA ID3 Endpoint Security Solutions Portfolio Management for potential Endpoint Protection Program software. The Department of Defense (DoD) has directed policies through the Host Based Security System (HBSS) Divestment Memo (April 13, 2021) and Fiscal Year (FY) 2025 Defense Information Systems Agency Working Capital Rate Changes (June 9, 2023) to allow DoD components to acquire and deploy diverse endpoint management security solutions with the caveat that any acquired solution must provide minimum required endpoint security capabilities specified in the "DoD Endpoint Security Criteria Requirements Matrix". This policy also requires components to expose data elements specified in the DoD Chief Information Officer (CIO) “Endpoint Security Minimum Data Standards” Memorandum. Current procurement for Endpoint Security Solution (ESS) License Maintenance provides software upgrades, updates, patches, and hotfix support to meet changing and emergent threats and seamlessly integrate into the existing environment. This product shall allow capabilities within that environment to maintain full functionality across the DoD. Market research and vendor engagements indicate that functionality/capabilities provided to the Government supporting Department of Defense may be available through various solutions. The DoD must continue to meet DoD endpoint security requirements, while adhering to all reporting standards. Research and analysis of commercial products indicates there are some ‘gaps’, notably coverage of Secret Internet Protocol Router (SIPR) and as well as data collection on Non-Classified Internet Protocol Router (NIPR) environment. DISA ID3 Endpoint Security Solutions Portfolio Management is inquiring about capabilities that may exist to cover DoDNet/Fourth Estate Network Optimization (4NEO) with approximately 35,000 endpoints, while providing information to Combatant Commands (COCOMs) and Military Departments on acceptable alternatives to the current ESS solution as an Endpoint Protection Platform (EPP). The anticipated Period of Performance is January 2025 - January 2029 The solution will support users and/or devices across the Continental United States (CONUS) and Other than Continental United States (OCONUS) environments within the DoDNet/Fourth Estate Network. DISCLAIMER: THIS SOURCES SOUGHT NOTICE IS FOR INFORMATIONAL PURPOSES ONLY. THIS IS NOT A REQUEST FOR PROPOSAL. IT DOES NOT CONSTITUTE A SOLICITATION AND SHALL NOT BE CONSTRUED AS A COMMITMENT BY THE GOVERNMENT. RESPONSES IN ANY FORM ARE NOT OFFERS AND THE GOVERNMENT IS UNDER NO OBLIGATION TO AWARD A CONTRACT AS A RESULT OF THIS NOTICE. NO FUNDS ARE AVAILABLE TO PAY FOR PREPARATION OF RESPONSES TO THIS NOTICE. ANY INFORMATION SUBMITTED BY RESPONDENTS IS STRICTLY VOLUNTARY. CONTRACT/PROGRAM BACKGROUND: Contract Number: NNG15SC03B Order Number: HC108424F0061 Contract Vehicle: DoD Enterprise Software Initiative (ESI) Incumbent and their size: Carahsoft Technology Corporation, Other Than Small Method of previous acquisition: Limited Source Period of performance: December 16, 2023 - December 15, 2024 Contract Number: N6600119A0001 Order Number: HC102822F1374 Contract Vehicle: DoD ESI Incumbent and their size: Carahsoft Technology Corporation, Other Than Small Method of previous acquisition: Limited Source Period of performance: September 23, 2022 - March 22, 2025 REQUIRED CAPABILITIES: To meet the stated objectives, DISA is requesting information on the availability of existing commercial products that fully meet DoD requirements. The solution should meet the requirements detailed in Exhibit A, Endpoint Security Requirements Matrix. Based on the information provided in the previous sections, interested vendors should provide the following in response to the Sources Sought: Describe the proposed EPP solution, to include product functionality, compliance with technical characteristics, and assessments of development timelines, and scope to enhance the solution to fully meet DoD requirements. Provide an example of your company's experience with the proposed EPP solution. Describe our company’s interfaces supported by the tool that can be leveraged by other users and tools to perform data submission and extraction. Describe your company’s maturity and existing deployments of the EPP solution, along with existing vendor integrations supported in the off-the-shelf versions of the software. Describe your company’s controls a proposed EPP solution implements to provide confidentiality and access control to enable users to view populations of endpoints that can be reasonably expected to contain endpoints which are either already attributed to their respective organizations, locations, or systems, or which contain endpoints they need to assign that attribution data to. Describe your company’s commercial and Government cloud components of the solution. Can the solution be deployed in non-cloud environments? Can the solution support hybrid deployments? What existing infrastructure is available to the DoD to distribute signatures, behavioral analysis, and other required content for the solution across all classifications of networks and coalition or allied networks. Describe the process of deploying the infrastructure required to sustain the solution on a new stand-alone network. Describe if your company’s solution can meet National Information Assurance Partnership (NIAP), Security Technical Implementation Guides (STIGs), Assessment and Authorization, 508, Federal Information Processing Standard (FIPS) 140-2, DoD CIO Scorecard, Federal Information Security Modernization Act (FISMA), Joint Force Headquarters (JFHQ) DOD Information Networks (DODIN) 24-8600 Tab F and other relevant DoD and Federal policy requirements. Discuss your company’s offering for training on the software. Describe how your company’s product is licensed or purchased. Describe by what, if any, existing vehicles the Government can procure your company’s solution. Describe your status as a reseller of maintenance and software for all the software titles proposed. SPECIAL REQUIREMENTS: A Top-Secret Facility Clearance is required. Please provide your current Facility Clearance level. SOURCES SOUGHT: The North American Industry Classification System Code (NAICS) for this requirement is 541519, with the corresponding size standard of $34,000,000 (https://www.sba.gov/document/support--table-size-standards). In order to make a determination for a small business set-aside, two or more qualified and capable small businesses must submit responses that demonstrate their qualifications. Responses must demonstrate the company’s ability to perform in accordance with FAR clause 52.219-14, Limitations on Subcontracting. To assist DISA in determining the level of participation by small business in any subsequent procurement that may result from this Sources Sought Notice, provide information regarding any plans to use joint ventures (JVs) or partnering. Please outline the company's areas of expertise and those of any proposed JVs/partners who combined can meet the specific requirements contained in this notice. SUBMISSION DETAILS: Responses should include: Business name and address; Name of company representative and their business title; Small Business Socio-economic status (if small); CAGE Code; Prime contract vehicles; to include ENCORE III, SETI, NIH CIO-SP4, NASA SEWP V, General Service Administration (GSA): OASIS, ALLIANT II, VETS II, STARS III, MAS (including applicable SIN(s), groups or pools), or any other Government Agency contract vehicle that allows for decentralized ordering. (This information is for market research only and businesses with a valid cage that lack prime contract vehicles are still encouraged to respond to this notice.) Businesses who wish to respond must send a response via email no later than 4:00 PM Eastern Daylight Time (EDT) on April 3, 2024 to kristen.m.abbott2.civ@mail.mil, and terri.l.rollins.civ@mail.mil. Interested businesses should submit a brief capabilities statement package addressing the specific questions above (no more than fifteen pages) demonstrating the ability to perform the services listed under Required Capabilities. Proprietary information and trade secrets, if any, must be clearly marked on all materials. All information received that is marked Proprietary will be handled accordingly. All submissions become Government property and will not be returned. All Government and contractor personnel reviewing submitted responses will have signed non-disclosure agreements and understand their responsibility for proper use and protection from unauthorized disclosure of proprietary information as pursuant to 41 USC 423. The Government shall not be held liable for any damages incurred if proprietary information is not properly identified. EXHIBITS: Exhibit A, Endpoint Security Requirements Matrix