Government Membership to Center for Internet Security (CIS)

The National Institute of Standards and Technology (NIST) intends to negotiate, on a sole source basis, under authority of FAR 13.106-1(b) (1), with Center for Internet Security (CIS) for a Government membership, period of performance 09/10/2020-09/09/2023.The National Institute of Standards and Technology (NIST), Office of Information Systems Management (OISM), currently operates a configuration management system based on Puppet and Satellite.  Puppet and Satellite are systems that gathers computer configuration data for systems at NIST and can enforce application of security configurations.  The purpose of gathering and storing this data are primarily two-fold: 1) This activity is expressly required under the Federal Information Security Act (FISMA) of 2002; 2) the data is used for configuration management purposes to baseline security configurations and evaluate the current security status of OISM’s massive infrastructure.The (FISMA) requires all agencies to implement secure

configurations for all IT assets. The Center for Internet Security (CIS) has developed Benchmarks and Audit Tools that are available via a License Agreement ("License") to support this requirement.  These are used to develop secure configurations used by Puppet and other management processes at NIST.  NIST staff participate in CIS Forums.Sole source determination is based on the need to renew a Government membership to CIS.  Membership to this organization will provide access to electronic configuration data.The License will grant access and use rights to NIST. These rights are reserved for CIS Members. They include:1. The right to internally distribute electronic versions of the CIS Benchmarks across your organization;2. The right to use the CIS Audit Tools across your organization;3. Access to the members only CIS Configuration Audit Tool (:CIS-CAT") and the CIS Benchmarks in XCCDF format, both of which support the NIST S-CAP initiative.To retain the above-mentioned rights, it is necessary for NIST to enroll as a CIS Member. NIST has used the benchmarks to secure many systems across all line offices for the past several years. NIST continues to need the security benchmarks and tools provided by CIS. The benchmarks cannot be used throughout NIST without the license. NIST must become a member of CIS to be granted the rights to continue to use the benchmarks and tools for the enterprise.*****The North American Industry Classification System (NAICS) code for this acquisition is 813920- Professional Organizations, with a size standard of $15M.****** A determination by the Government whether to compete the proposed acquisition based upon responses to this notice is solely within the discretion of the Government.  Information received will be considered solely for the purpose of determining whether to conduct a competitive procurement.*****Interested parties that believe they could satisfy the requirements listed above for NIST may clearly and unambiguously identify their capability to do so in writing on or before the response date for this notice. This notice of intent is not a solicitation.  Any questions regarding this notice must be submitted in writing via email to Prateema Carvajal at prateema.carvajal@nist.gov.  All responses to this notice of intent must be submitted so that they are received at Prateema.carvajal@nist.gov no later than June 10, 2020 at 8:00 AM Eastern Time.