Request for Information The Transportation Security Administration (TSA) is issuing a Request for Information (RFI) and accompanying draft Statement of Work (SOW) pursuant to Federal Acquisition Regulations (FAR) Part 10 for the purpose of determining market capability and obtaining additional information. This RFI does not constitute a Request for Proposals (RFP), a Request for Quote (RFQ), or an indication that the Government will contract for any of the items and/or services discussed in this notice. Any formal solicitation that may subsequently be issued will be announced separately. Information on the specific topics of interest is provided in the following sections of this announcement. Neither TSA nor any other part of the Federal Government will be responsible for any cost incurred by responders in furnishing this information. The Surface Operations Cybersecurity Assurance Division is driven by the mission to increase the resilience of Surface Transportation System Sector by providing Subject Matter Expertise support in the development, guidance and execution of Cyber Assessments. Due to a limited number of ‘cyber human resources’ available to directly assist and provide guidance to over 100 company networks, an automated solution is required. This tool must be able to analyze cybersecurity networks in the following modes, pipeline, rail, surface, (mass transit and aviation sectors). The product must be commercial off the shelf with the ability for customizable features if required. Please clearly answer all of the questions below: Sales brochures or other artifacts with no explanation will not be acceptable. TSA requests interested parties to review the attached draft SOW in its entirety and provide the following information, at a minimum, in its response: Provide a clear description of the automated scanning tool and scoring solution. Provide screenshots, or similar, to demonstrate the user experience on the scanning tool. Provide a sample report the scanning tool produces and sample remediation recommendations for issues found by the scanning tool. Provide a clear list of targets or areas the scanning tool analyzes. Provide feedback from existing customers with regards to trouble shooting of the automated tool, training, and customer support for the scanning tool. Provide a list of customers and contact information that currently utilize the scanning tool. TSA seeks to anonymize and aggregate the data provided by the scanning tools. Describe any capabilities included in the scanning tool to allow for the aggregation anonymized data or identify common issues or trends over time. Describe data extract capabilities, should they exist, and formats such as JSON, XML, etc. TSA seeks to aggregate the data provided by the scanning tools. Describe any capabilities included in the scanning tool to aggregate the data or identify common issues or trends over time. Provide the Unique Entity Identifier. Provide your business size status and socioeconomic category for small businesses. Provide information for any existing contracts through which TSA could place orders for the required supplies/services. Provide a point of contact (phone and email). Provide pricing scenarios for TSA to consider. Include prices for the same quantity as the base period for all option periods listed in the draft SOW. Provide customary licensing terms for the proposed scanning tool including any limitations placed on TSA regarding use of the scanning tool. Please see the attached SOW for quantities required. Provide information your commercial licensing/Government licensing terms to accommodate our needs for example 500 users simultaneously may not require 500 licenses. Tell us how you would meet our needs. Provide examples and descriptions of training options and availability. Provide any other information (e.g., technical capability, pricing terms, etc.) the vendor considers relevant for TSA to consider but is not included in this list. Vendor Questions: Vendors may submit questions regarding this RFI via e-mail to David Little at
[email protected]. Please submit all questions by 09 December 2022. Response Submission: Interested vendors shall submit all responses to this RFI electronically via e-mail to David Little at
[email protected]. Responses are due by 14 December 2022. Disclaimer: TSA is not seeking proposals at this time, and will not accept unsolicited proposals. Responders are advised that the U.S. Government will not pay for any information or administrative cost incurred in response to this RFI. All costs associated with responding to this RFI will be solely at the responding party's expense. All information received in response to this RFI that is marked PROPRIETARY will be handled accordingly. The Government shall not be liable for or suffer any consequential damages for any proprietary information not properly identified. Proprietary information will be safeguarded in accordance with the applicable Government regulations. Responses to the RFI will not be returned. Not responding to this RFI does not preclude participation in any future solicitation, if any is issued. In accordance with FAR 15.201(e), responses to this notice are not offers and cannot be accepted by the U.S. Government to form a binding contract.