Sources Sought C5ISRT NEXT GENERATION CYBERSECURITY AND INFORMATION ASSURANCE

W, NCIS, PAE Mission Systems, PAE Maritime, PEO Ships, Amphibious Assault and Connectors Program, PEO Digital, Office of Naval Research (ONR) Transportation Security Administration (TSA), Air Force, Army, Coast Guard, and Marine Corps. The complexity and persistent evolution of modern cyber threats necessitate specialized technical expertise to supplement the existing government workforce. The operational landscape demands a strategic evolution beyond traditional, static compliance models toward a dynamic, threat-informed, and resilient Cyber Ready posture. This forward-leaning approach is essential to guaranteeing the confidentiality, integrity, and availability of all designated Department of Defense (DoD) information systems, networks, and data, thereby ensuring mission assurance in the face of sophisticated adversaries. The Contractor shall provide all qualified personnel, supervision, and services required to execute a comprehensive, full-lifecycle cybersecurity program. This effort encompasses all C5ISRT systems, networks, applications, and data across all operating environments, including on-premises data centers, cloud platforms, and the tactical edge. The scope requires a proactive "secure-by-design" philosophy, focusing on operational risk management, cyber survivability, and the seamless integration of security into all phases of the system lifecycle. The services to be performed include, but are not limited to, strategic advisory, policy and risk analysis, security engineering and architecture, threat intelligence, advanced vulnerability management, proactive security operations, compliance auditing, and workforce training. This program supports a wide range of critical systems and initiatives executed for NSWC PCD as well as for the key stakeholders mentioned above. The work is organized into the following principal performance areas: Cybersecurity Assurance and Risk Management: Providing expert support for all Assessment and Authorization (A&A) functions and sustaining a risk management program aligned with the Risk Management Framework (RMF) and the strategic principles of the Cybersecurity Risk Management Construct (CSRMC). A primary focus is the execution of all RMF steps with the strategic goal of achieving and maintaining a state of Continuous Authority to Operate (cATO). This includes developing and maintaining all authorization artifacts (e.g., SSP, SAP, SAR, POA&M), managing the system portfolio within eMASS, and providing expert guidance on control implementation, reciprocity, and risk acceptance to government leadership. Cybersecurity Compliance and Continuous Monitoring: Conducting continuous, threat-informed vulnerability assessments to maintain near real-time awareness of the enterprise security posture. This requires the expert operation of tools such as the Assured Compliance Assessment Solution (ACAS) and Host-Based Security System (HBSS). The Contractor shall analyze scan results, correlate findings with threat intelligence, validate remediation actions, and provide detailed reporting on compliance with all applicable DISA STIGs, IAVM directives, and USCYBERCOM orders. The goal is to move beyond periodic scanning to a state of persistent monitoring and automated compliance verification. Cybersecurity Sustainment and DevSecOps Implementation: Engineering and delivering robust security solutions to the fleet with a focus on minimizing the operational burden on the warfighter. The Contractor shall embed automated security tools and processes directly into development and deployment pipelines (DevSecOps) to enable the secure and rapid delivery of capabilities. This includes managing patch repositories, developing secure baseline images and deployment scripts, and providing technical support for the delivery of critical updates to fielded NSWC PCD portfolio systems such as JEXC2 FoS and MDAP. Cybersecurity Engineering and Innovation: Architecting, implementing, and sustaining advanced security solutions that anticipate future threats and align with DoD strategic imperatives. The Contractor shall provide subject matter expertise in the design and implementation of a Zero Trust Architecture (ZTA) solution. This includes researching, prototyping, and integrating innovative technologies such as AI-driven defense mechanisms, Security Orchestration, Automation, and Response (SOAR) platforms, and advanced continuous monitoring tools. The Contractor shall lead the development of technical solutions and architectural changes driven by new cybersecurity requirements, ensuring that security is an enabler of mission objectives. The DRAFT Performance Work Statement (PWS) is included with this Sources Sought announcement and specifies the technical requirements. This Sources Sought announcement is to identify sources capable of providing support for this effort. The information received will be used for planning purposes to help determine if the requirement can be fully or partially set aside to small business concerns and if an alternative source of technical support is available to meet the needs of NSWC PCD and United States Navy (USN). A Cost-Plus Fixed Fee (CPFF) Seaport NxG contract is anticipated. Small businesses are encouraged to submit their capability statements. The resultant contract is anticipated be for a base period of 12-months with four, one year option periods of 12-months each. The anticipated NAICS code is 541330, Engineering Services, Size Standard $25.5 million. Submittal Information: Written responses are requested to be no more than 10 single-spaced, 8.5 x 11-inch pages using 12-point Times New Roman font minimum. If the material provided contains proprietary information, please mark accordingly, and provide disposition instructions (submit Fed data will not be returned). Classified material shall not be submitted. The response should include, but is not limited to, the following: a) A one-page company profile to include Company name, address, point of contact (including telephone number and email address), Small Business Administration (SBA) business size classification (i.e. large, small, small disadvantaged, service disabled, veteran owned, HUB Zone, etc.), number of employees, Country of Ownership, System for Award Management (SAM) information, Number of years in business, Cage Code, UE Identification Number, DUNS number, NAICS Code, major products, primary customer base. Limitations of subcontracting. b) NSWC PCD requests that companies respond by submitting (1) a summary outline and capabilities statement showing how these requirements (see PWS) for JEXC2 Software Support can be met. (2) Additionally, respondents are to provide contract numbers and descriptions for similar type work and products as evidence of capabilities. Provide a description of your company's experience and performance of similar contracts, including whether any of these have CPARs ratings. This description shall address and demonstrate, through prior and/or current experience, an understanding of this requirement. (3) Any other information your company deems necessary to aid the Government in refining its acquisition strategy and assessing your company's capability. c) If partnering with another company, describe capability of performance of partner company or business attributes desired to ensure the partner company is capable of performance. Su