US-FED-00000390354 - Sources Sought C5ISRT NEXT GENERATION CYBERSECURITY AND INFORMATION ASSURANCE - Deadline August 25,2026

C5ISRT NEXT GENERATION CYBERSECURITY AND INFORMATION ASSURANCEThe Naval Surface Warfare Center, Panama City Division (NSWC PCD) is soliciting capability statements from potential qualified sources to provide comprehensive full–lifecycle cybersecurity for the C5ISRT Division. The C5ISRT Division, is responsible for the cybersecurity of a large and diverse portfolio of mission–critical systems. This portfolio supports a wide range of stakeholders, including OPNAV N95, PMW 130, PMW 150, PMW 160, PMW 170, PMW 770, PMW 790, PMS 406, PMS 408, PMS 420, PMS 385, PMS 485, PMS 495, USFFC–NECC, USFFC–NSW, NCIS, PAE Mission Systems, PAE Maritime, PEO Ships, Amphibious Assault and Connectors Program, PEO Digital, Office of Naval Research (ONR) Transportation Security Administration (TSA), Air Force, Army, Coast Guard, and Marine Corps.The complexity and persistent evolution of modern cyber threats necessitate specialized technical expertise to supplement the existing government workforce. The operational landscape demands a strategic evolution beyond traditional, static compliance models toward a dynamic, threat–informed, and resilient Cyber Ready posture. This forward–leaning approach is essential to guaranteeing the confidentiality, integrity, and availability of all designated Department of Defense (DoD) information systems, networks, and data, thereby ensuring mission assurance in the face of sophisticated adversaries.The Contractor shall provide all qualified personnel, supervision, and services required to execute a comprehensive, full–lifecycle cybersecurity program. This effort encompasses all C5ISRT systems, networks, applications, and data across all operating environments, including on–premises data centers, cloud platforms, and the tactical edge. The scope requires a proactive “secure–by–design“ philosophy, focusing on operational risk management, cyber survivability, and the seamless integration of security into all phases of the system lifecycle.The services to be performed include, but are not limited to, strategic advisory, policy and risk analysis, security engineering and architecture, threat intelligence, advanced vulnerability management, proactive security operations, compliance auditing, and workforce training. This program supports a wide range of critical systems and initiatives executed for NSWC PCD as well as for the key stakeholders mentioned above.The work is organized into the following principal performance areas:Cybersecurity Assurance and Risk Management: Providing expert support for all Assessment and Authorization (A&A) functions and sustaining a risk management program aligned with the Risk Management Framework (RMF) and the strategic principles of the Cybersecurity Risk Management Construct (CSRMC). A primary focus is the execution of all RMF steps with the strategic goal of achieving and maintaining a state of Continuous Authority to Operate (cATO). This includes developing and maintaining all authorization artifacts (e.g., SSP, SAP, SAR, POA&M), managing the system portfolio within eMASS, and providing expert guidance on control implementation, reciprocity, and risk acceptance to government leadership.Cybersecurity Compliance and Continuous Monitoring: Conducting continuous, threat–informed vulnerability assessments to maintain near real–time awareness of the enterprise security posture. This requires the expert operation of tools such as the Assured Compliance Assessment Solution (ACAS) and Host–Based Security System (HBSS). The Contractor shall analyze scan results, correlate findings with threat intelligence, validate remediation actions, and provide detailed reporting on compliance with all applicable DISA STIGs, IAVM directives, and USCYBERCOM orders. The goal is to move beyond periodic scanning to a state of persistent monitoring and automated compliance verification.Cybersecurity Sustainment and DevSecOps Implementation: Engineering and delivering robust security solutions to the fleet with a focus on minimizing the operational burden on the warfighter. The Contractor shall embed automated security tools and processes directly into development and deployment pipelines (DevSecOps) to enable the secure and rapid delivery of capabilities. This includes managing patch repositories, developing secure baseline images and deployment scripts, and providing technical support for the delivery of critical updates to fielded NSWC PCD portfolio systems such as JEXC2 FoS and MDAP.Cybersecurity Engineering and Innovation: Architecting, implementing, and sustaining advanced security solutions that anticipate future threats and align with DoD strategic imperatives. The Contractor shall provide subject matter expertise in the design and implementation of a Zero Trust Architecture (ZTA) solution. This includes researching, prototyping, and integrating innovative technologies such as AI–driven defense mechanisms, Security Orchestration, Automation, and Response (SOAR) platforms, and adv