Network Detection & Response (NDR) Modernization

Background
The Department of State is seeking to enhance its cybersecurity capabilities through the acquisition and deployment of a fully operational Network Detection and Response (NDR) solution. This initiative aims to improve the agency's ability to detect, investigate, and respond to advanced network-based threats across its globally distributed IT enterprise.

The Office of Cyber Monitoring and Operations (DS/CTS/CMO) is leading this effort to modernize network security monitoring and reduce the time taken to detect and respond to threats.

Work Details
The contractor will be responsible for delivering a comprehensive NDR solution that includes:
1. AI-driven traffic analysis, encrypted traffic inspection, east-west visibility, and automated threat detection and response capabilities.
2. Furnishing all personnel, equipment, materials, and services necessary as outlined in the Performance Work Statement (PWS).
3. Delivering a Proof of Technology (POT) that demonstrates how the proposed solution meets departmental requirements, including integration with existing tools such as Splunk, Zeek, Suricata, ServiceNow, Palo Alto Networks, Syslog, Cribl, Nutanix Robo, and Microsoft Defender products.
4. A phased deployment strategy that includes implementation timelines using Agile methodologies for both on-premises and cloud environments.
5. Training for users based on roles or personas and development of a Risk Register with mitigation strategies for deployment risks.

Period of Performance
The contract will have a base period from September 30, 2025 to September 29, 2026, with an option for one additional year if exercised.

Place of Performance
The contract will be performed at multiple locations including: SA-26, 8101 O’Dell Rd., Beltsville, MD 20708; SA-20, 1801 N Lynn Street Arlington VA 22209; DOS ESOC West, 1 Denver Federal Center, Building 17, Denver Colorado 80225.