NMB - DUO/EID PIV Multi-Factor Authentication Support - MRAS

The National Mediation Board (NMB), an independent federal agency established by the 1934 amendments to the Railway Labor Act, is seeking to enhance its information systems security. The NMB plays a crucial role in facilitating harmonious labor-management relations within the railroad and airline industries. Its mandate includes mediating disputes related to collective bargaining agreements, effectuating employee rights of self-organization, and arbitrating disputes over existing agreements. In line with these responsibilities, the NMB aims to bolster its cybersecurity measures by implementing and maintaining a robust multi-factor authentication (MFA) system.

The General Services Administration (GSA) is conducting market research on behalf of the NMB to identify potential contractors capable of supporting this initiative. The work involves providing a secure, cloud-based software solution framework that integrates identity management solutions with advanced technical support services. Specifically, the contractor will need to manage licenses for eID Authenticate and maintain support for the existing Cisco Duo MFA solution. This effort ensures continuous protection of sensitive data such as Controlled Unclassified Information (CUI) and Personally Identifiable Information (PII).

Key requirements include ensuring that all proposed solutions are FedRAMP Certified or Validated at a Moderate impact level, in compliance with NIST SP 800-53 standards. The contractor must provide machine-readable authorization packages and continuous monitoring data in accordance with OMB M-24-15 mandates and FedRAMP modernization guidelines. Additionally, they are responsible for maintaining FedRAMP authorization throughout the contract duration while adhering to new compliance practices such as automated Key Security Indicators (KSIs).

Furthermore, professional Tier 3 technical support services are required from highly skilled engineers or subject matter experts who can offer advanced troubleshooting, custom configuration, integration services, and escalation management from Government Tier 1 and Tier 2 helpdesk personnel. The contractor will also oversee operations, maintenance, disaster recovery capabilities for authentication services, routine system health checks, updates, patch management processes, and monitor Known Exploited Vulnerabilities (KEV) as outlined by CISA.