The U.S. Army is searching for a cloud-based platform that it can use to simulate a real-world attacker hitting the Department of Defense Information Network (DoDIN).
In a request for information (RFI), the United States Army Contracting Command?Intelligence and Security Command (ACC?INSCOM) said it is in the process of determining the acquisition strategy for a cloud-based platform that includes a dedicated host on the internet that can simulate U.S. adversaries during operations by utilizing commercial internet addresses as a real-world attacker hitting the DoDIN.
The eventual contractor will need to provide a dedicated host that has a pool of 20 noncontiguous Internet Protocol (IP) addresses to conduct operations from a dedicated virtual commercial web server. The RFI specifies that the dedicated server cannot host any other organization’s virtual machines or data, and must provide isolation of any data residing on the server. ACC?INSCOM will use the server as an IP proxy server, and said it must be able to meet Impact Level 4 and 5 security requirements. The server must be at least moderate level under National Institute of Standards and Technology 800-53, Committee on National Security System 1253, and Federal Risk and Authorization Management Program controls.
ACC-INSCOM explains that during the adversarial threat simulation, there is a possibility that personally identifiable information, medical data, and mission data could be assessed. As a result, the server must protect data per Impact Level 4 security requirements.
The RFI also notes that virtual server access from unauthorized entities could allow for access to the 20 noncontiguous IPs, which would provide the possibility of being spoofed for access against the mission’s assessment target. However, ACC-INSCOM notes that no data will reside on the virtual servers, instead, all data will reside on the government’s machines.
ACC-INSCOM said it anticipates awarding a single award, firm-fixed price, one year contract with four one year option periods.
