USHMM Request for Information Managed IT Security and MSSP Services

UNITED STATES HOLOCAUST MEMORIAL

MUSEUM

REQUEST FOR INFORMATION (RFI)

Comprehensive Managed IT Security, Multi-Cloud/DevSecOps Architecture, Network Engineering, and Specialized MSSP Operational Services Solicitation / Market Research Tracking Number: USHMM-RFI-2027-MSSP

DISCLAIMER / MARKET RESEARCH NOTICE:

This Request for Information (RFI) is issued solely for information gathering and planning purposes. It does not constitute a Request for Proposal (RFP), Invitation for Bid (IFB), or an obligation on the part of the United States Holocaust Memorial Museum (USHMM) to acquire any products or services. Responses to this notice are not offers and cannot be accepted by USHMM to form a binding contract. Responders are solely responsible for all expenses associated with responding to this RFI.

I. Executive Summary and Strategic Purpose

The United States Holocaust Memorial Museum (USHMM) is conducting formal market research to evaluate commercial vendor capabilities, industry pricing benchmarks, federal/commercial labor rates, and available contract acquisition vehicles (e.g., GSA MAS SIN 54151HACS, NASA SEWP, CIO-SP3/4, SAM.gov) for re-procuring comprehensive Managed Information Technology (IT) Security, Multi-Cloud/DevSecOps Architecture, Network Engineering, and specialized Managed Security Service Provider (MSSP) operational activities.
The primary objective of this market research effort is to evaluate whether competitive commercial marketplace capabilities exist to:

●
●

●

●

Sustain, support, and execute day-to-day operations across USHMM's existing "As-Is" security infrastructure without operational disruption or increased organizational risk. Perform rigorous security architecture evaluations, threat modeling, gap analyses, and compliance assessments against industry-best security and privacy standards (NIST SP 800-53 r5, FISMA, PCI DSS v4.2.1, CISA Zero Trust Maturity Model, CSF 2.0).
Architect and recommend a modernized, cost-effective "To-Be" security state incorporating Zero Trust architecture, automated orchestration, tool consolidation, and a Government Owned Contractor Operated (GOCO) Security Operations Center (SOC) framework. Execute a seamless, structured transition lifecycle from the "As-Is" state to the "To-Be" operational model within strict schedule and budget parameters.

II. Background and Operational Baseline
USHMM’s cybersecurity footprint has expanded significantly in response to accelerated multi-cloud