The Navy relies on combat system data for critical decision-making in wartime. This data must be secure to prevent unauthorized access and ensure its integrity. Current security measures are struggling to keep up with evolving threats, making it difficult to guarantee data is only seen by authorized personnel. This vulnerability compromises tactical advantages and risks operational effectiveness. Traditional security approaches are often too slow and inflexible for the dynamic nature of modern naval operations. An answer to this need is not commercially available. The Navy seeks an adaptive "Zero Trust" data control system. Zero Trust is a security strategy for modern multi-cloud networks. Instead of focusing on the network perimeter, a Zero Trust security model enforces security policies for each individual connection between users, devices, applications and data. Zero Trust operates on the principle of “never trust, always verify” rather than granting implicit trust to all users inside a network. This granular security approach helps address the cybersecurity risks posed by remote workers, hybrid cloud services, personally-owned devices, and other elements of today’s networks. This goes beyond simply having usernames and passwords. The Navy needs to verify every data access request in near real time, regardless of the user's location or device. The sought solution requires leveraging both Government and commercial technologies: Advanced Authentication - moving beyond passwords to biometrics, multi-factor authentication, and behavioral analysis; Micro-segmentation - dividing data into smaller highly-controlled compartments to limit the impact of any potential breach (think of it like having separate locked filing cabinets for different types of sensitive information); Artificial Intelligence (AI) and Machine Learning (ML) - detecting anomalous behavior and automatically adapting security measures, which could involve analyzing user access patterns to identify potential threats in real-time; and Blockchain Technology - exploring its potential for secure data logging and access control, ensuring an immutable record of all data transactions. This Zero Trust system must ensure that only authorized personnel can access sensitive data, regardless of location or device type, which is crucial for maintaining a tactical advantage in future conflicts where information superiority will be paramount. Existing, new, and emerging technologies will be crucial in building this system. While promising technologies exist, they are not currently integrated or robust enough to meet the Navy's stringent security requirements. The new system must address real-time performance and must ensure access verification suitable for fast-paced combat scenarios. The Navy requires near-instantaneous system access to effectively respond to dynamic and evolving threats. Furthermore, scalability and integration with complex Navy networks and systems must be ensured, along with system resilience to cyberattacks and the ability to function in degraded environments (i.e., situations where critical infrastructure or communication links may be compromised due to enemy action, natural disasters, or other disruptive events). The solution must develop faster (reduce average authentication time from 15 seconds to 5 seconds) and more efficient authentication methods; implement micro-segmentation techniques to reduce the attack surface by dividing a network into smaller isolated security segments; integrate AI/ML for real-time threat detection and response; and explore and adapt blockchain technology for secure data management. The Navy aims to achieve significant improvements compared to existing systems, including reducing access latency by at least 50%, reducing the risk of unauthorized data access by at least 90%, and streamlining data management processes to reduce administrative overhead by at least 25%. The developed technology will be evaluated against National Institute of Standards and Technology (NIST) standards for compartmented data control, cybersecurity and data integrity (e.g., NIST SP 800-207, Zero Trust Architecture). The Navy requires the development and integration of an adaptive "Zero Trust" data control system to secure critical combat data. This system must leverage advanced authentication, micro-segmentation, and AI/ML to provide near real-time, verified access for authorized personnel across any device or location. Key performance requirements include reducing authentication time to under five seconds, decreasing the risk of unauthorized data access by at least 90%, and ensuring the system is scalable, resilient in degraded environments, and compliant with NIST standards. Work produced in Phase II may become classified. Note: The prospective contractor(s) must be U.S. owned and operated with no foreign influence as defined by 32 U.S.C. § 2004.20 et seq., National Industrial Security Program Executive Agent and Operating Manual, unless acceptable mitigating procedures can and have been implemented and approved by the Defense Counterintelligence and Security Agency (DCSA) formerly Defense Security Service (DSS). The selected contractor must be able to acquire and maintain a secret level facility and Personnel Security Clearances. This will allow contractor personnel to perform on advanced phases of this project as set forth by DCSA and NAVSEA in order to gain access to classified information pertaining to the national defense of the United States and its allies; this will be an inherent requirement. The selected company will be required to safeguard classified material during the advanced phases of this contract IAW the National Industrial Security Program Operating Manual (NISPOM), which can be found at Title 32, Part 2004.20 of the Code of Federal Regulations.
No documents are available for this record yet.