1333ND23QNB77003-Amend 0001.pdf

Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended, by one of the following methods:

(a) By completing items 8 and 15, and returning or (c) By separate letter or electronic communication which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by letter or electronic communication, provided each letter or electronic communication makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

E. IMPORTANT: Contractor is not is required to sign this document and return copies to the issuing office.

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT 1. CONTRACT ID CODE

2. AMENDMENT/MODIFICATION NUMBER 3. EFFECTIVE DATE 4. REQUISITION/PURCHASE REQUISITION NUMBER 5. PROJECT NUMBER (If applicable)

7. ADMINISTERED BY (If other than Item 6) CODE

STANDARD FORM 30 (REV. 11/2016)

Prescribed by GSA FAR (48 CFR) 53.243

FACILITY CODE

9A. AMENDMENT OF SOLICITATION NUMBER

9B. DATED (SEE ITEM 11)

10A. MODIFICATION OF CONTRACT/ORDER NUMBER

10B. DATED (SEE ITEM 13)

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offers is extended. is not extended.

12. ACCOUNTING AND APPROPRIATION DATA (If required) copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted;

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS. IT MODIFIES THE CONTRACT/ORDER NUMBER AS DESCRIBED IN ITEM 14.

CHECK ONE A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE CONTRACT ORDER NUMBER

IN ITEM 10A.

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation data, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(b).

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority)

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15C. DATE SIGNED

15A. NAME AND TITLE OF SIGNER (Type or print)

16C. DATE SIGNED

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

PAGE OF PAGES

6. ISSUED BY CODE

8. NAME AND ADDRESS OF CONTRACTOR (Number, street, county, State and ZIP Code) (X)

CODE

15B. CONTRACTOR/OFFEROR

(Signature of person authorized to sign)

16B. UNITED STATES OF AMERICA

(Signature of Contracting Officer)

Previous edition unusable

Attachment Page

PAGE 2 OF 34 1333ND23QNB7700300001

The purpose of this amendment is to provide responses to questions received and to revise the solicitation accordingly. The following solicitation sections and attachments have been updated:

1. CAPSS IDIQ PWS

2. Section L - Instruction to Offerors

3. Section M - Evaluation Factors for Award

4. Attachment 1 - Mock TO1 PWS - International Standards Support

All other terms and conditions remain unchanged.

Table of Contents

SECTION C DESCRIPTION/SPECIFICATIONS/WORK STATEMENT

C.1 IDIQ Performance Work Statement-Amend 0001

SECTION L INSTRUCTIONS, CONDITIONS, AND NOTICES TO OFFERORS

L.1 Instructions to Offerors-Amend 0001

SECTION M EVALUATION FACTORS FOR AWARD

M.1 Evaluation Factors for Award-Amend 0001

PAGE 3 OF 34 1333ND23QNB7700300001

SECTION C

DESCRIPTION/SPECIFICATIONS/WORK STATEMENT

C.1 IDIQ Performance Work Statement-Amend 0001

PAGE 4 OF 34 1333ND23QNB7700300001

PERFORMANCE WORK STATEMENT

Cybersecurity and Privacy Support Services (CAPSS) IDIQ Contract

1. BACKGROUND

The National Institute of Standards and Technology (NIST) develops cybersecurity standards, guidelines, best practices, and other resources to meet the needs of U.S. industry, federal agencies, and the broader public. Our work ranges from specific information that can be put into practice immediately to longer-term research that anticipates advances in technologies and future challenges.

As part of our efforts to cultivate trust in information, systems, and technologies and to help organizations measure and manage risk, we carry out cybersecurity assignments defined by federal statutes, executive orders, and policies, including developing cybersecurity standards and guidelines for federal agencies.

Our cybersecurity activities are driven by the needs of U.S. industry, government agencies, and the broader public, and they are undertaken only if our expertise is appropriate for NIST, which is a non-regulatory agency, and can make a difference. We manage very few operational programs, recognizing that other agencies and organizations focus on those aspects of cybersecurity, often using NIST-developed resources to inform their work.

NIST works closely with organizations in the public and private sectors to ensure that our information can be readily leveraged to address specific issues that they face. We listen, communicate, coordinate, and cooperate with industry and other agencies to prioritize and deliver the most effective information and services. When NIST produces documents and tools for federal agencies, we take their special needs into account while recognizing that many of these resources will be applied in the private sector and by state, local, and tribal government agencies. These activities take place primarily in the NIST Information Technology Laboratory (ITL) but also involve other parts of the agency.

Our priorities include cryptography, emerging technologies, enhanced risk management, identity and access management, cybersecurity measurements, privacy, trustworthy networks, trustworthy platforms, and education, training, and workforce development.

2. SCOPE OF WORK

The purpose of this Indefinite-Delivery, Indefinite-Quantity (IDIQ) type contract is for the contractor to provide cybersecurity and privacy technical expertise for the development of standards, guidelines, and research documents. The contractor shall also provide support services to NIST to engage stakeholders. Task orders issued under this contract may be firm fixed price, labor hour/time & materials (T&M), or a hybrid of both contract types. The type of task order will be clearly identified in each individual order.

The purpose of this contract is to gain technical expertise and consultation in multiple specified areas of cyber and information security and privacy to ensure that the NIST mission can be met to "provide standards, technology, tools, and practices to protect our nation's information and information systems." Operational cybersecurity services will make up only a small portion of this IDIQ.

PAGE 5 OF 34 1333ND23QNB7700300001

Cybersecurity and Privacy Support Services IDIQ Contract

NIST expects the requirements of its mission to expand and anticipates the need for support in meeting these requirements. The support needed to ensure a successful mission ranges from internal programmatic support to technical expertise and research consulting in a wide range of cyber and information security areas. It is also anticipated that ITL will need support with outreach efforts of various kinds.

The intended outcome is for NIST to have the ability to ensure that support is available when needed for specific tasks, as they are identified through internal requirements and resource evaluation, so NIST can accomplish its mission, meet higher organizational expectations, and provide cyber and information security mechanisms to reduce the risks to organizations, individuals, and the Nation.

While the primary objective of this contract is to serve the consulting, engineering, research, outreach, and development needs of the Computer Security Division (CSD) and the Applied Cybersecurity Division (ACD), other divisions in NIST with related security and/or privacy work are also authorized to use the vehicle.

3. SPECIFIC TASKS

The specific tasks required under this IDIQ contract will be detailed in individual task orders.

However, the following section provides information on the types of tasks that the contractor will be required to perform. Specific areas anticipating support include but are not limited to:

3.1. Technical inputs into and support the development of, Standards, Guidelines, NIST lnteragency Reports (NISTIRs), Models, Measures, Derived Test Requirements (DTRs), and Standard Reference Material(s).

NIST develops and maintains an extensive collection of standards, guidelines, recommendations, and research on the security and privacy of information and information systems. This includes various NIST technical publication series.

The contractor shall provide technical input and support for the development of these reports. The definition and background of the reports are listed, but not limited to the following:

1. Standards – NIST Standards such as FIPS, ISO/IEC standards…etc.

2. Guidelines - NIST Special Publications (SPs)

3. NIST Interagency Reports (NISTIRs) - Reports of research findings, including background information for Federal Information Processing Standards (FIPS) and NIST Special Publications (SPs).

4. Models – Data models and simulation testing

5. Measures – Develop metrics for cybersecurity and privacy

6. Derived Test Requirements (DTRs) – Development detailed procedures, inspections, and tests that the tester must follow, and the expected results that must be achieved for the topics below. These detailed methods are intended to provide a high degree of objectivity during the testing process and to ensure consistency.

7. Standard Reference Material(s)

PAGE 6 OF 34 1333ND23QNB7700300001

Specifics in each Task Order. Input(s) shall be technically correct, relevant to subject matter, and appropriate to designated audiences (i.e., Federal Government and Industry) . Formats shall follow NIST CSD, ITL, and Editorial Review Board (ERB) requirements. Topic areas may include, but are not limited to:

a. Cyber-physical systems, public safety communications, health information technology, electronic voting, critical infrastructure, and Federal agency cybersecurity practices

b. Cyber supply chain risk management

c. Cybersecurity awareness, training, education, and workforce development

d. Cryptographic research and techniques for emerging applications

e. Validation programs (for example, cryptographic modules, security content automation protocols)

f. Identity, access, and privilege management

g. Cloud computing and virtualization

h. Mobile security

i. Network and internet security

j. Advanced security testing, measurement, and reference data (for example, security content automation, incident handling, vulnerability management, and information sharing)

k. Technical security metrics (for example, roots of trust, combinatorial testing, attack graphs)

l. Organizational and system risk assessment and management

m. Software and application development, and application modeling

n. Privacy engineering and risk management

o. Cybersecurity and privacy in Health Information Technology (HIT) issues

p. Machine Learning and Artificial Intelligence (ML/AI) cybersecurity, privacy, and trustworthiness issues (for example, bias within AI)

Existing publications are located at https://csrc.nist.gov/publications.

3.2. Research and support services for modeling, test, data research and mission support.

Specifics in each Task Order. The contractor shall provide software development, application development, and application modeling support. These support services include design, develop, test, and deploy software, applications, Web applications, and/or multi-tier solutions in order to meet specific business needs in accordance with supplied requirements.

These services include data modeling, data schema design, database design, data transformation, and data loading services. This may include the creation and/or maintenance of web-enabled data presentation and input applications to support specific business needs. Services may also include the need for identification and authentication mechanisms to control access to applications. Provide business process modeling of current work processes to identify opportunities for resource savings

PAGE 7 OF 34 1333ND23QNB7700300001

and automation efforts. Topic areas of development work to be conducted may include, but are not limited to:

a. Computer Security Resource Center content management system implementation and workflow development (https://csrc.nist.gov)

b. National Vulnerability Database (NVD) data query, analysis, visualization, and subscription tool development, as well as developing AI capabilities for analysis (https://nvd.nist.gov/)

c. Automation and workflow development for US Government Configuration Baseline (USGCB) and National Checklist Program (NCP) data

d. Security Content Automation Protocol (SCAP) Automated testing and reference implementations

e. Generation of STIX-expressed indicators from cyber forensic analysis tools

f. Generation of SCAP-expressed content from automated indicators

g. Policy Machine demonstrations and reference implementations

h. Proof of concept of various PIV and derived credential implementations and associated validation tools

i. Cryptographic Validation Program (CVP) automated testing system and reference algorithm software development

j. Creation and management of public collaboration sites for numerous projects

3.3. Research work to be conducted in the following areas.

Specifics in each Task Order. The contractor shall provide research support services on the following topics. The topic areas may include, but are not limited to:

a. Cyber-physical systems, public safety communications, health information technology, electronic voting, critical infrastructure, and Federal agency cybersecurity practices

b. Cyber supply chain risk management

c. Cybersecurity awareness, training, education, and workforce development

d. Cryptographic research and techniques for emerging applications

e. Validation programs (for example, cryptographic modules, security content automation protocols)

f. Identity, access, and privilege management

g. Cloud computing and virtualization

h. Mobile security

i. Network and internet security

j. Advanced security testing, measurement, and reference data (for example, security content automation, incident handling, vulnerability management, and information sharing)

k. Technical security metrics (for example, roots of trust, combinatorial testing, attack graphs)

l. Organizational and system risk assessment and management

m. Software and application development, and application modeling

n. Privacy engineering and risk management

PAGE 8 OF 34 1333ND23QNB7700300001

o. Cybersecurity and privacy in Health Information Technology (HIT) issues

p. Machine Learning and Artificial Intelligence (ML/AI) cybersecurity, privacy, and trustworthiness issues (for example, bias within AI)

3.4. Support development and implementation of processes and mechanisms to enable effective outreach and communications with collaborators and stakeholders across the cybersecurity landscape, including industry, academia, standards organizations, and governments.

Specifics in each Task Order. The contractor shall provide outreach and communications support services. The support services may include, but are not limited to:

a. Planning and supporting workshops, conferences, webinars, and meetings

b. Facilitating discussions and consensus-making

c. Supporting use of communications tools including social media and innovative publishing methods

d. Creating and/or managing a web environment and web content

e. Testing web usability and efficacy

f. Preparing lessons learned from previous outreach work

g. Developing use cases and tools to enable the implementation of various NIST frameworks

h. Supporting the preparation, tracking, analysis, and adjudication of Requests for

Information and other public comment responses

3.5. Program operations and analysis work to be conducted in the following areas.

Specifics in each Task Order. The contractor shall provide program operation and analysis support for the follow NIST programs. The topic areas may include, but are not limited to:

a. National Vulnerability Database (NVD) analysis and operations

b. Cryptographic Algorithm Validation Program (CAVP) analysis and operations

c. Cryptographic Module Validation Program (CMVP) analysis

d. Security Content Automation Program (SCAP) Validation analysis, development, and support to labs and vendors

e. Cryptographic Validation Program (CVP) support to labs and vendors

3.6. Reports, analysis, and project tracking meeting external requirements.

The Computer Security Division (CSD) and the Applied Cybersecurity Division (ACD) specifically work with Congress and the White House Administration to inform policy decisions with technical expertise. Congressional staff and the Executive branch often work with NIST to develop and streamline pre-market research and develop technologies into federal initiatives. Some Congressional efforts that ITL divisions have supported include the Help America Vote Act (HAVA), the Federal Information Security Management Act (FISMA), and the Computer Security Research and Development Act (CSR&DA). The White House administrative support initiatives include the Federal

PAGE 9 OF 34 1333ND23QNB7700300001

Desktop Core Configuration (FDCC) Office of Management and Budget (OMB) initiative, IPv6 Transformation, Homeland Security Presidential Directive (HSPD) 12 on federal employee identification badges, and Domain Name System (DNS) Security.

The majority of the research, development, and congressional/administration support requires the use of highly experienced Subject Matter Experts (SMEs) with considerable knowledge and experience in the technologies being standardized or otherwise transitioned into market or mandate initiatives. Often there are needs for rapid responses to legislative mandates, executive orders, and White House initiatives. These rapid responses require extremely fast staffing by a variety of experts that can produce high-quality deliverables very quickly. For example, in 2016, NIST hosted The President’s Commission on Enhancing National Cybersecurity, which required contractor support to accomplish their work. The Commission began work in April and published their final report that December. During this time contractors were utilized not only to support the Commission operationally, but also to very quickly produce white papers on various topics needed by the Commission members.

Specifics in each Task Order. The contractor shall provide programmatic support in Project Management, perform research and analysis of various topics within the realm of cybersecurity and privacy, creation of project reports, project resource tracking, project and program requests for resources, and support in the creation of required documentation with specific formatting and graphic support requirements.

3.7. Recommendations on standards activities that reflect NIST and DOC strategic positions, and interaction with Standards Development Organizations.

Specifics in each Task Order. The contractor shall provide technical expertise and consultation to support CSD and ACD in the identification, selection, constraining, and/or harmonization of Standards in existence and/or on the progression of standards under development by national, international, and other Standards Development Organizations (SDOs). Provide technical expertise and assistance in creating technically correct input relevant to the subject matter of the Standard under development in an SDO and provide administrative support where required.

Task Orders issued will be accurate, complete, and explicit with specifics of what is required and expected to the maximum extent practicable. Each Task Order will be performance based with specific criteria for acceptance by the Contracting Officer's Representative (COR) to the maximum extent practicable.

All task orders shall include monthly project reports that shall, at a minimum, include progress made on task specified milestones using sub-tasks complete and sub-tasks remaining, as well as updates on schedule and budget/cost, along with any other specified information detailed in the individual task order(s).

4. DELIVERABLES AND DELIVERABLE DUE DATES

Each task order placed under this contract will include deliverables and deliverable due dates to the maximum extent practicable.

PAGE 10 OF 34 1333ND23QNB7700300001

5. PERIOD OF PERFORMANCE

This IDIQ contract shall have a 5-year period of performance as follows:

June 1, 2023 through May 31, 2028

The start/end dates are subject to change based on date of award.

6. GOVERNMENT-FURNISHED EQUIPMENT, DATA AND/OR INFORMATION

Specific Government Furnished Property, Data, and/or Information will be detailed in individual task orders. If work is to be performed at NIST, the location will be the NIST Gaithersburg, MD campus.

All Contractor personnel working on site at NIST for 6-months or longer shall be required to go through specific Federal Personal Identity Verification (PIV) processes in order to be compliant with HSPD-12. Contractors issued GFE or NIST credentials for longer than 180 days will likewise be required to go through the specified processes to obtain a PIV card. Specifics will be provided upon the award of individual task orders. General information on Government badging requirements can be found at http://www.fedidcard.gov/.

A spreadsheet will be furnished to the Contractor's Program Manager (Contract Level) to assist in tracking Government Furnished Equipment (GFE). This list must be updated minimally once per year, or upon request by the Government Program/Project Manager (P/PM). This spreadsheet at a minimum will track each contractor employee that has been furnished GFE, a phone number for each contractor employee, the NIST property tag number and serial number for each piece of equipment, and the physical location of the equipment.

7. RISK ASSESSMENT

The risk assessment for individual task orders under this contract ranges from None to IT-Moderate.

8. CONTRACTOR PERSONNEL REQUIREMENTS

The Contractor shall be responsible for employing technically qualified personnel to perform the work specified in this PWS and all task orders issued under the contract. The Contractor shall maintain the personnel, organization, and administrative control necessary to ensure that the work delivered meets task order requirements. Personnel assigned to, or utilized by, the Contractor in performance of work shall be fully capable of performing the contemplated functions of the respective labor categories in an efficient, reliable, and professional manner. The Contractor shall have the ability to provide qualified resources as Key Personnel on a consistent basis for individual task orders. For example, the contractor will be required to assign a Project Manager to each task order, along with other technical key personnel.

8.1. Base IDIQ Contract Key Personnel

The contractor must provide a Program Manager at the base IDIQ contract level (Program Manager 3 – Contract Level) as key personnel under this contract. The key personnel will be identified in the

PAGE 11 OF 34 1333ND23QNB7700300001

resultant IDIQ contract and shall be subject to the terms and conditions of clause 1352.237-75 Key Personnel. This is the ONLY contractor key personnel position required at the base IDIQ contract level. See below for the applicable labor category for this base contract key personnel position, along with minimum qualifications and functional responsibilities. No other key personnel are required at the base IDIQ contract level.

8.2. PROGRAM MANAGER 3 - CONTRACT LEVEL

Minimum/General Experience: This position requires a minimum of 10 years' general project management experience and 3 years IT experience in computer security and/or privacy.

Experience includes increasing responsibilities over a period of time.

Functional Responsibilities: Duties may include but are not limited to: Serves as the program manager for the IDIQ contract as a whole. Serves as program manager for a large, complex task order (or a group of task orders affecting the same common/standard/migration system) and shall assist the Government Program Manager in developing/presenting project materials by and between the Contracting Officer (CO), the Federal Acquisitions Contract - Project/Program Manager (FAC-P/PM), the contract-level Contracting Officer's Representative (COR), the task order-level COR(s), ordering activities of the management personnel and customer agency representatives. The Program Manager is responsible for the overall management of all task order(s) and ensuring that the technical solutions and schedules of the task orders are implemented in a timely manner. Performs enterprise-wide horizontal integration planning and interfaces to other functional units/organizations. The Program Manager may also supervise Project Managers at the task order level.

Minimum Education: Must either be certified as a.) a Project Management Professional (PMP) by the Project Management Institute (PMI) or other such credentialing organization, or b.) a Defense Acquisition Workforce Improvement Act (DAWIA) Project Manager Level III, or c.) Have been, or is currently, certified as a Senior-level FAC-Program/Project Manager (FAC-P/ PM ). A Bachelor's degree in computer science/engineering technology, software/programming, cybersecurity, IT privacy, or mathematics can be substituted for 2 years' general experience and 2 years IT experience. A PhD or Master’s Degree (in subjects described above) can be substituted for 3 years IT experience. A Master's Degree in Project Management can be substituted for 3 years' project management experience.

8.3. Required IDIQ Labor Categories

See Section B of the official Request for Proposal (RFP) for a list of the labor categories that must be made available by the contractor under the base IDIQ contract, at a minimum.

RFP Provisional Language: Per the Instructions to Offerors section of the RFP, offerors must propose the labor categories detailed in Section B of the RFP, for the base IDIQ contract (using the description of duties and minimum qualifications shown in Section B for each labor category) in their Management Approach Volume (see instructions for Factor B Management Approach - Labor Category Description, and propose ceiling fully burdened hourly labor rates for each labor category for each year of the IDIQ contract, for both Onsite (Government location) and Offsite (Contractor location), in their Business Volume. Offerors must propose a “Schedule of IDIQ Labor Categories,” complete with a description of duties and minimum qualifications, that

PAGE 12 OF 34 1333ND23QNB7700300001

includes the labor categories specified in Section B of the RFP. The Offeror’s proposed Schedule of Labor Categories shall be included within Volume II (IDIQ Management Approach) of the Offeror’s proposal in their Technical Volume.

Note that the “Program Manager 3 – Contract Level” is the only position/labor category that also requires an actual candidate to be proposed as key personnel for the IDIQ contract itself. The Government is NOT requesting that Offerors propose actual candidates for the remaining IDIQ labor categories for the IDIQ contract itself. See Instructions to Offerors section of the RFP for requirements for proposing actual candidates for key personnel positions for each Mock Task Order included in the RFP.

[This space intentionally left blank.]

PAGE 13 OF 34 1333ND23QNB7700300001

Cybersecurity and Privacy Support Services (CAPSS) IDIQ Contract

9. PERFORMANCE REQUIREMENT SUMMARY (PRS)

The Performance Requirements Summary for each task will be included in each individual task order, as applicable. However, the following is a generalized Performance Requirements Summary for this IDIQ Contract. Additional details, including acceptable quality levels, will be identified in individual task orders to the maximum extent practicable.

Desired Output Required Service Performance Standard Monitoring Method

1. Standards, Guidelines, NISTIRs, Models, Measures, DTRs, Standard Reference Material

Provide technical inputs into, and support the development of, Standards, Guidelines, NIST Interagency Reports (NISTIRs), Models, Measures, Derived Test Requirements (DTRs), and Standard Reference Material(s)

Deliverables are technically correct, of professional quality, free of typographical and grammatical errors, and relevant to subject and intended audience. Format acceptable by NIST Editorial Review Board (ERB).

Specified in Task Orders

2. Working software, applications, and application models

Research and support services for modeling, test, data research and mission support.

Design, develop, test, and deploy software, applications, Web applications, and/or multi-tier solutions in order to meet specific business needs in accordance with supplied requirements. Provide data modeling, data schema design, database design, data transformation and data loading services. This may include creation and/or maintenance of web-enabled data presentation and input applications to support specific business needs. Service may also include the need for identification and authentication mechanisms to control access to applications. Provide business process modeling of current work processes to identify opportunities for resource savings and automation effort

Software, applications, and application models accurately reflect technical specifications given. Software, applications, and application models meet or exceed any quality standards set out in individual task orders

Specified in Task Orders

3. Reports and other documentation of research completed

Research work to be conducted in assorted areas. Reports and/or other documentation

Deliverables are technically correct, of professional quality, free of typographical and

Specified in Task Orders

PAGE 14 OF 34 1333ND23QNB7700300001

prepared to convey the results of research conducted grammatical errors, and relevant to subject and intended audience

4. Effective outreach and communications with collaborators and stakeholders

Support development and implementation of processes and mechanisms to enable effective outreach and communications with collaborators and stakeholders across the cybersecurity landscape, including industry, academia, standards organizations, and governments

Deliverables are technically correct, of professional quality, free of typographical and grammatical errors, and relevant to subject and intended audience

Specified in Task Orders

5. Successful program operations and results of analysis work

Program operations and analysis work to be conducted in assorted areas. Results of analysis work prepared in reports or other documentation. Program operations shall have ongoing tracking and reporting capabilities.

Deliverables are technically correct, of professional quality, free of typographical and grammatical errors, and relevant to subject and intended audience

Specified in Task Orders

6. Reports, analysis, and successful project tracking results that meet external requirements

Reports, analysis, and project tracking meeting external requirements

Deliverables are technically correct, of professional quality, free of typographical and grammatical errors, and relevant to subject and intended audience

Specified in Task Orders

7. Thoughtful recommendations on standards activities;

acceptable interactions with SDOs

Recommendations on standards activities that reflect NIST and DOC strategic positions, and professional-quality interaction with Standards Development Organizations (SDOs)

Deliverables are technically correct, of professional quality, free of typographical and grammatical errors, and relevant to subject and intended audience

Specified in Task Orders

10. TRAVEL

Travel is authorized under this IDIQ contract, and any travel requirements will be delineated in individual task orders issued under the contract. Travel costs will be paid in accordance with Federal Travel Regulation.

PAGE 15 OF 34 1333ND23QNB7700300001

SECTION L

INSTRUCTIONS, CONDITIONS, AND NOTICES TO OFFERORS

L.1 Instructions to Offerors-Amend 0001

PAGE 16 OF 34 1333ND23QNB7700300001

Section L - 1

PROPOSAL RESPONSE REQUIREMENTS & INSTRUCTION TO OFFERORS

1. GENERAL

The offeror shall submit documentation illustrating their approach for satisfying the requirements of this solicitation. Proposals must be clear, coherent, and prepared in sufficient detail for effective evaluation of the offeror’s proposal against the evaluation criteria. Proposals must clearly demonstrate how the offeror intends to accomplish the project and must include convincing rationale and substantiation of all claims. Unnecessarily elaborate brochures or other presentations beyond those sufficient to present a complete effective response to the solicitation are not desired.

The offerors shall describe their proposals, through the use of graphs, charts, diagrams and narrative, in sufficient detail for the Government to understand and evaluate the nature of the approach.

All correspondence in conjunction with this solicitation must be directed to the Government Contracting Officer and Contract Specialist identified below:

Contracting Officer: Keith Bubar Phone Number: (301) 975-8329 E-mail address: keith.bubar@nist.gov

Contracting Specialist: Hing Pan Wong Phone Number: (301) 975-6289 E-mail address: hingpan.wong@nist.gov

2. Electronic Submission of Proposal

(a) By submission of an electronic proposal, the offeror must ensure that the submission is readable, in the format specified in the solicitation, and has been verified as free of computer viruses using standard commercial anti-virus software. Prior to any evaluation, the Government will check all files for viruses and ensure that all information is readable. In the event that any files are defective (unreadable), the Government will only evaluate the readable electronic files. Further, if a defective (unreadable) email/attachment renders a significant deficiency in the offeror's proposal, the Government may consider the proposal incomplete and not consider such proposals for further evaluation.

(b) A proposal that fails to conform to the requirements of paragraphs (a) and (b) above may be subject to interception or delay at Governmental electronic communications portals. This interception or delay may result in the proposal being lost, deleted, destroyed, or forwarded in such a manner that the proposal arrives at the target destination past the time and date of the deadline for submission established in the solicitation.

In the event that a proposal is lost, deleted, or destroyed due to the offeror's failure to conform to the requirements of paragraphs (a) and (b) above, such proposal will be considered to have never been delivered to the Government. In the event that a proposal is delayed due to the offeror's failure to conform to the requirements of paragraphs (a) and (b) above, the proposal will be treated as late in accordance with the provision of this solicitation entitled Late Submissions, Modifications, and Withdrawals of Proposals.

PAGE 17 OF 34 1333ND23QNB7700300001

Section L - 2

3. Formatting

Page Limitations. The cover letter, title page, table of contents, table of figures, list of tables and glossary of abbreviations & acronyms do not count against page count limitations. Key Personnel Resumes and Letters of Commitment do not count towards the page limitations. Proposal contents that exceed the stated page limitations will be removed from the proposal by the Contracting Officer, prior to turning the proposal over to the Government evaluation teams and will not be considered in the evaluation.

Format. Text shall be single-spaced, on 8½” x 11” paper (except as specifically noted), with a minimum one-inch margin all around. Pages shall be numbered consecutively. Offerors may use 11” x 17” sized pages for tables, charts, graphs, or pictures that cannot be legibly presented on 8½” x 11” paper. An 11” x 17” is a two-sheet equivalent (with regards to the page count limitations). Print shall be of a minimum 11-point font size or a maximum 12 characters per inch spacing. The use of a Sans Serif-style font is preferred over Times New Roman.

(Please note, this is a style of font, not one particular font.) Bolding, underlining, and italics may be used to identify topic demarcations or points of emphasis. Graphic presentations, including tables and charts, shall have a minimum 10-point font sizewhile not subject to the same font size and spacing requirements, shall and have spacing and text that is easily readable.

Each volume in the proposal shall include a copy of the cover letter (letter of transmittal), title page, and table of contents. The table of contents shall list sections, subsections, and page numbers. Each volume shall contain a glossary of all abbreviations and acronyms used. Each acronym used shall be spelled out in the text the first time it appears in each proposal volume.

Cross Referencing. Each volume, other than the Price volume, shall be written to the greatest extent possible on a stand-alone basis so that its content may be evaluated with a minimum of cross-referencing to other volumes of the proposal. Cross-referencing within a proposal volume is permitted where its use would conserve space without impairing clarity. Hyperlinking of cross-references is permissible. Information required for proposal evaluation, which is not found in its designated volume or cross-referenced, is assumed omitted from the proposal.

4. Proposal Instructions

This solicitation and evaluation is being conducted in two phases. The purpose of the two-phase approach is to streamline the process for offerors and minimize traditional burdens associated with lengthy paper-based submissions. Offerors shall submit their proposals in accordance with the following two phases.

Phase One

Offerors shall submit the following for Phase One of the solicitation. An incomplete Phase One proposal submission may be considered non-responsive and removed from further consideration. For Phase One, Offerors shall provide their proposal as described below. Each proposal shall consist of the volumes listed below, each of which shall be submitted in separate electronic files. Proposals shall be clearly and concisely written as well as being neat, indexed (cross-indexed as appropriate), and logically assembled. All pages of each part shall be appropriately numbered and identified with the name of the offeror, the date, and the solicitation number.

PAGE 18 OF 34 1333ND23QNB7700300001

Section L - 3

A 2-page (maximum) transmittal/cover letter signed by an individual authorized to commit the organization shall be transmitted with the proposal to the Government. The below table shows the page limits to which Offerors’ submissions must adhere.

Volume Section Page Limit

Volume I Transmittal/Cover Letter Executive Summary A.1 IDIQ Project Plan/ Specialized Experience Requirements A.2 Technical Approach/Key Personnel for MTO 1

2 Pages 5 Pages 30 Pages 13 Pages

a. Transmittal and Cover Letter (2 Page Limitation)

The offeror’s transmittal and cover letter for the proposal shall contain the name, phone number, and e-mail address of the person to be contacted concerning any matter related to the solicitation. Include the following information in the Transmittal and Cover Letter:

a. Unique Entity Identifier (UEI)and TIN;

b. Company Name, mailing address, and website address;

c. Date submitted and proposal expiration date;

d. All of the above-cited information for each entity on the proposed team, if a team is proposed;

e. Company Point of Contact, Phone, and Email address.

b. Executive Summary (5 Page Limitation)

The Offeror shall provide an overview and synopsis of the proposal, to be used as an aid in understanding the organization, content, and interrelationship of the proposal material. The offeror shall provide a brief history of the creation and development of the company and a description of the legal structure and organization of the company. Joint ventures shall be clearly explained, to include the organization of each member of the venture, the construct of the joint venture, the relationship between the members of the joint venture, and the Small Business Administration’s approval of the joint venture. Information is to be formatted at a summary level and should represent only data found elsewhere in the proposal. Pertinent aspects of the proposed approach including teaming approaches, if any, subcontracting, and relevant corporate experience and expertise on similar programs should be identified. Any proposed unique approaches should also be highlighted. Price information shall not be included in this document. Reference to the proposal areas containing substantiating information should be given when possible.

Submission Due Dates. Phase One proposals must be received electronically at hingpan.wong@nist.gov and keith.bubar@nist.gov prior to the solicitation response due date listed in the SAM.gov posting and attachments.

The offeror shall adhere to the following instructions in preparing its proposal in response to this solicitation. The proposal shall fully comply with all requirements. Proposals shall remain valid for a minimum period of 180 days.

FAILURE TO DO SO MAY BE CAUSE FOR REJECTION.

A. TECHNICAL APPROACH (VOLUME I)

The Technical Approach Volume shall be organized in the following format:

A.1: IDIQ Project Plan/Specialized Experience Requirements A.2: Technical Approach and Key Personnel for Mock Task Order 1

There shall be no pricing information contained within this volume of the proposal.

PAGE 19 OF 34 1333ND23QNB7700300001

Section L - 4

A.1 IDIQ Project Plan/Specialized Experience

IDIQ Project Plan

The offeror shall describe in detail the methods that will be employed to manage the IDIQ and task order requirements from initial solicitation to completion of the effort. Include a discussion on how the offeror will assess and understand the technical and contractual requirements of solicited tasks, determine the most effective allocation of effort among prime and subcontractors/team members, and submit quality proposals in an expedited timeframe (i.e., generally 14 days or less). The project plan shall demonstrate the offeror’s understanding of the technical subject matters listed in the IDIQ PWS, its key methodologies, integration strategies and organizational considerations. Address the process for timely incorporation of subcontractor/team member technical, schedule, and financial performance data into the prime's monthly reports for individual task orders.

Specialized Experience

The offeror shall identify its proposed team (prime and all key subcontractors/team members) and discuss the role that each member will have in accomplishing the specific functional area requirements of the IDIQ PWS.

Identify the basis for team member selection in terms of the capabilities/experience each possesses that will enhance overall contract performance. The offeror shall provide a comprehensive description of each member’s corporate experience in relation to performing requirements relevant to the IDIQ and Mock Task Order PWSs and shall clearly explain how team member strengths will be aligned to ensure the accomplishment of all functional area requirements. Each description shall clearly define the correlation between the identified capability and corporate experience, and shall identify the specific PWS functional area requirement(s) to which the experience applies.

A.2 Mock Task Order 1

Technical Approach for Mock Task Order 1

The offeror shall submit a technical approach for Task Order 1. The offeror shall identify its proposed technical approach and team (prime and all key subcontractors/team members) and discuss the role that each member will have in accomplishing the specific requirements of the PWS for the task order. The offeror shall describe its approach to successfully completing the task order requirements, identifying how its team members’ strengths will be aligned to ensure the accomplishment of all tasks. The technical approach shall clearly demonstrate the offeror’s technical understanding of the task order requirements. Identify the planned level of support that each member will provide, in total and for each functional area requirement of the specified task order PWS. Offerors shall provide their methodology and basis for estimating travel cost.

Key Personnel for Mock Task Order 1 (3-page limit per résumé. Résumé and letter of commitments do not count toward page limit.)

The offeror shall describe its proposed key personnel and staffing plan for Task Order 1. The offeror shall provide a brief description of its overall staffing plan for the task order and shall provide the résumé for the key personnel proposed for the task order. The offeror shall identify the prime offeror and key subcontractor/team member key personnel proposed the task order. The offeror shall clearly identify the labor categories from the required set of IDIQ labor categories under which each key personnel is being proposed. The offeror shall clearly demonstrate that the proposed key personnel meet or exceed the minimum qualifications of their respective labor categories

PAGE 20 OF 34 1333ND23QNB7700300001

Section L - 5 as well as any minimum qualifications detailed in the Task Order 1 PWS, and shall clearly demonstrate why the proposed key personnel are capable of successfully performing the respective task order’s requirements. Further, for each key personnel proposed for the task order, the offeror shall provide a letter of commitment to demonstrate the candidates’ availability for this task order, which shall be clearly labeled and included as part of the proposal. See the task order PWS for descriptions of the personnel requirements for the task order.

Instructions following the submission of Phase One Proposals:

Following the completion of the evaluation of Phase One proposals, the Government will advise each Phase One offeror of the extent to which they are one of the most highly rated offerors. This advisory notice is informational only and discontinuing the pursuit of the requirement into Phase Two following the notification is voluntary.

However, the intent of this advisory notice is to minimize proposal development costs for offerors with little to no chance of receiving an award to assist with the appropriate decision-making regarding the continuation of the proposal.

If the offeror chooses to participate in Phase Two following receipt of the Government’s advisory notice, the offeror shall submit their Phase Two Technical and Price proposals electronically to hingpan.wong@nist.gov within 30 calendar days of receipt of the advisory notice (the exact Phase Two proposal due date will be listed in the notification.)

Phase Two

For Phase Two, Offerors shall provide their proposal as described below. Each proposal shall consist of the volumes listed below, and each shall be submitted in separate electronic files.

Incomplete proposals may be considered non-responsive and removed from further consideration. Proposals shall be clearly and concisely written as well as being neat, indexed (cross-indexed as appropriate) and logically assembled. All pages of each part shall be appropriately numbered and identified with the name of the offeror, the date, and the solicitation number.

The sections below detail the page limits to which offerors’ submissions must adhere. Each proposal shall consist of an IDIQ Management Approach (Vol. II), Mock Task Orders 2 through 5 (Vol. III), Past Performance/References (Vol. IV), and a Business/Pricing Proposal (Vol. V), and shall be submitted in four (4) separate electronic files.

Volume Section Page Limit

Volume II IDIQ Management Approach 30 Pages

Volume III Mock Task Orders 2 through 5* 52 Pages total

Volume IV Past Performance/References No limit

Volume V Business/Pricing Proposal 10 Pages

*Key Personnel résumés for each Mock Task Order are limited to 3 pages for each key personnel purposed. This page count does not count toward the 52-page limit for the technical solution of the Mock Task Orders. Key Personnel letters of commitment also do not count towards the page limitations.

B. IDIQ MANAGEMENT APPROACH REQUIREMENTS (VOLUME II – 30 Page Limitation)

The offeror shall explain its plan for efficiently resourcing, managing, and controlling costs of task requirements for the entire life cycle of awarded task orders. The plan shall include the offeror’s approach for obtaining, PAGE 21 OF 34 1333ND23QNB7700300001

Section L - 6 allocating, monitoring, and controlling all resources and costs required to ensure the successful attainment of task objectives.

The IDIQ Management Approach Volume shall be organized in the following format:

B.1: Recruitment and Retention Plan B.2: Contract Management Plan B.3: Transition Plan B.4: Labor Category Descriptions

B.1 Recruitment and Retention Plan.

Describe the corporate mechanisms applicable to all employees (practices, policies, procedures, and tools) that will be employed by the prime offeror and key subcontractors/team members to recruit, retain, and replenish (when necessary) a sufficient number of qualified personnel with the requisite knowledge, skills, education, and experience to ensure successful accomplishment of the proposed technical and management approaches throughout the life of the IDIQ contract.