Cybersecurity Q-A.pdf

Question Response

1 Will any Government Furnished Equipment (GFE) be provided? No GFE are provided

Item D specifies “Contractor shall arrange interpretation services”.

Please confirm if this cost will be an authorized ODC with prior Government approval.

Confirmed

3 Please specify the “cost data” that is required other than the FFP amounts in the CLINs.

Please itemize the various cost items to better understand the pricing approach

4 Can offerors include assumptions related to the pricing? Yes

Will the Government please provide guidance on the representative list of geographical location and financial sector entities for the required cybersecurity services?

Deployment locations may vary but are likely to be in Europe, East Asia, or Southeast Asia. Entities will likely include, but are not limited to firms which provide virtual asset services and firms involved in related software supply chains.

Will the Government please provide detailed information on the projected total number of resources required annually, including specific roles and responsibilities besides the three key personnel identified/if more resources are needed?

The offeror should provide an assessment of required resources to respond to two cybersecurity incidents per year, including virtual and in-person engagement. In addition to the key personnel, the offeror may employ any personnel it deems necessary to meet the objectives of the scope of work.

Will the Government please provide details on the expected frequency and duration of travel for contractor employees under this contract if not 100% remote?

The contractor would be expected to support two deployments per year of 3-5 calendar days each.

8 Approximately how many global cybersecurity incidents does the Department of State anticipate supporting per year? Two per year.

9 How many resources does the Government anticipate are required to satisfy the requirements?

The contractor should submit a proposal with its estimate of the resources that would be required to achieve the objectives of the scope of work.

10 Will the Government clarify the role of the Subject Matter Experts (SMEs)?

The solicitation requires that the offeror identify a lead and deputy technical SME as key personnel. These SMEs will provide high level technical advice to the Project Manager and will assist the Project Manager in determining appropriate incident response measures.

The solicitation also requires that the contractor provide virtual and in-person support to affected firms following cyber attacks. This support may be provided by the key personnel SMEs, but the offeror has the flexibility to deploy whichever SMEs are most suited to the particular incident. These SMEs should be able to provide hands-on assistance to mitigate the effects of the attack.

Will the Government provide more details on the expectations for training and material detailing cybersecurity best practices, including specific topics or areas of focus?

Training material should be specific to mitigating the risk of attack by specific DPRK cyber crime actors.

Will the Government provide more details on the expectations for providing tailored recommendations in diplomatically sensitive situations, including any specific guidelines or protocols to follow?

The need to provide diplomatically sensitive recommendations will be situation-dependent. The Government will provide specific protocols if necessary. The contractor should demonstrate the ability to convey technical information and advice tailored to the geopolitical context of the cyber incident and affected firm.

13 Will the Government provide more details on the expectations for post-incident engagement?

Post-incident engagement may include system hardening, asset protection, threat hunting, and eradication of detected threats to prevent either immediate or future virtual asset theft. Engagements should also include a debrief and recommendations for best practices to prevent/mitigate future DPRK cyber threats.

What are the specific requirements for post-incident engagement, including the roles and responsibilities of the cyber forensic analyst(s) and personnel providing remediation guidance?

Post-incident engagement may include system hardening, asset protection, threat hunting, and eradication of detected threats to prevent either immediate or future virtual asset theft. Engagements should also include a debrief and recommendations for best practices to prevent/mitigate future DPRK cyber threats. Dependent on the nature of each incident, the offeror may choose which personnel to assign. For example, the cyber forensic analyst can also give remediation guidance, or a different SME can be assigned to this task.

15 Is the cyber forensic analyst(s) an additional Key Personnel? No. The cyber forensic analyst can be assigned as appropriate to each cyber incident.

19AQMM25R0032 - Global Support for Counter-DPRK Cybersecurity

Will the Government please specify the preferred qualifications and experiences for personnel supporting blockchain development companies and/or virtual asset exchanges in global/international cyber incident response?

The offeror should provide relevant examples of previous experience of the firm or key personnel with blockchain development companies and/or virtual asset exchanges.

If applicable, could the government please provide information on the current incumbent, the current contract number, and the contract value?

This is a new requirement without any prior incumbent

18 Could the government please provide the historical level of effort? No historical data

Could the government please confirm if there is any change in the scope of requirements—either an increase or decrease— compared to the current contract?

No historical data

Within the instructions, the government requests the offeror to provide an understanding and approach to the SOW requirements.

Could the government please confirm if the SOW requirements are the bullet points from A to K within the scope?

The requirement is everything under C-001 - STATEMENT OF

WORK

21 Could the government please clarify the technical requirements for this proposal, as there are no specified task areas?

The requirement is everything under C-001 - STATEMENT OF

WORK

22 Can the government please increase the proposal deadline by two week considering the holidays? Yes

23 Is this a recompete of an existing contract or a new procurement?

Who is the incumbent contractor if this is a recompete? Please see response to question 17

24 If this is a recompete, what is the average number of incidents that the team responds to in a year? This is a new requirement with no historical data.

As this effort is a firm fixed price, does the government intend that the response team be available and billable for the full contract year conducting non-deployment related tasks such as planning and review of Cyber Threat Intelligence?

The offeror should be available to deploy within the indicated timeline at any time throughout the contract year (up to two times), and is responsible for pre-deployment preparation. All tasks will be related to the two cyber incidents per year to which the offeror will be expected to respond.

SOW Section II.D. states that the contractor shall arrange interpretation services for global/international virtual engagement and deployments. Are these costs reimbursable as related to ODCs?

Please see response to question 2

Will the contractor be responsible for providing technical writers and translators to prepare final versions of reports for customer delivery?

Yes

28 Will the government accept past performance references from teaming partners? Yes

29 In the government's experience, is there a possibility that multiple teams would be deployed at the same time to different countries? No

30 The CLIN table notes the type of contract pricing for Travel is CNF.

Could the government define the acronym for this intended usage? CNF - Cost no Fee

The CLIN table notes the type of unit of pricing for Travel and ODCs is LT. Could the government define the acronym for this intended usage?

LT - Lot

32 What is the expected start date and dates for the overall period of performance?

Contract expected to start immediate after award (tentatively February) for a 3-years period of performance is all option periods are exercised.

Is the $5,000 plug figure for travel provided by the government for evaluation purposes ? Can bidders assume that a travel ceiling more appropriate with the scope of work be negotiated post award?

Yes a plug value for bidding purpose to standardize proposals and bidders may propose a value more appropriate for scope of work to which the Government will incrementally fund during Contract performance.

Can the government please clarify the extent to which the Scope of this contract is centered entirely around incident response, versus more broad cyber resilience?

For instance, the Introduction reads, "Currently, the Government intends to commission support from a cybersecurity service provider to assist foreign entities in enhancing their counter-DPRK cybersecurity posture as needed."

However, the Scope section suggests that all scope is in relation to responding to specific incidents. Does the government anticipate the contractor supporting these foreign entities outside of incident response?"

This project is intended to primarily focus on incident response. In the course of responding to an incident, the offeror should be prepared to give the affected firm recommendations for future cyber resilience.

The Contractor shall provide remote cyber incident response support, cybersecurity consultancy, and forensic analysis services to foreign governments, financial institutions, virtual asset service providers, or other victim entities within 48 hours of notification by the Government" Will the government provide a list of countries or regions where the offeror may have to deploy teams?

Deployment locations may vary but are likely to be in Europe, East Asia, or Southeast Asia.

36 Is there a page limit for each past performance reference or an overall maximum page count for the past performance section?

Page limit of 20-pages for Technical Volume to include Past Performance references

37 Is there a page limit for each key personnel resume? Page limit of 20-pages for Technical Volume to include Key Personnel resume

Can the government please clarify if it will accept past performance references for teaming partners/subcontractors other than the prime bidding organization?

Please see response to question 28

The solicitation prescribes FAR 52.219-9, Small Business Subcontracting Plan (Sep 2023) (15 U.S.C. 637(d)(4)).

Please confirm this is a post-award requirement.

This requirement is only applicable to large business.

Are bidders to provide a FFP quote for providing just the 3 key personnel listed in section H-016?

If not, and bidders are to provide a FFP quote to perform the services described in section II. Scope, will the government provide the metrics required to estimate level off effort including:

- Expected incidents per year

- Expected duration of each incident response effort

- Will concurrent incident support be required?

- Will on call support be required (weekend, after hours)?

The offeror will be expected to support up to two incidents per year.

Each incident will include virtual support provided within 48 hours (including weekends/after hours) and a deployment to the affected firm within 14 days, lasting 3-5 days. The offeror will not be required to concurrently respond to multiple incidents.

Could you confirm if the use of a teaming partner is allowed for this contract? If so, are there any specific requirements for how the teaming partner's contributions, roles, and responsibilities should be outlined and presented in the proposal?

Team partner(s) are allowable. Subcontractor(s) contribution cannot exceed 49% of the total cost. Joint ventures are treated as a single entity comprising of all partners, thus no limitation.

Do you prefer resumes for key personnel to be submitted as part of the initial proposal, or should we submit them only if shortlisted for further evaluation?

Key Personnel will be technically evaluated for award.

If proposing a teaming partner, do we need to submit resumes for their proposed personnel as well? Should these resumes be presented in a separate section, or integrated into our team's personnel section?

Key Personnel resumes will be part of the Technical volume regardless of if it's Prime/Sub(s).

Should we include a separate line item for each base year and option period in the price proposal, or can we submit a consolidated total cost for all periods?

Please separate the various performance periods pricing to properly fund the Contract.

Are there any specific certifications, security clearances, or professional qualifications that are mandatory for key personnel to possess in order to be considered for the project?

The project manager must possess a Secret clearance to be considered.

46 What is the duration for each deployment? 3-5 days

47 Are there any circumstances or situations around a deployment that could necessitate the deployment of more than 2 SMEs? No

48 Would we ever work on multiple deployments at the same time? No

49 Please confirm the mode of proposal submission for this RFP. Please see section L-001 - INSTRUCTIONS TO OFFERORS

Please confirm if the Government requires itemized pricing for:

• Core services include remote cyber incident response, consultancy, and forensic analysis.

• Deployment costs for SMEs under different scenarios, including variations in location and expertise.

• Engagement activities include IT architecture assessments, solution implementation, training, and incident mitigation.

• Specialized services like ransomware response, attribution guidance, and blockchain or virtual asset exchange support.

• Translation and interpretation services, where applicable.

This is dependent of Offeror approach in the Pricing Volume based on their individual interpretation & understanding of the overall requirement.

Should the pricing proposal adopt a fixed-price format for all deliverables, or should specific components follow a time-and-materials structure based on the nature of the service?

Please see section B for various CLIN pricing requirement.

Sheet1