20-FDA-SOL-1221384 Attachment E Evaluation Instructions and Criteria.pdf

RFP # 20-FDA-SOL-1211384

Attachment E

FDA Cybersecurity Capabilities Projects IDIQ

ATTACHMENT E

EVALUATION INSTRUCTIONS AND CRITERIA

GENERAL REQUIREMENTS AND INFORMATION

For the purpose of this request for proposal (RFP), the U.S. Food and Drug Administration (FDA) intends to conduct the evaluation and selection process in TWO (2) PHASES. The Government intends to award only one (1) Indefinite Delivery Indefinite Quantity (IDIQ) contract resulting from this combined synopsis/solicitation. The Government reserves the right not to award a contract.

PHASE I – REQUEST FOR QUALIFICATIONS

Phase I of the solicitation requires the offeror to submit their qualifications in accordance with the evaluation factors in Phase I – Qualification Evaluation Factors.

Each offeror will receive an advisory notification by email from the Contracting Officer via the Contract

Specialist. The notification will advise the offeror of the Government’s advisory recommendation for proceeding to Phase II of the solicitation. Offerors will be rated with a confidence rating. Offerors who are rated with the highest confidence by the Government will be advised to proceed to Phase II of the submission process. Offerors who are not amongst the most highly rated will be advised that they are unlikely to be viable competitors with the general basis for the Government’s advisory recommendation. The intent of this advice is to minimize development costs for those offerors with little to no chance of receiving the award.

At the discretion of the Government, the Government anticipates inviting up to five (5) offerors rated with the highest confidence to participate in Phase II of the solicitation. However, the Government’s advisory notification is a recommendation only. Offerors who are advised not to proceed may elect to continue their participation in the solicitation.

The Government does not intend to provide further debriefings after the advisory notifications have been disseminated. Failure to participate in Phase I of the solicitation precludes further consideration of an offeror. Proposals will not be accepted after the stated due date and time.

PHASE II – REQUEST FOR PROPOSAL

Phase II of the solicitation requires the offeror to submit a technical and business proposal in accordance with the evaluation factors in Phase II – Request for Proposal. The proposal and question due date for

Phase II will be provided in the advisory notification. A non-disclosure agreement may be required for

Phase II and will advised as such in the notification.

The technical proposal shall be presented by the offeror via an oral presentation. The location, date and time of the oral presentation will be indicated on the advisory notification of those invited to participate in Phase II of the solicitation; subject to change at the discretion of the Government. Offerors who have not been advised to participate in Phase II but have elected to submit a proposal for Phase II, need to notify the Contract Specialist and Contracting Officer will received the presentation date and time after submission of the written proposal for Phase II.

The oral presentation does not constitute discussions. The Government will not ask questions that will invite or allow the offeror to change its offer; only to clarify what has been stated by the offeror. The offeror shall not volunteer any information that might be construed as changing its offer. The

Government reserves the right to conduct discussions separate from the oral presentation.

PROPOSAL SUBMISSION INSTRUCTIONS

This section provides instructions for preparing proposals for both Phase I and Phase II of the solicitation. Offerors are cautioned to follow the instructions carefully to assure the Government receives consistent information in a form that will facilitate proposal evaluation. For the purposes of preparing proposals, offerors should assume an award time-frame of September 2020.

By submission of its offer in accordance with the instructions provided herein, the offeror unconditionally assents to the terms and conditions in this solicitation document and any attachments hereto. Unless this solicitation document expressly authorizes alternate proposals with respect to specific terms and conditions of the solicitation, an objection to any of the terms and conditions of this solicitation document shall constitute a deficiency that may render the offer unacceptable.

All terms and conditions and any amendments issued to this solicitation must be acknowledged and accepted in the proposal for both phases of the selection process.

The PDF is the version of record. An authorized individual who can contractually bind the offeror shall sign the cover page for each phase of the solicitation. Digital signatures are acceptable.

PHASE I – REQUEST FOR QUALIFICATIONS

Offerors shall submit their proposals no later than the date and time indicated on the solicitation posting on https://beta.sam.gov/.

Proposals shall conform to the solicitation provisions and prepared in accordance with this section. To aid in the evaluation, the proposal shall be clearly and concisely written as well as being neat, indexed and logically assembled. All pages of shall be appropriately numbered and identified with the name of the offeror, DUNS number, title of the solicitation and solicitation number.

The presentation format and content layout are at the discretion of the offeror but shall contain all required information to be considered fully responsive.

The PDF is the version of record. An authorized individual who can contractually bind the offeror shall sign the cover page of each volume. Digital signatures are acceptable.

https://beta.sam.gov/ https://beta.sam.gov/

A. General Formatting Instructions

The response shall be submitted in PDF format.

Offerors shall use the following page setup parameters:

▪ Margins – top, bottom, left, right – 1”

▪ Gutter – 0”

▪ From edge – header, footer – 0.25”

▪ Page size – 8.5” width x 11” height

- Exceptions – tables and Illustrations may use landscape layout (11” width x 8.5” height)

Each paragraph shall be separated by at least one blank line. Responses shall utilize a minimum of

1.15 spacing between lines using no less than a 10-point font size. Offerors are encouraged to use Calibri 11-point font size. Tables and illustrations may use a reduced font size not less than 8-point.

B. Page Limitation

Responses shall not exceed 10 pages in length. Any pages exceeding the maximum allowable pages will not be evaluated. The following are excluded from the total page count limitation but must be clearly labeled to the extent to which is clearly discernable by the Government:

▪ Cover Page

▪ Table of Contents

▪ Glossary

▪ Divider Pages

▪ Letters of partnerships/authorizations

PHASE II – REQUEST FOR PROPOSAL

Offerors shall submit the written proposal no later than the date and time indicated in the advisory notification. The items indicated below are the only items that must be submitted via email.

Additionally, the submitted written proposal must also include:

1) Representations and Certifications shall be submitted as required in the FAR provisions 52.212-3(b).

2) The PDF is the version of record. An authorized individual who can contractually bind the offeror shall sign the cover page of each volume. Digital signatures are acceptable.

3) Any material terms & conditions and exceptions to the Government’s terms and conditions shall be submitted in writing, if any.

The WRITTEN PROPOSAL shall be submitted in two (2) volumes. Each volume shall include a cover page which clearly identifies each volume by number, RFP number, and date of submission. Any amendments issued for this RFP must also be acknowledged on the cover page of each volume.

▪ Volume I – Technical Proposal and Past Performance

Volume must be free of any pricing information.

The following shall be submitted as part of volume 1 in PDF format. General formatting instructions from Phase I are applicable for this volume.

o List of attendees for the oral presentation, their role/position as it pertains to the proposal, and an email address for each attendee.

o Copy of the presentation slides in PDF format. The slides will not be evaluated.

o Factor 3 – Past Performance

▪ Volume II – Price Proposal

The business volume shall include the following in PDF and Excel formats:

• Attachment A –Labor Categories & Pricing Workbook with the follow worksheets completed in its entirety along with the “Notes & Assumptions” tabs as required.

- IDIQ Labor Category Rates

- Task Order #1 Price Proposal – FDA OIMT-OIS Risk and Vulnerability Assessment

- Task Order #2 Price Proposal – FDA Cybersecurity Support Services

• Offerors are responsible for ensuring that all calculations in Attachment A workbook are correct and accurate.

• All labor rates must be fully burdened labor rates.

• Other direct costs (IDIQ SOW section 4.6) are relatively minor in cost to the overall contract value of the IDIQ. Ordering instructions are provided in the IDIQ SOW. No pricing shall be submitted in the price proposal. ODCs will be requested at the task order level and price fair and reasonableness will be determined at that time.

• IDIQ Labor Category Pricing:

- Offeror shall provide pricing for applicable identified labor categories for work performed at both Government and Contractor site for the base period and all option periods.

- The offeror shall propose all labor categories required to perform the scope of the IDIQ;

add additional rows as needed.

- It is the responsibility of the offeror to carefully review "Labor Category Descriptions &

Min. Qualifications" tab prior to completing the schedule.

- Any additional labor categories added must include a labor category description on the

"Notes and Assumptions" tab.

- Any notes or assumptions. Any narrative detailing any assumptions not addressed elsewhere in the proposal.

- The Government has the discretion on whether to include the labor category in the award.

• Task Order Pricing:

- The offeror shall provide task order pricing using Attachment A workbook for each task order.

- Add rows as needed for task sections.

- All labor categories proposed must also be included in the IDIQ labor category spreadsheet.

- Any notes or assumptions. Any narrative detailing any assumptions not addressed elsewhere in the proposal.

The ORAL PRESENTATION by the offeror shall consist of the following evaluation factors:

▪ Factor 1 – Technical Capabilities

▪ Factor 2 – Management Approach

ORAL PRESENTATION GUIDELINES AND INSTRUCTIONS

The oral presentation will be conducted via a video conferencing meeting with the following guidelines:

▪ After submission of the written proposal for Phase II, each attendee will receive a link to the oral presentation video conference. The link shall not be forwarded to attendees not on the attendee list provided by the offeror.

▪ The offeror can have a maximum of five (5) attendees.

▪ The offeror may only attend ONE oral presentation, whether as the prime or the subcontractor for another firm.

▪ The video conference will be available 15 minutes prior to the scheduled presentation time.

The moderator will begin the presentation promptly at the time indicated in the advisory notification or otherwise indicated by the Government.

▪ The presentations will be no longer than 1.5 hours at which time the Government moderator will promptly end the meeting.

▪ No questions will be allowed from the offeror during the oral presentation except to clarify a question asked by the Government.

▪ All attendees for the meeting must be in view of the Government on the video conference.

▪ The following proposed key personnel must be present at the presentation:

o Program Manager o Senior Splunk Architect

A portion of the oral presentation will consist of the following. Each offeror will receive the same set of advance questions and a scenario; they may be asked at any point during the oral presentation:

▪ The Government will issue a list of questions to the offeror approximately one (1) hour before the scheduled presentation. These questions will be asked by the Government and answered by the offeror during the oral presentation.

▪ The Government will require the offeror to address a scenario. The scenario will not be provided ahead of time.

EVALUATION FACTORS

PHASE I – QUALIFICATION EVALUATION FACTORS

FACTOR 1 – RELEVANT EXPERIENCE

The offeror shall provide three (3) projects performed as the prime contractor that indicates your experience with projects of similar scope, complexity and size. Projects submitted for evaluation shall have been performed or completed within the past 60 months from the release date of this solicitation.

At a minimum, each project shall indicate the contract number, period of performance, and total award value. The offeror shall also indicate the total value of any hardware or software purchased thru the contract, if any.

The offeror shall fully describe how the projects submitted are similar in scope, complexity and size, your roles and responsibilities on the project, contract price, and complete dates of performance.

Offerors must provide a narrative of how they supported the scope that encompasses from the statement of work task areas 4.1 thru 4.7.

Projects of similar complexity and size for cybersecurity capabilities include:

▪ Users greater than 23,000 deployed worldwide.

▪ Deployment of security incident and event management architecture to worldwide model to include a scope of more than 150,000 endpoints and 5,000 servers.

▪ Total contract award value shall be at least $8 million for services performed. Any hardware or software purchased thru the contract will not be considered towards the $8 million.

Offerors shall provide sufficient information for the Government to determine its level of confidence in the ability of the offeror to perform the requirements of the RFP based on an assessment of relevant experience from the offeror.

FACTOR 2 – SUBCONTRACTORS AND PARTNERSHIPS

The offeror shall provide a list of anticipated subcontractors and their role for the IDIQ., if any. The offeror shall demonstrate their level of partnerships and/or relationship with OEMs and industry leaders in cybersecurity. Offerors must have a partnership/relationship with Splunk and McAfee

DLP. Other OEMs and industry leaders considered by FDA include, but not limited to, Palo Alto, McAfee CASB, Netwitness, Suricata and Kryptowire. Offerors may submit letters of partnerships/authorizations from the OEMs and industry partners which will not be counted towards the total page count. The letters must contain contact information for verification at the discretion of the Government.

PHASE II – PROPOSAL EVALUATION FACTORS

The following are the evaluation factors for phase II and past performance.

FACTOR 1 – TECHNICAL CAPABILITIES

The offeror shall provide a detailed narrative that clearly and completely demonstrates its technical approach to execute the specified activities in:

▪ Task Order #2: FDA Cybersecurity Support Services, sections 2.1 thru 2.4 of the task order

SOW that is comprehensive, feasible, and likely to be effective.

▪ Task Order #1: FDA OIMT-OIS Risk and Vulnerability Assessment, sections 3.1 thru 3.4 of the task order SOW that is comprehensive, feasible, and likely to be effective.

▪ IDIQ SOW – Data Loss Prevention and DHS Continuous Diagnostics and Mitigation (CDM) that is comprehensive, feasible, and likely to be effective (IDIQ SOW section 4.1).

The offeror shall provide one resume for each of the three (3) Key Personnel positions indicated from Task Order # 2 for the following positions who shall clearly display professional qualifications, certifications, and technical skills relevant to the task order SOW and IDIQ labor categories

(reference Attachment A):

▪ Program Manager

▪ Senior Splunk Architect

▪ Technical Writer Level 2

FACTOR 2 – MANAGEMENT APPROACH

The offeror shall submit a narrative for the IDIQ Management Approach (per IDIQ SOW Section 4.8) to only include the offeror’s:

▪ Plan to staff, retain, and replace personnel across multiple orders/awards simultaneously to include any assumptions, risks, and challenges and its associated staffing risk mitigation strategy that is sound and practicable.

▪ Plan to utilize and manage subcontractors and contract teaming partners for the IDIQ task areas that is realistic, executable, and likely to be effective (See IDIQ SOW Section 3.0 and

Task Areas 4.1-4.7)

▪ Communication plan that describes all lines of communication between the contractor and the Government (e.g. FDA Executive-level, FDA CO, FDA IDIQ COR) at the IDIQ level.

FACTOR 3 – PAST PERFORMANCE

The offeror shall submit past performance information from the three (3) projects submitted from

Phase I: Factor 1 – Relevant Experience only. For each past performance, the offeror shall submit the contractor name, contract number, period of performance, contractor project point of contact, and a current point of contact name, phone and email. Past performance information submitted that do not align to the three (3) projects will not be evaluated.

To the maximum extent practicable, the past performance references are to be attainable through the Contractor Performance Assessment Reporting System (CPARS).

If there are no references for the offeror on CPARS, the offeror shall provide the Past Performance

Questionnaire (Attachment F), to the reference(s). The questionnaire must be signed and submitted to the Government POCs by the reference via email.

Questionnaires received after the proposal due date and time will not be evaluated.

Any questionnaires submitted by the offeror on behalf of the reference will not be evaluated.

PHASE I – EVALUATION OF QUALIFICATIONS

The Government will assess its level of confidence that the offeror will successfully perform the requirements of the contract in regard to the evaluation factors. The evaluation factors will measure the

Government’s confidence that the offeror understands the requirements and will be successful in performing the contract.

The Government will assign a confidence rating for each offeror:

▪ High Confidence – The Government has high confidence that the offeror understands the requirement, has the ability to perform the scope based on the size, scope and complexity required by the Government, and will be successful in performing the contract with little or no

Government intervention.

▪ Moderate Confidence – The Government has some confidence that the offeror understands the requirement, has the ability to perform the scope based on the size, scope and complexity required by the Government, and will be successful in performing the contract with some

Government intervention.

▪ Low Confidence – The Government has low confidence that the offeror understands the requirement, has the ability to perform the scope based on the size, scope and complexity required by the Government, or will be successful in performing the contract even with

Government intervention.

The Government will determine the level of confidence for each offeror by evaluating the extent to which the offeror:

▪ Submitted three (3) projects of similar size, complexity and scope that collectively encompass the same or similar scope to the following task areas of the IDIQ statement of work (See IDIQ

SOW Task Area): 4.1 thru 4.7.

▪ Provided contract information to include contract number, period of performance and total award value.

▪ Performed as the PRIME contractor on the projects. Projects submitted where the offeror was not the prime contractor will not be evaluated.

▪ Projects must have started within the last 60 months from the release date of this RFP. Projects submitted outside of this time frame will not be evaluated.

▪ The total award value for each project is at least $8 million for services performed; exclusive of hardware and software purchased thru the award. At the discretion of the Government, the

Government may not evaluate projects where the value of the services performed is less than

$8 million.

▪ Meets or exceeds the complexity of cybersecurity capabilities deployed enterprise-wide defined.

▪ Has relevant partnerships/relationships with OEMs and industry leaders in cybersecurity.

▪ Has provide subcontractors, if any.

PHASE II – EVALUATION OF PROPOSAL

The Government intends to award only one (1) Indefinite Delivery Indefinite Quantity (IDIQ) contract resulting from this combined synopsis/solicitation. The Government reserves the right not to award a contract.

The Government will use a technical/price tradeoff process for source selection in Phase II of the solicitation. Award will be made to the responsible offeror whose offer conforms to the solicitation requirements and provides the best value to the Government, non-price factors and price considered.

The Government reserves the right to conduct discussions with the offerors in Phase II of the solicitation process if it is determined to be in the best interest of the Government.

FACTOR 1 – TECHNICAL CAPABILITIES

The Government will evaluate the extent to which the offeror’s narrative clearly and completely demonstrates the offeror’s technical approach to execute the activities in:

▪ Task Order #2: FDA Cybersecurity Support Services, sections 2.1 thru 2.4 of the task order

SOW and that it is comprehensive, feasible and likely to be effective.

▪ Task Order #1: Penetration Testing, sections 3.1 thru 3.4 of the task order SOW that is comprehensive, feasible, and likely to be effective.

▪ IDIQ SOW – Data Loss Prevention (IDIQ SOW section 4.2) and DHS Continuous Diagnostics and Mitigation (IDIQ SOW section 4.1) that is comprehensive, feasible, and likely to be effective.

The Government will evaluate the Key Personnel resumes to determine whether the proposed personnel possesses the appropriate qualifications, certifications, technical skills, and demonstrated successes relevant to the Task Order # 2 sections 2.1 thru 2.4 of the task order SOW requirements and IDIQ labor category descriptions.

FACTOR 2 – MANAGEMENT APPROACH

The Government will evaluate the offeror’s demonstrated approach to staff, retain, and replace qualified personnel with the different skillsets identified in Attachment A Labor Categories necessary to meet the staffing requirements for the duration of the IDIQ and that the plan is realistic and executable. The Government will evaluate the extent to which the offeror’s narrative includes an approach for identifying and managing staffing risks or challenges the offeror foresees in carrying out its approach, mitigation strategies for those risks, and any assumptions relied upon in developing the proposed staffing approach and that it is comprehensive, feasible, and likely to be effective

The Government will evaluate whether the offeror’s proposed plan to utilize and manage subcontractors and contract teaming partners is realistic, executable, and likely to be effective to meet the work requirements of the IDIQ SOW.

The Government will also evaluate the offeror’s communication plan to be used to meet the IDIQ requirements and that it effectively incorporates quality and repeatable processes and is comprehensive, feasible and likely to be effective.

FACTOR 3 – PAST PERFORMANCE

The Government will evaluate the relevance and quality of the offeror’s past performance information. In assessing the offeror’s past performance, the Government will evaluate the quality, timeliness, ability to control cost, schedule and minimize operational impact of the past work.

Past performance information submitted that do not align to the three (3) projects submitted for Phase I: Factor 1 – Relevant Experience will not be evaluated.

Any questionnaires submitted by the offeror on behalf of the reference will not be evaluated.

PRICE EVALUATION

Price will be evaluated separately from past performance and technical factors, and will be evaluated for fairness and reasonability in terms of reasonable and realistic pricing; that the proposed prices for the task orders are calculated based on reasonable and realistic assumptions.

As part of this evaluation, the Government will evaluate Offeror’s proposed price for Task Order # 1 and Task Order # 2 for reasonableness and realism for the work to be performed. Should price become the determining factor, the final quoted and evaluated price of Task Order # 1 and Task

Order # 2 combined will determine awardee.

Offerors are cautioned that an unrealistically low price, or unbalanced pricing of either task orders, as proposed initially or subsequently, may be grounds for eliminating a proposal from further consideration, either on the basis that the Offeror does not understand the required services or has made an irresponsible proposal. The Government will evaluate the Offeror’s ability to deliver an efficient, low-risk price service at a fair and reasonable price.

BASIS OF AWARD

The non-price factors and past performance factors are listed below and will be evaluated in descending order of importance. Non-price factors and past performance combined are significantly more important than price.

▪ Factor 1 – Technical Capabilities

▪ Factor 2 – Management Approach

▪ Factor 3 – Past Performance

The non-price factors, Factors 1 and 2 will be evaluated adjectivally and categorized as Excellent, Highly Acceptable, Acceptable, Marginal or Unacceptable. As technical merit of proposals becomes equal, the evaluated price may become the determining factor.

The Government will evaluate the Factor 3 – Past Performance, as a risk assessment, not as a weighted technical evaluation factor. Past Performance will be given a rating of Low Risk, Neutral, or High Risk.

Offerors with no record of past performance information will be evaluated neither positively nor negatively for this factor and receive a rating of “Neutral”.