Drone Services Attachment D - Pricing Proposal Template.v1.pdf

May 24, 2024 1 of 6

RFP#357835

Attachment D

Pricing Proposal for Drone Services

July 8, 2024

1. Instructions

Please provide pricing for a comprehensive drone technology platform that will provide all-weather, 24-7 drone infrastructure supporting situational awareness, security, site inspections, and contingency response services. The services will need to support operations throughout a ten-square-mile facility, both typical United States Midwestern terrain and subterranean environments.

Base Term – 1 Year Option Year 1 Option Year 2 Option Year 3 Option Year 4 Phase 1: - - - - -

Solicitation N/A N/A N/A N/A N/A Phase 2: - - - - -

Credentialing Phase 3: - - - - -

(___) # of Drone(s) (___) # of Pad(s)/Port(s)

Hardware Installation Software Implementation

Training Subterranean

Implementation Phase 4: - - - - -

Software Annual Maintenance

Hardware Annual Maintenance

Phase 5: - - - - - Codify and Export

Program Annual Total $ $ $ $ $

May 24, 2024 2 of 6

2. Instructions

To the best of your ability, please provide the pricing breakdown for each of the Requirements listed in Attachment B – Requirements for your proposed implementation of the drone technology platform.

Updated July 8, 2024

Attachment E – Price Breakdown per Requirement

(A) Req. Id

(B) Domain Area

(C) Description (D)

Price

Labor Rate(s)/Category(ies) (If Applicable)

1 Infrastructure Automatically recharge drone batteries

2 Infrastructure Download video from port

3 Infrastructure Temperature-controlled port with weather station/anemometer (safe to launch?)

4 Infrastructure Camera on drone port for security

5 Infrastructure Is the port fenced and/or secure from tampering?

6 Infrastructure Pad requirement and footprint (hardstand, gravel, concrete)

7 Infrastructure Network and power requirements

8 Infrastructure Software? (Cybersecurity risk assessment approval)

9 Infrastructure Port footprint (size?)

10 Infrastructure Maintenance/repair/warranty program?

11 Infrastructure Approved by DOE (components not made in China)

12 Infrastructure Cameras capable of Thermal, Zoom, Lidar, etc.

13 Infrastructure Size and payload limit

14 Infrastructure Remote ID (FAA requirement 09/16/2023)

15 Infrastructure Safety features (collision avoidance, etc.)

May 24, 2024 3 of 6

(A) Req. ID

(B) Domain Area

(C) Description

(D) Price

Labor Rate(s)/Category(ies) (If Applicable)

16 Infrastructure Ability to aid first responders with a live look at the scene before their arrival

17 Infrastructure Live feed for privileged users

18 Infrastructure Can take over control remotely if necessary

19 Infrastructure 10 sq. miles of site – Battery capacity and flight duration

20 Infrastructure Time for full battery recharge

21 Infrastructure Maintenance/repair/warranty/exchange or upgrade program?

22 Security All network communications involving authentication must be encrypted.

23 Security Data must be encrypted at rest and in transit 24 Security Must have sufficient security to prevent un-authorized users from accessing the system.

25 Security Vendor must be responsible for remediating security vulnerabilities in their solution.

26 Security Vendor must certify that they have processes in place to provide Fermilab with prompt notification of any potential data breaches (e.g., Fermilab is required to report any potential loss of PII to the Department of Energy within one hour).

27 Security Vendor must provide a detailed description of physical and logical security controls that are in place to ensure that only authorized personnel can access and manage applications, services and data.

28 System Must have the capability to integrate with Fermilab’s existing Single Sign-On infrastructure to authenticate users. This authentication will be verified using the SAML 2 protocol and Fermilab’s Identity Provider.

29 Security Should support multifactor authentication.

30 Security The solution vendor and all of its data storage facilities where Fermilab data will reside, including production and non-production tenants and those for Disaster Recovery, must be located in the United States.

31 System Must be able to assign an individual and backup to each incident category.

32 System Must have incident file search capabilities.

May 24, 2024 4 of 6

Req. Id

(B) Domain Area

(C) Description

(D) Price

Labor Rate(s)/Category(ies) (If Applicable)

33 System Must have the ability to assign individuals to investigative teams by incident category

34 System Must have the ability to implement role-based access controls.

35 System Must provide controls so that users are only able to access information and data that are relevant to their role, and necessary to carry out their responsibilities

36 System Must provide the ability for Fermilab to retrieve its data and move off of chosen software.

37 System Must allow access from mobile devices such as iPad, Windows Tablet, Android, and Apple compatible with data display via supported web browsers.

38 System Must have configurable and customizable real time reporting capabilities.

39 System Must have the ability to configure internal workflow processes that define and track investigative processes, review/approval processes, and resolution status.

40 System Vendor must either have an existing Master Service Agreement (MSA) with Fermi Research Alliance, LLC (FRA) or be willing to negotiate and sign an interconnection agreement describing how access to data will be controlled and how data will be protected.

41 System Vendor must provide operations and configuration support for the system.

42 System Vendor must provide regular updates and patches to keep up with new technology and computing security issues.

43 System Must have the ability to add incident categories to the pre-defined category list.

44 Cybersecurity and Privacy

The solution should provide capabilities for auditing the system (e.g. changes to the system, changes to the data, user role and responsibility reports for segregation of duties, access logs, etc.).

45 Cybersecurity and Privacy

All solution Vendor(s) should have obtained Federal Risk and Authorization Management Program (FedRAMP) authorization OR be willing to commit to securing FedRAMP authorization or meet Fermilab cybersecurity standards associated with NIST by the Project go-live date

46 Cybersecurity and Privacy

Disaster recovery must be the vendor's responsibility.

May 24, 2024 5 of 6

Req. Id

(B) Domain Area

(C) Description

(D) Price

Labor Rate(s)/Category(ies) (If Applicable)

47 Cybersecurity and Privacy

The solution Vendor should execute a disaster recovery test on its service no less than once each year with a recovery point objective of one hour and a recovery time objective of twelve hours.

48 Cybersecurity and Privacy

The solution Vendor must have policies defined for maintaining privacy and non-disclosure of any information collected.

49 Cybersecurity and Privacy

The solution Vendor must inform Fermilab with sufficient details of a security plan and any certifications and audits that assure that their services are managed at an appropriate level of security.

50 Cybersecurity and Privacy

Fermilab must complete a security risk assessment document and receive authority to operate on the selected product. The solution Vendor must be willing to work with Fermilab or be willing with appropriate documentation to share with Fermilab sufficient details of a risk assessment and security plan such as SOC2 report for their application and platform services that are used to comprise the service to assure that the services are managed at a level of security equivalent to that secured by using the recommended moderate level major application controls described in NIST Publication 800-53.

51 Data Fermilab must retain ownership of its data.

52 Data The solution Vendor must address how Fermilab data can be exported from the system in the event of contract nonrenewal.

53 Data The solution Vendor must provide a standards-based capability to export laboratory data needed to support other systems, provide a backup of the data or obtain a full extract (e.g., SOAP, JSON, SQL, flat .csv file import, XML file import, database interface tables).

54 Data Access The solution Vendor must identify all parties who will have access to our data, including during upgrades and maintenance windows.

55 Integration The solution Vendor should deliver a standard out of the box integration.

56 Service Design The solution Vendor must have an availability SLA of at least 98%.

May 24, 2024 6 of 6

Req. Id

(B) Domain Area

(C) Description

(D) Price

Labor Rate(s)/Category(ies) (If Applicable)

Service Design The solution Vendor should have an understanding of FRA General Terms and Conditions for Commercial Products and Commercial Services (03.2024) and a well-defined response time, resolution time, and a specific procedure for handling incidents and requests.

Please provide a copy of your standard SLA as part of your RFP Response

57 Service Design The proposed commercial solution should use common application code and data definitions so that all clients running the same version of the solution are using the same code base.

58 Service Design The core SaaS services must be owned, delivered, and managed by the vendor. Support for the system software, databases, upgrades, and development are the responsibility of the vendor.

Definitions:

CCB – Cloud to Cloud Backup DOE – Department of Energy EG – For Example ETC – Et. Cetera FAA – Federal Aviation Administration ID – Identification JSON- JavaScript Object Notation NIST – National Institute of Standards and Technology PII – Personal Identifying Information RFP – Request for proposal SAML – Security Assertion Markup Language SaaS – Software as a service SLA – Service level agreement SOAP – Simple Object Access Protocol SOC – Security Operations Center SQL – Structured query language XML – Extensible markup language