07 - Information Technology_Category_Attachment_Sol_47QSMD20R0001_Amd_0.pdf

Category Attachment Code : F

Title : Information Technology

Solicitation Number : 47QSMD20R0001

Refresh Number : 0000

Created on September 30, 2019

Information Technology Category Instructions and Regulations

Instructions:

All offerors must follow evaluation criteria and instructions outlined in the MAS solicitation, including in SCP-FSS-001. The Information Technology Category Attachment outlines additional evaluation criteria, requirements and information specific to this category only. For a list of required Schedule templates and attachments, please visit www.gsa.gov/mascategoryrequirements.

For additional guidance and information for Schedule buyers and sellers, please visit our general guidance page at www.gsa.gov/schedules.

Section I Responsibility and Evaluation Factors for ITC Startup Springboard Only. Innovative IT companies with fewer than two years of experience must meet the following:

Additional information can be found at the following website www.gsa.gov/springboard

1) Financial Responsibility Determination: Offerors with less than two years of corporate experience, the Offeror shall submit any form of financial documentation that will prove financial responsibility. If no financial statements exist, the contracting officer, after offer submission, may request additional documentation.

2) Corporate Experience Evaluation: Companies with less than two years of corporate experience shall submit additional information:

a) Relevant corporate experience of key personnel;

b) Key personnel, proposed by the Contractor and accepted by the contracting officer during contract award, are expected to remain dedicated to the contract. The resume(s) of the initially proposed key personnel shall become the minimum requirement for qualifications for the duration of the total contract term. If the originally proposed key personnel change, the Contractor is required to substitute personnel with equal ability and qualifications, along with updated resume(s) accordingly. Such a change shall require approval from the contracting officer.

c) Resumes of key personnel; and

d) Organizational chart illustrating clear lines of authority.

Section II Instructions for all IT Offerors

1) Technical Evaluation. All technical evaluation factors, subcategory and SIN specific requirements will be reviewed, evaluated, and rated acceptable or unacceptable based on criteria defined in the solicitation. Award will be made on a SIN-by-SIN basis. A rating of "unacceptable" under any technical evaluation factor by SIN will result in an "unacceptable" rating overall for that SIN, and that SIN will be rejected. Offers determined unacceptable for all proposed SIN(s) will be rejected.

2) Commercial Supplier Agreement (CSA)Terms. If offering Commercial Supplier Agreement (CSA)Terms (e.g. standard terms of sales or lease, Terms of Service (TOS), End User License Agreements (EULA), or other similar legal instruments or agreements) - Often ordering activities will decline to place an order because of Federally non-compliant terms (e.g., customer indemnification).

This results in a loss of business for the Schedule holder. In order to facilitate GSA's review and negotiation of each individual set of terms for compliance with Federal law, the Offeror is required to submit its CSA in an editable format, and preferably with the Federally non-compliant terms and conditions already removed. Such submissions may help GSA avoid delays in reviewing and negotiating each individual agreement. "Clickwrap" submissions or links to agreements are not acceptable. The Offeror must clearly define what additional products, services, and prices are included with its CSA.

3) Part Numbers. Offeror must ensure the Original Equipment Manufacturer (OEM), Manufacturer Part Number or Wholesaler Number for each product proposed reflects the actual part number assigned. If the OEM, Manufacturer, or Wholesaler Part Number is submitted incorrectly or not submitted, the product offering will not be awarded.

47QSMD20R0001 Refresh: 0000 Category: F Information Technology

Page: 1 of 62 http://www.gsa.gov/mascategoryrequirements www.gsa.gov/springboard

4) Ancillary Supplies and/or Services

a) Ancillary supplies and/or services are support supplies and services which are not within the scope of any ITC SIN, and shall be offered under the ANCILLARY SIN, which is offered under the Miscellaneous large category.

b) Non-professional labor categories must be incidental to and used solely to support hardware, software and/or professional services, and cannot be purchased separately. Non-professional labor categories shall be offered under the ANCILLARY SIN, which is offered under the Miscellaneous large category.

5) Energy Star or Electronic Product Environmental Assessment Tool (EPEAT) programs.

Commercially available products under this solicitation may be covered by the Energy Star or Electronic Product Environmental Assessment Tool (EPEAT) programs. For applicable products, offerors are encouraged to offer Energy Star-qualified products and EPEAT-registered products, at the Bronze level or higher. If offerors opt to offer Energy Star or Electronic Product Environmental Assessment Tool (EPEAT) products then they shall identify by model which products offered are Energy Star-qualified and EPEAT-registered, broken out by registration level of bronze, silver, or gold. Visit the Green Procurement Compilation, sftool.gov/greenprocurement for a complete list of products covered by these programs.

6) Relevant Project Experience Evaluation

a) The Offeror must submit a narrative demonstrating relevant project experience. A narrative is required for the following SINs:

IT Services Subcategory o 54151HACS - Highly Adaptive Cybersecurity Services (HACS) o 54151S - Information Technology Professional Services o 54151HEAL - Health Information Technology Services

IT Solutions Subcategory o 561422 - Automated Contact Center Solutions (ACCS) o 518210C - Cloud and Cloud-Related IT Professional Services o 541370GEO - Earth Observation Solutions o 541519ICAM - Identity, Credentialing and Access Management (ICAM o 541519PIV - Homeland Security Presidential Directive 12 Product and Service Components

Telecommunications Subcategory o 517312 - Wireless Mobility Solutions o 517410 - Commercial Satellite Communications Solutions (COMSATCOM)

IT Training Subcategory o 611420 - Computer Training

Provide a description of two (2) relevant projects within the last two years, not to exceed four (4) pages per project. Each description must clearly indicate the SIN to which it applies, and identify the specific services being proposed under that SIN. The two (2) projects can be completed or on-going project(s), similar in size and complexity to the effort contemplated herein and in sufficient detail for the Government to perform an evaluation. For companies with less than two (2) years of corporate experience, Offerors shall submit relevant projects of key personnel.

i. Each project description must also address the following elements:

1. Provide the following information for each project submitted:

47QSMD20R0001 Refresh: 0000 Category: F Information Technology

Page: 2 of 62

A. Project/Contract Name;

B. Project Description;

C. Dollar Amount of Contract;

D. Project Duration, which includes the original estimated completion date and the actual completion date; and

E. Point of Contact and Telephone Number.

ii. Detailed description of SIN-relevant work performed and results achieved.

iii. Provide background information on the project or projects presented to demonstrate expertise.

iv. Methodology, tools, and/or processes utilized in performing the work.

v. Demonstration of compliance with any applicable laws, regulations, Executive Orders, OMB Circulars, professional standards, etc.

vi. Project schedule (i.e., major milestones, tasks, deliverables), including an explanation of any delays.

vii. How the work performed is similar in scope and complexity to the work solicited under the proposed SIN.

viii. Demonstration of required specific experience and/or special qualifications detailed under the proposed SIN.

ix. Submit a summary of the final deliverables for the noted project or projects.

x. The Offeror may use the same project in support of more than one SIN as long as the description clearly identifies the SIN-relevant work. All examples of completed services must have been deemed acceptable by the customer.

xi. All examples of completed services shall have been found to be acceptable by the ordering activity. If the offeror cannot provide two examples of past experience, they may provide additional documentation to substantiate project experience to be evaluated by the contracting officer.

b) The following SINs have additional requirements that shall be addressed in the Relevant Project experience narrative:

i. SIN 54151HEAL - Health Information Technology Services:

1. Each completed example of project experience shall have been completed within the last three years. All examples of completed services shall have been found to be acceptable by the ordering activity.

2. Provide background information on the project or projects presented to demonstrate Health IT expertise.

3. Outline how the project or projects are related to SIN 54151HEAL.

ii. SIN 561422 - Automated Contact Center Solutions (ACCS)

1. Where applicable include descriptions of types of channels used in contact centers, annual volume of contacts by channel, Customer Relationship Management tools, speech and text analytics tools used, summary of employee engagement/retention practices used, multilingual services, summary of any efforts or practices used to support surge volume, list of accomplishments to include improvements in service, numbers of agents (including actual, virtual/home-based or Artificial Intelligence/Natural Language/Intelligence Language) used in the project, security considerations, summary of PII handling practices, and types of reporting/data analytics provided on the project.

iii. SIN 541370GEO - Earth Observation Solutions

Page: 3 of 62

1. A narrative of services provided or a project where products were provided.

iv. SIN 541519ICAM - Identity, Credentialing and Access Management (ICAM)

1. Both projects described must be prior Federal Government application deployment projects for public-facing IT systems.

2. Technical evaluation criteria for offers of policy-compliant agency setup, testing, identity proofing, credential issuance, subscriber customer service account management, revocation, and credential validation as part of the basic service.

A. Successful completion of Level 1 Credential Assessment - Include Assessment Report

B. Successful completion of Level 2 Credential Assessment - Include Assessment Report

C. Successful completion of applicable interoperability testing - Include Test Report

3. Technical evaluation criteria for offers of compliant ID proofing, Credential issuance, continued account management, revocation, and certificate validation as part of the basic service.

A. Successful completion of Level 3 and 4 Credential Assessment - Include Assessment Report

B. Access Certificates for Electronic Services (ACES) Security Certification and Accreditation (C&A) as a condition of obtaining and retaining approval to operate as a Certification Authority (CA) under the ACES Certificate policy and the GSA ACES Program. – Include Authorization to Operate (ATO) letter.

C. Common criteria for other Certification Authorities cross-certified by the Federal Bridge

4. Technical evaluation criteria for offers of E-authentication Hardware Tokens.

A. Listed on GSA's Federal Information Processing Standards (FIPS) 201 Approved Products List.

B. Crypto Modules must be FIPS 140-2 validated.

5. Technical evaluation criteria for offers of precursor services such as bulk load, testing, identity proofing, credential issuance, subscriber customer service account management, revocation, and credential validation as part of the basic service. Also includes translation and validation services, and partial services such as 3rd-party identity proofing or secure hosting.

A. Demonstrated compliance with NIST SP 800-63, as applicable to the technologies being utilized by the offeror.

B. Compliance with published E-Authentication architecture, verified by a clearance letter from GSA's Office of Governmentwide Policy.

6. Technical evaluation criteria for offers of Identity and Access Management Professional Services.

A. Documented experience with deployment of policy-compliant Identity and Access Management (IAM) projects in Government agencies. This includes IAM technologies and standards, including Security Assertion Markup Language (SAML), Public Key Infrastructure (PKI) and the Web Services (WS)-Federation specification.

Offerors should describe in detail their competencies when proposing under this SIN.

v. SIN 541519IPIV - Homeland Security Presidential Directive 12 Product and Service Components

1. All offers must be in compliance with guidance in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-63, OMB Memorandum 04-04.

Page: 4 of 62

vi. SIN 517410 - Commercial Satellite Communications Solutions (COMSATCOM)

1. Provide a description of the offeror's experience delivering COMSATCOM services as described in 552.238-110 Commercial Satellite Communication (COMSATCOM) Services.

2. All completed projects shall have been completed within the last three years prior to submission of the COMSATCOM SIN proposal.

3. If the offeror cannot provide two (2) projects, it may provide additional documentation to substantiate project experience to be evaluated by the contracting officer.

4. Provide background information on the project presented to demonstrate familiarity and expertise servicing COMSATCOM requirements.

5. Outline how the project is related to the COMSATCOM SIN.

6. Information Assurance Minimum Security Controls Compliance for SIN 517410

COMSATCOM

A. Federal policy specifies Government customer compliance with the Federal Information Security Management Act of 2002, as implemented by Federal Information Processing Standards Publication 200 (FIPS 200), "Minimum Security Requirements for Federal Information and Information Systems." This standard specifies minimum security requirements Federal agencies must meet, defined through the use of security controls described in the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53, "Recommended Security Controls for Federal Information Systems and Organizations," DoD Instruction (DoDI) 8500.2, "Information Assurance Implementation," and associated documents.

B. Complete the Information Assurance Checklist found on the GSA SATCOM Services Program Management Office website (http://www.gsa.gov/portal/content/122627).

C. The Government will evaluate the Information Assurance checklist submitted as part of offeror's proposal to determine whether the offeror understands the minimum security controls, and has processes, personnel, and infrastructure that currently complies or demonstrates a reasonable approach to becoming compliant with all the minimum security controls for at least a low-impact information system or MAC III system.

vii. SIN 611420 - Computer Training

1. The narrative must include the following:

A. course names, B. brief description, C. length of course, D. type of training, E. location (on or off customer site), and

F. any other pertinent details to the training offered.

2. If other than the manufacturer, submit proof of authorization to provide training course(s) for manufacturer's software and/or hardware products.

7) SINs with IT Professional Services This applies to all SINs that include IT professional services, the offeror shall not resell IT professional services. Currently, the IT Services subcategory and the IT Solutions subcategory include SINs with IT professional services.

Exception: IT professional services may only be resold in direct support of products that are authorized to be sold via the schedule contract, e.g. SIN 54151 - Software Maintenance Services that supports SIN 511210 - Software Licenses. (This does not include SINs within the IT Services Subcategory).

Page: 5 of 62

This applies to all SINs that include IT professional services, the offeror shall not provide services which fall under the Brooks Act. FAR 36.6, which distinguishes between mapping services of an A/E nature and mapping services which are not connected nor incidental to the traditionally accepted A/E Services.

8) Cooperative Purchasing

Section 211 of the E-Government Act of 2002 amended the Federal Property and Administrative Services Act to allow for cooperative purchasing. Cooperative Purchasing authorizes State and local government entities to purchase Information Technology (IT) supplies/products and services from MAS Contracts that include SINs from IT Category of the MAS Consolidated Solicitation.

9) IT Hardware Shipped FOB Destination

Prices for new or used/refurbished equipment shall be FOB destination, which covers equipment delivery to destination for any location within the geographic scope of this contract. This applies to all SINs offering hardware.

IT Hardware Subcategory o 33411 - Purchasing of New Electronic Equipment o 33411REF - Purchase of Used or Refurbished Equipment (Retired)

IT Solutions Subcategory o 541519CDM - Continuous Diagnostics and Mitigation (CDM) Tools

Section III Terms and Conditions for all IT Contractors

1) Organizational Conflicts Of Interest

a) Definitions.

"Contractor" means the person, firm, unincorporated association, joint venture, partnership, or corporation that is a party to this contract.

"Contractor and its affiliates" and "Contractor or its affiliates" refers to the Contractor, its chief executives, directors, officers, subsidiaries, affiliates, subcontractors at any tier, and consultants and any joint venture involving the Contractor, any entity into or with which the Contractor subsequently merges or affiliates, or any other successor or assignee of the Contractor.

An "Organizational conflict of interest" exists when the nature of the work to be performed under a proposed ordering activity contract, without some restriction on ordering activities by the Contractor and its affiliates, may either (i) result in an unfair competitive advantage to the Contractor or its affiliates or (ii) impair the Contractor's or its affiliates' objectivity in performing contract work.

b) To avoid an organizational or financial conflict of interest and to avoid prejudicing the best interests of the ordering activity, ordering activities may place restrictions on the Contractors, its affiliates, chief executives, directors, subsidiaries and subcontractors at any tier when placing orders against schedule contracts. Such restrictions shall be consistent with FAR 9.505 and shall be designed to avoid, neutralize, or mitigate organizational conflicts of interest that might otherwise exist in situations related to individual orders placed against the schedule contract. Examples of situations, which may require restrictions, are provided at FAR 9.508

2) Services Performed

a) All services performed by the Contractor under the terms of this contract shall be as an independent Contractor, and not as an agent or employee of the ordering activity.

b) The Contractor shall commence performance of services on the date agreed to by the Contractor and the ordering activity.

c) The Contractor agrees to render services only during normal working hours, unless otherwise agreed to by the Contractor and the ordering activity.

3) Travel. Any Contractor travel required in the performance of services must comply with the Pub. L.

Page: 6 of 62

99-234 and FAR Part 31.205-46, as applicable, in effect on the date(s) the travel is performed.

Established Federal Government per diem rates will apply to all Contractor travel.

4) Warranty

a) Unless otherwise specified in this contract, the Contractor's standard commercial warranty as stated in the contract's commercial pricelist will apply to this contract.

b) The Contractor's commercial guarantee/warranty shall be included in the Commercial Supplier Agreement to include Enterprise User License Agreements or Terms of Service (TOS) agreements, if applicable.

c) Except as otherwise provided by an express or implied warranty, the Contractor will not be liable to the ordering activity for consequential damages resulting from any defect or deficiencies in accepted items.

Regulation Number Regulation Title/Comments

52.222-46 EVALUATION OF COMPENSATION FOR PROFESSIONAL EMPLOYEES (FEB 1993)

52.222-48 EXEMPTION FROM APPLICATION OF THE SERVICE CONTRACT LABOR STANDARDS TO

CONTRACTS FOR MAINTENANCE, CALIBRATION, OR REPAIR OF CERTAIN EQUIPMENT

CERTIFICATION (MAY 2014)

52.223-19 COMPLIANCE WITH ENVIRONMENTAL MANAGEMENT SYSTEMS (MAY 2011)

52.223-2 AFFIRMATIVE PROCUREMENT OF BIOBASED PRODUCTS UNDER SERVICE AND

CONSTRUCTION CONTRACTS (SEP 2013)

52.229-1 STATE AND LOCAL TAXES (APR 1984)

52.222-62 PAID SICK LEAVE UNDER EXECUTIVE ORDER 13706 (JAN 2017)

52.223-13 ACQUISITION OF EPEAT - REGISTERED IMAGING EQUIPMENT (JUN 2014)

52.223-14 ACQUISITION OF EPEAT® - REGISTERED TELEVISIONS (JUN 2014)

52.223-16 ACQUISITION OF EPEAT® - REGISTERED PERSONAL COMPUTER PRODUCTS (OCT 2015)

552.238-115 SPECIAL ORDERING PROCEDURES FOR THE ACQUISITION OF ORDER-LEVEL MATERIALS

(MAY 2019)

552.238-107 TRAFFIC RELEASE (SUPPLIES) (MAY 2019)

552.238-73 IDENTIFICATION OF ELECTRONIC OFFICE EQUIPMENT PROVIDING ACCESSIBILITY FOR THE

HANDICAPPED (MAY 2019)

552.238-86 DELIVERY SCHEDULE (MAY 2019)

552.238-89 DELIVERIES TO THE U.S. POSTAL SERVICE (MAY 2019)

552.238-90 CHARACTERISTICS OF ELECTRIC CURRENT (MAY 2019)

552.238-91 MARKING AND DOCUMENTATION REQUIREMENTS FOR SHIPPING (MAY 2019)

552.238-92 VENDOR MANAGED INVENTORY (VMI) PROGRAM (MAY 2019)

552.238-93 ORDER ACKNOWLEDGMENT (MAY 2019)

552.238-94 ACCELERATED DELIVERY REQUIREMENTS (MAY 2019)

Subcategory Instructions and Regulations

F01. Electronic Commerce Subcategory

SIN 54151ECOM Electronic Commerce and Subscription Services

54151ECOM Includes value added network services, e-mail services, Internet access services, electronic subscription services, data transmission services, and emerging electronic commerce technologies.

Page: 7 of 62

NOTE: Subject to Cooperative Purchasing

Cooperative Purchasing: Yes Set Aside: No FSC/PSC Code : D304 Maximum Order : $500,000

NAICS

Number Description Business Size 541511 Custom Computer Programming Services $30 million 541512 Computer Systems Design Services $30 million 541513 Computer Facilities Management Services $30 million 541519 Other Computer Related Services $30 million 811212 Computer and Office Machine Repair and Maintenance $30 million

Instructions:

1. Specific Instructions for SIN 54151ECOM - Electronic Commerce and Subscription Services

a. Acceptance Testing: Acceptance testing shall be performed of the systems for ordering activity approval in accordance with the approved test procedures. Management and operations pricing shall be provided on a uniform basis. All management and operations requirements for which pricing elements are not specified shall be provided as part of the basic service.

b. Normal commercial installation, operation, maintenance, and engineering interface training on the system shall be provided. If there is a separate charge, it must be stated on the GSA Price List

(I-FSS-600 CONTRACT PRICE LISTS (OCT 2016).

c. Monthly summary report may be provided to the Ordering Activity in accordance with commercial practice.

2. If an electronic commerce service plan is offered the following must be stated on the GSA Price List

(I-FSS-600 CONTRACT PRICE LISTS (OCT 2016):

a. Describe the electronic service plan and eligibility requirements;

b. Describe charges, if any, for additional usage guidelines; and

c. Describe corporate volume discounts and eligibility requirements, if any.

F02. IT Hardware Subcategory

Instructions:

1. Offerors submitting an offer for a SIN(s) under the "Hardware Subcategory" must also comply with the following:

a. Installation and Technical Services for new or used/refurbished equipment.

i. Offerors shall indicate in the GSA Price List (I-FSS-600 CONTRACT PRICE LISTS (OCT 2016):

A. if the equipment is self-installable; and/or

B. If the equipment is not self-installable, include any fees for installation, training, or maintenance.

ii. Offerors should provide commercial practices for installation, deinstallation and/or reinstallation for review and possible inclusion in the contract.

Page: 8 of 62

SIN 33411 Purchasing of New Electronic Equipment

33411 Includes desktop, laptop, tablet computers (including rugged), servers,storage equipment, hyperconverged integrated systems, supercomputers, routers, switches and other communications equipment, IT security equipment (hardware based firewalls), audio and video (AV) equipment, public address systems, monitors/displays, sensors and other Internet of Things (IOT) devices, printers and Multi-Function Device (MFD) equipment, broadcast band radio, two-way radio (LMR), microwave radio equipment, satellite communications equipment, radio transmitters/receivers (airborne), radio navigation equipment/antennas, optical/imaging systems,and associated peripherals required for operations (such as controllers, connectors, cables, drivers, adapters, etc., ancillary installation of any equipment purchased.

NOTE: Subject to Cooperative Purchasing

Cooperative Purchasing: Yes Set Aside: No FSC/PSC Code : 7010 Maximum Order : $500,000

NAICS

Number Description Business Size 334111 Electronic Computer Manufacturing 1250 employees 334112 Computer Storage Device Manufacturing 1250 employees

Instructions:

****Best-in-Class (BIC) Designation****

1. Specific Instructions for SIN 33411 - Purchase of new electronic equipment

N/A

SIN 33411REF Purchase of Used or Refurbished Equipment

33411REF Includes the following used or refurbished IT equipment.

NOTE: Subject to Cooperative Purchasing

Cooperative Purchasing: Yes Set Aside: No FSC/PSC Code : 7010 Maximum Order : $500,000

NAICS

Number Description Business Size 334111 Electronic Computer Manufacturing 1250 employees 334112 Computer Storage Device Manufacturing 1250 employees

Instructions:

1. Specific Instructions for SIN 33411REF - Purchase of new electronic equipment

a. A Letter of Supply is not required to be submitted for Used or Refurbished equipment.

b. Offers for used or refurbished equipment shall provide maintenance service and/or repair service and repair parts, in accordance with normal industry practices, for the type of equipment offered, for the Scope of the Contract (i.e., at minimum, the 48 contiguous states and the District of Columbia).

c. The words “used” or “refurbished” shall be the first word in the product title/name for the SIP file for GSA Advantage.The word “used” or ”refurbished” shall be the first word in the product title/name for the GSA Pricelist pricing charts (I-FSS-600 CONTRACT PRICE LISTS (OCT 2016). The words “used” or “refurbished” shall be in each product title in any response to a customer Request for Quote (RFQ) or request for information (RFI).

Page: 9 of 62

SIN 532420L Leasing of New Electronic Equipment

811212 Maintenance, Repair Service, and Repair Parts/Spare Parts for Government-Owned General Purpose Commercial Information Technology Equipment, Radio/Telephone Equipment. (After Expiration of Guarantee/Warranty Provisions and/or When Required Service Is Not Covered by Guarantee/Warranty Provisions) and for Leased Equipment

NOTE: Subject to Cooperative Purchasing

Cooperative Purchasing: Yes Set Aside: No FSC/PSC Code : W070 Maximum Order : $500,000

NAICS

Number Description Business Size 532420 Office Machinery and Equipment Rental and Leasing $35 million

Instructions:

1. Specific Instructions for SIN 532420L - Leasing of new electronic equipment

a. Two (2) sets of leasing terms and conditions.are allowable. Either option or both options may be offered.

i. Option 1 does not contain a cancellation clause and all leases automatically expire on September 30th or sooner. Available at http://www.gsa.gov/mascategoryrequirements

ii. Option 2 contains a cancellation clause, in which the fee must be in accordance with applicable legal principles. Available at http://www.gsa.gov/mascategoryrequirements

a. The terms and conditions for each option type(s) offered shall be attached to the GSA Price List

(I-FSS-600 CONTRACT PRICE LISTS (OCT 2016)).

SIN Level Regulations:

Regulation Number Regulation Title/Comments

52.207-5 OPTION TO PURCHASE EQUIPMENT (FEB 1995)

SIN 532420R Daily/Short Term Rental of IT Equipment

532420R Daily or Short-Term Rental of Information Technology Equipment is from one day to 365 days.

NOTE: Subject to Cooperative Purchasing

Cooperative Purchasing: Yes Set Aside: No FSC/PSC Code : W070 Maximum Order : $500,000

NAICS

Number Description Business Size 532420 Office Machinery and Equipment Rental and Leasing $35 million

Instructions:

1) Specific Instructions for SIN 532420R - Daily or short term rental of IT equipment

a. In the event the equipment is sold by the Contractor, or in the event of bankruptcy of the Contractor, corporate dissolution of the Contractor, or other event, so long as the ordering activity is not in default. The

47QSMD20R0001 Refresh: 0000 Category: F Information Technology

Page: 10 of 62 equipment shall remain in the possession of the ordering activity until the expiration of the rental agreement.

Any assignment, sale, bankruptcy, or other transfer of the rented equipment by the Contractor will not relieve the Contractor of its obligations to the ordering activity, and will not change the ordering activity’s duties or increase the burdens or risks imposed on the ordering activity.

b. Maintenance is included in the charge for rental.

c. Rental payments are as stated the GSA Price List (I-FSS-600 CONTRACT PRICE LISTS (OCT 2016)).

d. Include the following statement in the GSA Price List (I-FSS-600 CONTRACT PRICE LISTS (OCT 2016)): If the sum of the payments exceeds [offeror proposed %] of the stated initial value of the rented property, then ownership of the rented property transfers to the renting ordering activity.

SIN 811212 Computer and Office Machine Repair and Maintenance

811212 Maintenance, Repair Service, and Repair Parts/Spare Parts for Government-Owned General Purpose Commercial Information Technology Equipment, Radio/Telephone Equipment. (After Expiration of Guarantee/Warranty Provisions and/or When Required Service Is Not Covered by Guarantee/Warranty Provisions) and for Leased Equipment

NOTE: Subject to Cooperative Purchasing

Cooperative Purchasing: Yes Set Aside: No FSC/PSC Code : J070 Maximum Order : $500,000

NAICS

Number Description Business Size 811212 Computer and Office Machine Repair and Maintenance $30 million

Instructions:

1. Specific Instructions for SIN 811212 - Computer and Office Machine Repair and Maintenance

a. Hardware maintenance and/or Service Repair is available, and allow for additional information to complete the "fill-in" to the terms and conditions.

i. Repair Service Order Terms available at www.gsa.gov/mascategoryrequirements

ii. Maintenance Order Terms available at www.gsa.gov/mascategoryrequirements

a. The terms and conditions for each option type(s) offered shall be attached to the GSA Price List

(I-FSS-600 CONTRACT PRICE LISTS (OCT 2016)).

F03. IT Services Subcategory

Instructions:

Offerors submitting an offer for a SIN(s) under the "IT Services Sub-category" must also comply with the following:

a. Only IT Professional Services or Labor Categories shall be offered.

b. Resumes shall be provided to the GSA contracting officer or the ordering activity upon request.

c. Offerors shall provide a description of each type of IT Professional Service or Labor Category offered, and it should be presented in the same manner as the Contractor sells to its commercial and other ordering activity customers. If the Contractor is proposing hourly rates, a description of all corresponding commercial job titles (labor categories) for those individuals who will perform the service

47QSMD20R0001 Refresh: 0000 Category: F Information Technology

Page: 11 of 62 should be provided.

The following is an example of the manner in which the description of a commercial job title should be presented:

EXAMPLE: Commercial Job Title: System Engineer

Minimum/General Experience: Three (3) years of technical experience which applies to systems analysis and design techniques for complex computer systems. Requires competence in all phases of systems analysis techniques, concepts and methods; also requires knowledge of available hardware, system software, input/output devices, structure and management practices.

Functional Responsibility: Guides users in formulating requirements, advises alternative approaches, conducts feasibility studies.

Minimum Education: Bachelor's Degree in Computer Science

d. Pricing for each type of IT Professional Service or Labor Category shall be in accordance with customary commercial practices; e.g., hourly rates, monthly rates, term rates, and/or fixed prices, minimum general experience and minimum education.

a. Pricing of services shall be offered at the Contractor's facility and/or at the ordering activity location in accordance with customary commercial practices.

SIN 54151HACS Highly Adaptive Cybersecurity Services (HACS)

54151HACS Includes a wide range of fields such as, the seven-step Risk Management Framework services, information assurance, virus detection, network management, situational awareness and incident response, secure web hosting, and backup, security services and, Security Operations Center (SOC) services. HACS vendors are cataloged under the 5 subcategories of High Value Asset Assessments; Risk and Vulnerability Assessments, Cyber Hunt, Incident Response, and Penetration Testing.

NOTE: Subject to Cooperative Purchasing

Cooperative Purchasing: Yes Set Aside: No FSC/PSC Code : D399 Maximum Order : $500,000

NAICS

Number Description Business Size 541511 Custom Computer Programming Services $30 million 541512 Computer Systems Design Services $30 million 541513 Computer Facilities Management Services $30 million 541519 Other Computer Related Services $30 million

Instructions:

Additional SIN Description: Includes proactive and reactive cybersecurity services that improve customer enterprise-level security posture. Services to identify and protect a customer's information resources, detect and respond to cybersecurity events or incidents, and recover capabilities or services impaired by any incidents that emerge.

It encompasses a wide range of fields that include, but are not limited to, Risk Management Framework (RMF) services, information assurance (IA), virus detection, network management, situational awareness and incident response, secure web hosting, and backup and security services.

The seven-step RMF includes preparation, information security categorization; control selection, implementation, and assessment; system and common control authorizations; and continuous monitoring.

RMF activities may also include Information Security Continuous Monitoring Assessment (ISCMA), which evaluate organization-wide ISCM implementations, and also Federal Incident Response Evaluations (FIREs), which assess an organization's incident management functions.

It also includes Security Operations Center (SOC) services. The SOC scope includes services such as:

24x7x365 monitoring and analysis, traffic analysis, incident response and coordination, penetration testing, Page: 12 of 62 anti-virus management, intrusion detection and prevention, and information sharing.

1. Specific Instructions for SIN 54151HACS - Highly Adaptive Cybersecurity Services (HACS)

a. Offerors may request to be placed in the following subcategories.

i. High Value Asset (HVA) Assessments include Risk and Vulnerability Assessment (RVA) which assesses threats and vulnerabilities, determines deviations from acceptable configurations, enterprise or local policy, assesses the level of risk, and develops and/or recommends appropriate mitigation countermeasures in operational and non-operational situations. The services offered in the RVA sub-category include Network Mapping, Vulnerability Scanning, Phishing Assessment, Wireless Assessment, Web Application Assessment, Operating System Security Assessment (OSSA), Database Assessment, and Penetration Testing. Security Architecture Review (SAR) evaluates a subset of the agency s HVA security posture to determine whether the agency has properly architected its cybersecurity solutions and ensures that agency leadership fully understands the risks inherent in the implemented cybersecurity solution. The SAR process utilizes in-person interviews, documentation reviews, and leading practice evaluations of the HVA environment and supporting systems. SAR provides a holistic analysis of how an HVA s individual security components integrate and operate, including how data is protected during operations. Systems Security Engineering (SSE) identifies security vulnerabilities and minimizes or contains risks associated with these vulnerabilities spanning the Systems Development Life Cycle. SSE focuses on, but is not limited to the following security areas: perimeter security, network security, endpoint security, application security, physical security, and data security.

ii. Risk and Vulnerability Assessment (RVA) assesses threats and vulnerabilities, determines deviations from acceptable configurations, enterprise or local policy, assesses the level of risk, and develops and/or recommends appropriate mitigation countermeasures in operational and non-operational situations. The services offered in the RVA sub-category include Network Mapping, Vulnerability Scanning, Phishing Assessment, Wireless Assessment, Web Application Assessment, Operating System Security Assessment (OSSA), Database Assessment, and Penetration Testing.

iii. Penetration Testing is security testing in which assessors mimic real-world attacks to identify methods for circumventing the security features of an application, system, or network.

iv. Incident Response services help organizations impacted by a cybersecurity compromise determine the extent of the incident, remove the adversary from their systems, and restore their networks to a more secure state.

v. Cyber Hunt activities respond to crises or urgent situations within the pertinent domain to mitigate immediate and potential threats. Cyber Hunts start with the premise that threat actors known to target some organizations in a specific industry or with specific systems are likely to also target other organizations in the same industry or with the same systems.

b. Services offered SIN 54151HACS shall be in accordance with the following laws and standards when applicable to the specific task orders, including but not limited to:

o Federal Acquisition Regulation (FAR) Part 52.204-21 o OMB Memorandum M-17-12 - Preparing for and Responding to a Breach of Personally Identifiable Information (PII) o OMB Memorandum M- 19-03 - Strengthening the Cybersecurity of Federal Agencies by enhancing the High Value Asset Program o 2017 Report to the President on Federal IT Modernization o The Cybersecurity National Action Plan (CNAP) o NIST SP 800-14 - Generally Accepted Principles and Practices for Securing Information Technology Systems o NIST SP 800-27A - Engineering Principles for Information Technology Security (A Baseline for Achieving Security) o NIST SP 800-30 - Guide for Conducting Risk Assessments

Page: 13 of 62 o NIST SP 800-35 - Guide to Information Technology Security Services o NIST SP 800-37 - Risk Management Framework for Information Systems and Organizations: A Systems Life Cycle Approach for Security and Privacy o NIST SP 800-39 - Managing Information Security Risk: Organization, Mission, and Information System View o NIST SP 800-44 - Guidelines on Securing Public Web Servers o NIST SP 800-48 - Guide to Securing Legacy IEEE 802.11 Wireless Networks o NIST SP 800-53 – Security and Privacy Controls for Federal Information Systems and Organizations o NIST SP 800-61 - Computer Security Incident Handling Guide o NIST SP 800-64 - Security Considerations in the System Development Life Cycle o NIST SP 800-82 - Guide to Industrial Control Systems (ICS) Security o NIST SP 800-86 - Guide to Integrating Forensic Techniques into Incident Response o NIST SP 800-115 - Technical Guide to Information Security Testing and Assessment o NIST SP 800-128 - Guide for Security-Focused Configuration Management of Information Systems o NIST SP 800-137 - Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations o NIST SP 800-153 - Guidelines for Securing Wireless Local Area Networks (WLANs) o NIST SP 800-160 - Systems Security Engineering: Considerations for a Multidisciplinary Approach in the Engineering of Trustworthy Secure Systems o NIST SP 800-171 - Protecting Controlled Unclassified Information in non-federal Information Systems and Organizations.

c. All professional labor categories under SIN 54151S Information Technology Professional Services may remain there, unless the labor categories are specific to SIN 54151HACS.

2. Oral Technical Evaluation for SIN 54151HACS - Highly Adaptive Cybersecurity Services (HACS)

a. Unless otherwise specified, the offeror shall participate in an oral technical evaluation that will be conducted by a Technical Evaluation Board (TEB). The oral technical evaluation will be held at the unclassified level and will be scheduled by the TEB. The oral technical evaluation will be used to assess the offeror's capability to successfully perform the services within the scope of each subcategory as set forth in this solicitation, excepting those service components awarded through the submission of the Service Self-Attestation. The Self-Attestation form is available at gsa.gov/hacs.

An offeror may only be awarded SIN 54151HACS upon successful completion of the Highly Adaptive Cybersecurity Services oral technical evaluation. If the offeror elects to be cataloged under the "Cyber Hunt" and/or "Incident Response" subcategories, additional questions related to those areas will be asked during the HACS Oral Technical Evaluation.

i. ORAL TECHNICAL EVALUATION CONSTRAINTS: The offeror shall identify up to five key personnel, by name and association with the offeror, who will field questions during the oral technical evaluation. The HACS SIN consists of 5 subcategories. The base HACS Oral Technical Evaluation consists of questions related to the 3 subcategories of, High Value Asset Assessments, Risk and Vulnerability Assessments and Penetration Testing. One (1) hour and 40 minutes is allotted for the base HACS Oral Technical Evaluation. The evaluation will be stopped precisely after 1 hour and 40 minutes. Should the offer elect to be considered for the additional subcategories of Incident Response and Cyber Hunt, an additional 10 minutes will be allotted for each of those subcategories. The total base evaluation session is expected to last up to 1 hour and 40 minutes, depending on the number of subcategories the offeror is proposing. The TEB Chairperson will be responsible for ensuring the schedule is met and that

47QSMD20R0001 Refresh: 0000 Category: F Information Technology

Page: 14 of 62 http://gsa.gov/hacs all offerors are given the same opportunity to present and answer questions.

ii. ORAL TECHNICAL EVALUATION SCHEDULING: The TEB will contact the offeror's authorized negotiator or the signatory of the SF 1449 via email to schedule the oral technical evaluation. Evaluation time slots will be assigned on a first-come-first-served basis. The Government reserves the right to reschedule any offeror's oral technical evaluation at its sole discretion. The oral technical evaluation will be held at facilities designated by the TEB. The exact location, seating capacity, and any other relevant information will be provided when the evaluations are scheduled. The Government may also make accommodations for vendors to participate in the oral evaluations virtually.

iii. PROHIBITION OF ELECTRONIC RECORDING OF THE ORAL TECHNICAL EVALUATION: The offeror may not record or transmit any of the oral evaluation process. All offeror's electronic devices shall be removed from the room during the evaluation. The offeror is permitted to have a timer in the room during the evaluation, provided by the TEB.

iv. RESUBMISSION RESTRICTIONS FOR UNSUCCESSFUL VENDORS UNDER THIS EVALUATION FACTOR: The TEB will afford the offeror multiple opportunities to achieve the "pass" criteria under this evaluation factor through "clarification" questioning, during the Oral Technical Evaluation. Any offeror whom the TEB has found to have not passed under this evaluation factor shall be failed and shall be ineligible to re-submit under the SIN to participate in this evaluation factor for a period of six (6) months following the date of failure.

v. HIGH VALUE ASSET (HVA) ASSESSMENTS SUBCATEGORY PLACEMENT: Any offeror previously awarded all of the following four SINs: 132-45A Penetration Testing, 132-45B Incident Response, 132-45C Cyber Hunt, and 132-45D Risk and Vulnerability Assessment, shall not be subject to a Highly Adaptive Cybersecurity Services oral technical evaluation, so long as they provide in the modification package to the GSA contracting officer a Service Self-Attestation acknowledging their ability to perform Security Architecture Review (SAR) and Systems Security Engineering (SSE) services in their entirety. The Self-Attestation form is available at gsa.gov/hacs.

b. Oral Technical Evaluation Procedures: The offeror will be evaluated on their knowledge of the proposed services. The oral technical evaluation will require the offeror to respond to a specific scenario and general questions to assess the offeror's expertise. The competencies, criteria and evaluation minimums for the questions are below: All new offerors and modifications must participate in and PASS the HACS Oral Technical Evaluation. The Oral Technical Evaluation will include, at a minimum, questions on Risk and Vulnerability Assessment (RVA), Security Architecture Review (SAR), Systems Security Engineering (SSE), and Penetration Testing. At the time of submission, all new offerors and modifications can also elect to be cataloged in one or both of the additional subcategories of Cyber Hunt or Incident Response (IR). Should this election be taken, additional questions related to these subcategories will be included in their HACS evaluation and these additional subcategory topics must be passed as well.

c. Oral Technical Evaluation Criteria: The offeror's responses to the government's questions during the oral technical evaluation session shall be used to determine whether the offeror has the requisite experience and expertise to perform tasks expected to be performed within the scope of the SIN. The oral technical proposal will be evaluated and rated on a pass/fail basis. The rating definitions provided below will be used for the evaluation of the offeror's responses to questions during the oral evaluation.

TECHNICAL RATINGS

Rating Definition

Acceptable The proposal clearly meets the minimum requirements of the solicitation.

Unacceptable The proposal does not clearly meet the minimum requirements of the solicitation.

47QSMD20R0001 Refresh: 0000 Category: F Information Technology

Page: 15 of 62 http://gsa.gov/hacs

SIN 54151HEAL Health Information Technology Services

54151HEAL Includes a wide range of Health IT services to include connected health, electronic health records, health information exchanges, health analytics, personal health information management, innovative Health IT solutions, health informatics, emerging Health IT research, and other Health IT services.

NOTE: Subject to Cooperative Purchasing

Cooperative Purchasing: Yes Set Aside: No FSC/PSC Code : D399 Maximum Order : $500,000

NAICS

Number Description Business Size 541511 Custom Computer Programming Services $30 million 541512 Computer Systems Design Services $30 million 541513 Computer Facilities Management Services $30 million 541519 Other Computer Related Services $30 million

Instructions:

1. Specific Instructions for SIN 54151HEAL - Health Information Technology Services

a. Services offered SIN 54151HEAL shall be in accordance with the following laws and standards when applicable to the specific task orders, including but not limited to:

o Health Information Technology for Economic and Clinical Health Act of 2009 (HITECH) o The Health Insurance Portability and Accountability Act of 1996 (HIPAA) o The National Institute of Standards and Technology (NIST) Federal Information Processing Standards (FIPS) and Special Publications o Federal Information Security Management Act (FISMA) of 2002

SIN 54151S Information Technology Professional Services

54151S IT Professional Services and/or labor categories for database planning and design; systems analysis, integration, and design; programming, conversion and implementation support; network services, data/records management, and testing.

NOTE: Subject to Cooperative Purchasing

Cooperative Purchasing: Yes Set Aside: No FSC/PSC Code : D399 Maximum Order : $500,000

NAICS

Number Description Business Size 541511 Custom Computer Programming Services $30 million 541512 Computer Systems Design Services $30 million 541513 Computer Facilities Management Services $30 million 541519 Other Computer Related Services $30 million

Instructions:

1. Specific Instructions for SIN 54151S - Information Technology Professional Services

Page: 16 of 62

N/A

F04. IT Software Subcategory

Instructions:

****Best-in-Class (BIC) Designation****

Offerors submitting an offer for a SIN(s) under the “IT Software Sub-category” must also comply with the following:

1) Technical Support: Without additional charge to the ordering activity, shall provide a hot line technical support number for the purpose of providing user assistance and guidance in the implementation of the software.