70RSAT19RB00000001_-_Q_and_C_-_20190604.pdf

70RSAT19RB00000001: Questions and Answers

Document &

Section Citation

Offeror Question/Comment Government Response

1 §2.

Could you please tell me if the Combined Synopsis/Solicitation posted as solicitation number 70RSAT19RB00000001 on FBO contains requirements similar to any work performed currently or in the past, or will this be a new requirement?

If possible, can you please provide the most recent contract or task order number?

This is a Broad Agency Announcement (BAA), as discussed in Federal Acquisition Regulation (FAR) 35.016.

This is a research and development solicitation that "seeks innovative approaches to improve protection of the cellular mobile infrastructure."

As such, there is no incumbent contract information DHS can provide.

2 §2., 3., and 4.4 Our company is seeking a $500 million Federal research grant to research the improvement of our proven technology.

Please review the following sections of the BAA Call document relevant to your inquiry:

2. Project Description and Scope

3. Technical Topic Areas (TTAs)

4.4 Expected Award Funding Profile by TTA

3 §5.4 We would like to present an investment opportunity for you and your team to review.

Please refer to section 5.4 of the BAA Call and follow the proposal submission requirements to submit your proposal.

4 N/A Please advise us as to how we can submit proposals that can remain confidential and proprietary to the DHS?

Proposal submission for this BAA Call is handled through the DHS/S&T BAA Portal.

The weblink for the Portal may be found in the most recent posting on FBO (https://www.fbo.gov/spg/DHS/OCPO/DHS- OCPO/70RSAT19RB00000001/listing.html).

Submitted information marked proprietary in accordance with section 9.6. of the CSD Open BAA will not be disclosed outside the Federal Government.

5 N/A Please advise if this is a funded project or sources sought as I did not ascertain this from the FBO site.

This is a research and development solicitation as contemplated in FAR 6.102(d)(2) and 35.016, not a sources sought notice.

Per section 4.1 of the CSD Open BAA, funding is uncertain and is subject to change.

Document &

Section Citation

Offeror Question/Comment Government Response

6 §5.6

The instructions in the current PDF directed me to BAA HSHQDC-17-R-B0002 (current issue) Section 1.3.

International partners recognized as of the finalization of that document are listed; the list ends with “ (n) future international partners.”

Regarding future partners: In February 2019 meetings occurred and subsequent agreements were reached between President Trump and Jair Bolsonaro, President of Brazil. These include agreements regarding technological advances beneficial to both the U.S. and to Brazil. Is Brazil now considered an acceptable international partner to include in a submission for

70RSAT19RB00000001?

At present, DHS/S&T does not have an agreement in place with Brazil. If a proposal selected for award negotiations involves foreign participation, that will be handled on a case-by-case basis.

7 N/A How many projects per TTA will be awarded? There are no pre-determined number of awards per TTA.

8 N/A Can a foreign company be a sub on the proposal? Yes.

9 N/A Do you expect to make multiple awards per TTA? There are no pre-determined number of awards per TTA.

10 N/A Will you build consortia from multiple proposal submissions? Probably no, however teaming is encouraged.

11 N/A Will the funding be allocated over multiple fiscal years, or can the work be proposed to enable demonstration of capabilities within the first year?

It depends on your proposal, contract awards could range from anywhere from 1 to 4 years depending on what you propose.

12 N/A How, and in what manner, does National Risk Management Center (NRMC) work with the Committee on Foreign Investment in the United States (CFIUS)?

This is outside the scope of the BAA Call.

13 N/A How many anticipated awards for BAA? There are no pre-determined number of awards per TTA.

14 N/A Is the award ceiling of $2.75 million for each TTA 1 and 2, or are they combined? Any awards under those two TTAs could be up to $2.75 million each.

15 N/A If our company is a contractor currently performing on an S&T contract, would that preclude us from responding to the BAA?

DHS would have to asses any conflict of interest implications due to the nature of the kind of work your company is performing.

16 N/A Is resume covered under the 25 page limit? Yes.

17 N/A Is validation and testing in a critical infrastructure application, e.g. power distribution, or aircraft telemetry, etc. encouraged?

This is dependent on what is proposed and DHS will not render an opinion on proposed solutions.

Document &

Section Citation

Offeror Question/Comment Government Response

18 N/A Are the different BAAs presented today in addition to SRMNI? Multiple were presented, so want to know if each is unique.

Please refer to the S&T BAA page for solicitation. The things you heard and saw today are included in this and are applicable.

19 N/A Are these BAAs available on FBO?

Yes. If there is anything new it will come out on FBO.

All current DHS/S&T research and development solicitation announcements (BAAs and SBIR) are found on Fed Biz Opps. Proposals are submitted through the section of DHS/S&T portal website specific to that R&D solicitation.

20 N/A Where does voice threat and security fit into this effort? Both in TTA 1 or 2.

21 N/A Is the BAA the only vehicle to evaluate TTA 3? What if there exists commercial-ready solutions? Would you like to consider it?

We are interested in advancements and pilot capabilities that enable the Government mission. It’s not just that we’re doing development only. This is applied research and development, so understand that your solution is not just a fixed point in time.

22 N/A Is there any restrictions on publication based on the project? There is a requirement for DHS review and approval for publications.

23 N/A Do you expect a team with both academia and industry? Teaming is encouraged.

24 4.2 Do you expect any prototype development? What are the expected deliverables?

This depends on your TTA solution and we recommend standard systems engineering artifacts. Also, please check the deliverables schedule in the BAA at section 4.2.

25 N/A Does S&T have shared labs with Mobile Network Operators for 5G security testing? If, not, is this in the plan?

Currently, no.

26 N/A Does DHS work with the United Kingdom’s National Cyber Security Centre?

Yes. Any of our international partners are on the slides and on the DHS/S&T website.

27 N/A How does DHS envision working more closely with network operators on “minimum security requirements?” This question is outside the scope of the BAA Call

28 5.5.3 Is this BAA considered a pilot project? No, but the inclusion of a pilot required for your proposal; please refer to section

5.5.3 of the BAA Call.

29 N/A How do you anticipate integrating this BAA with existing solutions in place at Mobile Network Operators?

This is part of what offerors should provide as part of their proposal based on standards, understanding OEMs, and the ecosystem.

Document &

Section Citation

Offeror Question/Comment Government Response

30 N/A How quickly would successful results in the BAA lead to commercial opportunities?

This depends on the proposed solution and the offeror's commercialization and transition plan.

31 N/A Can you give any analogous examples? No.

32 N/A What do you expect the process to be? It depends on your proposal.

33 N/A What is the relationship between DHS/CISA efforts on ICT supply chain risk and similar interest from DARPA or

NIST?

DHS/CISA has a relationship, there is an interagency group in Information and Communications Technology (ICT).

34 N/A Is DHS looking into adoption of open source, virtualization, and SDN as a part of the network evolution?

Yes, however you must consider and address how it fits in the overall ecosystem and how you are going to get your open source solution into operations. For example, simply posting the solution on GitHub would be inadequate.

35 N/A Do you have openness to private LTE network solutions for public safety use cases in addition to, or as an alternative to, network slicing?

DHS is not commenting on whether a possible approach is in scope.

In developing your proposals, consider where the standards are now and where they are going in the future.

Offerors should consider interoperability, scalability, and commercialization.

DHS has no interest in projects that cannot seamlessly fit into the ecosystem, i.e., the expectaiton is that a developed solution will be operationalized.

36 N/A “Six month pilot as fully priced” – what is it? Can you elaborate?

The exact nature of the pilot is dependent on the proposal. No matter the proposed solution, the pilot must be fully priced in the proposal.

37 N/A Any interest in Quantum Key Distribution (QKD) to enhance mobile security? DHS is not commenting on whether a possible approach is in scope.

38 N/A What are your thoughts on verification of endpoints that are IoT devices, software bots, or people? DHS is not commenting on whether a possible approach is in scope.

39 N/A This is related to credentials (ICAM): what are your thoughts on mobile digital credentials for people and things?

DHS is not commenting on whether a possible approach is in scope.

Document &

Section Citation

Offeror Question/Comment Government Response

40 N/A Is persistent data encryption starting at point-of-capture in the 5G IoT device within scope, as this obviates the needs for “bearer” encryption?

DHS is not commenting on whether a possible approach is in scope.

41 N/A Is DHS considering a consortium model for acquiring these capabilities?

Yes, it is a consideration. Whether it will be an existing one or a new one is to be determined.

42 N/A Is there a separate BAA on the EC3 work? No, at the moment, this may change, there is a Long Range BAA topic, but there are no funds at the moment.

43 N/A What are the types of applications that will be supported on the mobility network? What are the top five applications?

DHS fully expects the current applications for the current networks to be supported by a proposed soltuion, as well as the new capabilities provided by 5G such as machine-to-machine and massive IoT. The proposed solution is entirely up to the offeror, since DHS does not want to hamper innovation or provide specific technical direction regarding proposals.

44 N/A Are the anticipated award ceilings per award, or total across multiple awardees? The anticipated award ceilings are per award.

45 N/A TTA 1 and 2 share a common anticipated award ceiling of $2.75M. Is this a combined amount, or for each TTA? (See response to question 14.)

46 N/A What is the relationship with the International Telecommunication Union's (ITU) Study Group 17 (SG17) - convergence or divergence?

This is outside the scope of the BAA call.

47 N/A Natural or malicious line of sight denial, e.g., swarms of drones or weather?

This is dependent on what is proposed and DHS will not render an opinion on proposed solutions.

48 N/A Should the offeror define a new protocol for "national prioritized" communications, e.g., make carriers designate and reserve slices?

This is dependent on what is proposed and DHS will not render an opinion on proposed solutions.

49 N/A When will the slides be posted? They are provided with the questions and answers.

50 N/A Is there prioritization for implementing new secure solutions for 5G networks versus 2G, 3G, and 4G?

This is dependent on what is proposed and DHS will not render an opinion on proposed solutions.

51 N/A

Is there interest in implementing and demonstrating in a software-defined radio testbed of passive surveillance and wireless device identification and classification technologies?

This is dependent on what is proposed and DHS will not render an opinion on proposed solutions.

Document &

Section Citation

Offeror Question/Comment Government Response

52 N/A Is DHS looking for solutions for legacy systems or are forward-thinking, custom-built scalable solutions also encouraged?

This is dependent on what is proposed and DHS will not render an opinion on proposed solutions.

53 N/A Would it be possible to submit a proposal where the award topic would not be made public and kept FOUO?

DHS contract awards are matters of public record unless exempted in whole or in part, e.g., security classification, or Freedom of Information Act exemption.

54 5.8 Could an award/project be exempted from having to give a briefing in the semi-public forums referenced in section 5.8?

DHS does not anticipate deviating from the requirements found in section 5.8 of the BAA Call.

55 N/A Can an international entity be a sub to a U.S. entity to bid this BAA? Yes.

56 N/A What are the metrics for the TTAs? Each TTA has stated goals. Proposed solutions should address achievement of goals.See 70RSAT19RB00000001 5.5.1.

57 N/A

For software supply chain visibility, how is DHS collaborating/coordinating with other agencies like the Department of Commerce and the Department of Defense, e.g., Department of Commerce's National Telecommunications and Information Administration (NTIA) software bill of materials muti-stakeholder process being led by Dr. Allan Friedman?

This is outside the scope of the BAA call.

58 N/A If a company has Small Business Innovative Research program contracts with DHS/S&T can these be used for

BAA?

No, this BAA Call is only interested in awarding new projects, not changes to the scope of ongoing DHS SBIR contracts.

59 N/A Our proposals will include new intellectual property (IP) that we want to protect. How do we ensure our IP will be protected when we submit a proposal?

Per section 9.5.3 of the Open BAA HSHQDC-17-R-B0002, offerors are required to appropriately mark any proprietary information contained in their proposal.

60 N/A Is the primary focus Public Safety use cases? This is dependent on what is proposed and DHS will not render an opinion on proposed solutions.

61 N/A Can an offeror respond to multiple TTAs? Would this require separate proposals? Would the cost volumes be together or separate for each TTA?

Offerors may submit multiple proposals against different TTAs. A cost volume specific to each proposal is required.

Document &

Section Citation

Offeror Question/Comment Government Response

62 N/A

Fig 1. The threats to Mobile Infrastructure Levels of security addressed at the (a) Hardware, (b) Operating System (OS), (C) Firmware (d) Applications level security what extent need to be covered in this project?

Example:

(a) Hardware level security boot PROM level and embedded Security implementation and Trusted Computing Methods need to be covered?

(b) Operating System Level security is it Kernel layers of security need to be covered for this project scope?

(c) Firmware level security coverage details expected for this Project need to be clarified?

(d) Application Level Security Coverage details expected for this project need to be clarified?

The scope of the project has to be very specific to 3G, 4G, 5G, WiFi, Bluetooth, NFC Tags related Wireless Environment ? or Legacy 2G, 3G Networks, 4G and 5 G Networks this clarity need to be provided.

The stated items in Figure 1 are the targets for research under this BAA Call. The goals for each TTA are explicit and it is left to offerors how to propose solutions to meet them.

63 N/A

2. Security concerning the Protocol Layers used in 2G, 3G (PSTN) carriers and 4G & 5G Layers mapping what extent implementation is required?

Example: (a) SAI Technology Inc can demonstrate 3G, 4G, and 5G Security interoperability and Challenges, will that be sufficient? We need clarification what extent the Protocol layer security implementation is expected for this project?

The goals for each TTA are explicit and it is left to offerors how to propose solutions to meet them and is the rationale for soliciting with a BAA.

64 N/A The intent of the project to cover Cyber vulnerabilities in Internetworking Function (IWF) what extent depth is required?

The goals for each TTA are explicit and it is left to offerors how to propose solutions to meet them and is the rationale for soliciting with a BAA.

65 N/A SS7 Networks security gaps demonstration is it required for this project?

The goals for each TTA are explicit and it is left to offerors how to propose solutions to meet them and is the rationale for soliciting with a BAA.

Document &

Section Citation

Offeror Question/Comment Government Response

66 N/A

SS7 Interoperability with 3GPP Release 8 versus Release 14 lot of security enhancements have to considered? What is the level of security attack coverage depth required for this project?

Example: SS7 Ad Hoc security layer addition with diameter further enhances the security aspects SIP calls and text messages. This is somewhat becomes extended security layers for the existing legacy network?

Could you please clarify what level depth is expected for the Phase I, Phase II and Phase III for this project implementations?

The goals for each TTA are explicit and it is left to offerors how to propose solutions to meet them and is the rationale for soliciting with a BAA.

67 N/A

Let us assume a company can implement LTE Architecture Government Security policy on top of the cellular networks with add on security layer that can be implemented in USA? Is this approach is acceptable?

The goals for each TTA are explicit and it is left to offerors how to propose solutions to meet them and is the rationale for soliciting with a BAA.

68 N/A

Security implementation as per 3GPP Ultra Reliable Low Latency Communications (URLLC), Enhanced Mobile Board Band (eMBB) and Massive Machine Type Communications level of depth expectation for the Phase I and Phase II delivery?

Example: (a) As per the 3GPP Ultra Reliable Low Latency Communications (URLLC) by adding additional security layer communication increases the latency of the network? What extent this trade –off allowed in this project?

The goals for each TTA are explicit and it is left to offerors how to propose solutions to meet them and is the rationale for soliciting with a BAA.

69 N/A Would be open to implement Cloud Radio Access Network (CRAN) and Software Defined Network (SDN) for this security demonstration purpose?

The goals for each TTA are explicit and it is left to offerors how to propose solutions to meet them and is the rationale for soliciting with a BAA.

70 3.1

TTA #1 Focus on 2G, 3G, and 4G Network Protections.

Cloud clarify if SAI Technology and Cyber Forza provides the complete end to end to Mobile Platform with Cyber Security integration will that be acceptable for the

TTA#1?

DHS is not commenting on whether a possible approach is in scope. Please refer to section 3.1 of the BAA Call.

Document &

Section Citation

Offeror Question/Comment Government Response

71 3.2

TTA #2 if we consider the 3GPP 15 or 3GPP 16 based 5G basic security implementation and proposal for the innovative security to protect Government will be acceptable?

DHS is not commenting on whether a possible approach is in scope. Please refer to section 3.2 of the BAA Call.

72 3.1 TTA# 1 Vendor agnostic techniques will be developed and demonstrated for the SS7/Diameter will that be acceptable?

DHS is not commenting on whether a possible approach is in scope. Please refer to section 3.1 of the BAA Call.

73 3.1.1

Goal #1 Data filtering and anomaly detection to improve SS& security to monitor, detect, and respond to any anomalous or potential malicious use of SS7 Networks.

If we provide 5 different use case scenario’s will that be enough to demonstrate for the Phase I? Could you please clarify if this requires extensive study versus critical study of security aspects? Mandatory security concerns versus optional security concerns for this goal need to be clarified?

The goals for each TTA are explicit and it is left to offerors how to propose solutions to meet them and is the rationale for soliciting with a BAA.

74 3.1.1

Goal #2 Threat Assessment and Mitigations IWF between MNOs methods will be provided and some extent simulations provided to demonstrate will that be acceptable for the Phase I?

The goals for each TTA are explicit and it is left to offerors how to propose solutions to meet them and is the rationale for soliciting with a BAA.

75 3.1.1

Goal #3 Vendor agnostic methods will be proposed for the Core network implementation for the LTE Core Network and validate them in the test bed environment will be required for the Phase I?

The goals for each TTA are explicit and it is left to offerors how to propose solutions to meet them and is the rationale for soliciting with a BAA.

76 3.2 TTA #2 Fifth Generation (5G) Network Security new innovative methods of security protection provided any participant will it be accepted due to evolving standards?

The goals for each TTA are explicit and it is left to offerors how to propose solutions to meet them and is the rationale for soliciting with a BAA.

77 3.2.2

Goal 2 Security Architecture for Government using the network slicing Confidentiality Integrity, and Encryption methods effectiveness will be sufficient? Could clarify the expectation for the 5G network Phase I demonstration?

The goals for each TTA are explicit and it is left to offerors how to propose solutions to meet them and is the rationale for soliciting with a BAA.

Document &

Section Citation

Offeror Question/Comment Government Response

78 4.2, 5.5.1

The item “Go/No-Go Demonstration Evaluation Plan” appears twice, once in row 7 with a due date of 5 months after award, and a second time in row 10 with a due date of 10 months after award. Do these reference the same or different evaluations? If these are different evaluations, to what does the second entry refer?

These are different evaluations. Please review section 5.5.1.