70RSAT19RB00000001_-_Q_and_C_-_20190610.pdf

70RSAT19RB00000001: Questions and Answers

Document &

Section Citation

Offeror Question/Comment Government Response Received (Email or Industry Day)

1 §2.

Could you please tell me if the Combined Synopsis/Solicitation posted as solicitation number 70RSAT19RB00000001 on FBO contains requirements similar to any work performed currently or in the past, or will this be a new requirement?

If possible, can you please provide the most recent contract or task order number?

This is a Broad Agency Announcement (BAA), as discussed in Federal Acquisition Regulation (FAR) 35.016.

This is a research and development solicitation that "seeks innovative approaches to improve protection of the cellular mobile infrastructure."

As such, there is no incumbent contract information DHS can provide.

Email

2 §2., 3., and 4.4 Our company is seeking a $500 million Federal research grant to research the improvement of our proven technology.

Please review the following sections of the BAA Call document relevant to your inquiry:

2. Project Description and Scope

3. Technical Topic Areas (TTAs)

4.4 Expected Award Funding Profile by TTA

Email

3 §5.4 We would like to present an investment opportunity for you and your team to review.

Please refer to section 5.4 of the BAA Call and follow the proposal submission requirements to submit your proposal. Email

4 N/A Please advise us as to how we can submit proposals that can remain confidential and proprietary to the DHS?

Proposal submission for this BAA Call is handled through the DHS/S&T BAA Portal.

The weblink for the Portal may be found in the most recent posting on FBO (https://www.fbo.gov/spg/DHS/OCPO/DHS- OCPO/70RSAT19RB00000001/listing.html).

Submitted information marked proprietary in accordance with section 9.6. of the CSD Open BAA will not be disclosed outside the Federal Government.

Email

5 N/A Please advise if this is a funded project or sources sought as I did not ascertain this from the FBO site.

This is a research and development solicitation as contemplated in FAR 6.102(d)(2) and 35.016, not a sources sought notice.

Per section 4.1 of the CSD Open BAA, funding is uncertain and is subject to change.

Email

Document &

Section Citation

Offeror Question/Comment Government Response Received (Email or Industry Day)

6 §5.6

The instructions in the current PDF directed me to BAA HSHQDC-17-R-B0002 (current issue) Section 1.3.

International partners recognized as of the finalization of that document are listed; the list ends with “ (n) future international partners.”

Regarding future partners: In February 2019 meetings occurred and subsequent agreements were reached between President Trump and Jair Bolsonaro, President of Brazil. These include agreements regarding technological advances beneficial to both the U.S. and to Brazil. Is Brazil now considered an acceptable international partner to include in a submission for

70RSAT19RB00000001?

At present, DHS/S&T does not have an agreement in place with Brazil. If a proposal selected for award negotiations involves foreign participation, that will be handled on a case-by-case basis.

Email

7 N/A How many projects per TTA will be awarded? There are no pre-determined number of awards per TTA. Industry Day 8 N/A Can a foreign company be a sub on the proposal? Yes. Industry Day 9 N/A Do you expect to make multiple awards per TTA? There are no pre-determined number of awards per TTA. Industry Day

10 N/A Will you build consortia from multiple proposal submissions? Probably no, however teaming is encouraged. Industry Day

11 N/A Will the funding be allocated over multiple fiscal years, or can the work be proposed to enable demonstration of capabilities within the first year?

It depends on your proposal, contract awards could range from anywhere from 1 to 4 years depending on what you propose. Industry Day

12 N/A How, and in what manner, does National Risk Management Center (NRMC) work with the Committee on Foreign Investment in the United States (CFIUS)?

This is outside the scope of the BAA Call. Industry Day

13 N/A How many anticipated awards for BAA? There are no pre-determined number of awards per TTA. Industry Day

14 N/A Is the award ceiling of $2.75 million for each TTA 1 and 2, or are they combined? Any awards under those two TTAs could be up to $2.75 million each. Industry Day

15 N/A If our company is a contractor currently performing on an S&T contract, would that preclude us from responding to the BAA?

DHS would have to asses any conflict of interest implications due to the nature of the kind of work your company is performing. Industry Day

16 N/A Is resume covered under the 25 page limit? Yes. Industry Day

17 N/A Is validation and testing in a critical infrastructure application, e.g. power distribution, or aircraft telemetry, etc. encouraged?

This is dependent on what is proposed and DHS will not render an opinion on proposed solutions. Industry Day

18 N/A Are the different BAAs presented today in addition to SRMNI? Multiple were presented, so want to know if each is unique.

Please refer to the S&T BAA page for solicitation. The things you heard and saw today are included in this and are applicable. Industry Day

Document &

Section Citation

Offeror Question/Comment Government Response Received (Email or Industry Day)

19 N/A Are these BAAs available on FBO?

Yes. If there is anything new it will come out on FBO.

All current DHS/S&T research and development solicitation announcements (BAAs and SBIR) are found on Fed Biz Opps. Proposals are submitted through the section of DHS/S&T portal website specific to that R&D solicitation.

Industry Day

20 N/A Where does voice threat and security fit into this effort? Both in TTA 1 or 2. Industry Day

21 N/A Is the BAA the only vehicle to evaluate TTA 3? What if there exists commercial-ready solutions? Would you like to consider it?

We are interested in advancements and pilot capabilities that enable the Government mission. It’s not just that we’re doing development only. This is applied research and development, so understand that your solution is not just a fixed point in time.

Industry Day

22 N/A Is there any restrictions on publication based on the project? There is a requirement for DHS review and approval for publications. Industry Day

23 N/A Do you expect a team with both academia and industry? Teaming is encouraged. Industry Day

24 4.2 Do you expect any prototype development? What are the expected deliverables?

This depends on your TTA solution and we recommend standard systems engineering artifacts. Also, please check the deliverables schedule in the BAA at section 4.2.

Industry Day

25 N/A Does S&T have shared labs with Mobile Network Operators for 5G security testing? If, not, is this in the plan?

Currently, no. Industry Day

26 N/A Does DHS work with the United Kingdom’s National Cyber Security Centre?

Yes. Any of our international partners are on the slides and on the DHS/S&T website. Industry Day

27 N/A How does DHS envision working more closely with network operators on “minimum security requirements?” This question is outside the scope of the BAA Call Industry Day

28 5.5.3 Is this BAA considered a pilot project? No, but the inclusion of a pilot required for your proposal; please refer to section

5.5.3 of the BAA Call. Industry Day

29 N/A How do you anticipate integrating this BAA with existing solutions in place at Mobile Network Operators?

This is part of what offerors should provide as part of their proposal based on standards, understanding OEMs, and the ecosystem. Industry Day

30 N/A How quickly would successful results in the BAA lead to commercial opportunities?

This depends on the proposed solution and the offeror's commercialization and transition plan. Industry Day

31 N/A Can you give any analogous examples? No. Industry Day 32 N/A What do you expect the process to be? It depends on your proposal. Industry Day

33 N/A What is the relationship between DHS/CISA efforts on ICT supply chain risk and similar interest from DARPA or NIST?

DHS/CISA has a relationship, there is an interagency group in Information and Communications Technology (ICT). Industry Day

Document &

Section Citation

Offeror Question/Comment Government Response Received (Email or Industry Day)

34 N/A Is DHS looking into adoption of open source, virtualization, and SDN as a part of the network evolution?

Yes, however you must consider and address how it fits in the overall ecosystem and how you are going to get your open source solution into operations. For example, simply posting the solution on GitHub would be inadequate.

Industry Day

35 N/A Do you have openness to private LTE network solutions for public safety use cases in addition to, or as an alternative to, network slicing?

DHS is not commenting on whether a possible approach is in scope.

In developing your proposals, consider where the standards are now and where they are going in the future.

Offerors should consider interoperability, scalability, and commercialization.

DHS has no interest in projects that cannot seamlessly fit into the ecosystem, i.e., the expectaiton is that a developed solution will be operationalized.

Industry Day

36 N/A “Six month pilot as fully priced” – what is it? Can you elaborate?

The exact nature of the pilot is dependent on the proposal. No matter the proposed solution, the pilot must be fully priced in the proposal. Industry Day

37 N/A Any interest in Quantum Key Distribution (QKD) to enhance mobile security? DHS is not commenting on whether a possible approach is in scope. Industry Day

38 N/A What are your thoughts on verification of endpoints that are IoT devices, software bots, or people? DHS is not commenting on whether a possible approach is in scope. Industry Day

39 N/A This is related to credentials (ICAM): what are your thoughts on mobile digital credentials for people and things?

DHS is not commenting on whether a possible approach is in scope. Industry Day

40 N/A Is persistent data encryption starting at point-of-capture in the 5G IoT device within scope, as this obviates the needs for “bearer” encryption?

DHS is not commenting on whether a possible approach is in scope. Industry Day

41 N/A Is DHS considering a consortium model for acquiring these capabilities?

Yes, it is a consideration. Whether it will be an existing one or a new one is to be determined. Industry Day

42 N/A Is there a separate BAA on the EC3 work? No, at the moment, this may change, there is a Long Range BAA topic, but there are no funds at the moment. Industry Day

43 N/A What are the types of applications that will be supported on the mobility network? What are the top five applications?

DHS fully expects the current applications for the current networks to be supported by a proposed soltuion, as well as the new capabilities provided by 5G such as machine-to-machine and massive IoT. The proposed solution is entirely up to the offeror, since DHS does not want to hamper innovation or provide specific technical direction regarding proposals.

Industry Day

Document &

Section Citation

Offeror Question/Comment Government Response Received (Email or Industry Day)

44 N/A Are the anticipated award ceilings per award, or total across multiple awardees? The anticipated award ceilings are per award. Industry Day

45 N/A TTA 1 and 2 share a common anticipated award ceiling of $2.75M. Is this a combined amount, or for each TTA? (See response to question 14.) Industry Day

46 N/A What is the relationship with the International Telecommunication Union's (ITU) Study Group 17 (SG17) - convergence or divergence?

This is outside the scope of the BAA call. Industry Day

47 N/A Natural or malicious line of sight denial, e.g., swarms of drones or weather?

This is dependent on what is proposed and DHS will not render an opinion on proposed solutions. Industry Day

48 N/A Should the offeror define a new protocol for "national prioritized" communications, e.g., make carriers designate and reserve slices?

This is dependent on what is proposed and DHS will not render an opinion on proposed solutions. Industry Day

49 N/A When will the slides be posted? They are provided with the questions and answers. Industry Day

50 N/A Is there prioritization for implementing new secure solutions for 5G networks versus 2G, 3G, and 4G?

This is dependent on what is proposed and DHS will not render an opinion on proposed solutions. Industry Day

51 N/A

Is there interest in implementing and demonstrating in a software-defined radio testbed of passive surveillance and wireless device identification and classification technologies?

This is dependent on what is proposed and DHS will not render an opinion on proposed solutions. Industry Day

52 N/A Is DHS looking for solutions for legacy systems or are forward-thinking, custom-built scalable solutions also encouraged?

This is dependent on what is proposed and DHS will not render an opinion on proposed solutions. Industry Day

53 N/A Would it be possible to submit a proposal where the award topic would not be made public and kept FOUO?

DHS contract awards are matters of public record unless exempted in whole or in part, e.g., security classification, or Freedom of Information Act exemption. Industry Day

54 5.8 Could an award/project be exempted from having to give a briefing in the semi-public forums referenced in section 5.8?

DHS does not anticipate deviating from the requirements found in section 5.8 of the BAA Call. Industry Day

55 N/A Can an international entity be a sub to a U.S. entity to bid this BAA? Yes. Industry Day

56 N/A What are the metrics for the TTAs? Each TTA has stated goals. Proposed solutions should address achievement of goals.See 70RSAT19RB00000001 5.5.1. Industry Day

57 N/A

For software supply chain visibility, how is DHS collaborating/coordinating with other agencies like the Department of Commerce and the Department of Defense, e.g., Department of Commerce's National Telecommunications and Information Administration (NTIA) software bill of materials muti-stakeholder process being led by Dr. Allan Friedman?

This is outside the scope of the BAA call. Industry Day

58 N/A If a company has Small Business Innovative Research program contracts with DHS/S&T can these be used for

BAA?

No, this BAA Call is only interested in awarding new projects, not changes to the scope of ongoing DHS SBIR contracts. Industry Day

Document &

Section Citation

Offeror Question/Comment Government Response Received (Email or Industry Day)

59 N/A Our proposals will include new intellectual property (IP) that we want to protect. How do we ensure our IP will be protected when we submit a proposal?

Per section 9.5.3 of the Open BAA HSHQDC-17-R-B0002, offerors are required to appropriately mark any proprietary information contained in their proposal. Industry Day

60 N/A Is the primary focus Public Safety use cases? This is dependent on what is proposed and DHS will not render an opinion on proposed solutions. Industry Day

61 N/A Can an offeror respond to multiple TTAs? Would this require separate proposals? Would the cost volumes be together or separate for each TTA?

Offerors may submit multiple proposals against different TTAs. A cost volume specific to each proposal is required. Industry Day

62 N/A

Fig 1. The threats to Mobile Infrastructure Levels of security addressed at the (a) Hardware, (b) Operating System (OS), (C) Firmware (d) Applications level security what extent need to be covered in this project?

Example:

(a) Hardware level security boot PROM level and embedded Security implementation and Trusted Computing Methods need to be covered?

(b) Operating System Level security is it Kernel layers of security need to be covered for this project scope?

(c) Firmware level security coverage details expected for this Project need to be clarified?

(d) Application Level Security Coverage details expected for this project need to be clarified?

The scope of the project has to be very specific to 3G, 4G, 5G, WiFi, Bluetooth, NFC Tags related Wireless Environment ? or Legacy 2G, 3G Networks, 4G and 5 G Networks this clarity need to be provided.

The stated items in Figure 1 are the targets for research under this BAA Call. The goals for each TTA are explicit and it is left to offerors how to propose solutions to meet them.

Email

63 N/A

2. Security concerning the Protocol Layers used in 2G, 3G (PSTN) carriers and 4G & 5G Layers mapping what extent implementation is required?

Example: (a) SAI Technology Inc can demonstrate 3G, 4G, and 5G Security interoperability and Challenges, will that be sufficient? We need clarification what extent the Protocol layer security implementation is expected for this project?

The goals for each TTA are explicit and it is left to offerors how to propose solutions to meet them and is the rationale for soliciting with a BAA. Email

64 N/A The intent of the project to cover Cyber vulnerabilities in Internetworking Function (IWF) what extent depth is required?

The goals for each TTA are explicit and it is left to offerors how to propose solutions to meet them and is the rationale for soliciting with a BAA. Email

65 N/A SS7 Networks security gaps demonstration is it required for this project?

The goals for each TTA are explicit and it is left to offerors how to propose solutions to meet them and is the rationale for soliciting with a BAA. Email

Document &

Section Citation

Offeror Question/Comment Government Response Received (Email or Industry Day)

66 N/A

SS7 Interoperability with 3GPP Release 8 versus Release 14 lot of security enhancements have to considered? What is the level of security attack coverage depth required for this project?

Example: SS7 Ad Hoc security layer addition with diameter further enhances the security aspects SIP calls and text messages. This is somewhat becomes extended security layers for the existing legacy network? Could you please clarify what level depth is expected for the Phase I, Phase II and Phase III for this project implementations?

The goals for each TTA are explicit and it is left to offerors how to propose solutions to meet them and is the rationale for soliciting with a BAA. Email

67 N/A

Let us assume a company can implement LTE Architecture Government Security policy on top of the cellular networks with add on security layer that can be implemented in USA? Is this approach is acceptable?

The goals for each TTA are explicit and it is left to offerors how to propose solutions to meet them and is the rationale for soliciting with a BAA. Email

68 N/A

Security implementation as per 3GPP Ultra Reliable Low Latency Communications (URLLC), Enhanced Mobile Board Band (eMBB) and Massive Machine Type Communications level of depth expectation for the Phase I and Phase II delivery?

Example: (a) As per the 3GPP Ultra Reliable Low Latency Communications (URLLC) by adding additional security layer communication increases the latency of the network? What extent this trade –off allowed in this project?

The goals for each TTA are explicit and it is left to offerors how to propose solutions to meet them and is the rationale for soliciting with a BAA. Email

69 N/A Would be open to implement Cloud Radio Access Network (CRAN) and Software Defined Network (SDN) for this security demonstration purpose?

The goals for each TTA are explicit and it is left to offerors how to propose solutions to meet them and is the rationale for soliciting with a BAA. Email

70 3.1

TTA #1 Focus on 2G, 3G, and 4G Network Protections.

Cloud clarify if SAI Technology and Cyber Forza provides the complete end to end to Mobile Platform with Cyber Security integration will that be acceptable for the TTA#1?

DHS is not commenting on whether a possible approach is in scope. Please refer to section 3.1 of the BAA Call. Email

71 3.2

TTA #2 if we consider the 3GPP 15 or 3GPP 16 based 5G basic security implementation and proposal for the innovative security to protect Government will be acceptable?

DHS is not commenting on whether a possible approach is in scope. Please refer to section 3.2 of the BAA Call. Email

72 3.1 TTA# 1 Vendor agnostic techniques will be developed and demonstrated for the SS7/Diameter will that be acceptable?

DHS is not commenting on whether a possible approach is in scope. Please refer to section 3.1 of the BAA Call. Email

Document &

Section Citation

Offeror Question/Comment Government Response Received (Email or Industry Day)

73 3.1.1

Goal #1 Data filtering and anomaly detection to improve SS& security to monitor, detect, and respond to any anomalous or potential malicious use of SS7 Networks.

If we provide 5 different use case scenario’s will that be enough to demonstrate for the Phase I? Could you please clarify if this requires extensive study versus critical study of security aspects? Mandatory security concerns versus optional security concerns for this goal need to be clarified?

The goals for each TTA are explicit and it is left to offerors how to propose solutions to meet them and is the rationale for soliciting with a BAA. Email

74 3.1.1

Goal #2 Threat Assessment and Mitigations IWF between MNOs methods will be provided and some extent simulations provided to demonstrate will that be acceptable for the Phase I?

The goals for each TTA are explicit and it is left to offerors how to propose solutions to meet them and is the rationale for soliciting with a BAA. Email

75 3.1.1

Goal #3 Vendor agnostic methods will be proposed for the Core network implementation for the LTE Core Network and validate them in the test bed environment will be required for the Phase I?

The goals for each TTA are explicit and it is left to offerors how to propose solutions to meet them and is the rationale for soliciting with a BAA. Email

76 3.2 TTA #2 Fifth Generation (5G) Network Security new innovative methods of security protection provided any participant will it be accepted due to evolving standards?

The goals for each TTA are explicit and it is left to offerors how to propose solutions to meet them and is the rationale for soliciting with a BAA. Email

77 3.2.2

Goal 2 Security Architecture for Government using the network slicing Confidentiality Integrity, and Encryption methods effectiveness will be sufficient? Could clarify the expectation for the 5G network Phase I demonstration?

The goals for each TTA are explicit and it is left to offerors how to propose solutions to meet them and is the rationale for soliciting with a BAA. Email

78 4.2, 5.5.1

The item “Go/No-Go Demonstration Evaluation Plan” appears twice, once in row 7 with a due date of 5 months after award, and a second time in row 10 with a due date of 10 months after award. Do these reference the same or different evaluations? If these are different evaluations, to what does the second entry refer?

These are different evaluations. Please review section 5.5.1. Email

79 N/A We would like to schedule a meeting at your facility for a presentation and demo of our solution. Can you please indicate a day and time that works for you?

DHS will not take meetings with individual contractors related to this BAA Call. Email

80 N/A Are Security Clearances required for onsite implementation and support personnel? If so, what level of clearance?

This is solution dependent, but also pilot dependent, which will be addressed after selection, as appropriate. Email

Document &

Section Citation

Offeror Question/Comment Government Response Received (Email or Industry Day)

81 N/A Our company's solution is a remote service, does this align with the customer expectations for the deployment phase of the project? If not, what is the expectation?

The goals for each TTA are explicit and it is left to offerors how to propose solutions to meet them and is the rationale for soliciting with a BAA. Email

82 N/A How many end users are anticipated for the pilot? The scale of pilots to be proposed is at the discretion of the offeror, to include the number of end-users that would be supported. Email

83 N/A How many total end users are expected? The scale of pilots to be proposed is at the discretion of the offeror. The count of end users operationally is not determined. Email