70RTAC22R00000027 J.4 - Pricing Template.xlsx
XLSX spreadsheet 39 KB Posted
- Attached to
- Solicitation for Hack DHS: Crowdsourced Vulnerability Assessment Services (CVAS) Federal contract opportunity
- Solicitation number
- 70RTAC22R00000027
About this file
This is a request for proposal for crowdsourced vulnerability assessment services for the Department of Homeland Security. The solicitation seeks proposals for bug bounty and vulnerability disclosure services on six DHS systems over a four month period, with two systems in scope for the first month, two systems in the second month, and the final two systems in the third month. Services include conducting remote security testing of web applications, infrastructure, desktop, collaboration platforms and mobile applications; reporting any discovered vulnerabilities; and providing credentials as needed to test certain systems. Pricing is to be provided using firm-fixed-price contract line item numbers for bounty payouts and administrative services on a percentage basis compared to total funding for bounties. Proposals are due by August 17th, 2022 and the period of performance for the contract is one base year with four one-year options.
View the file
Other files for this federal contract opportunity
| File | Type | Posted |
|---|---|---|
| Amend 0001_RFP 70RTAC22R00000027_SF30.pdf | ||
| Amend 0001_Response to Vendor Questions on RFP.pdf | ||
| Amend 0001_RFP 70RTAC22R00000027.pdf | ||
| 70RTAC22R00000027 RFP.pdf | ||
| 70RTAC22R00000027 J.1 - SF1449.pdf | ||
| 70RTAC22R00000027 J.2 - PWS.pdf | ||
| 70RTAC22R00000027 J.3 - Past Performance Questionnaire.pdf |
On GovTribe
Work with this file on GovTribe
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
IDIQ Pricing
| Request for Proposal for 70RTAC22R00000027 | |||
| Attachment J.4: Pricing Template | |||
| Tab 1 of 3: IDIQ Pricing | |||
| Offeror Name: | |||
| Instructions: | Please fill in the yellow-highlighted cells. Offerors do not need to provide pricing for CLINs 0001, 1001, 2001, 3001, and 4001. The Government has already established a not-to-exceed amount of these CLINs. The amount of these CLINs is the ceiling amount of all bounty payouts under all task orders that will be awarded for each ordering period. At the task order level, the Government will provide the total bounty payout amount for the task order. For all sub-CLINs under CLINs 0002, 0003, 1002, 1003, 2002, 2003, 3002, 3003, 4002, and 4003, Offerors are instructed to enter a maximum percentage (%) of the Administrative Services compared to the total bounty payout amount establihsed in CLINs 0001, 1001, 2001, 3001, and 4001. For example, if the Offeror inserted "30%" for CLIN 0002AA, and the Government identifies $1M for the bounty payout for the order, then the Offeror's proposed price for the Aministrative Services would be $300,000. The total amount of the order would equate to $1,300,000 for the purposes of this example. The rates established for these CLINs will apply to task orders. However, Offerors are encouraged to offer additional discounts at the task order level. | ||
| Base Period | |||
| CLIN Number | Description | Quantity | Price/Percentage |
| 0001 | Bounty Payouts (Fixed-Unit-Price or Firm-Fixed-Price) | 1 Lot | $5,691,140.00 |
| 0002 | Administrative Services – Public Asset (Firm-Fixed-Price) | ||
| 0002AA | Fixed-Duration Bounty Challenge | 1 Lot | |
| 0002AB | Continuous Bounty Challenge | 1 Lot | |
| 0002AC | Live Events | 1 Lot | |
| 0003 | Administrative Services – Private Asset (Firm-Fixed-Price) | ||
| 0003AA | Fixed-Duration Bounty Challenge | 1 Lot | |
| 0003AB | Continuous Bounty Challenge | 1 Lot | |
| 0003AC | Live Events | 1 Lot | |
| Option Period 1 | |||
| CLIN Number | Description | Quantity | Price/Percentage |
| 1001 | Bounty Payouts (Fixed-Unit-Price or Firm-Fixed-Price) | 1 Lot | $5,861,874.20 |
| 1002 | Administrative Services – Public Asset (Firm-Fixed-Price) | ||
| 1002AA | Fixed-Duration Bounty Challenge | 1 Lot | |
| 1002AB | Continuous Bounty Challenge | 1 Lot | |
| 1002AC | Live Events | 1 Lot | |
| 1003 | Administrative Services – Private Asset (Firm-Fixed-Price) | ||
| 1003AA | Fixed-Duration Bounty Challenge | 1 Lot | |
| 1003AB | Continuous Bounty Challenge | 1 Lot | |
| 1003AC | Live Events | 1 Lot | |
| Option Period 2 | |||
| CLIN Number | Description | Quantity | Price/Percentage |
| 2001 | Bounty Payouts (Fixed-Unit-Price or Firm-Fixed-Price) | 1 Lot | $ 6,037,730.43 |
| 2002 | Administrative Services – Public Asset (Firm-Fixed-Price) | ||
| 2002AA | Fixed-Duration Bounty Challenge | 1 Lot | |
| 2002AB | Continuous Bounty Challenge | 1 Lot | |
| 2002AC | Live Events | 1 Lot | |
| 2003 | Administrative Services – Private Asset (Firm-Fixed-Price) | ||
| 2003AA | Fixed-Duration Bounty Challenge | 1 Lot | |
| 2003AB | Continuous Bounty Challenge | 1 Lot | |
| 2003AC | Live Events | 1 Lot | |
| Option Period 3 | |||
| CLIN Number | Description | Quantity | Price/Percentage |
| 3001 | Bounty Payouts (Fixed-Unit-Price or Firm-Fixed-Price) | 1 Lot | $ 6,218,862.34 |
| 3002 | Administrative Services – Public Asset (Firm-Fixed-Price) | ||
| 3002AA | Fixed-Duration Bounty Challenge | 1 Lot | |
| 3002AB | Continuous Bounty Challenge | 1 Lot | |
| 3002AC | Live Events | 1 Lot | |
| 3003 | Administrative Services – Private Asset (Firm-Fixed-Price) | ||
| 3003AA | Fixed-Duration Bounty Challenge | 1 Lot | |
| 3003AB | Continuous Bounty Challenge | 1 Lot | |
| 3003AC | Live Events | 1 Lot | |
| Option Period 4 | |||
| CLIN Number | Description | Quantity | Price/Percentage |
| 4001 | Bounty Payouts (Fixed-Unit-Price or Firm-Fixed-Price) | 1 Lot | $ 6,405,428.21 |
| 4002 | Administrative Services – Public Asset (Firm-Fixed-Price) | ||
| 4002AA | Fixed-Duration Bounty Challenge | 1 Lot | |
| 4002AB | Continuous Bounty Challenge | 1 Lot | |
| 4002AC | Live Events | 1 Lot | |
| 4003 | Administrative Services – Private Asset (Firm-Fixed-Price) | ||
| 4003AA | Fixed-Duration Bounty Challenge | 1 Lot | |
| 4003AB | Continuous Bounty Challenge | 1 Lot | |
| 4003AC | Live Events | 1 Lot |
&G
Sample Order Pricing
| Request for Proposal for 70RTAC22R00000027 |
| Attachment J.4: Pricing Template |
| Tab 2 of 3: Sample Order Pricing |
| Offeror Name: |
| Instructions: The sample order pricing tab will be based on the Scenario provided in the Scenario tab. The sample order total price will be used for price evaluation purposes. The price for CLIN 0001 is provided for evaluation purposes. Offerors do not need to provide additional price for CLIN 0001. Column D, Row 15 (Price for CLIN 0002) will be automatically populated based on the percentage in Column D, Row 16. Column D, Row 16 (IDIQ Percentage (%) of Administrative Services Compared to the Total Funding for Bounty Payout) will be automatically generated once the Offeror completes the IDIQ Pricing Tab, IDIQ CLIN 0003AA. Column D, Row 17 (Sample Order Total) will be automatically updated once the Offeror inserts pricing for CLIN 0002 in the Sample Order Pricing tab. |
| Task Order CLIN | Description | Quantity | Price/Rate |
| 0001 | Bounty Payouts (Fixed Unit Price) (IDIQ CLIN 0001) | TBD | $ 125,000.00 |
| Critical Severity Bug: $5000 | |||
| High Severity Bug: $3500 | |||
| Medium Severity Bug: $2000 | |||
| Low Severity Bug: $750 | |||
| Informational Bug: No payout | |||
| 0002 | Administrative Services for Private Assets (All other price elements (e.g. Platform cost, overhead costs, background checks, etc.)) (Firm-Fixed-Price) (IDIQ CLIN 0003AA) | 1 Lot | $ - 0 |
| IDIQ Percentage (%) of Administrative Services Compared to the Total Funding for Bounty Payouts | 0% | ||
| Sample Order Total: | $ 125,000.00 |
&G
Scenario
| Request for Proposal for 70RTAC22R00000027 |
| Attachment J.4: Pricing Template |
| Tab 3 of 3: Scenario |
| Period of Performance (PoP): 4 months (including pre- and post- event coordination and a three (3)-month bug bounty event) |
Scenario: The Department of Homeland Security (DHS) wishes to conduct a private, invite only remote bug bounty event which includes six (6) DHS systems. The systems will only be in scope for one (1) month each during the PoP. There will be two (2) systems in scope the first month which are replaced by two (2) different systems in the second month, and then those are replaced by the final two (2) systems in the final month of the PoP.
System 1 is an on-premises environment consisting of a web server with an application which takes user input from various forms and stores/retrieves them from a database for further processing and presentation to users or individuals processing records. Researchers will be provided credentials to the application.
System 2 is a Infrastructure as a Service (IaaS) system consisting of three (3) web portals, an email server, and a virtual appliance that performs email scanning.
System 3 is a cloud-based environment which supplies desktops as a service to end users after authentication through Department single sign-on. Researchers will be provided credentials.
System 4 is a collaboration platform that allows for text chat, presentation, file sharing, and video/voice chat. The system is heavily reliant on Commercial off the Shelf (COTS), but configuration and maintenance as well as identify/access control is performed by the Department with a mix of single-sign on accounts for the Department and single-factor login/password accounts for partners. No credentials will be provided, however if a researcher discovers credentials that allow access for testing by that researcher may be allowed with DHS permission.
System 5 is a set of iOS and Android mobile applications which upload photos tagged with geolocation from multiple devices across the United States to a data center for machine learning based image classification and categorization.
System 6 is a Department coded cloud application which parses documents for Personally Identifiable Information (PII), Personal Health Information (PHI), and financial information before placing them into a publicly searchable archive. No credentials will be given.
&G image1.png
File details come from the government source that posted it. Updated .