72001G25R00001_002 FE.pdf

(x)

72001G25R00001 x x

1 copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted ; or (c) By separate letter or electronic communication which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGEMENT TO BE

RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN REJECTION OF YOUR

OFFER. If by virtue of this amendment you desire to change an offer already submitted , such change may be made by letter or electronic communication, provided each letter or electronic communication makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

x

N/A

Not Applicable

72001G

20523-1000

USAID OIG

11/13/20240002

13. THIS ITEM ONLY APPLIES TO MODIFICATION OF CONTRACTS/ORDERS. IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

12. ACCOUNTING AND APPROPRIATION DATA (If required) is not extended.is extended, Items 8 and 15, and returning

Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended , by one of the following methods: (a) By completing

The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offers

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

FACILITY CODE CODE

10B. DATED (SEE ITEM 13)

10A. MODIFICATION OF CONTRACT/ORDER NO.

9B. DATED (SEE ITEM 11)

9A. AMENDMENT OF SOLICITATION NO.

CODE

8. NAME AND ADDRESS OF CONTRACTOR (No., street, county, State and ZIP Code)

7. ADMINISTERED BY (If other than Item 6)CODE 6. ISSUED BY

PAGE OF PAGES

4. REQUISITION/PURCHASE REQ. NO.3. EFFECTIVE DATE2. AMENDMENT/MODIFICATION NO. 5. PROJECT NO. (If applicable)

1. CONTRACT ID CODE

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

11/13/2024

CHECK ONE A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE CONTRACT

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority) appropriation data, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(b).

E. IMPORTANT: Contractor is not is required to sign this document and return __________________ copies to the issuing office.

ORDER NO. IN ITEM 10A.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

The purpose of this amendment is to:

1. Attach the responses to the questions submitted during the Q&A period.

2. Extend the proposal due date to 16:00 on December 27, 2024.

3. Attach an updated Instructions to Offerors reference document.

4. Remove Attachment II - NDA & COI Sample. The remaining attachments will NOT be re-numbered.

5. Amend description of Item 0005 in the solicitation schedule to "Option Year Four -

Supplier must provide technical support services in accordance with the SOW."

No other changes have been made to the solicitation or its attachments, except as mentioned

Continued ...

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)15A. NAME AND TITLE OF SIGNER (Type or print)

15C. DATE SIGNED 16B. UNITED STATES OF AMERICA 15B. CONTRACTOR/OFFEROR 16C. DATE SIGNED

(Signature of person authorized to sign) (Signature of Contracting Officer)

Kiaira Stallworth

STANDARD FORM 30 (REV. 11/2016)

Prescribed by GSA FAR (48 CFR) 53.243

Previous edition unusable

Except as provided herein, all terms and conditions of the document referenced in Item 9 A or 10A, as heretofore changed, remains unchanged and in full force and effect .

ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

NAME OF OFFEROR OR CONTRACTOR

2 2

CONTINUATION SHEET

REFERENCE NO. OF DOCUMENT BEING CONTINUED PAGE OF

(A) (B) (C) (D) (E) (F)

72001G25R00001/0002 in this and previous amendments.

NSN 7540-01-152-8067 OPTIONAL FORM 336 (4-86)

Sponsored by GSA

FAR (48 CFR) 53.110

SOLICITATION #: 72001G25R00001

TECHNICAL SUPPORT SERVICES

PART I – THE SCHEDULE

SECTION A – SOLICITATION/CONTRACT FORM

A.1 TITLE

Technical Support Services

A.2 CONTRACT TYPE

This is anticipated to be a blanket purchase agreement (BPA).

(END OF SECTION A)

SECTION B – SUPPLIES & SERVICES PRICES/COSTS

The offeror must propose a discount table showing the discount percentages on their GSA MAS contract for each year of the period of performance of the BPA contract (one base year and four options years).

(END OF SECTION B)

SECTION C – DESCRIPTION/STATEMENT OF WORK SUMMARY

SEE “ATTACHMENT I – STATEMENT OF WORK” FOR THE ENTIRETY OF THE REQUIREMENTS

C.1 PURPOSE

U.S. Agency for International Development (USAID) Office of Inspector General (OIG) requires technical services in support of our independent evaluations and audit. Such technical services may include external network penetration tests; internal network vulnerability assessments; Wi-Fi, cell phone, and oracle database tests; and related training of OIG staff.

The maximum value for all orders issued against the single-award Blanket Purchase Agreement (BPA) will not exceed $5 million without bilateral agreement from both parties. There is no minimum or maximum number of orders that may be issued against the BPA.

C.2 SCOPE OF WORK

The purpose of this BPA is to provide an ordering vehicle for USAID OIG to receive nonpersonal technical services in support of information technology evaluations and audits. The contractor operating as independent and not as an agent of the Government, will provide for all labor, tools, materials, facilities, equipment, supervision, and other items necessary, unless specifically stated elsewhere in this document or in the specific order. The Contractor may be required to perform work under multiple orders.

Examples of Types of Work

Some examples of potential types of work to be completed under this BPA call order are as follows:

• Network Penetration Testing o Black box penetration testing o Grey box penetration testing o White box penetration testing

• Other Penetration Testing o Wireless penetration testing o Internet of Things penetration testing o Physical penetration testing

• Technical Vulnerability Assessments o Internal network vulnerability assessment o Oracle database vulnerability assessment

• Employee/Contractor Tests o Social Engineering o Phishing o Faux Malicious Links o Adherence to physical security policies

▪ Use of screen and computer locks

▪ Display of PIV badges

▪ Removal of print output from printers

▪ Tailgating

• Combined Testing (i.e., Red Teaming)

• Conduct training on technical testing

• Stand up a sandbox environment for OIG to practice the technical tools and techniques

• Follow-up work to assess whether the agency implemented technical recommendations

• Conduct technical tests to assess agency staffs’ knowledge of security requirements.

Deliverables

For each BPA call order, deliverables may include the following.

• Detailed work plan for each phase of testing

• Quality assurance plan for each phase of testing

• Rules of engagement for testing to be signed by the contractor, OIG, and agency

• Detailed narrative and supporting documentation of actual testing performed

• Detailed technical report on results of testing and analysis for agency technical staff

• Discussion Paper that discusses the findings from testing so that non-technical readers at the fifth-grade level can understand, as described in individual orders

• Draft Evaluation or Audit Report – Contents of the discussion paper plus a detailed scope and methodology section of the work performed, as described in individual orders

• Final Evaluation or Audit Report – Contents of the draft report plus Agency management’s verbatim comments and the contractor’s- evaluation of the comments, as described in individual orders

• Technical training materials

• Resumes of staff assigned to the BPA call order

• Onboarding documents, such as nondisclosure agreements, statements of independence from the agency, U.S. Office of Personnel Management optional forms 306, Visit Authorization Letters, and Visitors Access Request.

Meetings

For each BPA call order, meetings may include the following.

• Post award meeting

• Session for OIG to train contractor staff on requirements for the engagement (i.e., evaluation or audit)

• Entrance conference for the engagement with agency and OIG officials

• Planning meetings with agency and OIG staff

• Biweekly status meetings with OIG staff

• Biweekly status meetings with agency and OIG staff

• Working meetings with OIG to write the draft and final reports and to address OIG reviewer and agency management comments

• Exit conference for the engagement with agency and OIG officials

• Training sessions

C.3 PERIOD OF PERFORMANCE

The period of performance for this award shall be:

Base Period: January 20, 2025 through January 19, 2026 Option Period One (1): January 20, 2026 through January 19, 2027 Option Period Two (2): January 20, 2027 through January 19, 2028 Option Period Three (3): January 20, 2028 through January 19, 2029 Option Period Four (4): January 20, 2029 through January 19, 2030

C.4 PLACE OF PERFORMANCE

Work outside the continental United States (OCONUS) is not anticipated but this specific requirement will be specified at the call order level. Most calls under this blanket purchase agreement shall be completed in the Washington, DC metropolitan area. Travel expenses to USAID OIG’s offices or other locations in the Washington, DC, metropolitan area for meetings or any activities will not be paid or reimbursed to the contractor or any consultants or subcontractors. The contractor, subcontractor(s), and/or consultant(s) are responsible for all their own local travel.

Travel to other locations in the continental United States will be billed in accordance with FAR 31.205-46. All travel must be pre-approved in writing by the appropriate COR. The not to exceed amount is to be determined at the call order level.

(END OF SECTION C)

SECTION D – PACKAGING AND MARKING

[RESERVED]

(END OF SECTION D)

SECTION E – INSPECTION AND ACCEPTANCE

(END OF SECTION E)

SECTION F – PERFORMANCE (DELIVERABLES)

See section 1.4.2 in the Statement of Work.

(END OF SECTION F)

SECTION G – CONTRACT ADMINISTRATIVE DATA

G.1 CONTRACTING OFFICER AUTHORITY

The Contracting Officer is the only person authorized to make or approve any changes in the requirements of this award and notwithstanding any provisions contained elsewhere in this award, the said authority remains solely with the Contracting Officer. In the event the Contractor makes any changes at the direction of any person other than the Contracting Officer, the change shall be considered to have been made without authority and no adjustment shall be made in the award terms and conditions, including price.

The Administrative Contracting Officer is:

Kiaira Stallworth Office of Inspector General

IG/M/AOO

1300 Pennsylvania Avenue, NW Washington, DC 20523 Email: kstallworth@usaid.gov Telephone: (202) 230-4306

G.2 CONTRACTING OFFICER REPRESENTATIVE

1. The Contracting Officer’s Representative (COR) designated for this award (to be designated via COR Designation letter) is authorized to act as an official representative of the Contracting Officer.

2. The COR is designated by the Contracting Officer and authorized to act within the limitations specified herein and written restrictions specifically imposed under the terms of this award and by the Contracting Officer. The authority might extend the following: inspection, acceptance, or rejection of work.

3. This designation does not include authority to direct changes in scope, price, terms, or conditions of this award. The authority herein also does not include authority to execute modifications to the award, which requires the signature of the Contracting Officer, or to bind the Government by contract terms of a proposed contract change.

G.3 TECHNICAL DIRECTIONS AND RELATIONSHIP WITH USAID/OIG

a. Technical Directions are defined to include:

1. Provision of information to the Contractor which fill in details, suggest possible lines of inquiry, or otherwise facilitate completion of work;

2. Provision of information to the Contractor which assists in the interpretation of Government requirements, policy and specifications;

3. Review and, where required, provide written approval of technical reports, specifications, workplan, or technical information to be delivered.

a. The COR is authorized by designation to take any or all action with respect to the following:

4. Assure that the Contractor performs the technical requirements of the contract in accordance with the contract terms, conditions, and specifications.

5. Perform or cause to be performed, inspections necessary in connection with above and require the Contractor to correct all deficiencies; perform acceptance for the Government.

6. Maintain all liaison and direct communications with the Contractor. Written communications with the Contractor and documents must be signed as "Contracting Officer Representative" with a copy furnished to the Contracting Officer.

7. Issue interpretations of Government requirements, policy, guidance and specifications.

8. Monitor the Contractor's production or performance progress and notify the Contractor in writing of deficiencies noted, and direct appropriate action to effect correction. Record and report to the Contracting Officer incidents of faulty or nonconforming work, delays or problems.

9. Facilitate with the USAID Security clearance process and appropriate identification if access to Government facilities is required. If to be provided, ensure that Government furnished property is available when required.

10. Complete Contractor Performance Assessment Reports (CPARs) once a year.

LIMITATIONS: The COR is not empowered to award, agree to, or sign any contract (including delivery or task orders) or modifications thereto, or in any way to obligate the payment of money by the Government. The COR may not take any action which may impact on the contract schedule, funds, scope or rate of utilization of contract personnel resources. All contractual agreements, commitments, or modifications which involve prices, quantities, quality, schedules, must be made only by the Contracting Officer.

11. The COR is required to meet at least quarterly with the Contractor and the Contracting Officer concerning performance of items delivered under the contract and any other administration or technical issues. Verbal reports may be made if no problems are being experienced.

Problem areas should be brought to the immediate attention of the Contractor and Contracting Officer.

12. In the absence of the designated primary COR, the alternate COR identified in the official COR delegation letter may serve as COR in their place. However, such an action shall immediately be communicated to the Contractor and the Contracting Officer.

13. Contractual Problems of any nature that may arise during the life of the contract must be handled in accordance with specific public laws and regulations (i.e. Federal Acquisition

Regulation and Agency for International Development Acquisition Regulation). The Contractor and the COR must bring all contracting problems to the immediate attention of the Contracting Officer. Only the Contracting Officer is authorized to formally resolve such problems. The Contracting Officer will be responsible for resolving legal issues, determining contract scope and interpreting contract terms and conditions. The Contracting Officer is the sole authority authorized to approve changes in any of the requirements under this contract.

Notwithstanding any clause contained elsewhere in this contract, the said authority remains solely with the Contracting Officer. These changes include but will not be limited to the following areas: scope of work, price, quantity, technical specifications, delivery schedules, and contract terms and conditions. In the event the Contractor effects any changes at the direction of any other person other than the Contracting Officer, the change will be considered to have been made without authority.

14. Failure by the Contractor to report to the Contracting Officer, any action by the Government considered a change, within the specified number of days contained in FAR 52.243-7 (Notification of Changes), waives the Contractor's right to any claims for equitable adjustments.

G.4 PAYMENT AND INVOICES

Payment terms are NET30. An original of each invoice in PDF format shall be submitted to the Office of Chief Financial Officer via email at ei@usaid.gov. One (1) copy of each invoice shall also be submitted to the COR.

G.5 ACCOUNTING AND APPROPRIATION DATA

TBD at time of award.

(END OF SECTION G)

SECTION H – SPECIAL CONTRACT REQUIREMENTS

(END OF SECTION H)

PART II – CONTRACT CLAUSES

SECTION I – CONTRACT CLAUSES

I.1 GSA CONTRACT CLAUSES

All contract clauses as applicable in the contractor’s GSA Multiple Award Schedule will apply to the impending contract.

I.2 FAR CONTRACT CLAUSES INCORPORATED BY REFERENCE

FAR 52.252-2 – CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at this/these address (es):

http://acquisition.gov/far/

The following clauses are applicable to this requirement:

NUMBER TITLE DATE

52.203-19 Prohibition on Requiring Certain Internal Confidentiality

Agreements or Statements

JAN 2017

52.204-13 System for Award Management Maintenance OCT 2018 52.204-18 Commercial and Government Entity Code Maintenance AUG 2020 52.204-23 Prohibition on Contracting for Hardware, Software, and Services

Developed or Provided by Kaspersky Lab and Other Covered Entities

NOV 2021

52.204-25 Prohibition of Contracting for Certain Telecommunications and Video Surveillance Services or Equipment

NOV 2021

52.209-6 Protecting the Government’s Interest When Subcontracting with Contractors Debarred, Suspended, or Proposed for Debarment

NOV 2021

52.209-10 Prohibition on Contracting with Inverted Domestic Corporations NOV 2015 52.212-4 Contract Terms and Conditions – Commercial Products and

Commercial Services

NOV 2023

52.212-5 Contract Terms and Conditions Required to Implement Statutes or Executive Orders—Commercial Products and Commercial Services

As per paragraph (b), the Contracting Officer has indicated as being incorporated in this contract by reference to implement provisions of law or Executive orders applicable to acquisitions of commercial products and commercial services:

[X] 52.203-17 Contractor Employee Whistleblower Rights [X] 52.204-27 Prohibition on a ByteDance Covered Application [X] 52.222-3 Convict Labor [X] 52.222-19 Child Labor – Cooperation with Authorities and Remedies [X] 52.222-26 Equal Opportunity [X] 52.222-50 Combating Trafficking in Persons [X] 52.223-18 Encouraging Contractor Policies to Ban Text Messaging While Driving

NOV 2023

52.219-28 Post-Award Small Business Program Rerepresentation MAR 2023 52.233-3 Protest After Award AUG 1996 52.233-4 Applicable Law of Breach of Contract Claim OCT 2004 52.244-6 Subcontracts for Commercial Products and Commercial Services OCT 2022 52.245-1 Government Property SEPT 2021 52.245-1 Government Property--Alternate I SEPT 2021

52.245-9 Use and Charges APR 2012

I.2 FAR CONTRACT CLAUSES IN FULL TEXT

FAR 52.252-2 – CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at this/these address (es):

(end of clause)

FAR 52.217-9 – OPTION TO EXTEND THE TERMS OF THE CONTRACT (MAR 2000)

(a) The Government may extend the term of this contract by written notice to the Contractor provided that the Government gives the Contractor a preliminary written notice of its intent to extend at least 60 days before the contract expires. The preliminary notice does not commit the

Government to an extension.

(b) If the Government exercises this option, the extended contract shall be considered to include this option clause.

(c) The total duration of this contract, including the exercise of any options under this clause, shall not exceed 60 months.

(end of clause)

I.3 AIDAR CONTRACT CLAUSES INCORPORATED BY REFERENCE

NUMBER TITLE DATE

752.211-70 Language and Measurements JUN 1992

752.7006 Notices APR 1984

752.7025 Approvals APR 1984

(END OF SECTION I)

PART III – LIST OF DOCUMENTS, EXHIBITS AND OTHER ATTACHMENTS

SECTION J – LIST OF ATTACHMENTS

Attachment Number Title I Statement of Work

II [REMOVED FROM SOLICITATION]

III Mock Call Pricing Sheet https://www.law.cornell.edu/definitions/index.php?width=840&height=800&iframe=true&def_id=80fb588108eda34822560ae27fdc9a0d&term_occur=1&term_src=Title:48:Chapter:1:Subchapter:H:Part:52:Subpart:52.2:52.217-9

(END OF SECTION J)

PART IV – REPRESENTATIONS AND INSTRUCTIONS

SECTION K – REPRESENTATIONS, CERTIFICATIONS, AND OTHER STATEMENS OF OFFERORS

FAR 52.204-24 – REPRESENTATION REGARDING CERTAIN TELECOMMUNICATIONS AND

VIDEO SURVEILLANCE SERVICES OR EQUIPMENT (NOV 2021)

The Offeror shall not complete the representation at paragraph (d)(1) of this provision if the Offeror has represented that it "does not provide covered telecommunications equipment or services as a part of its offered products or services to the Government in the performance of any contract, subcontract, or other contractual instrument" in paragraph

(c)(1) in the provision at 52.204-26, Covered Telecommunications Equipment or

Services—Representation, or in paragraph (v)(2)(i) of the provision at 52.212-3, Offeror

Representations and Certifications-Commercial Products or Commercial Services. The

Offeror shall not complete the representation in paragraph (d)(2) of this provision if the

Offeror has represented that it "does not use covered telecommunications equipment or services, or any equipment, system, or service that uses covered telecommunications equipment or services" in paragraph (c)(2) of the provision at 52.204-26, or in paragraph

(v)(2)(ii) of the provision at 52.212-3.

(a) Definitions. As used in this provision—

Backhaul, covered telecommunications equipment or services, critical technology, interconnection arrangements, reasonable inquiry, roaming, and substantial or essential component have the meanings provided in the clause

52.204-25, Prohibition on Contracting for Certain Telecommunications and

Video Surveillance Services or Equipment.

(b) Prohibition. (1) Section 889(a)(1)(A) of the John S. McCain National Defense

Authorization Act for Fiscal Year 2019 (Pub. L. 115-232) prohibits the head of an executive agency on or after August 13, 2019, from procuring or obtaining, or extending or renewing a contract to procure or obtain, any equipment, system, or service that uses covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system. Nothing in the prohibition shall be construed to—

(i) Prohibit the head of an executive agency from procuring with an entity to provide a service that connects to the facilities of a third-party, such as backhaul, roaming, or interconnection arrangements; or

(ii) Cover telecommunications equipment that cannot route or redirect user data traffic or cannot permit visibility into any user data or packets that such equipment transmits or otherwise handles.

(2) Section 889(a)(1)(B) of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 (Pub. L. 115-232) prohibits the head of an executive agency on or after August 13, 2020, from entering into a contract or extending or renewing a contract with an entity that uses any equipment, system, or service that uses covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system. This prohibition applies to the use of covered telecommunications equipment or services, regardless of whether that use is in performance of work under a federal contract. Nothing in the prohibition shall be construed to—

(i) Prohibit the head of an executive agency from procuring with an entity to provide a service that connects to the facilities of a third-party, such as backhaul, roaming, or interconnection arrangements; or

(ii) Cover telecommunications equipment that cannot route or redirect user data traffic or cannot permit visibility into any user data or packets that such equipment transmits or otherwise handles.

(c) Procedures. The Offeror shall review the list of excluded parties in the System for

Award Management (SAM) (https://www.sam.gov) for entities excluded from receiving federal awards for "covered telecommunications equipment or services".

(d) Representation. The Offeror represents that—

(1) It □ will, □ will not provide covered telecommunications equipment or services to the Government in the performance of any contract, subcontract or other contractual instrument resulting from this solicitation. The Offeror shall provide the additional disclosure information required at paragraph

(e)(1) of this section if the Offeror responds "will" in paragraph (d)(1) of this section; and

(2) After conducting a reasonable inquiry, for purposes of this representation, the Offeror represents that—

It □ does, □ does not use covered telecommunications equipment or services, or use any equipment, system, or service that uses covered telecommunications equipment or services. The Offeror shall provide the additional disclosure information required at paragraph (e)(2) of this section if the Offeror responds "does" in paragraph (d)(2) of this section.

(e) Disclosures. (1) Disclosure for the representation in paragraph (d)(1) of this provision. If the Offeror has responded "will" in the representation in paragraph

(d)(1) of this provision, the Offeror shall provide the following information as part of the offer:

(i) For covered equipment—

(A) The entity that produced the covered telecommunications equipment (include entity name, unique entity identifier, CAGE code, and whether the entity was the original equipment manufacturer

(OEM) or a distributor, if known);

(B) A description of all covered telecommunications equipment offered (include brand; model number, such as OEM number, manufacturer part number, or wholesaler number; and item description, as applicable); and

(C) Explanation of the proposed use of covered telecommunications equipment and any factors relevant to determining if such use would be permissible under the prohibition in paragraph (b)(1) of this provision.

(ii) For covered services—

(A) If the service is related to item maintenance: A description of all covered telecommunications services offered (include on the item being maintained: Brand; model number, such as OEM number, manufacturer part number, or wholesaler number; and item description, as applicable); or

(B) If not associated with maintenance, the Product Service Code

(PSC) of the service being provided; and explanation of the proposed use of covered telecommunications services and any factors relevant to determining if such use would be permissible under the prohibition in paragraph (b)(1) of this provision.

(2) Disclosure for the representation in paragraph (d)(2) of this provision. If the

Offeror has responded "does" in the representation in paragraph (d)(2) of this provision, the Offeror shall provide the following information as part of the offer:

(i) For covered equipment—

(A) The entity that produced the covered telecommunications equipment (include entity name, unique entity identifier, CAGE code, and whether the entity was the OEM or a distributor, if known);

(B) A description of all covered telecommunications equipment offered (include brand; model number, such as OEM number, manufacturer part number, or wholesaler number; and item description, as applicable); and

(C) Explanation of the proposed use of covered telecommunications equipment and any factors relevant to determining if such use would be permissible under the prohibition in paragraph (b)(2) of this provision.

(ii) For covered services—

(A) If the service is related to item maintenance: A description of all covered telecommunications services offered (include on the item being maintained: Brand; model number, such as OEM number, manufacturer part number, or wholesaler number; and item description, as applicable); or

(B) If not associated with maintenance, the PSC of the service being provided; and explanation of the proposed use of covered telecommunications services and any factors relevant to determining if such use would be permissible under the prohibition in paragraph

(b)(2) of this provision.

(End of provision)

FAR 52.252-1 – SOLICITATION PROVISIONS INCORPORATED BY REFERENCE (FEB 1998)

This solicitation incorporates one or more solicitation provisions by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. The offeror is cautioned that the listed provisions may include blocks that must be completed by the offeror and submitted with its quotation or offer. In lieu of submitting the full text of those provisions, the offeror may identify the provision by paragraph identifier and provide the appropriate information with its quotation or offer. Also, the full text of a solicitation provision may be accessed electronically at this/these address(es):

http://acquisition.gov/far/

(End of provision)

The following provisions, incorporated by reference, are applicable to this requirement and require representations, certifications, or the submission of other information by offerors:

NUMBER TITLE DATE

52.203-11 Certification and Disclosure Regarding Payments to Influence

Certain Federal Transactions

SEP 2007

52.203-18 Prohibition on Contracting with Entities that Require Certain Internal Confidentiality Agreements or Statements— Representation

JAN 2017

52.204-7 System for Award Management OCT 2018 52.204-16 Commercial and Government Entity Code Reporting AUG 2020 52.204-22 Alternative Line Item Proposal JAN 2017 52.204-17 Ownership or Control of Offeror AUG 2020 52.204-20 Predecessor of Offeror AUG 2020 52.204-26 Covered Telecommunications Equipment or Services--

Representation

NOV 2021

52.209-2 Prohibition on Contracting with Inverted Domestic Corporations— Representation

NOV 2015

52.209-7 Information Regarding Responsibility Matters OCT 2018 52.212-3 Offeror Representations and Certifications—Commercial Products and Commercial Services

NOV 2023

52.215-1 Instructions to Offerors-Competitive Acquisition – Alternate I OCT 1997 52.225-25 Prohibition on Contracting with Entities Engaging in Certain

Activities or Transactions Relating to Iran—Representation and Certifications

JUN 2020

(END OF SECTION K)

SECTION L – INSTRUCTIONS, CONDITIONS, AND NOTICES TO OFFERORS

SEE REFERENCE DOCUMENT TITLED “INSTRUCTIONS TO OFFERORS” FOR INSTRUCTIONS.

(END OF SECTION L)

SECTION M – EVALUATION FACTORS FOR AWARD

SEE REFERENCE DOCUMENT TITLED “INSTRUCTIONS TO OFFERORS” FOR THE ENTIRETY OF

THE INSTRUCTIONS.

For this solicitation, under best value source selection, non-price evaluation factors, when combined, are significantly more important than price. However, an offeror will not be selected for award on the basis of superior capability without consideration of the price.

In determining which offer represents the best value to meet the Government’s needs, the Government shall evaluate responses using the evaluation criteria below. If the Contracting Officer determines that competing technical proposals are essentially equal, price factors must become the determining factor in source selection. Conversely, if the contracting officer determines that competing price proposals are essentially equal, technical factors must become the determining factor in source selection.

The factors are listed below in descending order of importance.

• Contractor’s Statement of Independence

This section of the proposal must describe clearly state whether or not the company is independent from USAID, MCC, USADF, and IAF. Specifically, the offeror is required to affirm whether or not the company is independent from USAID, including a statement that the company (1) is free from personal and external impairments to independence from USAID, MCC, USADF, and IAF; (2) is organizationally independent; and (3) intends to maintain its independence in fact, attitude, and appearance throughout the period of performance of the scope of work. In addition, if any impairment(s) exists and/or are foreseen, the proposals must explicitly state the nature of such impairment(s). This is a disqualifying factor.

• Contractor’s Past Performance

This section of the proposal must describe the company’s past work experience in performing work related to the audits described in Section 1.4, Scope of Work, in the Statement of Work.

The description must be no more than three (3) pages in length (with 1-inch margins), single-sided, and single-spaced.

Offerors shall also provide references for contracts with four different organizations (including Federal, State, local Government, and private) that your firm was awarded within the past five years that demonstrates your ability to perform the work identified in the scope of work. Each reference must be separately identified and include the following information: referenced organization’s name, contract number (if any), three current points of contacts who are capable of providing reference information with respect to your firm’s performance, current telephone numbers for each point of contact, current email address for each point of contact, project name, address of reference organization, facsimile number of reference firm, a brief description of the work performed, the dollar amount of the contract, the number of years of contract, and any problems encountered to include the offeror’s corrective action. USAID OIG recommends that you alert the contacts that their names have been submitted and that they are authorized to provide performance information concerning the listed and when USAID OIG requests.

• Response to Mock BPA Call Order: Network Defenses

For this section of the proposal, the offer must provide the following in response to “Section 6 - Mock BPA Call Order: Network Defenses.”

Work Plan

The offeror must provide a work plan that describes the approach and specific work steps that the offeror proposes to implement to satisfy Task 2. The work plan must detail the processes (tasks, subtasks, etc.) undertaken by the contractor and/or subcontractor, the level of effort for each process, and the timelines, project milestones, and delivery dates for performance of each task identified in the work plan. The delivery dates must be consistent with the Schedule of Deliverables for each task, factoring in the time it will take to complete the initial work in Task

1. In addition, the work plan must follow the guidelines contained in NIST SP 800-115, Technical Guide to Information Security Testing and Assessment, unless otherwise approved by the COR. However, if the offeror believes that the delivery dates to complete its testing are unrealistic, the contractor must annotate in its workplan how long it would expect the testing to be completed.

Under no circumstances may the contractor intentionally alter USAID’s network or information contained in it (e.g., correct vulnerabilities identified, installing software, or open files) or launch an attack (e.g., denial of service and move or alter files) of the Agency’s network. All internal and external scans must be coordinated with the Agency and COR following a rules of engagement agreement. See Appendix V for a sample of key terms and conditions in a rules of engagement agreement for a technical vulnerability assessment. The work plan shall, to the extent possible, exclude OIG from the scope.

In preparing the workplan, the contractor shall make the following assumptions:

o The goal is to identify vulnerabilities in the Agencies network and network defenses, thereby simulating a hacker’s activities.

o For the external penetration testing, the contractor will have no knowledge of USAID or its network.

o External penetration testing will include fake malicious links sent by email to capture the email addresses of USAID staff that click on the link, and other similar activities, the contractor deems appropriate.

o Upon award, research for external penetration testing will begin. Most research for the external penetration testing will be completed before the entrance conference only to the point of identifying potential access points and weakness that could be exploited to gain access—without scanning or accessing USAID’s network and without the knowledge of USAID officials.

o The contractor will conduct an independent, credentialed internal scan of USAID’s entire network (including web applications, servers, workstations, and network devices), analyze the results, and identify causes of vulnerabilities identified.

o The contractor’s report will present areas of specific concern (such as missing patches), rather than identifying the number of vulnerabilities by severity level that the testing tool identified.

o The contractor will use an OIG-issued laptop to test whether it can penetrate USAID’s network and to conduct the internal vulnerability assessment.

o All software licenses that the contractor will purchases for this BPA call will become the property of OIG.

o USAID must approve the software that will be installed on the OIG-issued laptop.

o OIG will issue the official draft and final reports to the Agency.

In addition, assume that it will take:

o 45 days to onboard the contractor’s staff.

o 45 days, including various meetings to receive, configure, and obtain clearance to use an

OIG laptop to perform the technical vulnerability assessment and to complete the external penetration testing; arrange administrator level network access; and complete and sign the rules of engagement, which must be in place before commencing the technical vulnerability assessment and scanning or accessing USAID’s network as part of the penetration testing.

o 200 days for contractor to work with the COR to respond to comments from internal OIG reviewers’ comments through issuance of the official draft evaluation report.

o 40 days to work with the COR to respond to comments on discussion paper.

o 30 days for the Agency to provide comments on the OIG’s official draft evaluation report.

o 30 days for the contractor to work with the COR to analyze the Agency’s comments and respond to internal OIG reviewers’ comments through issuance of the official final evaluation report.

• System of Quality Controls

For this section of the proposal, the offeror must describe in detail the contractor’s (and subcontractor’s if applicable) internal quality controls over its technical services provided in relation to section 1 of this BPA. Note that, for each BPA call, the contractor will be required to provide updated information on its system of quality controls and to attest whether it followed its system of quality controls for the services provided.

• National Security Agency Certification

For this section of the proposal, the offeror must provide evidence that the firm has a National

Security Agency Certification, if applicable. This is not a disqualifying factor; however, firms that are National Security Agency certified are preferred and will be given greater consideration.

(END OF SECTION M)