72001G25R00001_FE.pdf

Office of Inspector General

United States Agency for International

Development

Technical Support Services

Solicitation No.: 72001G25R00001

Issue Date: November 13, 2024

72001G25R00001

SOLICITATION, OFFER AND AWARD

4. TYPE OF SOLICITATION2. CONTRACT NUMBER 3. SOLICITATION NUMBER

7. ISSUED BY CODE 8. ADDRESS OFFER TO (If other than Item 7)

System (DPAS) - Code of Federal Regulations - at 15 CFR 700.

6. REQUISITION/PURCHASE NUMBER

NOTE: In sealed bid solicitations "offer" and "offeror" mean "bid" and "bidder".

NEGOTIATED (RFP) REQUEST FOR

SEALED BID (IFB) INVITATION FOR BID

5. DATE ISSUED

1. This Contract is a Rated Order under the Defense Priorities and Allocations RATING PAGE OF PAGES

1 4

C. E-MAIL ADDRESS

EXT.NUMBERAREA CODE

B. TELEPHONE (NO COLLECT CALLS)A. NAME

10. FOR

INFORMATION

CALL:

CAUTION: LATE Submissions, Modifications, and Withdrawals: See Section L, Provision No. 52.214-7 or 52.215-1. All offers are subject to all terms and conditions contained in this solicitation.

(Date)(Hour) local timeuntildepository located in copies for furnishing the supplies or services in the Schedule will be received at the place specified in Item 8, or if hand carried, in the

SOLICITATION

9. Sealed offers in original and

PART IV - REPRESENTATIONS AND INSTRUCTIONS

OTHER STATEMENTS OF OFFERORS

EVALUATION FACTORS FOR AWARD

INSTRUCTIONS, CONDITIONS, AND NOTICES TO OFFERORS

REPRESENTATIONS, CERTIFICATIONS AND

LIST OF ATTACHMENTS

CONTRACT CLAUSES

PART III - LIST OF DOCUMENTS, EXHIBITS AND OTHER ATTACHMENTS

I

J

K

L

M SPECIAL CONTRACT REQUIREMENTS

CONTRACT ADMINISTRATION DATA

DELIVERIES OR PERFORMANCE

INSPECTION AND ACCEPTANCE

PACKAGING AND MARKING

DESCRIPTION/SPECIFICATIONS/WORK STATEMENT

SUPPLIES OR SERVICES AND PRICES/COSTS

SOLICITATION/CONTRACT FORM

PART II - CONTRACT CLAUSESPART I - THE SCHEDULE

H

G

F

E

D

C

B

A

SEC. DESCRIPTION PAGE(S) (X) DESCRIPTION SEC. (X)

11. TABLE OF CONTENTS

18. OFFER DATE17. SIGNATURE

SUCH ADDRESS IN SCHEDULE.

IS DIFFERENT FROM ABOVE - ENTER

15C. CHECK IF REMITTANCE ADDRESS

EXTENSIONNUMBERAREA CODE

15B. TELEPHONE NUMBER

(Type or print)AND

ADDRESS

OF

OFFEROR

CODE FACILITY

16. NAME AND TITLE OF PERSON AUTHORIZED TO SIGN OFFER15A. NAME

DATEAMENDMENT NO.DATEAMENDMENT NO.

and related documents numbered and dated):

amendments to the SOLICITATION for offerors

(The offeror acknowledges receipt of

14. ACKNOWLEDGEMENT OF AMENDMENTS

CALENDAR DAYS (%)30 CALENDAR DAYS (%)20 CALENDAR DAYS (%)10 CALENDAR DAYS (%)

(See Section I, Clause No. 52.232.8)

13. DISCOUNT FOR PROMPT PAYMENT

designated point(s), within the time specified in the schedule.

by the offeror) from the date for receipt of offers specified above, to furnish any or all items upon which prices are offered at the price set opposite each item, delivered at the

NOTE: Item 12 does not apply if the solicitation includes the provisions at 52.214-16, Minimum Bid Acceptance Period.

OFFER (Must be fully completed by offeror)

IMPORTANT - Award will be made on this Form, or on Standard Form 26, or by other authorized official written notice.

28. AWARD DATE

(Signature of Contracting Officer)

27. UNITED STATES OF AMERICA

25. PAYMENT WILL BE MADE BY

26. NAME OF CONTRACTING OFFICER (Type or print)

CODE 24. ADMINISTERED BY (If other than Item 7)

ITEM

(4 copies unless otherwise specified)

23. SUBMIT INVOICES TO ADDRESS SHOWN IN

41 U.S.C. 3304 (a) ( 10 U.S.C. 3204 (a) (

22. AUTHORITY FOR USING OTHER THAN FULL AND OPEN COMPETITION UNDER THE

21. ACCOUNTING AND APPROPRIATION20. AMOUNT19. ACCEPTED AS TO ITEMS NUMBERED

AWARD (To be completed by government)

CODE

11/13/2024 X

72001G

USAID OIG

20523-1000

1600 ET 12/04/2024

Kiaira Stallworth kstallworth@usaid.gov

X

X

X

X

X

X

X

X

X

X

X

X

X

PAGE(S)

Kiaira Stallworth

AUTHORIZED FOR LOCAL REPRODUCTION

Previous edition is unusable

STANDARD FORM 33 (REV. 12/2022)

Prescribed by GSA - FAR (48 CFR) 53.214(c)

1-3 4-6

6-8

9-13

13-16

12. In compliance with the above, the undersigned agrees, if this offer is accepted within _____0_________ calendar days (60 calendar days unless a different period is inserted

PROPOSAL

UNITED STATES CODE AT:

ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

NAME OF OFFEROR OR CONTRACTOR

2 4

CONTINUATION SHEET

REFERENCE NO. OF DOCUMENT BEING CONTINUED PAGE OF

72001G25R00001

(A) (B) (C) (D) (E) (F)

The United States Agency for International

Development (USAID) Office of the Inspector

General (OIG) for is soliciting proposals from qualified businesses/GSA contractors under

Schedule 54151HACS – Information Technology - IT

Services. The applicable NAICS code is 541519.

This request for proposal seeks contractors holding the Highly Adaptive Cybersecurity

Services Special Item Number, 54151HACS, and the contractor must be categorized in the following

HACS subgroups, Penetration Testing & Risk and

Vulnerability Assessments. The requirement is for technical services in support of the agency's independent evaluations and audit. Such technical services may include external network penetration tests; internal network vulnerability assessments; Wi-Fi, cell phone, and oracle database tests; and related training of staff, as described further in the Statement of Work (SOW) provided as part of this RFP.

For this solicitation, under best value source selection, non-price evaluation factors, when combined, are significantly more important than price. However, an offeror will not be selected for award on the basis of superior capability without consideration of the price. Thus, USAID

OIG is requesting a proposal, technical and price, for the fulfillment of the requirements included in the attached SOW and in adherence with the Instructions to Offerors reference document.

Proposals will be evaluated based on the criteria described in the Instructions to Offerors document.

The anticipated contract type for any award made from this solicitation is a blanket purchase agreement under which call orders can be placed.

If issued, the individual call order(s) will specify contract type (i.e., firm-fixed price, labor hours, etc.), payment schedule, and payment terms, as outlined in the SOW. Funds will NOT be obligated against the BPA master contract, funds will only be obligated against issued call orders.

The anticipated period of performance for award made from this solicitation includes a one-year

Continued ...

OPTIONAL FORM 336 (4-86)

Sponsored by GSA

FAR (48 CFR) 53.110

NSN 7540-01-152-8067

3 4

CONTINUATION SHEET

REFERENCE NO. OF DOCUMENT BEING CONTINUED PAGE OF

72001G25R00001

(A) (B) (C) (D) (E) (F) base period and four, one-year priced option periods.

Base Year One (1): January 20, 2025 - January 19, Option Year One (1): January 20, 2026 - January

19, 2027

Option Year Two (2): January 20, 2027 - January

19, 2028

Option Year Three (3): January 20, 2028 - January

19, 2029

Option Year Four (4): January 20, 2029 - January

19, 2030

Any questions regarding this notice and/or the

RFP should be submitted via email to Kiaira

Stallworth (kstallworth@oig.usaid.gov) and Scott

Ferrante (sferrante@oig.usaid.gov). Questions must be submitted no later than 12:00pm on

November 18, 2024. Questions will NOT be accepted after this date and time. When submitting questions, you must use the following as the subject line of your email: "RFP #72001G25R00001

- Questions". Proposal submissions should also be sent to the email addresses listed above.

Responses to questions will be provided no later than 4:00pm on November 20, 2024.

Issuance of this solicitation does not constitute an award commitment, including the issuance of call orders, on the part of the U.S. Government, nor does it commit the U.S. Government to pay for the costs incurred in the preparation and submission of a proposal.

Included Attachments:

Attachment I - Statement of Work

Attachment II - Sample Non-disclosure & Conflicts of Interest Agreement

Attachment III - Mock Call Pricing Sheet

0001 Base Year - Supplier must provide technical support services in accordance with the SOW

0002 Option Year One - Supplier must provide technical support services in accordance with the SOW

Continued ...

OPTIONAL FORM 336 (4-86)

Sponsored by GSA

4 4

CONTINUATION SHEET

REFERENCE NO. OF DOCUMENT BEING CONTINUED PAGE OF

72001G25R00001

(A) (B) (C) (D) (E) (F)

0003 Option Year Two - Supplier must provide technical support services in accordance with the SOW

0004 Option Year Three - Supplier must provide technical support services in accordance with the

SOW

0005 Option Year Four - Supplier must provide financial statement audit services in accordance with the SOW

OPTIONAL FORM 336 (4-86)

Sponsored by GSA

SOLICITATION #: 72001G25R00001

TECHNICAL SUPPORT SERVICES

PART I – THE SCHEDULE

SECTION A – SOLICITATION/CONTRACT FORM

A.1 TITLE

Technical Support Services

A.2 CONTRACT TYPE

This is anticipated to be a blanket purchase agreement (BPA).

(END OF SECTION A)

SECTION B – SUPPLIES & SERVICES PRICES/COSTS

The offeror must propose a discount table showing the discount percentages on their GSA MAS contract for each year of the period of performance of the BPA contract (one base year and four options years).

(END OF SECTION B)

SECTION C – DESCRIPTION/STATEMENT OF WORK SUMMARY

SEE “ATTACHMENT I – STATEMENT OF WORK” FOR THE ENTIRETY OF THE REQUIREMENTS

C.1 PURPOSE

U.S. Agency for International Development (USAID) Office of Inspector General (OIG) requires technical services in support of our independent evaluations and audit. Such technical services may include external network penetration tests; internal network vulnerability assessments; Wi-Fi, cell phone, and oracle database tests; and related training of OIG staff.

The maximum value for all orders issued against the single-award Blanket Purchase Agreement (BPA) will not exceed $5 million without bilateral agreement from both parties. There is no minimum or maximum number of orders that may be issued against the BPA.

C.2 SCOPE OF WORK

The purpose of this BPA is to provide an ordering vehicle for USAID OIG to receive nonpersonal technical services in support of information technology evaluations and audits. The contractor operating as independent and not as an agent of the Government, will provide for all labor, tools, materials, facilities, equipment, supervision, and other items necessary, unless specifically stated elsewhere in this document or in the specific order. The Contractor may be required to perform work under multiple orders.

Examples of Types of Work

Some examples of potential types of work to be completed under this BPA call order are as follows:

• Network Penetration Testing o Black box penetration testing o Grey box penetration testing o White box penetration testing

• Other Penetration Testing o Wireless penetration testing o Internet of Things penetration testing o Physical penetration testing

• Technical Vulnerability Assessments o Internal network vulnerability assessment o Oracle database vulnerability assessment

• Employee/Contractor Tests o Social Engineering o Phishing o Faux Malicious Links o Adherence to physical security policies

▪ Use of screen and computer locks

▪ Display of PIV badges

▪ Removal of print output from printers

▪ Tailgating

• Combined Testing (i.e., Red Teaming)

• Conduct training on technical testing

• Stand up a sandbox environment for OIG to practice the technical tools and techniques

• Follow-up work to assess whether the agency implemented technical recommendations

• Conduct technical tests to assess agency staffs’ knowledge of security requirements.

Deliverables

For each BPA call order, deliverables may include the following.

• Detailed work plan for each phase of testing

• Quality assurance plan for each phase of testing

• Rules of engagement for testing to be signed by the contractor, OIG, and agency

• Detailed narrative and supporting documentation of actual testing performed

• Detailed technical report on results of testing and analysis for agency technical staff

• Discussion Paper that discusses the findings from testing so that non-technical readers at the fifth-grade level can understand, as described in individual orders

• Draft Evaluation or Audit Report – Contents of the discussion paper plus a detailed scope and methodology section of the work performed, as described in individual orders

• Final Evaluation or Audit Report – Contents of the draft report plus Agency management’s verbatim comments and the contractor’s- evaluation of the comments, as described in individual orders

• Technical training materials

• Resumes of staff assigned to the BPA call order

• Onboarding documents, such as nondisclosure agreements, statements of independence from the agency, U.S. Office of Personnel Management optional forms 306, Visit Authorization Letters, and Visitors Access Request.

Meetings

For each BPA call order, meetings may include the following.

• Post award meeting

• Session for OIG to train contractor staff on requirements for the engagement (i.e., evaluation or audit)

• Entrance conference for the engagement with agency and OIG officials

• Planning meetings with agency and OIG staff

• Biweekly status meetings with OIG staff

• Biweekly status meetings with agency and OIG staff

• Working meetings with OIG to write the draft and final reports and to address OIG reviewer and agency management comments

• Exit conference for the engagement with agency and OIG officials

• Training sessions

C.3 PERIOD OF PERFORMANCE

The period of performance for this award shall be:

Base Period: January 20, 2025 through January 19, 2026 Option Period One (1): January 20, 2026 through January 19, 2027 Option Period Two (2): January 20, 2027 through January 19, 2028 Option Period Three (3): January 20, 2028 through January 19, 2029 Option Period Four (4): January 20, 2029 through January 19, 2030

C.4 PLACE OF PERFORMANCE

Work outside the continental United States (OCONUS) is not anticipated but this specific requirement will be specified at the call order level. Most calls under this blanket purchase agreement shall be completed in the Washington, DC metropolitan area. Travel expenses to USAID OIG’s offices or other locations in the Washington, DC, metropolitan area for meetings or any activities will not be paid or reimbursed to the contractor or any consultants or subcontractors. The contractor, subcontractor(s), and/or consultant(s) are responsible for all their own local travel.

Travel to other locations in the continental United States will be billed in accordance with FAR 31.205-46. All travel must be pre-approved in writing by the appropriate COR. The not to exceed amount is to be determined at the call order level.

(END OF SECTION C)

SECTION D – PACKAGING AND MARKING

[RESERVED]

(END OF SECTION D)

SECTION E – INSPECTION AND ACCEPTANCE

(END OF SECTION E)

SECTION F – PERFORMANCE (DELIVERABLES)

See section 1.4.2 in the Statement of Work.

(END OF SECTION F)

SECTION G – CONTRACT ADMINISTRATIVE DATA

G.1 CONTRACTING OFFICER AUTHORITY

The Contracting Officer is the only person authorized to make or approve any changes in the requirements of this award and notwithstanding any provisions contained elsewhere in this award, the said authority remains solely with the Contracting Officer. In the event the Contractor makes any changes at the direction of any person other than the Contracting Officer, the change shall be considered to have been made without authority and no adjustment shall be made in the award terms and conditions, including price.

The Administrative Contracting Officer is:

Kiaira Stallworth Office of Inspector General

IG/M/AOO

1300 Pennsylvania Avenue, NW Washington, DC 20523 Email: kstallworth@usaid.gov Telephone: (202) 230-4306

G.2 CONTRACTING OFFICER REPRESENTATIVE

1. The Contracting Officer’s Representative (COR) designated for this award (to be designated via COR Designation letter) is authorized to act as an official representative of the Contracting Officer.

2. The COR is designated by the Contracting Officer and authorized to act within the limitations specified herein and written restrictions specifically imposed under the terms of this award and by the Contracting Officer. The authority might extend the following: inspection, acceptance, or rejection of work.

3. This designation does not include authority to direct changes in scope, price, terms, or conditions of this award. The authority herein also does not include authority to execute modifications to the award, which requires the signature of the Contracting Officer, or to bind the Government by contract terms of a proposed contract change.

G.3 TECHNICAL DIRECTIONS AND RELATIONSHIP WITH USAID/OIG

a. Technical Directions are defined to include:

1. Provision of information to the Contractor which fill in details, suggest possible lines of inquiry, or otherwise facilitate completion of work;

2. Provision of information to the Contractor which assists in the interpretation of Government requirements, policy and specifications;

3. Review and, where required, provide written approval of technical reports, specifications, workplan, or technical information to be delivered.

a. The COR is authorized by designation to take any or all action with respect to the following:

4. Assure that the Contractor performs the technical requirements of the contract in accordance with the contract terms, conditions, and specifications.

5. Perform or cause to be performed, inspections necessary in connection with above and require the Contractor to correct all deficiencies; perform acceptance for the Government.

6. Maintain all liaison and direct communications with the Contractor. Written communications with the Contractor and documents must be signed as "Contracting Officer Representative" with a copy furnished to the Contracting Officer.

7. Issue interpretations of Government requirements, policy, guidance and specifications.

8. Monitor the Contractor's production or performance progress and notify the Contractor in writing of deficiencies noted, and direct appropriate action to effect correction. Record and report to the Contracting Officer incidents of faulty or nonconforming work, delays or problems.

9. Facilitate with the USAID Security clearance process and appropriate identification if access to Government facilities is required. If to be provided, ensure that Government furnished property is available when required.

10. Complete Contractor Performance Assessment Reports (CPARs) once a year.

LIMITATIONS: The COR is not empowered to award, agree to, or sign any contract (including delivery or task orders) or modifications thereto, or in any way to obligate the payment of money by the Government. The COR may not take any action which may impact on the contract schedule, funds, scope or rate of utilization of contract personnel resources. All contractual agreements, commitments, or modifications which involve prices, quantities, quality, schedules, must be made only by the Contracting Officer.

11. The COR is required to meet at least quarterly with the Contractor and the Contracting Officer concerning performance of items delivered under the contract and any other administration or technical issues. Verbal reports may be made if no problems are being experienced.

Problem areas should be brought to the immediate attention of the Contractor and Contracting Officer.

12. In the absence of the designated primary COR, the alternate COR identified in the official COR delegation letter may serve as COR in their place. However, such an action shall immediately be communicated to the Contractor and the Contracting Officer.

13. Contractual Problems of any nature that may arise during the life of the contract must be handled in accordance with specific public laws and regulations (i.e. Federal Acquisition

Regulation and Agency for International Development Acquisition Regulation). The Contractor and the COR must bring all contracting problems to the immediate attention of the Contracting Officer. Only the Contracting Officer is authorized to formally resolve such problems. The Contracting Officer will be responsible for resolving legal issues, determining contract scope and interpreting contract terms and conditions. The Contracting Officer is the sole authority authorized to approve changes in any of the requirements under this contract.

Notwithstanding any clause contained elsewhere in this contract, the said authority remains solely with the Contracting Officer. These changes include but will not be limited to the following areas: scope of work, price, quantity, technical specifications, delivery schedules, and contract terms and conditions. In the event the Contractor effects any changes at the direction of any other person other than the Contracting Officer, the change will be considered to have been made without authority.

14. Failure by the Contractor to report to the Contracting Officer, any action by the Government considered a change, within the specified number of days contained in FAR 52.243-7 (Notification of Changes), waives the Contractor's right to any claims for equitable adjustments.

G.4 PAYMENT AND INVOICES

Payment terms are NET30. An original of each invoice in PDF format shall be submitted to the Office of Chief Financial Officer via email at ei@usaid.gov. One (1) copy of each invoice shall also be submitted to the COR.

G.5 ACCOUNTING AND APPROPRIATION DATA

TBD at time of award.

(END OF SECTION G)

SECTION H – SPECIAL CONTRACT REQUIREMENTS

(END OF SECTION H)

PART II – CONTRACT CLAUSES

SECTION I – CONTRACT CLAUSES

I.1 GSA CONTRACT CLAUSES

All contract clauses as applicable in the contractor’s GSA Multiple Award Schedule will apply to the impending contract.

I.2 FAR CONTRACT CLAUSES INCORPORATED BY REFERENCE

FAR 52.252-2 – CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at this/these address (es):

http://acquisition.gov/far/

The following clauses are applicable to this requirement:

NUMBER TITLE DATE

52.203-19 Prohibition on Requiring Certain Internal Confidentiality

Agreements or Statements

JAN 2017

52.204-13 System for Award Management Maintenance OCT 2018 52.204-18 Commercial and Government Entity Code Maintenance AUG 2020 52.204-23 Prohibition on Contracting for Hardware, Software, and Services

Developed or Provided by Kaspersky Lab and Other Covered Entities

NOV 2021

52.204-25 Prohibition of Contracting for Certain Telecommunications and Video Surveillance Services or Equipment

NOV 2021

52.209-6 Protecting the Government’s Interest When Subcontracting with Contractors Debarred, Suspended, or Proposed for Debarment

NOV 2021

52.209-10 Prohibition on Contracting with Inverted Domestic Corporations NOV 2015 52.212-4 Contract Terms and Conditions – Commercial Products and

Commercial Services

NOV 2023

52.212-5 Contract Terms and Conditions Required to Implement Statutes or Executive Orders—Commercial Products and Commercial Services

As per paragraph (b), the Contracting Officer has indicated as being incorporated in this contract by reference to implement provisions of law or Executive orders applicable to acquisitions of commercial products and commercial services:

[X] 52.203-17 Contractor Employee Whistleblower Rights [X] 52.204-27 Prohibition on a ByteDance Covered Application [X] 52.222-3 Convict Labor [X] 52.222-19 Child Labor – Cooperation with Authorities and Remedies [X] 52.222-26 Equal Opportunity [X] 52.222-50 Combating Trafficking in Persons [X] 52.223-18 Encouraging Contractor Policies to Ban Text Messaging While Driving

NOV 2023

52.219-28 Post-Award Small Business Program Rerepresentation MAR 2023 52.233-3 Protest After Award AUG 1996 52.233-4 Applicable Law of Breach of Contract Claim OCT 2004 52.244-6 Subcontracts for Commercial Products and Commercial Services OCT 2022

I.2 FAR CONTRACT CLAUSES IN FULL TEXT

FAR 52.252-2 – CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at this/these address (es):

(end of clause)

FAR 52.217-9 – OPTION TO EXTEND THE TERMS OF THE CONTRACT (MAR 2000)

(a) The Government may extend the term of this contract by written notice to the Contractor provided that the Government gives the Contractor a preliminary written notice of its intent to extend at least 60 days before the contract expires. The preliminary notice does not commit the

Government to an extension.

(b) If the Government exercises this option, the extended contract shall be considered to include this option clause.

(c) The total duration of this contract, including the exercise of any options under this clause, shall not exceed 60 months.

(end of clause)

I.3 AIDAR CONTRACT CLAUSES INCORPORATED BY REFERENCE

NUMBER TITLE DATE

752.211-70 Language and Measurements JUN 1992

752.7006 Notices APR 1984

752.7025 Approvals APR 1984

(END OF SECTION I)

PART III – LIST OF DOCUMENTS, EXHIBITS AND OTHER ATTACHMENTS

SECTION J – LIST OF ATTACHMENTS

Attachment Number Title I Statement of Work

II

Sample Non-disclosure & Conflicts of Interest Agreement III Mock Call Pricing Sheet

(END OF SECTION J)

https://www.law.cornell.edu/definitions/index.php?width=840&height=800&iframe=true&def_id=80fb588108eda34822560ae27fdc9a0d&term_occur=1&term_src=Title:48:Chapter:1:Subchapter:H:Part:52:Subpart:52.2:52.217-9

PART IV – REPRESENTATIONS AND INSTRUCTIONS

SECTION K – REPRESENTATIONS, CERTIFICATIONS, AND OTHER STATEMENS OF OFFERORS

FAR 52.204-24 – REPRESENTATION REGARDING CERTAIN TELECOMMUNICATIONS AND

VIDEO SURVEILLANCE SERVICES OR EQUIPMENT (NOV 2021)

The Offeror shall not complete the representation at paragraph (d)(1) of this provision if the Offeror has represented that it "does not provide covered telecommunications equipment or services as a part of its offered products or services to the Government in the performance of any contract, subcontract, or other contractual instrument" in paragraph

(c)(1) in the provision at 52.204-26, Covered Telecommunications Equipment or

Services—Representation, or in paragraph (v)(2)(i) of the provision at 52.212-3, Offeror

Representations and Certifications-Commercial Products or Commercial Services. The

Offeror shall not complete the representation in paragraph (d)(2) of this provision if the

Offeror has represented that it "does not use covered telecommunications equipment or services, or any equipment, system, or service that uses covered telecommunications equipment or services" in paragraph (c)(2) of the provision at 52.204-26, or in paragraph

(v)(2)(ii) of the provision at 52.212-3.

(a) Definitions. As used in this provision—

Backhaul, covered telecommunications equipment or services, critical technology, interconnection arrangements, reasonable inquiry, roaming, and substantial or essential component have the meanings provided in the clause

52.204-25, Prohibition on Contracting for Certain Telecommunications and

Video Surveillance Services or Equipment.

(b) Prohibition. (1) Section 889(a)(1)(A) of the John S. McCain National Defense

Authorization Act for Fiscal Year 2019 (Pub. L. 115-232) prohibits the head of an executive agency on or after August 13, 2019, from procuring or obtaining, or extending or renewing a contract to procure or obtain, any equipment, system, or service that uses covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system. Nothing in the prohibition shall be construed to—

(i) Prohibit the head of an executive agency from procuring with an entity to provide a service that connects to the facilities of a third-party, such as backhaul, roaming, or interconnection arrangements; or

(ii) Cover telecommunications equipment that cannot route or redirect user data traffic or cannot permit visibility into any user data or packets that such equipment transmits or otherwise handles.

(2) Section 889(a)(1)(B) of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 (Pub. L. 115-232) prohibits the head of an executive agency on or after August 13, 2020, from entering into a contract or extending or renewing a contract with an entity that uses any equipment, system, or service that uses covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system. This prohibition applies to the use of covered telecommunications equipment or services, regardless of whether that use is in performance of work under a federal contract. Nothing in the prohibition shall be construed to—

(i) Prohibit the head of an executive agency from procuring with an entity to provide a service that connects to the facilities of a third-party, such as backhaul, roaming, or interconnection arrangements; or

(ii) Cover telecommunications equipment that cannot route or redirect user data traffic or cannot permit visibility into any user data or packets that such equipment transmits or otherwise handles.

(c) Procedures. The Offeror shall review the list of excluded parties in the System for

Award Management (SAM) (https://www.sam.gov) for entities excluded from receiving federal awards for "covered telecommunications equipment or services".

(d) Representation. The Offeror represents that—

(1) It □ will, □ will not provide covered telecommunications equipment or services to the Government in the performance of any contract, subcontract or other contractual instrument resulting from this solicitation. The Offeror shall provide the additional disclosure information required at paragraph

(e)(1) of this section if the Offeror responds "will" in paragraph (d)(1) of this section; and

(2) After conducting a reasonable inquiry, for purposes of this representation, the Offeror represents that—

It □ does, □ does not use covered telecommunications equipment or services, or use any equipment, system, or service that uses covered telecommunications equipment or services. The Offeror shall provide the additional disclosure information required at paragraph (e)(2) of this section if the Offeror responds "does" in paragraph (d)(2) of this section.

(e) Disclosures. (1) Disclosure for the representation in paragraph (d)(1) of this provision. If the Offeror has responded "will" in the representation in paragraph

(d)(1) of this provision, the Offeror shall provide the following information as part of the offer:

(i) For covered equipment—

(A) The entity that produced the covered telecommunications equipment (include entity name, unique entity identifier, CAGE code, and whether the entity was the original equipment manufacturer

(OEM) or a distributor, if known);

(B) A description of all covered telecommunications equipment offered (include brand; model number, such as OEM number, manufacturer part number, or wholesaler number; and item description, as applicable); and

(C) Explanation of the proposed use of covered telecommunications equipment and any factors relevant to determining if such use would be permissible under the prohibition in paragraph (b)(1) of this provision.

(ii) For covered services—

(A) If the service is related to item maintenance: A description of all covered telecommunications services offered (include on the item being maintained: Brand; model number, such as OEM number, manufacturer part number, or wholesaler number; and item description, as applicable); or

(B) If not associated with maintenance, the Product Service Code

(PSC) of the service being provided; and explanation of the proposed use of covered telecommunications services and any factors relevant to determining if such use would be permissible under the prohibition in paragraph (b)(1) of this provision.

(2) Disclosure for the representation in paragraph (d)(2) of this provision. If the

Offeror has responded "does" in the representation in paragraph (d)(2) of this provision, the Offeror shall provide the following information as part of the offer:

(i) For covered equipment—

(A) The entity that produced the covered telecommunications equipment (include entity name, unique entity identifier, CAGE code, and whether the entity was the OEM or a distributor, if known);

(B) A description of all covered telecommunications equipment offered (include brand; model number, such as OEM number, manufacturer part number, or wholesaler number; and item description, as applicable); and

(C) Explanation of the proposed use of covered telecommunications equipment and any factors relevant to determining if such use would be permissible under the prohibition in paragraph (b)(2) of this provision.

(ii) For covered services—

(A) If the service is related to item maintenance: A description of all covered telecommunications services offered (include on the item being maintained: Brand; model number, such as OEM number, manufacturer part number, or wholesaler number; and item description, as applicable); or

(B) If not associated with maintenance, the PSC of the service being provided; and explanation of the proposed use of covered telecommunications services and any factors relevant to determining if such use would be permissible under the prohibition in paragraph

(b)(2) of this provision.

(End of provision)

FAR 52.252-1 – SOLICITATION PROVISIONS INCORPORATED BY REFERENCE (FEB 1998)

This solicitation incorporates one or more solicitation provisions by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. The offeror is cautioned that the listed provisions may include blocks that must be completed by the offeror and submitted with its quotation or offer. In lieu of submitting the full text of those provisions, the offeror may identify the provision by paragraph identifier and provide the appropriate information with its quotation or offer. Also, the full text of a solicitation provision may be accessed electronically at this/these address(es):

http://acquisition.gov/far/

(End of provision)

The following provisions, incorporated by reference, are applicable to this requirement and require representations, certifications, or the submission of other information by offerors:

NUMBER TITLE DATE

52.203-11 Certification and Disclosure Regarding Payments to Influence

Certain Federal Transactions

SEP 2007

52.203-18 Prohibition on Contracting with Entities that Require Certain Internal Confidentiality Agreements or Statements— Representation

JAN 2017

52.204-7 System for Award Management OCT 2018 52.204-16 Commercial and Government Entity Code Reporting AUG 2020 52.204-22 Alternative Line Item Proposal JAN 2017 52.204-17 Ownership or Control of Offeror AUG 2020 52.204-20 Predecessor of Offeror AUG 2020 52.204-26 Covered Telecommunications Equipment or Services--

Representation

NOV 2021

52.209-2 Prohibition on Contracting with Inverted Domestic Corporations— Representation

NOV 2015

52.209-7 Information Regarding Responsibility Matters OCT 2018 52.212-3 Offeror Representations and Certifications—Commercial Products and Commercial Services

NOV 2023

52.215-1 Instructions to Offerors-Competitive Acquisition – Alternate I OCT 1997 52.225-25 Prohibition on Contracting with Entities Engaging in Certain

Activities or Transactions Relating to Iran—Representation and Certifications

JUN 2020

(END OF SECTION K)

SECTION L – INSTRUCTIONS, CONDITIONS, AND NOTICES TO OFFERORS

SEE REFERENCE DOCUMENT TITLED “INSTRUCTIONS TO OFFERORS” FOR INSTRUCTIONS.

(END OF SECTION L)

SECTION M – EVALUATION FACTORS FOR AWARD

SEE REFERENCE DOCUMENT TITLED “INSTRUCTIONS TO OFFERORS” FOR THE ENTIRETY OF

THE INSTRUCTIONS.

For this solicitation, under best value source selection, non-price evaluation factors, when combined, are significantly more important than price. However, an offeror will not be selected for award on the basis of superior capability without consideration of the price.

In determining which offer represents the best value to meet the Government’s needs, the Government shall evaluate responses using the evaluation criteria below. If the Contracting Officer determines that competing technical proposals are essentially equal, price factors must become the determining factor in source selection. Conversely, if the contracting officer determines that competing price proposals are essentially equal, technical factors must become the determining factor in source selection.

• Contractor’s Statement of Independence

This section of the proposal must describe clearly state whether or not the company is independent from USAID, MCC, USADF, and IAF. Specifically, the offeror is required to affirm whether or not the company is independent from USAID, including a statement that the company (1) is free from personal and external impairments to independence from USAID, MCC, USADF, and IAF; (2) is organizationally independent; and (3) intends to maintain its independence in fact, attitude, and appearance throughout the period of performance of the scope of work. In addition, if any impairment(s) exists and/or are foreseen, the proposals must explicitly state the nature of such impairment(s).

• Contractor’s Past Performance

This section of the proposal must describe the company’s past work experience in performing work related to the audits described in Section 1.4, Scope of Work, in the Statement of Work.

The description must be no more than three (3) pages in length (with 1-inch margins), single-sided, and single-spaced.

Offerors shall also provide references for contracts with four different organizations (including Federal, State, local Government, and private) that your firm was awarded within the past five years that demonstrates your ability to perform the work identified in the scope of work. Each reference must be separately identified and include the following information: referenced organization’s name, contract number (if any), three current points of contacts who are capable of providing reference information with respect to your firm’s performance, current telephone numbers for each point of contact, current email address for each point of contact, project name, address of reference organization, facsimile number of reference firm, a brief description of the work performed, the dollar amount of the contract, the number of years of contract, and any problems encountered to include the offeror’s corrective action. USAID OIG recommends that you alert the contacts that their names have been submitted and that they are authorized to provide performance information concerning the listed and when USAID OIG requests.

• Response to Mock BPA Call Order: Network Defenses

For this section of the proposal, the offer must provide the following in response to “Section 6 - Mock BPA Call Order: Network Defenses.”

Work Plan

The offeror must provide a work plan that describes the approach and specific work steps that the offeror proposes to implement to satisfy Task 2. The work plan must detail the processes (tasks, subtasks, etc.) undertaken by the contractor and/or subcontractor, the level of effort for each process, and the timelines, project milestones, and delivery dates for performance of each task identified in the work plan. The delivery dates must be consistent with the Schedule of Deliverables for each task, factoring in the time it will take to complete the initial work in Task

1. In addition, the work plan must follow the guidelines contained in NIST SP 800-115, Technical Guide to Information Security Testing and Assessment, unless otherwise approved by the COR.

Under no circumstances may the contractor intentionally alter USAID’s network or information contained in it (e.g., correct vulnerabilities identified, installing software, or open files) or launch an attack (e.g., denial of service and move or alter files) of the Agency’s network. All internal and external scans must be coordinated with the Agency and COR following a rules of engagement agreement. See Appendix V for a sample of key terms and conditions in a rules of engagement agreement for a technical vulnerability assessment. The work plan shall, to the extent possible, exclude OIG from the scope.

In preparing the workplan, the contractor shall make the following assumptions:

o The goal is to identify vulnerabilities in the Agencies network and network defenses, thereby simulating a hacker’s activities.

o For the external penetration testing, the contractor will have no knowledge of USAID or its network.

o External penetration testing will include fake malicious links sent by email to capture the email addresses of USAID staff that click on the link, and other similar activities, the contractor deems appropriate.

o Upon award, research for external penetration testing will begin. Most research for the external penetration testing will be completed before the entrance conference only to the point of identifying potential access points and weakness that could be exploited to gain access—without scanning or accessing USAID’s network and without the knowledge of USAID officials.

o The contractor will conduct an independent, credentialed internal scan of USAID’s entire network (including web applications, servers, workstations, and network devices), analyze the results, and identify causes of vulnerabilities identified.

o The contractor’s report will present areas of specific concern (such as missing patches), rather than identifying the number of vulnerabilities by severity level that the testing tool identified.

o The contractor will use an OIG-issued laptop to test whether it can penetrate USAID’s network and to conduct the internal vulnerability assessment.

o All software licenses that the contractor will purchases for this BPA call will become the property of OIG.

o USAID must approve the software that will be installed on the OIG-issued laptop.

o OIG will issue the official draft and final reports to the Agency.

In addition, assume that it will take:

o 45 days to onboard the contractor’s staff.

o 45 days, including various meetings to receive, configure, and obtain clearance to use an

OIG laptop to perform the technical vulnerability assessment and to complete the external penetration testing; arrange administrator level network access; and complete and sign the rules of engagement, which must be in place before commencing the technical vulnerability assessment and scanning or accessing USAID’s network as part of the penetration testing.

o 30 days for contractor to work with the COR to respond to comments from internal OIG reviewers’ comments through issuance of the official draft evaluation report.

o 30 days for the Agency to provide comments on the OIG’s official draft evaluation report.

o 30 days for the contractor to work with the COR to analyze the Agency’s comments and respond to internal OIG reviewers’ comments through issuance of the official final evaluation report.

Finally, if different than the System of Quality Controls factor for the BPA Contract proposal, the contractor must describe in detail the contractor’s (and subcontractor’s if applicable) internal quality controls over its technical services provided in relation to section 1 of “Mock BPA Call

Order: Network Defenses,” including planning, completion of the testing and analysis (referred to as “fieldwork”), and reporting.

• System of Quality Controls

For this section of the proposal, the offeror must describe in detail the contractor’s (and subcontractor’s if applicable) internal quality controls over its technical services provided in relation to section 1 of this BPA. Note that, for each BPA call, the contractor will be required to provide updated information on its system of quality controls and to attest whether it followed its system of quality controls for the services provided.

• National Security Agency Certification

For this section of the proposal, the offeror must provide evidence that the firm is National Security Agency Certification, if applicable.

(END OF SECTION M)