Technical Support Services QnA_FINAL.pdf

Technical Support Services

Solicitation # 72001G25R00001

Price/Solicitation/Award Related Questions

Proposal Submission:

1. Re: Instructions to Offerors 5. General Instructions.

FAR 12.303 includes the SF33 and Representations and Certifications as part of the proposal submission. Should offerors submit those with the proposal and, if yes, in what volume?

If it preferred that your reps and certs be available via SAM.gov; however, if your reps and certs are not available via your SAM.gov, you must present them with the proposal as a separate volume titled “Representations and Certifications”.

2. Please confirm that the only response page limits are for the description of past work experience

(3 pages).

Confirmed. The only response page limits are for the description of past work experience.

3. In multiple places [Attachment II] refers to itself as a “Gift Agreement.” Can USAID please confirm that Attachment II is the correct Attachment and, if so, update these references to “Non-

Disclosure and Conflicts of Interest Agreement.”

This is the correct attachment. However, please see the response to the question below.

4. In the Conflict of Interest section of [Attachment II], [it] asks that personnel working on the contract certify that they (a) have no financial interest in the actions of USAID, (b) that their spouse, children, or partners, have no such financial interest, and (c) that the organization at which they are employed has no such interest. Such representations would usually only be required as part of a FAR 52.203-16 Preventing Personal Conflicts of Interest certification, which are to be used when personnel are performing acquisition functions closely associated with inherently governmental functions. As such work does not appear to be within the scope of this contract these certifications seem potentially misplaced. Additionally, it is unclear how any personnel could make the certifications as currently drafted, as the personnel performing this work will inherently be working for a company that has a financial interest in the official actions of USAID, such as whether USAID issues orders under the BPA, provides funding for the orders, or terminates an order. Given the above, we would request that USAID review this section and either remove this requirement or limit the certification to employees not being aware of any organizational conflicts under FAR 9.5 that would prevent them from performing under this contract.

The attachment was provided only as a sample of what the actual document may contain.

However, it will be removed from the package to eliminate confusion. The requirement for an

NDA and conflict of interest for contractor staff remains.

5. On page four of the RFP, the document states the contractor would be providing financial statement audit services in option year four. This does not appear consistent with the Scope of

Work, can USAID clarify?

The verbiage and titling have been corrected. The revised document will be uploaded to

SAM.gov.

6. Are the content and index page included in the page count?

That can be left up to supplier discretion.

7. Can we get an extension of 4 weeks time?

The due date for proposals has been extended from Dec. 4 to Dec. 27.

Price:

1. Can you confirm the expectation for separating costs for internal vs. external testing? Is it mandatory to use a specific cost structure or categories as highlighted in Attachment III?

We are requesting offerors to provide separate costs for internal versus external testing to facilitate our ability to analyze the price proposal. The offeror may propose additional labor categories, but at a minimum, should use the categories specified in Attachment III.

2. Could you clarify if the cost and timeline of Tier 2 and Tier 2R investigations should be included in the base period pricing?

Yes, this should be included in the base period pricing.

Current Service:

1. Is there an incumbent for this work? If yes, who is the incumbent?

There is no incumbent; this is a new requirement.

Award/Post-Award:

1. Does the government intend to award the Mock BPA?

There is potential for the mock call order to be awarded; if so, it would be awarded after the award of the BPA.

2. Can you clarify the process for defining "bilateral agreement" in the context of increasing the $5 million maximum value? Does this require separate solicitation, or is it considered part of the existing BPA?

The BPA ceiling would only be increased via bilateral modification to the BPA contract, meaning both parties would agree to the new ceiling and a modification would be issued for signature by both parties. This does not require a separate solicitation because it is considered part of the existing BPA.

3. Could you provide further details on the criteria USAID will use to evaluate the "detailed plan of internal quality controls" required in each BPA call?

For the mock call, we will be assessing the extent to which the quality control plan addresses each phase of the technical vulnerability assessment and external penetration test. The goal of the plan is to assure that the results reported are accurate.

For any future call orders, details of the criteria will be provided at the call order level. It is not unreasonable to assume that the quality control plan may look the same for each call order, depending on the technical services needed at the time.

Evaluation:

1. Kindly clarify the technical evaluation factors order of importance or are these provided in descending order of importance are these of equal importance.

The technical evaluation factors have been placed in descending order of importance in

Amendment 003 of the solicitation. This update was made in the instructions to offerors reference document and section ‘M’ of the solicitation document, but they have been listed below in said order for ease.

Contractor’s Statement of Independence Contractor’s Past Performance Response to Mock BPA Call Order: Network Defenses System of Quality Controls National Security Agency Certification

Provisions/Clauses/Policies:

1. Should the contractor provide a contingency plan for loss or damage to USAID-issued equipment, or does USAID provide such a policy?

The solicitation has been amended to include clauses FAR 52.245-1 (Government Property-- Alternate I) & FAR 52.245-9 (Use and Charges) to address the issuance, use, replacement, and repair of government furnished property. If awarded, the contractor shall abide by these clauses.

Technical/Requirements Related Questions

Statement of Work Requirements (BPA Contract):

1. Could USAID provide clarity on the expected outcomes of the post-award meeting, particularly concerning alignment on deliverables, timelines, and stakeholder expectations?

The goal is to ensure the contractor fully understands the objective, deliverables, timelines, expectations, and other key aspects. This time will also be used for introductions and to answer the contractor’s questions.

Technical Evaluation Factor - Contractor’s Statement of Independence:

1. Can USAID [OIG] confirm that the requirement for a Contractor’s Statement of Independence is intended to address whether the contractor has a FAR 9.5 organizational conflict of interest that would prevent the contractor from performing the services sought under this BPA and that a certification that the contractor is not aware of such a conflict will be sufficient to meet this requirement.

The certification is to attest that no impairment of independence or conflict of interest exists or is perceived. Independence of the contractor and staff working on any engagements is required to meet the Council of the Inspectors General on Integrity and Efficiency’s Quality Standards for

Inspection and Evaluation and the U.S. General Accountability Office’s Government Auditing

Standards. In addition to organizational (referred to as structural) conflicts, the certification covers self-interest, self-review, bias, familiarity, undue influence, and management participation threats. In the mock call, see Appendix I for Section 1, “Conceptual Framework for Independence

Assessment Checklist” for a description of these conflicts. Also in the mock call, see Appendix II for Section 1, “Statement of Professional Independence From the Organizations and Programs

Under Evaluation” for the certification template.

Technical Evaluation Factor - National Security Agency Certification:

2. Re: Instructions to Offerors 5.1.2 Technical Proposal National Security Agency Certification

Would the Government consider accepting Offerors proof of a facility security clearance in lieu of the NSA certification to demonstrate trustworthiness?

The government will not accept proof of facility security clearance in lieu of the NSA Certification.

Certification by the National Security Agency is preferred but it is not a disqualifying factor.

Technical Evaluation Factor - Mock Call Order:

1. For the Mock BPA - Statement of Professional Independence can USAID confirm that the requirement for a Contractor’s Statement of Independence is intended to address whether the contractor has a FAR 9.5 organizational conflict of interest that would prevent the contractor from performing the services sought under this BPA and that a certification that the contractor is not aware of such a conflict will be sufficient to meet this requirement.

The certification is to attest that no impairment of independence or conflict of interest exists or is perceived. Independence of the contractor and staff working on any engagements is required to meet the Council of the Inspectors General on Integrity and Efficiency’s Quality Standards for

Inspection and Evaluation and the U.S. General Accountability Office’s Government Auditing

Standards. In addition to organizational (referred to as structural) conflicts, the certification covers self-interest, self-review, bias, familiarity, undue influence, and management participation threats. In the mock call, see Appendix I for Section 1, “Conceptual Framework for Independence

Assessment Checklist” for a description of these conflicts. Also in the mock call, see Appendix II for Section 1, “Statement of Professional Independence From the Organizations and Programs

Under Evaluation” for the certification template.

2. [As a part of the Response to Mock Call Order,] could USAID [OIG] specify the degree of flexibility permitted for the contractor to propose alternative methodologies or frameworks for evaluations that deviate from NIST SP 800-115, provided they achieve equivalent or superior results?

The contractor may propose alternative methodologies, as long as they provide equivalent results and align with the intent of NIST SP 800-115.

3. Re: Technical Support Services Instructions to Offerors 6.4 Requirements for Staffing

Please confirm the on-site requirements, hybrid and teleworking option, if any for all Contractor staff. Except for the actual pen testing tasks, will the Government allow performing other duties off-site?

The Government will allow the contractor to perform duties off-site with the understanding that duties may need to be completed on-site to facilitate the work.

4. Is the intent to have the contractor assess systems other that OIG systems?

The intent is to have the contractor assess USAID systems and not OIG systems. USAID is one of four agencies that USAID OIG oversees.

5. Can you provide a comprehensive list of the IT infrastructure components (networks, servers, endpoints, cloud services) to be assessed?

See the table below for a comprehensive list of IT infrastructure components.

Asset Type No. Explanation

Endpoints 17,659 Windows & Linux Servers: 1,336 (Windows: 908 + Linux:

428) Workstations: 16,323

Networking devices 2,340 Firewalls: 230 Routers: 270 Switches: 750 Riverbeds: 34 Wi-Fi Arrays: 1,056 (Arrays: 3 + Access Points: 1,053)

IPS: 0

AirTights: 0

Input/output devices 8,288 Printer: 1,252 IP Phone: 6,716

VTC: 320

6. For the penetration testing, should both internal and external networks be tested, or is the focus on a specific environment?

We believe that you are asking whether the penetration test will involve (1) penetration testing from outside the network or (2) once inside the network, penetrating systems. If so, the penetration testing will be starting from outside of USAID’s network. The vulnerability assessment will be scanning from inside the network.

7. Are any legacy systems in place that may require special handling or additional time for assessment?

No.

8. What are the cloud services currently in use, and are there specific platforms or configurations that need particular focus?

The cloud services currently in use are Platform as a Service, Infrastructure as a Service, and

Software as a Service. No, there are not specific platforms or configurations that need particular focus.

9. Should the penetration tests include social engineering attacks, such as phishing campaigns or physical security tests, as part of the security evaluation?

Yes. Specifically, penetration testing should include tests to assess whether USAID staff are susceptible to malicious emails.

10. Is Intrusion Detection/Prevention in place?

Yes.

11. Will the testers be whitelisted?

Yes, assuming you are asking whether the Agency will give the contractor appropriate access to run its technical vulnerability assessment, and not stop the testing.

12. What is the anticipated deliver completion date?

Ten months following award.

13. How many web applications are in-scope for testing?

None for the internal technical vulnerability assessment. For the external penetration test, any

USAID web application is in scope.

14. How many estimated dynamic pages does each application contain?

USAID estimates that it has 67,900-72,900 dynamic pages.

15. Are there any API that needs to be tested?

No.

16. Is Pentesting going to be Grey Box (Authenticated) or Blackbox (unauthenticated)?

Assume that external penetration testing will be authenticated.

17. Are there predefined templates or tools for the listed deliverables such as training material and sandbox environments, or will these need to be developed from scratch?

Some templates are in the mock BPA call, Appendices I-IV. In addition, see the OIG’s official evaluation report embedded in the response to question 5 under the Statement of Work

Requirements section above. OIG does not have a sandbox environment.

18. Can you confirm if USAID will provide any licenses for penetration testing tools, or must all software costs be included in the proposed budget?

OIG will not provide licenses for penetration testing tools. All software costs must be included in the contractor’s cost proposal. That said, USAID only allows the software in the file below inside of its network. This must be considered for the technical vulnerability assessment.

Product List - USAID Service Central2.pdf

19. For tasks involving external penetration testing, what level of pre-existing network or infrastructure knowledge is permissible for contractors to acquire during pre-engagement phases?

The contractor may gather all necessary information to complete the work during the pre-engagement phase—without touching (e.g., no port scanning or pinging) USAID’s network.

20. Will USAID provide any pre-approved software licenses for vulnerability assessment and penetration testing, or must contractors propose and justify their toolset as part of the proposal?

OIG will not provide licenses for vulnerability assessments and penetration testing. All software costs must be included in the contractor’s cost proposal.

21. In Section 1.4 Scope of Work could the government clarify the use of the term “audit” – is audit being used to mean review, or is an actual audit intended?

In section 1.4, the term “audit” means an audit conducted in accordance with the U.S. General

Accountability Office’s Government Auditing Standards in effect at the time of the audit. An actual audit may be required, if specified in the BPA call. However, an OIG team will work with the contractor to assure all audit phases are conducted in accordance standards. The technical contractor for this award would perform the technical planning, testing, and reporting. OIG would document the technical contractor’s work in accordance with standards. OIG would also issue an official audit report that meet standards.

22. Is there a standard format or template for the technical report and discussion paper, or will the contractor have the flexibility to design these deliverables?

There is no template for the technical report and discussion paper; however, Task 2.3 outlines the information to be included in the discussion paper. Ultimately, the discussion paper will become the OIG’s evaluation report using the following template—unless OIG leadership requires the OIG team to use a different report format.

0610B-Final-Evaluat ion-Report-Template.dotx

23. For compliance with Section 508, does USAID provide tools or resources to check document accessibility, or is the contractor expected to have such tools?

The contractor ensures compliance with section 508 requirements. This can be accomplished by converting the report to PDF and using adobe professional. OIG will also run its tools and can assist the technical contractor with this process.

24. Will USAID [OIG] provide direct access to training platforms, or will contractors need to arrange and pay for external cybersecurity certifications?

The contractor is responsible for arranging and covering the costs of external cybersecurity certifications.

25. Are there specific metrics or thresholds USAID [OIG] employs for evaluating contractor adherence to quality standards, such as report clarity for non-technical stakeholders or technical accuracy for internal agency staff?

Yes. In the mock BPA call, Tasks 2.4 – 2.6 and Appendix VII of Section 1, “Report Quality Factors.”

26. Regarding Task 2.1, will the initial document request list provided to the COR require USAID approval before it is shared with the evaluation liaison, or does the contractor have discretion in its finalization?

The initial document request list will require approval from the OIG COR before it is provided to

USAID’s evaluation liaison. However, the COR will focus on clarity of the requests and may suggest other documents based on knowledge of USAID. After COR approval, the COR will submit the initial document request to the Agency evaluation liaison.

27. For Task 2.4, how should the contractor handle situations where non-technical report content contains sensitive but unclassified information that cannot be redacted without loss of meaning?

OIG will work with the contractor to minimize the need to redact the report. For example, for some reports USAID officials have agreed that the information did not need to be redacted if the system name was not included in the report. If the report ultimately contains Sensitive But

Unclassified, contractor should mark such document as such in the header and footer, but not redact the information. OIG will work with the Agency to determine what should be redacted. In the final report, OIG will redact the information.

28. What is the expected timeframe for receiving and configuring OIG-issued laptops, and are contractors allowed to request additional specifications for these devices to ensure compatibility with their testing methodologies?

OIG estimates that it will take 3 weeks from the time of the COR’s request to make the OIG-issued laptop available for pickup. That said, the contractor must have completed the onboarding process, which takes about 45 days, before picking up the laptop. The specifications for OIG’s laptops are as follows:

Dell Latitude 5540 or 5450 (whichever is available at the time of the request) Intel i7 core processor

32GB RAM

512GB HD

15” Display

The contractors are allowed to request additional specifications for the laptops to ensure compatibility with their testing methodologies. However, there is no guarantee that OIG will have such laptops in stock or be able to timely procure them. This may take 30 days. Considering that, the contractor must also include in its cost proposal an optional line item for the cost of laptops, including the specifications, which will ultimately become property of the U.S. government.

29. For weekly and biweekly status meetings, are there standardized agendas and reporting formats, or is the contractor expected to develop these collaboratively with the COR?

For weekly status meetings with OIG, the contractor must discuss in detail all work performed since the last status meetings, problems encountered (e.g., delays in receiving information from the Agency), potential vulnerabilities, and potential findings—before presenting them at biweekly meetings with USAID officials. The contractor is not required to prepare a written agenda for this meeting or to report the results (i.e., meeting minutes) of the meeting.

For the biweekly status meeting with USAID officials the agenda must include a discussion of the status of work, impediments to completing the work, and potential vulnerabilities and findings.

Although the contractor is required to provide the agenda at least one day before the meeting, there is no prescribed format for the agenda. The contractor is not required to prepare a report on the meeting results.

Payment Schedule:

1. The 50% payment for tasks 2.3-2.5 is only paid at completion of deliverables. This could place an undue burden on small businesses. Would the government consider an alternate payment schedule.

Thank you for raising this concern. In response, we have adjusted the payment schedule as follows.

TASK/DELIVERABLE PAYMENT

Completion of Tasks 1.1 - 1.6 6%

Completion of Tasks 2.1 - 2.2 6%

Completion of Task 2.3 20%

Completion of Tasks 2.4 20%

Completion of Task 2.5 21%

Completion of Task 2.6 15%

Completion of Tasks 1.7 - 1.9 and 2.7 12%

TOTAL 100%

Onboarding:

1. Does USAID have a predefined timeline or sequence for the onboarding process (e.g., PIV card issuance, RSA token setup)? If delays occur, how should they be addressed contractually?

Yes, OIG has a defined sequence for the onboarding process, and any delays in onboarding should not affect the contract timeline. Contractor staff cannot begin work until the onboarding process is complete, ensuring that the contract schedule remains unaffected. We anticipate that the contractor will be onboarded within 45 days after the contractor provides all onboarding documents.

If delays occur, the COR is allowed to approve some deliverables after the due date. See deliverables in delivery table that state, “unless otherwise agreed to by the COR” in the due date.

Though not anticipated, if delays cause the contract to go beyond the period of performance, OIG’s contracting officer will modify the contract to extend the period of performance.

2. Could USAID clarify the expected timeline for completing background checks (e.g., Tier 2 investigations) for onboarding contractor personnel, and how delays beyond 45 days might affect the project schedule?

We anticipate that the contractor will be onboarded within 45 days after all onboarding documents are provided. If delays occur, the COR is allowed to approve some deliverables after the due date. See deliverable in the delivery table that state, “unless otherwise agreed to by the

COR” in the due date. While we expect there to be enough cushion in the schedule to allow minimal delays, if delays go beyond the period of performance, OIG’s contracting officer will modify the contract to extend the period of performance.

3. Are there any prerequisites or certifications (beyond Tier 2 public trust) USAID requires for key personnel, such as the Senior Cybersecurity Officer or Security Officer?

Yes, each key personnel on this task shall have at least 5 years of experience in the following:

• Using common technical vulnerability assessment tools, including proper credentialing, loading updates, and configuring the application to run in a safe mode.

• Interpreting the results of scanning reports and identifying false positives.

• Testing network infrastructure, servers, and clients and their common vulnerabilities and exposures. In addition, key personnel must be knowledgeable of how a typical organization sets up its network and security measures, such as firewalls and routers.

• Implementing penetration testing phases: reconnaissance, scanning, vulnerability assessment, exploitation (though this phase will not be performed for this engagement— unless explicitly approved by USAID management in writing), and reporting.

• Researching and recommending solutions to mitigate common vulnerabilities and exposures.

• Orally communicating technical results and solutions to technical and non-technical audiences in a clear, convincing manner.

• Preparing written results of penetration tests and vulnerability assessments for non-technical audiences.

In addition to the areas above, key personnel assigned to this BPA order are as follows and must meet the following.

• Senior Cybersecurity Professional (key personnel). The individual shall possess a bachelor’s degree in cybersecurity, computer science, information technology, or equivalent;

certification in penetration testing and vulnerability assessments, such as a Computing

Technology Industry Association PenTest+, Global Information Assurance Certification

Penetration Tester, Cybersecurity Service Provide, Certified Ethical Hacker, Certified

Penetration Tester, or equivalent; and more than 10 years of experience in conducting penetration testing and vulnerability assessments.

• Mid-level Cybersecurity Professional (key personnel). The individual shall possess a bachelor’s degree in cybersecurity, computer science, information technology, or equivalent;

certification in penetration testing and vulnerability assessments, such as Computing

Technology Industry Association PenTest+, Global Information Assurance Certification

Penetration Tester, Cybersecurity Service Provide, Certified Ethical Hacker, Certified

Penetration Tester, or equivalent; and at least 8 years of experience in conducting penetration testing and vulnerability assessments.

For a full list of prerequisites and certifications for other personnel, please refer to Section 4.1.