SF30- Amendment 3-SEWP VI-6.24.24.pdf
PDF 1 MB Posted
- Attached to
- Amendment 14-SEWP VI Final RFP (6th Generation of Solutions for Enterprise-Wide Procurements) Federal contract opportunity
- Solicitation number
- 80TECH24R001
About this file
This document appears to be Amendment 3 to the Final Request for Proposal (RFP) for the 6th Generation of Solutions for Enterprise-Wide Procurements (SEWP VI) Government-Wide Acquisition Contract (GWAC). The RFP is issued by the National Aeronautics and Space Administration (NASA) Information Technology Procurement Office and has an anticipated contract award date of May 1, 2025 with a 10-year ordering period. The principal purpose is to provide the federal government an acquisition vehicle for Information Technology Product and Service Solutions. Offerors may propose products and services across a wide range of NAICS codes, including 541512 - Computer Systems Design Services and 541519e - IT Value Added Reseller. Responses to the RFP are due approximately 60 calendar days after the planned release date of February 2024. The RFP includes instructions and requirements related to supply chain risk management, security, physical security, personnel security, supply chain integrity, and supply chain resilience. NASA has provided sample response templates and attestation forms for offerors to complete as part of their proposal.
View the file
Other files for this federal contract opportunity
Show all 50
Amendment 14-SEWP VI Final RFP (6th Generation of Solutions for Enterprise-Wide Procurements) has more files on GovTribe.
On GovTribe
Work with this file on GovTribe
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
CYBER-SUPPLY CHAIN RISK MANAGEMENT PLAN
Version 1 - 4/2124
INSTRUCTIONS
INTRODUCTION:
U S adversaries have attacked our nation's supply chains and compromised Federal Government systems, capitalizing on security weaknesses in U S companies and third party affiliates It is incumbent on NASA SEWP's industrial base to implement vigilant Supply Chain Risk Management procedures to ensure proper risks and mitigation of risks are identified
This document is intended to evaluate a potential contractor's SCRM maturity
TEMPLATE COMPLE TION INSTRUCTIONS:
• Provide a contact (name, email, and phone number) for questions, support, or additional information related to the questionnaire to the respondents
• We recommend designating one primary POC from your organization who will collaborate with the appropriate POCslteams/vendor/supplier to coordinate and collect and compile responses for each section The appropriate POCs within each organization will vary and may consist of individuals in information technology, acquisition, procurement, supply chain, or security offices While related, each section is design to be relevant to a different aspect of your organization This template is intended to gather an initial and consistent baseline and additional follow-up questions from the organization, or other documentation, may be warranted
• Provide your responses in the text box in the text entry boxes provided
• Provide a response to each 'Yes ', 'No' question as relevant to the offering
• If the response is No, provide a summary explanation and risk mitigation plan in the summary explanantion box
If the requested supply chain risk management information on the next tab has previously been provided to the requesting organization, pro,"ide an updated revision covering mate
A Critfoa.l Compo11e11t is d,Jitted as: A SJ1stem element that, if comprom ised, damaged, or failed, could cause a mission or b11sU1ess fail11re
Name of Respondent:
Title:
Name of Organization:
Phone number:
Email:
SECT. 1 SUPPLY CHAIN PROVENANCE VENDOR
RESPONSE
(Yes/No)
If the response is No, provide a summary explanation and risk mitigation plan Identity - including that of each parent and/or subsidiary corporate entities.
1.1 Are suppliers of critical ICT components iden ified?
1.2 Is the company ownership of suppliers of critical ICT components verified?
1.3 Are suppliers of critical ICT components under U.S. ownership?
1.4 If distributors will be used to provide products/services to the Government, is a threat analysis performed for each distributor?
1.5 Are any subcontractors and/or suppliers located outside the United States or its territories? If "yes", list company name(s) and foreign country location(s).
1.6 Are Basic Security Requirements (not Derived Security Requirements) implemented for the fourteen families in Chapter Three of NIST SP 800-171 R3, Protecting Controlled Unclassified Information in Nonfederal Systems?
SECT. 2 SUPPLY CHAIN MANAGEMENT AND SUPPLIER GOVERNANCE
General
2.1 Are policies/processes in place to ensure timely notification of updated risk management informa ion previously provided to the Contracting Officer and Contracting Officer's
Information Communications Technology (ICT) Supply Chain Management
2.2 Is there a documented Quality Management System (QMS) based on an industry standard or framework for the prime contractor's Information and Communications Technology (ICT) supply chain operation? If "yes" provide QMS documentation.
Supplier Governance
2.3 Do Supply Chain Risk Management (SCRM) requirements exist in contracts with critical ICT
2.4 Is there a process to verify that suppliers are meeting SCRM contractual terms and conditions, including, where applicable, requirements to be passed down to sub-suppliers?
SECT. 3 INFORMATION SECURITY
Identify
3.1 Is there a process used to verify hat information is categorized according to legal, regulatory, or internal sensitivity requirements?
3.2 Are the policies and procedures referenced in 3.1 reviewed and updated annually? When was the most recent review?
Detect
3.3 Are incident detection and reporting prac ices defined and documented which outline the actions that should be taken in the case of an information security or cybersecurity event?
3.4 Are cybersecurity events centrally logged, tracked, and continuously monitored?
3.5 Is endpoint protec ion software deployed throughout the prime contractor's environment? If "no", describe the mitigation efforts used instead.
3.6 Is there a documented incident response process and a dedicated incident response team (CSIRT - Computer Security Incident Response Team)? If "no", describe the mitigation efforts used instead.
SECT. 4 PHYSICAL SECURITY
4.1 Is the entity (organization, operational unit, facility, etc.) curren ly covered by an unrestricted/unlimited Na ional Industrial Security Program (NISP) Facility Clearance (FCL) or a related U.S. government program such as C- TPAT that certifies the entity as meeting appropriate
4.2 Are security policies and procedures documented which address the control of physical access to cyber assets (network devices, data facilities, patch panels, industrial control systems, programmable logic, etc.)?
4.3 Are physical security industry standards/controls adhered to? (e.g., NIST publication, ISO, UL, etc )
CONTACT INFORMATION
C-SCRM PLAN TEMPLATE
I
4.4 Are the policies and procedures listed in 4.3 reviewed and updated at least annually? When was the most recent review?
4.5 Does a documented Security Incident Response process exist which covers physical security incidents at the prime contractor's owned or operated facilities (e.g., potential intruder access, missing equipment, etc.)? If "no", describe mitigation efforts.
Physical Security In-transit
4.6 Are requirements in place to ensure the use of Original Equipment Manufacturer (OEM) or
Authorized Distributors for all critical ICT components?
4.7 Are counterfeit prevention requirements passed on to second and third party suppliers?
SECT. 5 PERSONNEL SECURITY
5.1 Is a personnel security program implemented at the prime contractor's owned or operated
5.2 Are physical security practices documented or formally governed?
Onboarding
5.3 Are policies documented for conducting background checks of prime contractor employees as permitted by each country in which you operate?
SECT. 6 SUPPLY CHAIN INTEGRITY
6.1 Are documented processes in place for managing third-party products and component defects throughout their lifecycle?
6.2 What provisions for auditing are included within supplier contracts?
6.3 Are hardware/software products or services integrity and End of Life requirements passed down to second and third party suppliers?
6.4 Are processes in place for addressing reuse and/or recycle of hardware products?
SECT. 7 SUPPLY CHAIN RESILIENCE
7.1 Is a formal process documented for ensuring supply chain resilience as part of your product offering SCRM practices?
Supply Chain Disruption Risk Management (Business Continuity)
7.2 Can prime contractor personnel work remotely?
7.3 Is a data backup policy in place that aligns with NIST SP 800-53 CP-9?
7.4 Has your organization conducted vulnerability assessments, risk assessment, or other calculations to identify what impact physical risks associated with climate related risks (e.g., increases in precipita ion-driven flooding, extreme heat events, and inundation due to sea level rise and storm surge) might have on your assets, products, and/or services?
7.6 Does your organization have a disaster response plan that includes contingency plans and response protocols for potential short-term acute events (e.g., hurricane, earthquake, flooding, and etc.) and long-term climate related risks impact (e.g.; changes in precipitation, increased average temperature, and sea level rise)?
7.7 Does your organization's disaster response plan include how to manage potential increases in frequency, severity, or duration of weather events?
7.8 Does he disaster response plan describe which assets, products, services would most significantly disrupt operations if they experienced short term acute damage (immediate failure, either temporary or catastrophic).
7.9 Does he disaster response plan describe which assets, products, services, would most significantly disrupt operations if hey experienced gradual long-term cumulative damage (slower degradation; greater wear and tear).
Attachment L C-SCRM Attestation Form Instructions.pdf
Instructions
Attachment L C-SCRM Attestation Form 2024.pdf
Template
Title:
Name of Organization:
Phone Number:
Email:
Summary Response 1:
0:
1:
2:
4:
5:
0:
3:
Summary Response 2:
0:
1:
2:
3:
0:
Summary Response 3:
0:
1:
2:
3:
4:
5:
0:
Summary Response 4:
1:
0:
1:
0:
1:
4:
0:
1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
0:
1:
2:
3:
4:
Name of Respondent:
Yes:
0: Off
1: Off
2: Off
3: Off
4: Off
5: Off
6: Off
7: Off
8: Off
9: Off
10: Off
11: Off
12: Off
13: Off
14:
0: Off
1: Off
2: Off
3: Off
4:
0: Off
1:
0: Off
1: Off
2: Off
3: Off
4: Off
5: Off
6: Off
7: Off
8: Off
9: Off
10: Off
11: Off
12: Off
13: Off
14: Off
15: Off
16: Off
17: Off
18: Off
No:
0: Off
1: Off
2: Off
3: Off
4: Off
5: Off
6: Off
7: Off
8: Off
9: Off
10: Off
11: Off
12: Off
13: Off
14:
0: Off
1: Off
2: Off
3: Off
4:
0: Off
1:
0: Off
1: Off
2: Off
3: Off
4: Off
5: Off
6: Off
7: Off
8: Off
9: Off
10: Off
11: Off
12: Off
13: Off
14: Off
15: Off
16: Off
17: Off
18: Off
Category A
Offeror NAICS Size Standard Crosswalk
SEWP VI Exhibit 4
Complete the below table IAW the instructions provided in A.3.7.1 Offer Volume Subsection(C ) Offeror NAICS Size Standard Crosswalk .
Company Name
Category A-541519e
NAICS Description Size Standard
325910 Printing Ink Manufacturing
325992 Photographic Film, Paper, Plate, and Chemical Manufacturing
333316 Photographic and Photocopying Equipment Manufacturing Note: Such as Cameras (Except Television and Video), Projectors, Film Developing Equipment, Photocopying Equipment, And Microfilm Equipment.
334111 Electronic Computer Manufacturing
334112* Computer Storage Device Manufacturing
334118 Computer Terminal and Other Computer Peripheral Equipment Manufacturing
334210 Telephone Apparatus Manufacturing
334220 Radio and Television Broadcasting and Wireless Communications Equipment Manufacturing
334290 Other Communications Equipment Manufacturing
334310 Audio and Video Equipment Manufacturing
334419 Other Electronic Component Manufacturing
334510 Electromedical and Electrotherapeutic Apparatus Manufacturing
334511 Search, Detection, Navigation, Guidance, Aeronautical, and Nautical System and Instrument Manufacturing
334610 Manufacturing and Reproducing Magnetic and Optical Media
335139 Stage Lighting Equipment Manufacturing
335311 Power, Distribution and Specialty Transformer Manufacturing
335313 Switchgear and Switchboard Apparatus Manufacturing
334515 Battery testers, electrical, manufacturing
335921 Fiber Optic Cable Manufacturing
335929 Other Communication and Energy Wire Manufacturing
335931 Current-Carrying Wiring Device Manufacturing
335932 Noncurrent-Carrying Wiring Device Manufacturing
335999 All Other Miscellaneous Electrical Equipment and Component Manufacturing
337214 Office Furniture (Except Wood) Manufacturing
339112 Surgical and Medical Instrument Manufacturing
423430 Computer and Computer Peripheral Equipment and software Merchant Wholesalers
512191 Tele production and Other Postproduction Services
512290 Other Sound Recording Industries
513210(footnote 15)** Software Publishers
516210 Subscription Services, Video On Demand, Television Networks
517111 Wired Telecommunications Carriers
517112 Wireless Telecommunications Carriers (except Satellite)
517410 Satellite Telecommunications
517121 Telecommunications Resellers
518210* Computing Infrastructure Providers, Data Processing, Web Hosting, and Related Services
519290 Web Search Portals and All Other Information Services
541330 Engineering Services
541512 Computer Systems Design Services
541513 Computer Facilities Management Services
541519* Other Computer Related Services
541519e(footnote 18)** IT Value Added Reseller
541990 All Other Professional, Scientific and Technical Services
611420 Computer Training
811210 Electronic and Precision Equipment Repair and Maintenance
Category B
Offeror NAICS Size Standard Crosswalk
SEWP VI Exhibit 4
Complete the below table IAW the instructions provided in A.3.7.1 Offer Volume Subsection(C ) Offeror NAICS Size Standard Crosswalk .
Company Name
Category B-541512
NAICS Description Size Standard
512191 Tele production and Other Postproduction Services
512290 Other Sound Recording Industries
513210(footnote 15)** Software Publishers
516210 Subscription Services, Video On Demand, Television Networks
517111 Wired Telecommunications Carriers
517112 Wireless Telecommunications Carriers (except Satellite)
517410 Satellite Telecommunications
517121 Telecommunications Resellers
518210* Computing Infrastructure Providers, Data Processing, Web Hosting, and Related Services
519290 Web Search Portals and All other Information Services
541330 Engineering Services
541430 Graphic Design Services
541490 Other Specialized Design Services
541511 Custom Computer Programming Services
541512* Computer Systems Design Services
541513* Computer Facilities Management Services
541519* Other Computer Related Services
541614 Process, Physical Distribution, and Logistics Consulting Services
541618 Other Management Consulting Services
541611 Administrative Management and General Management Consulting Services
541690 Other Scientific and Technical Consulting Services
541715 Research and Development in the Physical, Engineering, and Life Sciences (except Nanotechnology and Biotechnology)
541990 All Other Professional, Scientific, and Technical Services
561621 Security Systems Services (except Locksmiths)
611420 Computer Training
Category C
Offeror NAICS Size Standard Crosswalk
SEWP VI Exhibit 4
Complete the below table IAW the instructions provided in A.3.7.1 Offer Volume Subsection(C ) Offeror NAICS Size Standard Crosswalk .
Company Name
Category C-541512
NAICS Description Size Standard
512191 Tele production and Other Postproduction Services
512290 Other Sound Recording Industries
513210(footnote 15)** Software Publishers
516210 Subscription Services, Video On Demand, Television Networks
517111 Wired Telecommunications Carriers
517112 Wireless Telecommunications Carriers (except Satellite)
517410 Satellite Telecommunications
517121 Telecommunications Resellers
518210* Computing Infrastructure Providers, Data Processing, Web Hosting, and Related Services
519290 Web Search Portals and All other Information Services
541330 Engineering Services
541430 Graphic Design Services
541490 Other Specialized Design Services
541511 Custom Computer Programming Services
541512* Computer Systems Design Services
541513* Computer Facilities Management Services
541519* Other Computer Related Services
541614 Process, Physical Distribution, and Logistics Consulting Services
541618 Other Management Consulting Services
541611 Administrative Management and General Management Consulting Services
541690 Other Scientific and Technical Consulting Services
541715 Research and Development in the Physical, Engineering, and Life Sciences (except Nanotechnology and Biotechnology)
541990 All Other Professional, Scientific, and Technical Services
561621 Security Systems Services (except Locksmiths)
611420 Computer Training
| 2024-06-24T18:01:42-0400 | |
| ANDREA Ross |
File details come from the government source that posted it. Updated .