Attachment 1 - ITO DevSecOps 15July2020.pdf

Attachment 1 Request for Quote FA8307-20-R-0112

Instructions to Offerors/Basis for Entering into Agreement Software DevSecOps Services

15 July 2020

1. Instructions to Offerors:

A. This is a competitive action conducted in accordance with (IAW) Federal Acquisition Regulation (FAR) Part 16. The intent of this action is to onboard additional contractors to the Basic Ordering Agreement (BOA) for Software DevSecOps Services. It is not a source selection that is subject to FAR 15.3 procedures.

B. Any quote submitted in response to this Request for Quote (RFQ) must be in compliance with the terms and conditions outlined in the RFQ and attachments, and the Statement of Objectives (SOO), dated 29 June 2020. All claimed capabilities to meet the requirements shall be realistic and are subject to verification by the Government. Non-conformance with these instructions may result in rejection of the quote or an unfavorable quote evaluation, or being deemed ineligible for a BOA.

C. The quote shall be clear, concise, and shall include sufficient detail for effective evaluation and for substantiating the validity of stated claims. The quote should not simply rephrase or restate the Government's requirements but, rather, shall provide convincing rationale and examples to address how the Offeror intends to meet these requirements. Offerors shall assume that the Government has no prior knowledge of their experience and will base its evaluation on the information presented in the Offeror's quote.

D. Discrepancies. If an Offeror believes that the requirements in these instructions contain an error, omission, or are otherwise unsound, the Offeror shall immediately notify the Contracting Officer (CO) in writing with supporting rationale as well as the remedies the Offeror is asking the CO to consider as related to the omission or error.

E. System for Award Management (SAM) Requirements: Offerors must be registered and active in the SAM database. If registration is not active at the time of BOA issuance, the Offeror will not be eligible to receive BOA. Offerors may obtain information on registration at https://sam.gov and/or https://www.acquisition.gov.

F. Consent to Disclosure and Company-to-Company Non-Disclosure Agreements (NDAs)

A. The Government has determined that neither personnel from the requesting agency, nor from another agency, with adequate training and capabilities to perform the required quote evaluation are readily available. Therefore, the Government intends to make use of the following companies to perform advisory and assistance services (A&AS) for this RFQ:

• MITRE Corporation

• Applied Research Solutions

B. Pursuant to FAR 9.505-4(b), Obtaining Access to Propriety Information, a contractor that gains access to proprietary information of other companies in performing A&AS for the Government must agree with the other companies to protect their information from unauthorized use or disclosure for as long as it remains proprietary and refrain from using the information for any purpose other than that for which it was furnished. The CO shall obtain copies of these agreements and ensure that they are properly executed. While FAR 9.505-4(b) affords Offerors the ability to obtain an NDA from any company that will provide A&AS to the Government for this RFQ, Offerors may choose not to do so.

If an Offeror chooses the latter, the Offeror must provide clear indication of that choice in writing to the CO prior to or at the time of submission of its quote. If an Offeror chooses to obtain an NDA, to facilitate that process the Government is providing the points of contact, with address, to whom Offerors should submit both their and any subcontractor NDAs for signature:

MITRE POC Information:

Michael Leonard michael.leonard.11.ctr@us.af.mil The MITRE Corporation 4801 Northwest Loop 410, Suite 1000 San Antonio, TX 78229

ARS POC Information:

Jose Ramos Applied Research Solutions 7750 IH 10 West, Suite 1006 San Antonio, TX 78229 jose.ramos.12.ctr@us.af.mil

C. Offerors' NDAs should be:

(1) In the format and with the content preferred by the Offeror so long as it meets the intent of FAR 9.505-4(b),

(2) Signed by the Offeror,

(3) Written such that it can be signed by an appropriate employee of the A&AS provider; and,

(4) By the RFQ due date email a fully executed NDA to Ms. Christina Fernandez at christina.fernandez@us.af.mil with a copies to Ms. Ebonie Charles at ebonie.charles@us.af.mil and Ms. Dawn Davenport at dawn.davenport@us.af.mil.

D. If an Offeror objects to disclosure of any part of its quote to the A&AS provider identified above, then within three working days of the date of issuance of this RFQ, its objection to disclosure of a portion of its quote (a) shall be provided in writing to the CO within 3 days of RFQ issuance, and,

(b) shall include a detailed statement of the basis for the objection. The detailed statement shall identify the specific portions of the quote to which the Offeror objects to disclosure to the A&AS advisor. Note that the failure to permit disclosure of any part of an Offeror's quote to the A&AS advisor could result in those withheld portions of the Offeror's quote not being evaluated, which could impact the Offeror's ability to receive a BOA. Note that a NDA is only required if the company chooses to enter into one with another company. The Government is not requiring companies to execute a NDA in order to submit a quote.

G. Period of Performance: The ordering period for this BOA is from date of award through 14 January 2025. The performance period for all orders placed under this BOA shall not exceed five (5) years from the completion of the ordering period.

mailto:jose.ramos.12.ctr@us.af.mil

H. Offerors shall submit one (1) electronic copy of their quote via email on or before the RFQ closing date 10 August 2020, 12:00 PM CDT to Ms. Ebonie Charles at ebonie.charles@us.af.mil, Ms. Dawn Davenport at dawn.davenport@us.af.mil and Ms. Christina Fernandez at christina.fernandez@us.af.mil. Quotes received after the time and date listed will not be considered or evaluated for receipt of a BOA. The Government will not be responsible for any failure of receipt of the quote or any failure of the Offeror to verify receipt of the quote.

I. Questions regarding this RFQ shall be submitted on the template provided (Attachment 6) to the points of contact listed above no later than 21 July 2020 at 12:00 PM CDT. Once the Government provides responses to questions, Offerors will be afforded an opportunity for verbal interchanges via an Ask Me Anything (AMA) session to clarify responses provided. Questions with the Government’s responses will be provided via beta.SAM.gov. Please be advised that the Government reserves the right to transmit questions and answers of a common interest to all prospective Offerors.

J. Offerors submitting a quote in response to this RFQ shall submit the volumes identified below. All volumes must be submitted as separate attachments. Quotes shall be clear, concise, and shall include sufficient detail for effective evaluation. Quotes should not simply rephrase or restate the Government’s requirements; but rather, shall provide convincing rationale, where necessary, to address how the Offeror has the required capabilities to meet requirements.

Quotes shall be single-spaced, on 8.5 x 11 paper, have a minimum of one-inch margin all around and not less than Times New Roman 12 pt. font. Fold-outs may be used for tables, figures, and charts only, on 11 x 17 paper and not less than Times New Roman 10 pt. font. Page limits do include fold-outs.

Offerors shall number each page. All quote information shall be submitted in either MS Word, MS Excel, or as a searchable PDF. Do not submit a quote in all formats.

Page limits do not include covers for volumes, tables of contents, glossaries of abbreviations and acronyms, indices, title pages, cross reference indexes, section dividers/tables if they are inserted solely to provide ease to the reader in locating parts/sections of the quote, and pages marked “This page intentionally left blank”.

The following table identifies the page limits to which Offerors must adhere. Pages in excess of these page limits will not be read or considered in the evaluation of the quote. Submit your quote in accordance with the table below. All submissions shall reference the complete RFQ number.

Volume Title Page

Limit

I ADMINISTRATIVE 2

II FACTOR 1: TECHNICAL 5

(1) Volume I: ADMINISTRATIVE

Offerors shall provide a cover letter with their quote to include current points of contact (Contract Manager and Program Manager) that are authorized to obligate your firm, CAGE Code, DUNS, mailing address, current e-mail address and phone number, a statement that the company understands the requirements specified and will meet the performance standards and requirements therein, and acknowledges use of non-Government advisors. Offerors shall also confirm quote validity for 120 days. Limited to no more than two (2) pages.

(2) Volume II: TECHNICAL (FACTOR 1)

(a) Subfactor 1.1 - Technical Capability: Offerors shall include technical narratives for this subfactor. The technical narrative should be specific, complete, clear, legible, and coherent.

Provide as specifically as possible your firm’s capabilities to meet the general scope, demonstrate an ability to hire and maintain qualified personnel, and be co-located in various geographic locations. All the requirements specified in the RFQ are mandatory. By your quote submission, you are representing that your firm will perform all the requirements specified in the RFQ. It is not necessary or desirable for you to tell us so in your quote. Do not merely reiterate the objectives or reformulate the requirements specified in the RFQ. This section is limited to five (5) pages.

(b) Subfactor 1.2 - Oral Presentations/Portfolio Review: If invited to the Oral

Presentations/Portfolio Review, Offerors shall be prepared to present their technical capabilities and to answer any questions about their technical approaches. Offerors shall also be prepared to present a portfolio and/or source code repository that demonstrates a technical understanding of DevSecOps engineering, software development, cybersecurity and/or IT support and operations. Offerors may provide information for several Government or commercial clients that they consider most relevant in demonstrating their ability to perform the proposed effort. The Government is evaluating your technical understanding and capabilities. This can be conveyed through various methods to include links to demonstrations or web applications. Offerors should be prepared to present their source code.

Do not send source code information with the quote.

2. Basis for Entering into BOA:

A. Determination to enter into BOAs will be made IAW the procedures specified in the RFQ and after an assessment by the Government once both phases of evaluation are completed of which Offerors appear most capable of satisfying the Government’s requirements. A BOA may be entered into with an Offeror deemed responsible IAW FAR 9.1, as supplemented, whose quote conforms to the RFQ’s requirements (to include all stated terms, conditions, representations, certifications, and all other information required by the RFQ instructions) and is judged, based on the evaluation factors, as most capable of satisfying the Government’s requirements.

B. The Government evaluation process is as follows:

Step 1: The Government will initially conduct a compliance review of all quotes to determine if they conform to the terms of the RFQ, e.g. page limits, font sizes, spacing, margins, and its material conditions, i.e., those that affect the quantity, quality, or delivery of the goods or services offered. At a minimum, those portions of an Offeror’s quote that do not adhere to the terms will not be considered. A quote that fails to conform to one or more of a RFQ's material terms or conditions is technically unacceptable and cannot form the basis for entering into a BOA. The Government reserves the right to exclude noncompliant quotes from the competition for failing to meet RFQ requirements. Similarly, if terms, conditions, or assumptions are included in a quote, the Offeror’s quote might be excluded from the competition for failing to comply with the RFQ’s instructions.

Step 2: Evaluate technical capability information for all compliant quotes received in response to the

RFQ.

Step 3:

- Offerors who receive a Highly Capable Technical rating will be invited to the Oral Presentation/Portfolio Review as a continuation of the technical evaluation.

- Offerors who receive a Capable or Not Capable Technical rating are not eligible for a BOA and will not be invited to the Oral Presentation/Portfolio Review.

Note that the Oral Presentation/Portfolio Review is a continuation of the technical evaluation and attendance is mandatory in order to receive a BOA. Invitations to the Oral Presentation/Portfolio Review will be provided to qualified attendees on or about 2 September 2020. BOA determination will be contingent on the results of the RFQ.

3. Evaluation Factors

A. Responses to this RFQ will be evaluated against the following:

Factor 1: Technical Subfactor 1.1: Technical Capability Subfactor 1.2: Oral Presentations/Portfolio Review

FACTOR 1: TECHNICAL

Subfactor 1.1 – Technical Capability: This subfactor will be used to determine whether the quote is TECHNICALLY CAPABLE. Please note that any assumptions provided with your quote will be reviewed and may affect your technical capability.

This subfactor is met when the Offeror proposes a technical narrative that is technically sound, realistic, and clearly and completely demonstrates the Offeror’s ability to meet the general scope, ability to hire and maintain qualified personnel, and be co-located in various geographical locations. A sound technical narrative means the overall narrative is well constructed, logically valid, and meets the requirements of the RFQ. A realistic narrative is one that is achievable based on known facts within the commercial marketplace and customary practices. The Government will evaluate this factor based on the following:

– Highly Capable indicates that the company thoroughly discusses how it will meet the general scope of the agreement in great technical detail, is able to co-locate in various geographical locations, and provides a robust mechanism for hiring and retaining highly capable personnel to perform services.

– Capable indicates that the company discusses some of how it will meet the general scope of the agreement, but does not provide specific technical information, does demonstrate the ability to co-locate in various geographical locations, and provides some mechanism to hire and retain capable personnel to perform services.

– Not Capable indicates that the company does not discuss if/how it will meet the general scope of the agreement; an ability to hire and maintain talent, does not demonstrate the ability to co-locate in various geographical locations, and/or does not want to, or is unable to, perform services.

Note: Quotes with a CAPABLE or NOT CAPABLE rating in Subfactor 1.1 will not be eligible for a

BOA.

Subfactor 1.2 – Oral Presentation/Portfolio Review: Offerors who received a Highly Capable Technical rating in Subfactor 1.1 – Technical Capability will be invited to participate in Subfactor 1.2 Oral Presentations/Portfolio Review. Offerors shall plan for an estimated time limit for the Oral Presentation/Portfolio Review of between 15 and 30 minutes; the exact amount of time will be stated in the invitation.

This subfactor is met when the Offeror provides a detailed technical approach and portfolio and/or source code repository sufficient to demonstrate a technical understanding of DevSecOps engineering, software development, cybersecurity and/or IT support and operations. The Government will evaluate this subfactor based on the following:

RATINGS DEFINITIONS

Excellent Oral Presentation and Portfolio indicate a strong technical understanding of

DevSecOps engineering, software development, cybersecurity and/or IT support and operations. Portfolio experience is extremely relevant and demonstrates technical mastery of skills to meet the general scope of BOA.

Good Oral Presentation and Portfolio indicate a good technical understanding of DevSecOps engineering, software development, cybersecurity and/or IT support and operations. Portfolio experience is very relevant and demonstrates exemplary skills to meet the general scope of the BOA.

Acceptable Oral Presentation and Portfolio indicate an average technical understanding of DevSecOps engineering, software development, cybersecurity and/or IT support and operations. Portfolio experience is mostly relevant and demonstrates acceptable skills to meet the general scope of the BOA.

Unacceptable Oral Presentation and Portfolio do not demonstrate adequate technical understanding of DevSecOps engineering, software development, cybersecurity and/or IT support and operations. Portfolio experience is not relevant and does not demonstrate adequate skills needed to perform the general scope of the BOA.

4. Although past performance will not be used as an evaluation factor, such information obtained from other sources available to the Government, e.g., the Contractor Performance Assessment Reporting System (CPARS), will be used as part of the responsibility determination made IAW FAR 9.104-1.

5. Ombudsman. In accordance with AFFARS 5352.201-9101, Ombudsman (JUN 2016), an Ombudsman has been appointed to hear and facilitate the resolution of concerns from Offerors, potential Offerors, and others for this acquisition If resolution cannot be made by the CO, concerned parties may contact the following: Deputy Director, Acquisition Excellence & Program Execution Directorate at AFLCMC/AQ-AZ Workflow (email: ASCA@us.af.mil) or at 937-255-5512/DSN 785- 5512, Wright-Patterson AFB, OH.