Attachment 9 - Ordering Guide.docx

PROviding Treasury Enterprise Cybersecurity Technology and Services (PROTECTS) BPA

Ordering Guide

Department of Treasury Blanket Purchase Agreement

This Ordering Guide sets forth the procedures for issuing call orders against the PROTECTS to support agency mission requirement for professional services.

General Information The PROviding treasury Enterprise Cybersecurity Technology &Services (PROTECTS) vehicle is a multiple award Blanket Purchase Agreement (BPA) for the acquisition of professional cyber services to adapt and transform cyber operations and operating models across Treasury and its Bureaus to improve capabilities, consistency, and economies of scale across the Treasury. Comprised of xx small business and xx large business awards, the vehicle provides a streamlined solution for supporting professional cyber services through commercial, labor hour, managed services, and firm-fixed-price or a combination of call orders. All BPA awards have a seven (7) 12-month ordering periods (XX/XX/ 2023 – XX/XX/2030).

Total BPA estimated Ceiling: TBD

Small Business Participants

TBD

Large Business Participants

TBD

Version 1.0 January 2024

Scope

Treasury and its Bureaus and Departmental Offices (DO) operate Security Operations Centers (SOCs) and perform enterprise Security Operations (SecOps) services on both an individual Bureau and shared services basis. These capabilities provide the means to monitor, detect, and respond to cybersecurity threats to their networks, information processing systems, and sensitive data. Treasury and its Bureaus/DO rely upon contracted personnel and other organic IT resources to staff and operate select SOC functions.

The PROviding Treasury Enterprise Cybersecurity Technology & Services (PROTECTS) program serves as a framework and solution set to standardize solutions and operating models in providing cybersecurity services across the enterprise both within individual Bureaus and DO and at an enterprise level. PROTECTS helps furnish the best cybersecurity services possible to Treasury, Treasury Bureaus and those federal government agencies who depend on Treasury for their financial management.

BPA PWS

The PWS has six different task areas. These tasks can be standalone call orders or ordered all together. Additional information on the breakdown of large and small business solicitation can be found below under the section titled “How to Place an Order.”

Who Can Place Orders

Ordering is open to all warranted Treasury and Bureau Contracting Officers within their warrant limitation.

How to Place Orders This vehicle is established for decentralized ordering. The OCO is responsible for following all pertinent rules and regulations for awarding a BPA call order, as dictated through this Ordering Guide, the terms of the Basic Agreement, the FAR, DTAR and ISRAP, and the OCO’s local policy. In case of any conflicts, the BPA terms and conditions supersede. As such, the OCO is responsible for any protests, disputes, or claims that arise prior to award, and for monitoring and appraising contractor performance on the orders, to include completing CPARS.

The OCO shall review and consider bundling and or consolidation. It is the responsibility of the OCO to determine if either bundling and or consolidation is applicable to their respective task. If bundling and or consolidation is applicable, the OCO shall follow the steps in accordance with FAR, DTAR, ISRAP and local policy.

The BPA PWS and its task areas are available to both small and large business. The OCO shall issue a request for information (RFI) to all BPA holders for every requirement. The OCO will review the responses of the RFI. Based on responses and anticipated competition, the OCO will decide as to which pool to solicit the requirement from. When making the determination, the OCO shall document the responses from the RFI as well as the effect on the small business BPA holders.

If the OCO decides to solicit against the large business pool, that does not preclude small business from competing and providing a quote in response to the RFQ at the call order level.

Competition is anticipated for each order.

Call Order Periods of Performance Call orders may have a Period of Performance of up to a base year plus seven option ordering periods. However, call orders must not exceed a base plus two option ordering years if awarded at any time during the last year (Year 7) of the BPA. Such orders must be priced using Year 7 pricing and escalation rates in-line with approved pricing for previous two years’ rates.

Order Types All orders will be either firm-fixed-price, labor hour or managed services or a combination thereof.

Labor Categories BPA labor categories and rates can be found in Attachment 1. The labor categories definitions must be used for all orders and can be found in Attachment 6. Labor categories other than those listed in the BPAs are not allowed.

What to Do After Call Order or Modification Has Been Awarded Within 5 days upon award of an order or in-scope modification to an order, the Ordering Contracting Office will email the below information via Microsoft Excel document to BPA CO for administrative tracking at the following email address: (email box TBD)

Primary Requesting Office:

Ordering Contracting Office:

Ordering Contracting Officer Email and Phone:

Contracting Officer’s Representative (COR):

Contracting Officer’s Representative Email and Phone:

Call Order number:

Short Description of the Work:

Period of Performance:

Total Award Amount (including Options):

Additional Ordering Guidance

Government Property Clause – All orders must incorporate applicable Government Property Clauses, as determined by the nature of the order.

Organizational Conflicts of Interest – The PROTECTS BPA is a vehicle that allows for the ordering of awards at different points of the cyber security process. BPA awardees will be responsible for monitoring all OCI issues.

Order Administration The COR shall use all standard order administration practices such as:

· Surveillance and monitoring;

· Performance Assessment;

· Timely invoicing processes

· Communication with all parties involved

Awardee Information Small Business

TBD

Large Business

TBD

Government Point of Contact Information

The BPA CO has the overall responsibility for managing and administering the BPA, as well as the following:

· Providing administrative procedures guidance for placing orders

· Monitoring base year and option year periods of performance

The BPA COR has overall responsibility for technical aspects of the BPA, as well as:

· Support CORs with technical matters

· Help resolve CORs technical concerns and questions

· Resolve technical issues with the contractor at the BPA level

· Support the BPA CO with technical matters

Attachments

Attachment 1 – Price Template Attachment 2 – BPA Labor Categories