BAA-UKR-CYBERSECURITY-2019_AMENDMENT_01.pdf

4 Igor Sikorsky Street, Kyiv 04112, Ukraine; Phone: +380 (44) 521 5000; Fax: 521-5245; http://ukraine.usaid.gov

Amendment Issuance Date: March 6, 2019

Revised Deadline for Questions: March 13, 2019, 10:00 a.m. Kyiv time

Expressions of Interest Due: April 8, 2019, 10:00 a.m. Kyiv time

Subject: BAA-UKR-CYBERSECURITY-2019, Amendment No. 01

Reference: USAID/Ukraine Broad Agency Announcement (BAA) for Cybersecurity for

Critical Infrastructure in Ukraine

Ladies/Gentlemen:

The purpose of Amendment No. 01 is to:

(1) provide answers to the questions received in regards to BAA-UKR-CYBERSECURITY- 2019,

(2) revise the BAA to reflect answers to the received questions, and

(3) open another opportunity for questions with a deadline of March 13, 2019, 10:00 a.m. Kyiv time.

Thank you for your interest in USAID programs.

Sincerely, /s/

Maria Televantos Agreement/Contracting Officer

BAA for Cybersecurity for Critical Infrastructure in Ukraine

BAA-UKR-CYBERSECURITY-2019

Amendment No. 01

Questions and Answers

Q1. Please confirm that you are looking to get formal offers not only expression of interest.

In case you need official offer please advise when is the closing date?

A1. USAID invites Interested Parties to submit an Expression of Interest (EOI), as provided in the Broad Agency Announcement (BAA) No. BAA-UKR-CYBERSECURITY-2019. The deadline for submitting EOIs is April 8, 2019, 10:00 a.m. Kyiv time. At this stage, USAID is only requesting EOIs. Information on further stages can be found in the full BAA.

Section VII of the BAA, “Expression of Interest Information Formatting,” provides more information on the contents of the EOI.

Q2. Please provide the following information: how and where the applications will be accepted;

where we can find additional information; and who the contact/responsible person is.

A2. Please see the answer to the question Q1. In addition, please note that EOIs must be submitted electronically to the following email addresses: eparinova@usaid.gov and ashatokhina@usaid.gov. For more information on EOI preparation and submission, please see the BAA.

Q3. I am interested in receiving more information about the opportunity referenced below:

https://www.grants.gov/web/grants/view-opportunity.html?oppId=312944

A3. USAID has amended the BAA to incorporate another opportunity for questions in regards to the subject BAA. The second round of questions closes March 13, 2019, 10:00 a.m.

Kyiv time. Please use this opportunity to send us a question for which you expect additional information.

Q4. Please send us the application form to BAA-UKR-CYBERSECURITY-2019.

A4. There is no specific application form. Section VII. “Expression of Interest Information

Formatting” of the BAA provides instructions regarding the submission requirements for an Expression of Interest (EOI).

Q5. On page 4, the BAA defines the three categories of interested parties that can submit an

Expression of Interest; Implementing Partner, Experts, or Co-Investor. Please clarify whether USAID prefers interested parties to submit an individual Expression of Interest or is it acceptable to submit an Expression of Interest by a team of organizations representing different categories of interested parties?

mailto:eparinova@usaid.gov mailto:ashatokhina@usaid.gov https://www.grants.gov/web/grants/view-opportunity.html?oppId=312944

A5. You are welcome to form teams, but please remember that USAID reserves the right to accept an EOI in its entirety or to select only portions of the EOI, including members of the team. Therefore, USAID recommends that all interested parties submit individual/separate EOIs to ensure they are each being considered. Please also note that if you form a team and only submit one EOI, then only one member of that team will be invited to represent the team.

Q6. On page 5, the BAA defines who an Expert is. Can USAID clarify whether an expert must be an individual or can it be a team within an academic department, think tank, or foundation?

A6. An expert can be an individual, a team, an academic department, think tank or foundation.

The BAA has been amended to clarify this. Please do remember, however, that the interested party must nominate only one individual to represent the organization at the co-creation workshop.

Q7. On page 4-5, the BAA defines who is a Co-Investor is. Can USAID clarify what role is anticipated for co-investors to play at the co-creation process and during the following phases of the BAA?

A7. Section III of the BAA states that co-investors “will contribute financial and/or other resources to the co-creation process and the development project that will address the problem statement.”

Q8. Page 11, 1. (e) states, “EOI must include a professional resume of the person who will represent the implementing partner on the co-design team.” Can USAID clarify how many people can be nominated to attend the co-creation process? Is it one (1) per team or one (1) per organization represented on a team?

A8. Each EOI must nominate one person to represent the interested party.

Q9. Can USAID clarify whether more than one resume can be included in an EOI?

A9. No. Only one resume can be included. Please refer to Section VII of the BAA, which explains that “EOIs must include a professional resume of the person who will represent the implementing partner/co-investor/expert on the co-design team.”

Q10. Can USAID clarify what is the commercial model pursued under the contract for any technology developed?

A10. As described in Section III “The BAA Process,” USAID will identify the anticipated instrument type (acquisition or assistance) in Stage 4 - Award Determination. The BAA states: “The right to select for award an instrument type that is appropriate to the specific development context, partner relationship, and proposal selected for award. Instrument types include, but are not limited to, contracts, grants, cooperative agreements, public-private partnerships, Inter-Agency Agreements, Government to Government Agreements, Donor to Donor Agreements, and Memorandums of Understanding. In addition, the Government may craft a new instrument type to meet the needs of a specific relationship.”

Q11. As part of the experts represented at the co-creation process, can USAID clarify whether they expect representatives of the Government of Ukraine to attend?

A11. The specific participants that will be involved in the co-creation process will be determined after reviewing EOIs.

Q12. Per Section III, The BAA Process, “the amount of resources made available under this

BAA will depend on the concepts received and the availability of funds from USAID and other co-investors.” Can USAID confirm the overall award amount(s) and number of awards USAID envisions funding under this BAA?

A12. Section IV of the BAA specifies that “Funding availability and amounts will depend on the ideas generated during the collaboration process as well as the funding capacity of participating organizations, which are not necessarily limited to USAID.” USAID anticipates approximately $38 million in resources that could support the resultant activity(ies), but the total amount of resources made available will depend on the concepts received and the availability of funds from co-investors. USAID reserves the right to make one award, multiple awards, or no awards.

Q13. Does USAID have an overall timeline for the four-stage process?

A13. While we cannot specify the overall timeline for these steps, we do anticipate holding a co-creation workshop in June, as specified in Section III “The BAA Process,” Stage 2 - Co-creation and Co-development of the Concept Paper. USAID’s anticipated award date is September, 2019, but the timing depends on the outcome of the BAA process and any schedule developed during the co-creation workshop.

Q14. Can USAID please confirm the type of contract mechanism for the award(s) designed under this BAA?

A14. As described in Section III “The BAA Process,” USAID will identify the anticipated instrument type (acquisition or assistance) in Stage 4 - Award Determination. The BAA states: “The right to select for award an instrument type that is appropriate to the specific development context, partner relationship, and proposal selected for award. Instrument types include, but are not limited to, contracts, grants, cooperative agreements, public-private partnerships, Inter-Agency Agreements, Government to Government Agreements, Donor to Donor Agreements, and Memorandums of Understanding. In addition, the Government may craft a new instrument type to meet the needs of a specific relationship.”

Q15. Many USAID Broad Agency Announcements describe one overriding problem or provide challenge statements. Could USAID clarify the overarching problem statement and/or confirm that interested parties can respond to the stated and other challenges in advancing Ukraine’s cybersecurity in their response?

A15. USAID lays out its understanding of some of the critical issues facing Ukraine’s cybersecurity Section II “Problem and Challenge Statements” of the BAA. As mentioned at the end of this section, “USAID/Ukraine is seeking to develop and test new and innovative approaches that will concretely address these and other cybersecurity challenges in Ukraine.”

Q16. To apply as an implementing partner organization, interested parties need to have both cyber and Ukraine experience. To broaden the pool of applicable approaches for the overall co-creation process, would USAID consider revising the criteria to significant Ukraine experience and/or cyber security development projects?

A16. Past experience working on cybersecurity issues in Ukraine is not required. USAID requests that implementing partners describe their experience implementing cyber security development projects and experience working in Ukraine and/or similar environments. The BAA has been amended to clarify that “EOIs must discuss the implementing partner’s experience in implementing cyber security development projects and the implementing partner’s experience in Ukraine and/or similar environments.”

Q17. Could USAID confirm that the professional resume referenced in the expression of interest

(EOI) is not included in the ten-page limit for the EOI?

A17. The resume does count as part of the ten-page limit of the EOI. The BAA has been amended to provide this clarification.

Q18. Could USAID please detail what should be included in the cover letter mentioned on page

10, point A?

A18. Interested Parties are not required to include a cover letter in their submission. The BAA has been amended to clarify that certain information must be included in the first page of the EOI, but a separate cover page is not required.

Q19. Would USAID please allow text boxes, graphics, and tables to use a font size smaller than

12 point such as 10 point?

A19. Yes; fonts smaller than 12 point may be used in text boxes, graphics and tables, as appropriate. USAID requests 12 font minimums in order to ensure submissions are easily legible. Please ensure that text boxes, graphics and tables are easily legible by reviewers.

Q20. Can USAID specify the anticipated timeline for each stage indicated in the BAA under Section III “The BAA Process” p.3?

A20. While we cannot specify the overall timeline for these steps, we do anticipate holding a co-creation workshop in June, as specified in Section III “The BAA Process”, Stage 2 - Co-creation and Co-development of the Concept Paper. USAID’s anticipated award date is September, 2019, but the timing depends on the outcome of the BAA process and any schedule developed during the co-creation workshop.

Q21. Can USAID specify more clearly what is meant by “Critical Infrastructure” in the title of

BAA?

A21. Section II “Problem and Challenge Statements” lays out some critical infrastructure areas, including Ukraine’s “energy, transportation, communication, financial and banking systems.” EOIs may include these and other critical infrastructure areas. When thinking through critical infrastructure areas, as laid out in Section II, interested parties may consider areas which, if attacked, may “destabilize the country and decrease domestic --and international -- confidence in Ukraine’s ability to deliver basic services and security.”

For additional guidance on critical infrastructure areas, please refer to U.S. Department of Homeland Security guidance on Critical Infrastructure Sectors1.

Q22. Can USAID assign weight to each of the five criteria the EOI will be evaluated against, “Criteria for Expressions of Interest” p.5?

1 https://www.dhs.gov/cisa/critical-infrastructure-sectors

A22. The referenced section of the BAA states that “interested parties must meet” the criteria.

Thus it is necessary for EOIs to meet all the criteria, and interested parties should populate EOIs with the information they believe best responds to the criteria noted in Stage 1 of Section III “The BAA Process.”

Q23. How will USAID assess the “reputation” of interested parties, as mentioned under criteria #5, p.6?

A23. USAID will use a variety of methods to assess reputation, including but not limited to, past performance information found in CPARS, reference checks, internet searches, etc.

Q24. Criteria #3 under “Criteria for Expression of Interest” mentions the “technical staff or team engaged in the endeavor,” p.5: what number of team member resumes does USAID expect and kindly confirm that the resumes are not counted against the page limit.

A24. Only one resume may be submitted with the EOIs. Please refer to Section VII of the BAA, which explains that “EOIs must include a professional resume of the person who will represent the implementing partner/co-investor/expert on the co-design team.” This resume does count against the 10-page limit. Implementing partners may describe, as applicable, additional team members elsewhere in their EOIs.

Q25. Should partnership with local or international organizations be demonstrated by any written document indicating readiness to cooperate on this initiative?

A25. No, this is not necessary.

Q26. Will this opportunity be primarily funded from within USAID in the USA and in USD, or from within USAID offices in Europe in Euros, or other?

A26. The resultant award(s) will be awarded and managed by USAID/Ukraine, which is based in

Kyiv, Ukraine. All awards will be made in USD.

Q27. How many locations are within the scope of the project?

A27. This will depend on the outcome of the co-creation process.

Q28. What is the duration of the project?

A28. This will depend on the outcome of the co-creation process.

Q29. Some award types may not include any funding? What award types does this relate to?

(Understanding that EOI is an unfunded element)

A29. Section IV “Specific Rights Reserved for the U.S. Government under this BAA” further elaborates that USAID reserves “the right to award instruments under this BAA that do not commit or exchange monetary resources.”

Q30. When will specific dates be advertised for the project to commence (The only date that has been mentioned is June 3-7, 2019 CO CREATION WORKSHOP IN KIEV)?

A30. The anticipated award date is September, 2019, but the timing depends on the outcome of the co-creation process.

Q31. Will USAID pay for the contractor (travel/hours etc) to participate in the above June 3-7, 2019 CO CREATION WORKSHOP in Kiev?

A31. No. The only exception is for Experts. As stated in the BAA, “If the institution is unable to fund the expert to attend the co-design workshop, USAID might be able to provide this support. If the expert’s institution is unable to fund the travel, the EOI must explain why USAID should consider funding the travel.”

Q32. Would all EOI 3 related contracts be with USAID only?

A32. USAID is the U.S. Government agency managing this solicitation. Please refer to Section

V of the BAA, “Specific Rights Reserved for the U.S. Government under this BAA” for additional information.

Q33. Does the project require collaboration with USAID scientist only, or will there be a requirement to exchange with Ukraine Scientist and personnel as well?

A33. Collaboration is encouraged, and the co-creation workshop will require collaboration of the interested parties selected to participate from the implementing partner, co-investor and expert categories.

Q34. What is the current maturity/ capabilities of the areas that require developing?

A34. Please see Section II of the BAA, “Problem and Challenge Statements.”

Q35. Do they currently have in place high level standards/ policies from Gov (similar to CPNI/

NCSC/NIST/ISO etc)?

A35. Please see Section II of the BAA, “Problem and Challenge Statements.”

Q36. What are the estimated resources that USAID seeks to complete EOI 3?

A36. Section III of the BAA, “The BAA Process” states that “The amount of resources made available under this BAA will depend on the concepts received and the availability of funds from USAID and other co-investors.”

Q37. Are there specific phases to implement EOI 3, or will it be a single award?

A37. Please refer to the stages described in Section III of the BAA, “The BAA Process.”

Q38. What is the projected duration of the EOI 3 level of effort?

A38. This will depend on the outcome of the co-creation process.

Q39. Are there any clearances required for this work?

A39. No security clearances are anticipated.

Q40. Are there any limitations with [interested party] leveraging its own […] offices and capabilities to fulfil EOI 3 requirements, to include travel required under EOI 3?

A40. Leveraging resources is encouraged. In fact, the BAA states “EOIs must indicate what resources are available to be applied toward the solutions identified during the co-design process. Such resources include cash and other resources, both tangible and intangible, such as in-kind contributions, expertise, intellectual property, brand value, high-value coordination, and access to key people, places, and information.”

Q41. Will the company be allowed to perform EOI 3 tasks in another parts of Europe and with European Personnel and then have USAID pickup, and relocate the solution to Ukraine through USAID existing logistic means?

A41. All aspects of the activity will be developed during the co-creation process.

Q42. If USAID allows for integration of the solution in another part of Europe, besides Ukraine, would USAID also coordinate with USAID and partners of this project to travel to that European country for technological exchanges, technology maturity evaluation, testing and training?

A42. All aspects of the activity will be developed during the co-creation process.

Q43. On page 5 of 14 the BAA states, “Please submit an Expression of Interest (EOI) addressing the criteria below, in the format in Section VII. Each interested party is limited to one EOI submission per category. Note: “Category” means (1) Implementing Partners, (2) Co- Investors, or (3) Experts.” If the interested party intends to submit an Expression of Interest in all three categories, does the interested party have to submit three separate EOIs (one in each category) or can the interested party submit one EOI and discuss all three categories within the single EOI?

A43. No. If an interested party wishes to be considered under multiple categories, then the interested party must submit a separate EOI for each category.

Q44. Who are the participants in the Co-design Team?

A44. This will be determined by USAID during Stage 1 of the process. USAID will review EOIs received and will select those interested parties that USAID determines to have addressed the evaluation criteria to an extent that demonstrates that the interested party will make a significant contribution to the co-creation process. Additional information can be found in Section III of the BAA, “The BAA Process.”

Q45. Can the R&D Idea incorporate existing solutions customized to maximize positive significant impact on the Ukraine’s infrastructure environment, or does the idea have to be a newly researched, not previously implemented solution?

A45. Ideas can be both existing solutions or newly researched. If an existing solution is proposed, then organizations must ensure that any submissions under this BAA are free of any third party proprietary data rights that would impact the license granted to USAID herein.

Q46. General: Where will USAID be posting responses to the Q&A and all future communications related to this opportunity?

A46. All amendments to the BAA will be posted to FBO.gov and Grants.gov.

Q47. General: Does the National Cybersecurity Coordination Center plan to have a direct interface with the General Staff of the Armed Forces of Ukraine Cybersecurity Operations Center (CSCOC)?

General: Does the National Cybersecurity Coordination Center employ a Data Classification tool (e.g., TITUS)?

A47. USAID is unable to provide an authoritative answer to either of these questions.

Q48. General: Which security suite tools will be implemented as part of this program?

A48. All aspects of the activity will be developed during the co-creation process.

Q49. General: Is USAID aware of the ongoing modernization efforts for Cyber Defense within the Armed Forces of Ukraine?

A49. No.

Q50. General: Would USAID consider making this a small business set-aside contract?

A50. Section IV. “Additional Considerations” of the BAA explains that “Public, private, for-profit, and nonprofit organizations, as well as institutions of higher education, public international organizations, non-governmental organizations, U.S. and non-U.S.

governmental organizations, multilateral and international donor organizations, and individuals (in the expert category of interested parties only) are eligible under this BAA.”

Q51. General: Will this work be competed on an existing contract vehicle (e.g., GSA IT schedule

70), or going off schedule?

A51. This is a Broad Agency Announcement issued under Federal Acquisition Regulation (FAR)

Part 35.016 (c).

Q52. General: Are there any clearance or certification requirements?

A52. No security clearances are anticipated. During Stage 4 of “The BAA Process”, as described in Section III, USAID will request representations and certifications, as needed.

Q53. General: Will the competition be best value or lowest cost?

A53. This is not a FAR Part 15 procurement as noted in Section I, “Overview.”

Q54. General: How will costs and price realism be evaluated?

A54. This will occur in Stage 4 of “The BAA Process”, as described in Section III. The USAID

Contract/Agreement Officer will request a budget from the Apparently Successful Partner(s) and “ engage in final review, negotiation, responsibility, cost reasonableness, etc.”

Q55. General: Does funding currently exist for this project or is funding currently identified?

Understanding that additional funding options are trying to be identified, is there any base funding available or are all funds yet to be identified?

A55. Section IV of the BAA specifies that “Funding availability and amounts will depend on the ideas generated during the collaboration process as well as the funding capacity of participating organizations, which are not necessarily limited to USAID.” USAID anticipates approximately $38 million in resources that could support the resultant activity(ies), but the total amount of resources made available will depend on the concepts received and the availability of funds from co-investors. USAID reserves the right to make one award, multiple awards, or no awards.

Q56. Section III: Are companies allowed to submit EOI that include prime and subcontractor partners?

A56. You are welcome to form teams, but please remember that USAID reserves the right to accept an EOI in its entirety or to select only portions of the EOI, including members of the team. Therefore, USAID recommends that all interested parties submit individual/separate EOIs to ensure they are each being considered. Please also note that if you form a team and

Q57. Section III: Does the Government intend for there to be multiple awards during stage 4 in each of the interested parties’ categories?

A57. USAID does not intend on making separate awards per category of interested party.

USAID intends on selecting interested parties from each of the three categories to participate in the co-creation process, as each category of interested party will bring different contributions to the table. USAID reserves the right to award multiple awards, a single award, or no awards.

Q58. Section VII: The EOI requests one resume, however we have multiple people who could provide valuable insight during stage 2. Can we submit multiple candidates with the EOI?

Can resumes be excluded from the 10 page limit?

A58. No. Only one resume may be included. Please refer to Section VII of the BAA, which explains that “EOIs must include a professional resume of the person who will represent the implementing partner/co-investor/expert on the co-design team.” This resume does count against the 10-page limit. Interested parties may describe, as applicable, additional team members that could provide valuable insight elsewhere in their EOIs.

Q59. Section VII: Section VII discussed requiring references for EOI. “EOIs must include at least three relevant references, including the following information: Name; email address and phone number; and projects under which the interested party collaborated with the named reference”. Can these references include other Federal, State, Local or commercial customers?

A59. Yes. Any relevant past performance references can be included.

Q60. Does USAID allow Expressions of Interest from a consortium of Interested Parties who would align prior to the EOI and prepare a single EOI submission as a consortium of Implementing Partners?

A60. You are welcome to form teams, but please remember that USAID reserves the right to accept an EOI in its entirety or to select only portions of the EOI, including members of the team. Therefore, USAID recommends that all interested parties submit individual/separate EOIs to ensure they are each being considered. Please also note that if you form a team and

Q61. Does the government require specific research documentation (i.e. test results, metrics, etc.) as part of the EOI submission (Stage 1)?

A61. Interested parties should populate EOIs with the information they believe best responds to the criteria noted in Stage 1 of Section III “The BAA Process.”

Q62. During Stage 2, after the co-creation workshop, does the government have a timeline for inviting organizations to moving forward to Stage 3?

A62. Not at this time. USAID’s anticipated award date is September, 2019, but the timing depends on the outcome of the BAA process.

Q63. The objective of the EOI is the development of cyber security solutions for critical infrastructure in Ukraine. Is the intent of this BAA to have an implementing partner's product/service developed to focus on only one particular industry segment for example, the electric power industry?

A63. All aspects of the activity will be developed during the co-creation process.

Q64. It is understood that the co-creation process includes several entities. Does that mean that all of these entities will be involved in the co-design of a product/service? What role(s) would they play during the co-design phase versus that of the implementer?

A64. Yes, all entities invited to participate in the co-creation workshop will be involved in the co-design of one or more concepts. Each category of interested party is expected to provide valuable contributions to the workshop.

Q65. Aside from developing its proposal throughout the four phases of this BAA, is it required from an implementing partner to cost share the actual implementation of the cyber development project?

A65. No, cost share is not required. However, as indicated in Section VII “Expression of Interest

Information Formatting” of the BAA, Implementing Partner EOIs must indicate “what resources are available to bring to bear on the co-design and solution. Such resources include both tangible and intangible, such as expertise, intellectual property, brand value, high-value coordination, access to key people, information, cash, and in-kind contributions.”

Q66. What is the intended time-line for implementing the cyber development project, once awarded?

A66. This depends on the outcome of the co-creation process, since all aspects of the activity will be designed during the co-creation process.

Q67. Will the cyber development project require the participation of a local Ukrainian entity/teaming partner?

A67. All aspects of the activity will be developed during the co-creation process, including partnering arrangements.

Q68. Is the intent to have development finance institutions, as co-investors, participate in the cyber development project of an implementing partner?

A68. USAID intends to invite selected interested parties from each category, including co-investors, to the co-creation workshop.

Q69. We have some additional questions regarding participation in this project in term of projects type which we can present to your organization. We currently working on the idea of [question redacted]. Could you please confirm that such project type we can propose for further developing under USAID?

A69. Please review Section II “Problem and Challenge Statements” of the BAA to determine if your proposed research and development idea would be an appropriate solution to the problem and challenges laid out.

[End of Amendment No. 01]