Bug Bounty SaaS JA.pdf

DocuSign Envelope ID: 16F1D19E-3A9A-4598-9E6E-F1CE4783F020

JUSTIFICATION FOR OTHER THAN FULL AND OPEN COMPETITION

41 U.S.C. 253(c), 10 U.S.C. 2304(c) and FAR 6.302

1. This requirement is in support of GSA, Chief Information Officer (CIO), Security Operation Division (SecOps), 1800 F Street, NW Washington, D.C. 20005. The contracting activity is GSA OAS Office of Internal Acquisition (OIA), 1800 F Street NW, Washington, DC 20405.

2. Nature and/or description of the action being approved.

GSA Security Operation Division (SecOps) has a requirement for a GSA Security Operation Division (SecOps) has a requirement for a public Bug Bounty SaaS Platform.

With bug bounties becoming an established industry-wide best practice, GSA Security Operations Division (SecOps) desires to establish one of its own. As part of its programmatic focus on security, SecOps needs to purchase access to a pre-existing, commercially available Bug Bounty SaaS Platform that will allow it to launch and manage the Bug Bounty program. In addition, the platform will allow GSA to implement a Vulnerability Disclosure policy to handle and triage reports from researchers for GSA. This acquisition will provide access to a large network of security researchers, people who have an interest - both personally and financially - in helping to find and address bugs and other technical issues within GSAs web applications. Bug bounties serve as a legal and social arrangement with the security community: bounty operators, define what researchers are permitted to do in regards to discovering and reporting security issues of a production system, and in turn, researchers are assured they will not be punished for anything they do within that scope and are awarded for their findings.

Contemplated Contract Type: Firm Fixed Price. This will be an open market contract award, a small business set aside.

Proposed Approach under Consideration: A notice of intent to award sole source will be issued via the FBO website for the Bug Bounty SaaS Platform. Due to the fact that only one vendor, Hacker One, is an authorized provider of the brand name product, a sole source contract award will be issued to HackerOne.

The period of performance for the contract award will be one (1) year and two (2) option periods:

Base Period: 9/25/2020 – 9/24/2021 Option Period 1: 9/25/2021 – 9/24/2022

DocuSign Envelope ID: F7482DEB-86BF-4664-A700-CF22412FEAEF

Option Period 2: 9/25/2022 – 9/24/2023

3. A description of the supplies or services required to meet the agency’s needs (including the estimated value).

Federal agencies are currently incorporating two types of coordinated vulnerability disclosure (CVD) programs into their security efforts: vulnerability disclosure policies (VDPs) and bug bounties. VDPs establish processes for the identification, management, and remediation of security vulnerabilities uncovered by security researchers. They are among the most effective methods for obtaining new insights regarding security vulnerability information and provide high return on investment. They also provide protection for those who uncover these vulnerabilities by differentiating between good-faith security research and unacceptable means of gathering security information. VDPs establish processes and procedures for the security research community to report vulnerabilities to appropriate agency contacts, who can then use the reports to address vulnerabilities of which they may not have been aware. Bug bounty programs differ from VDPs by offering compensation based on established parameters to security researchers who report the vulnerabilities. While several organizations in the Federal government have used bug bounty programs effectively, each agency should carefully weigh the cost, organizational competence, and maturity required for a strong and sustainable program.

Draft BOD 20-01 will be releasing soon and requires that federal agencies:

○ Implement a Vulnerability Disclosure Policy that requires GSA internet accessible systems to be enrolled

○ Adhere to a timeline that eventually leads to all GSA internet accessible systems being enrolled

Vulnerability Disclosure Policies invite ethical hackers, researchers, finders (General Public) to hack systems defined in the scope of this policy.

IS is going beyond the outlined requirements of Draft BOD 20-01 and adding a Bug Bounty Program to work in conjunction with the vulnerability disclosure policy and program. This adds monetary rewards for Ethical Hackers, Researchers, and Finders for reporting Cyber Security vulnerabilities.

These two programs will bring an influx of reports that will need to be validated and triaged for GSA Processing and Remediation and would be best handled within a platform and 3rd party assistance

This is a brand name specific requirement for HackerOne to deliver a Bug Bounty program which SecOPs will utilize for SecOps-owned web applications. HackerOne provides access to their Bug Bounty SaaS Platform for researchers to report vulnerabilities (“Platform/Network Access”) and allow SecOps to manage and track issues across multiple public services exposed to the Internet, triage services for those reported vulnerabilities, disburse rewards for effective vulnerabilities, and explain the reasons behind rejections (“Vulnerability Report Triage Services”). The Vulnerability Report Triage Services, must be provided on a “per web application” basis, allowing SecOps to operate a Bug Bounty for a web application independently of the other web applications that are utilizing the Platform/Network Access for their own tests. As part of these services, HackerOne must provide staff who are specialists in reviewing vulnerability reports and communicating with researchers. Ability to prorate the Optional CLINS if not used within the time period

The total estimated value of this contract is $10,904,220.00 for the base and all option periods.

However this task order is funded for the base year (Mandatory CLINs) at $220,820.00.

HackOne will provide the following:

POP CLIN Item QTY Cost Total

Base Year

CLIN 0001

Mandatory HackerOne Response Enterprise + Standard Triage

(VDP)

$40,000.00

CLIN 0002

Optional CLIN Response Triage Plus Upgrade to Standard

$50,000.00

CLIN 0003

Optional Response Advisory Plus Upgrade

$20,000.00

CLIN 0004

HackerOne Public/Private Bounty Enterprise + Standard Triage Parent Program

$57,500.00

CLIN 0005

Optional HackerOne Public/Private Bounty Enterprise + Standard Triage Parent Program

$345,000.00

CLIN 0006

Optional HackerOne Public

Triage Child Program

CLIN 0007

Optional CLIN for Public Bounty Triage Plus Upgrade from Standard

$62,500.00

$375,000.00

CLIN 0008

Optional Public Bounty Advisory Plus Upgrade

$22,000.00

$132,000.00

CLIN 0009

Optional HackerOne Private

$23,320.00

$139,920.00

CLIN 0010

HackerOne Private Bounty

Child Program

CLIN 0011

Optional Private Bounty Triage Plus Upgrade from Standard

Base Year CLIN 0012 Optional Private Bounty 6 $22,000.00 $132,000.00

Advisory Plus Upgrade from

CLIN 0013

Optional HackerOne Challenge + Standard Triage

$250,000.00

$500,000.00

CLIN 0014

Bounty Pool for Public

Base Year CLIN 0015 Optional Bounty Pool for Public 6 $50,000.00 $300,000.00

CLIN 0016

Bounty Pool for Private

CLIN 0017

Optional CLIN Bounty Pool for Private

$300,000.00

CLIN 0018

HackerOne Challenge

$200,000.00

$400,000.00

Base Year Total Plus Options $220,820.00 $3,634,740.00

Option Year

CLIN 1001

HackerOne Response

CLIN 1002

CLIN 1003

CLIN 1004

HackerOne Public/Private

CLIN 1005

Public/Private Bounty Enterprise

CLIN 1006

CLIN 1007

CLIN 1008

CLIN 1009

CLIN 1010

HackerOne Private Bounty

CLIN 1011

Optio n Year 1

CLIN 1012

Optional Private Bounty

CLIN 1013

CLIN1014

CLIN 1015

Optional Bounty Pool for Public

CLIN1016

CLIN1017

CLIN 1018

Option Year 1 One Total Cost $220,820.00 $3,634,740.00

CLIN 2001

HackerOne Response

CLIN 2002

CLIN 2003

CLIN 2004

HackerOne Public/Private

CLIN 2005

Public/Private Bounty Enterprise

CLIN 2006

CLIN 2007

CLIN 2008

CLIN 2009

CLIN 2010

HackerOne Private Bounty

CLIN 2011

CLIN 2012

Optional Private Bounty

CLIN 2013

CLIN 2014

CLIN 2015

Optional Bounty Pool for Public

CLIN 2016

CLIN 2017

CLIN 2018

Option Year 2 Total Cost $220,820.00 $3,634,740.00

Total Cost for Base and all option years

$662,460.00

$10,904,220.00 being the only company Fedramp certified that meets our requirements.

4. Circumstances permitting other than full and opencompetition

X FAR 6.302-1 Only one responsible source and no other supplies or services will satisfy agency requirements (10 U.S.C. 2304(c)(1) or 41 U.S.C. 3304(a)(1)).

When the supplies or services required by the agency are available from only one responsible source, or from a limited number of responsible sources, and no other type of supplies or services will satisfy agency requirements, full and open competition need not be provided for. To satisfy the Agency’s need, GSA has determined a sole source procurement is in order. Specifically, the basis for limiting competition is that GSA market research indicates HackerOne http://uscode.house.gov/

(i) Supplies or services may be considered to be available from only one source if the source has submitted an unsolicited research proposal that--

(A) Demonstrates a unique and innovative concept (see definition at 2.101), or, demonstrates a unique capability of the source to provide the particular research services proposed;

(B) Offers a concept or services not otherwise available to the Government; AND

(C) Does not resemble the substance of a pending competitive acquisition. (See 10 U.S.C. 2304(d)(1)(A) and 41 U.S.C. 3304(b)(1).)

OR

(ii) Supplies may be deemed to be available only from the original source in the case of a follow-on contract for the continued development or production of a major system or highly specialized equipment, including major components thereof, when it is likely that award to any other source would result in—

(A) Substantial duplication of cost to the Government that is not expected to be recovered through competition; or

(B) Unacceptable delays in fulfilling the agency’s requirements. (See 10 U.S.C.

2304(d)(1)(B) or 41 U.S.C. 3304(b)(2).)

Supporting Rationale:

FAR 6.302-1(c) Brand Name Justification (Justifications citing this authority should only address portion of the requirement that requires the brand name product. Approval levels will only apply to the dollar value of the acquisition that is attributed to the brand name requirement).

An acquisition or portion of an acquisition that uses a brand-name description or other purchase description to specify a particular brand-name, product, or feature of a product, peculiar to one manufacturer.

Supporting Rationale:

Bug bounties are a proven method of mitigating security risk in production systems: they incentivise researchers to report issues to the system owner who can fix them before they’re discovered by malicious actors. By the very nature of a

DocuSign Envelope ID: F7482DEB-86BF-4664-A700-CF22412FEAEF https://www.acquisition.gov/sites/default/files/current/far/html/Subpart%202_1.html#wp1145508 http://uscode.house.gov/ http://uscode.house.gov/ http://uscode.house.gov/ http://uscode.house.gov/ bug bounty program, HackerOne provides a Bug Bounty SaaS Platform while providing the best value to the government by being well established. HackerOne is well-known as the provider of a Bug Bounty SaaS Platform, and has a larger and more talented pool of security researchers in their community. The larger the community of security researchers in the Bug Bounty SaaS Platform provider’s network, the better the chance SecOps has of finding bugs and technical issues within its web applications. In addition, HackerOne is the only platform on the market that has been authorized for usage from a security perspective under the FedRAMP program, which is required for using SaaS products in the government.

We would not be able to use other products until they completed this process.

FAR 6.302-2 Unusual and compelling urgency 10 U.S.C. 2304(c)(2) or 41 U.S.C.

3304(a)(2) Justifications citing this authority may not exceed one (1) year.

When the agency’s need for the supplies or services is of such an unusual and compelling urgency that the Government would be seriously injured unless the agency is permitted to limit the number of sources from which it solicits bids or proposals, full and open competition need not be provided for.

N/A for

GSA

FAR 6.302-3 Industrial mobilization; engineering, developmental, or research capability; or expert services 10 U.S.C. 2304(c)(3) or 41 U.S.C. 3304(a)(3)

(2) Full and open competition need not be provided for when it is necessary to award the contract to a particular source or sources in order—

(i) To maintain a facility, producer, manufacturer, or other supplier available for furnishing supplies or services in case of a national emergency or to achieve industrial mobilization;

(ii) To establish or maintain an essential engineering, research, or development capability to be provided by an educational or other nonprofit institution or a federally funded research and development center; or

(iii) To acquire the services of an expert or neutral person for any current or anticipated litigation or dispute.

N/A for

GSA

FAR 6.302-4 International agreement 10 U.S.C. 2304(c)(4) or 41 U.S.C. 3304(a)(4)

FAR 6.302-5 Authorized or required by statute 10 U.S.C. 2304(c)(5) or 41 U.S.C.

3304(a)(5).

This authority may be used when statutes, such as the following, expressly authorize or require that acquisition be made from a specified source or through another agency:

DocuSign Envelope ID: F7482DEB-86BF-4664-A700-CF22412FEAEF http://uscode.house.gov/ http://uscode.house.gov/ http://uscode.house.gov/ http://uscode.house.gov/ http://uscode.house.gov/ http://uscode.house.gov/ http://uscode.house.gov/ http://uscode.house.gov/

(1) Federal Prison Industries (UNICOR)—18 U.S.C. 4124 (see FAR subpart 8.6).

(2) Qualified nonprofit agencies for the blind or other severely disabled—41 U.S.C. chapter 85, Committee for Purchase From People Who Are Blind or Severely Disabled (see FAR subpart 8.7).

(3) Government Printing and Binding—44 U.S.C. 501-504, 1121 (see FAR subpart 8.8).

(4) Sole source awards under the 8(a) Program (15 U.S.C. 637)

*Other justification form required if sole source estimated value exceeds $22M.

(5) Sole source awards under the HUBZone Act of 1997—15 U.S.C. 657a (see 19.1306).

(6) Sole source awards under the Veterans Benefits Act of 2003 (15 U.S.C. 657f).

(7) Sole source awards under the WOSB Program–15 U.S.C. 637(m) (see 19.1506).

Other:

N/A for

GSA

FAR 6.302-6 National security 10 U.S.C. 2304(c)(6) or 41 U.S.C. 3304(a)(6).

N/A for

GSA

FAR 6.302-7 Public interest 10 U.S.C. 2304(c)(7) or 41 U.S.C. 3304(a)(7)

4. A description of efforts made to ensure that offers are solicited from as many potential sources as is practicable, including whether a notice was or will be publicized as required

DocuSign Envelope ID: F7482DEB-86BF-4664-A700-CF22412FEAEF http://uscode.house.gov/ https://www.acquisition.gov/sites/default/files/current/far/html/Subpart%208_6.html#wp1075770 http://uscode.house.gov/ http://uscode.house.gov/ http://uscode.house.gov/ https://www.acquisition.gov/sites/default/files/current/far/html/Subpart%208_7.html#wp1103480 http://uscode.house.gov/ https://www.acquisition.gov/sites/default/files/current/far/html/Subpart%2019_13.html#wp1093718 https://www.acquisition.gov/sites/default/files/current/far/html/Subpart%2019_13.html#wp1093718 http://uscode.house.gov/ http://uscode.house.gov/ https://www.acquisition.gov/sites/default/files/current/far/html/Subpart%2019_15.html#wp1097805 https://www.acquisition.gov/sites/default/files/current/far/html/Subpart%2019_15.html#wp1097805 http://uscode.house.gov/ http://uscode.house.gov/ by FAR Subpart 5.2 and, if not, which exception under FAR Subpart 5.202 applies.

(MARKET RESEARCH, discuss which notices were published and where (outreach).

The RFQ will be posted via Beta.SAM to ensure fair opportunity is afforded to “potential” Contractors.

Price reasonableness will be determined through comparison of proposed prices to the manufacturer’s current commercial list price, the Independent Government Cost Estimate

(IGCE)

Lowest Price Technically Acceptable (LPTA) will be the best value methodology used for this effort.

The CO determines that the expected outcome of this acquisition, in the Government’s estimation, provides the greatest overall benefit in response to the requirement.

5. A determination by the contracting officer that the anticipated cost to the Government will be fair and reasonable.

Even thought this is a Sole Source requirement, this RFQ will be solicited through beta.sam to insure competition to the maximum extent practicable. Price reasonableness will be determined through comparison of proposed prices to the current commercial list price, the independent cost government estimate and competitive prices received through historical data.

6. A description of the market research conducted (see FAR Part 10) and the results or a statement of the reason market research was not conducted. (MARKET RESEARCH -review of industry sources, GSA eLibrary).

To determine these types of services are not supported by a mandatory source or an existing GSA contract vehicle, the Market Research team interviewed industry partners.

Beginning in February, the Market Research team interviewed two well known companies within the commercial industry that provide access to their Bug Bounty SaaS Platform and their community of security researchers: HackerOne and BugCrowd.

A Request for Information (RFI) was issued on July 30 - August 12 to determine the likelihood of a small business being qualified to perform the requirement and the outcome indicated that there were not two or more qualified small businesses capable of performing the requirement. The RFI was issued to GSA contractors using Beta SAM and three (3) responses were received from Luta Security, Pars Consulting Engineers & HackerOne, all are small businesses. However, only HackerOne’s response to the RFI demonstrated the ability to meet the requirements.

7. Any other facts supporting the use of other than full and open competition.

N/A

8. A listing of the sources, if any, that expressed, in writing, an interest in the acquisition.

The RFI was issued to GSA contractors using Beta SAM and three (3) responses were received from Luta Security, Pars Consulting Engineers & HackerOne, all are small businesses.

DocuSign Envelope ID: F7482DEB-86BF-4664-A700-CF22412FEAEF https://acquisition.gov/far/current/html/Subpart%205_2.html#wp1107980 https://acquisition.gov/far/current/html/Subpart%205_2.html#wp1107980 https://acquisition.gov/far/current/html/Subpart%205_2.html#wp1107990 https://acquisition.gov/far/current/html/Subpart%205_2.html#wp1107990 https://acquisition.gov/far/current/html/FARTOCP10.html#wp266706 https://acquisition.gov/far/current/html/FARTOCP10.html#wp266706

9. A statement of the actions, if any, the agency may take to remove or overcome any barriers to competition before any subsequent acquisition for the supplies or services required.

This requirement is anticipated to be an ongoing need for GSA, Office of the Chief Information Officer (CIO), Security Operations Division, in future years. The Security Operations Division will conduct an annual assessment of the technology currently in place as well as other viable technologies in the marketplace before any subsequent acquisition is made. Additionally, new market research will be conducted prior to the expiration of the current award to determine if new manufacturers or sources are available to avoid limitation of competition in future years.

Program/Technical Official Certification:

I hereby certify and accept the responsibility that any and all supporting data provided above or used to justify the above requested for a sole source procurement (e.g., verifying the Government’s minimum needs, schedule requirements, and/or other rationale for other than full and open competition) is accurate and complete to the best of my personal knowledge and belief.

9/3/2020

Contracting Officer’s Representative’s Signature Date

9/3/2020

Project Manager’s Signature Date

Contracting Officer’s Certification:

I hereby certify that the information contained in this Justification for Other than Full and Open Competition, is accurate and complete to the best of my knowledge.

9/8/2020

Contracting Officer’s Signature Date

In accordance with Office of Internal Acquisition policy, One Level Above Contracting Officer’s Review and Approval (required for all actions over $250,000).

I hereby certify that the information contained in this Justification for Other than Full and Open Competition, is accurate and complete to the best of my knowledge.

9/9/2020

One Level Above Contracting Officer’s Signature Date

In accordance with FAR 6.304, for Orders exceeding $700,000, but not exceeding $13.5 Million: Competition Advocate

I certify and approve that this justification is accurate and complete to the best of my knowledge and belief.

Competition Advocate’s Signature Date

9/10/2020