CSO Call 9 - Cyber Defense Platform.pdf

UNCLASSIFIED

CSO CALL 9- CYBER DEFENSE PLATFORM

OVERVIEW

This Commercial Solutions Opening (CSO) Call solicitation is issued in accordance with Defense Federal Acquisition Regulation Supplement (DFARS) Section 212.70

NAICS Code and associated description: 518210 — Data Processing, Hosting, and Related Services

Federal Agency Name and Contracting Officer: AFLCMC, Brock Bowers

Commercial Solutions Opening Title: This is a combined synopsis/solicitation for the AFLCMC Data Operation CSO Call 9 titled "CYBER DEFENSE PLATFORM."

Commercial Solutions Opening Number: FA8600-23-S-0056-0009

Commercial Solutions Opening Type: This is the initial announcement of Call 9. This will be a One-Step Closed Call.

One Step: PROPOSAL DUE DATE AND TIME: Proposals will be accepted until 5 September 2025 at 1600 ET. Proposals may be submitted at any time during this period.

Proposals received after the specified date and time will be considered late in accordance with FAR 52.212-1(f). Proposal must be valid for 120 days.

Submission POCs: Proposals must be submitted via email to the following Points of Contact

(POC):

Contracting Officer: Brock W. Bowers Email: AFLCMC.WA.SOC@us.af.mil

FULL TEXT

CSO CALL 9- CYBER DEFENSE PLATFORM

OVERVIEW

This Commercial Services Opening (CSO) Call is intended to be a streamlined solicitation to allow for the establishment of modern Data Operations (DataOps) solutions supporting a variety of critical national security systems. Specifically, the Air Force Life Cycle Management Center (AFLCMC) requires a vendor to source, configure, and deploy a cyber defense platform near the Wright Patterson Air Force Base location. Offerors are invited to submit technical proposals to develop and deliver a state-of-the-art commercial solution that addresses the technical and performance requirements as detailed in Attachment 1 — Statement of Objectives (SOO) — Cyber Defense Platform.

This AFLCMC project requires a vendor to have personnel who have at minimum Secret security clearances. To be eligible for contract award, vendors must be cleared to work, or have the ability to be cleared to work, in a classified environment at the time of proposal submission.

AFLCMC anticipates awarding a FAR Part 12 contract to one or more vendors. Vendors should review FAR clauses 52.2 12-4 and 52.2 12-5 for standard terms and conditions of a FAR Part 12 contract. AFLCMC is not obligated to make any awards as a result of this Call and all awards are explicitly subject to the availability of funds and successful negotiations.

The Government is not responsible for any monies expended by the vendor prior to the issuance of any awarded contract.

AFLCMC intends to follow the processes identified in the "AFLCMC Data Operations CSO" unless otherwise noted or annotated in this Call. AFLCMC reserves the right to modify the solicitation requirements of this CSO Call at its sole discretion.

DIGITAL INFRASTRUCTURE (DI) FOCUS AREAS

This Call is issued in support of the following Focus Areas:

5. Network Operations Center (NOC) / Security Operations Center (SOC) AFLCMC is seeking solutions to support, enable, and augment network administration and cybersecurity operations.

X. Cyber, Secure Processing Due to the sensitive nature of the USAF mission, the ability to leverage cyber secure processing, compliant with DoD standards for all impact levels is required.

CALL DESCRIPTION, INSTRUCTIONS TO OFFERORS, AND EVALUATION

CRITERIA

Overview: This call will be a One-Step Closed call. The proposal due date and time is 5 September 2025 at 1600 ET. Proposals must be submitted to the following email:

AFLCMC.WA.SOC@us.af.mil.

Proposals may be submitted at any time prior to this due date and time. White Papers will not be accepted. Offerors are responsible for monitoring SAM.gov for any amendments to this Call that may have updated information. Proposals will be evaluated against the criteria detailed below in Evaluation Criteria.

All proposals must be UNCLASSIFIED. AFLCMC will not accept classified proposals under this Call.

CONTRACT DETAILS:

Contract Type: AFLCMC anticipates awarding a FAR Part 12 contract to one or more vendors. The awarded contract may be structured as an Indefinite Delivery Indefinite Quantity (IDIQ) contract with the ability to issue Firm Fixed Price (FFP) task orders for a period of five (5) years from the contract effective date.

PROPOSAL INSTRUCTIONS: Below is the required structure and required content for proposal submission for this Call.

Please submit files in either PDF, Word, Excel, or PowerPoint file type(s). The proposal submission must include, at minimum, the following four Parts:

Part 1 - Cover Page;

Part 2 - Technical Proposal;

Part 3 - Price Proposal;

Part 4- Statement of Work (SOW)

Note: Some file type(s) may get quarantined in the AFLCMC firewall. Offerors are encouraged to specify the number of attachments included in the proposal submission email.

AFLCMC will provide a confirmation of receipt for each timely proposal submission. Ifan Offeror does not receive an email confirming proposal receipt, they are encouraged to follow-up with the email address AFLCMC.WA.SOC@us.af.mil to ensure successful proposal transmission.

Mandatory Proposal Items: The following section provides a template for Parts 1- 4 ofa complete proposal submission:

Part 1 — Cover Page:

The vendor's cover page must include the following information:

1. Vendor Name

2. Vendor Address

3. Vendor technical, programmatic, and contracts points of contact (PoCs)

4. List whether your organization qualifies as any of the following in accordance with FAR Part 19: Small Business (SB), Small Disadvantaged Business (SDB), Woman- Owned Small Business (WOSB), HlJBZone Small Business, Veteran- Owned Business, Service-Disabled Veteran Owned Small Business (SDVOSB), Historically Black College or University (HBCU) and Minority Institution

5. CAGE code

6. Cognizant Security Office

i. Name

ii. Address

iii. Phone Number

7. Provide a list of general classification levels and additionally proscribed categories from the below options that your organization has utilized for past projects.

(UNCLASSIFIED / CUT / SECRET / SECRET SAR I TOP SECRET / TOP

SECRET SAR / TOP SECRET SCI) Note: Do not provide any classified information regarding past projects on your submission, to include contract/agreement numbers (PIiDs).

Part 2 - Technical Proposal:

The vendor shall include an executive summary in the technical proposal not to exceed (NTE) two pages.

The technical proposal shall provide a detailed technical response that addresses all the technical and contractor requirements as detailed in Attachment 1— Statement of Objectives — Cyber Defense Platform. The technical volume shall discuss all tasks to be performed, and if necessary, a brief description of each proposed labor category.

The technical proposal shall not exceed 10 pages. The total page count does not include the Cover Page in Part 1 or the Executive Summary. Any pages submitted in excess of the 10-page limit will not be considered or evaluated.

Part 3 - Price Proposal

The price proposal must include pricing information sufficiently detailed for meaningful evaluation of the proposal. Since this Call will result in a FAR Part 12 commercial contract, the requirements of the Truth in Negotiations Act (TINA) are not applicable.

The vendor shall include a Microsoft Excel spreadsheet with the price proposal detailing the proposed cost elements and overall price.

For CLIN 0003, 0005, 0007, and 0009, vendor shall propose a per license cost so the OPTION CLINs can be exercised to purchase up to 63 licenses.

Part 4 - Statement of Work (SOW):

A SOW must be included with the full proposal. The SOW shall not exceed 5 pages in length and must be a separate and distinct document suitable for incorporation into the procurement instrument. Do not include proprietary data or markings in the SOW.

The proposed SOW shall accurately describe the work to be performed to meet the requirements in Attachment 1 — Statement of Objectives — Cyber Defense Plafform.

EVALUATION CRITERIA

Proposal Evaluation Criteria: Proposals will be evaluated in accordance with the following evaluation criteria:

1. T- Technical:

Experience: The Government will consider the extent to which the offeror has demonstrated experience and/or knowledge in the SOO areas. The Government is particularly interested in the offeror's demonstrated experience with or knowledge of Kubernetes or VMWare, Elastic, and QRadar.

Access: Is the offeror eligible for security access to AFLCMC programs, specifically personnel with an active Secret clearance with the capability to be read in to Special Access Programs (SAP)?

Schedule: Is the offeror's proposed solution feasible to be delivered within the time constraints of the anticipated award?

2. P - Price: The proposed price will be evaluated for reasonableness.

No other criteria will be used.

Using the evaluation criteria, AFLCMC will select proposals for award that best meet the Government's needs. The Government generally considers Technical more important than Price, but may prioritize a less technically capable proposal to ensure a diversity of approaches and/or maximize effective use of available funding. The selection of one or more sources for award will be based on the Government's evaluation and funding availability.

NOTE: AFLCMC reserves the right to award and fund one or more, or no, contracts for all or part of the proposals received. The Government may incrementally fund any or all awards under this CSO Call. All awards are subject to the availability of funds.

Prior to award to a successful vendor, the Contracting Officer will make a determination regarding price reasonableness.

Debriefings: The Government will conduct written, post-award debriefings upon request only in accordance with 52.212-1(1) and will address the evaluation factors contained herein only. It will not include a comparison of submissions against a common statement of work

(SOW) as the CSO provides no common statement of work that interested parties must respond to and instead represents opportunity for submission of a variety of innovative commercial items, technologies, and/or services that represent meaningful submissions of diverse scope and price.

GENERAL PROPOSAL INFORMATION

Proposal Content: Reference the below One-Step, Closed Call Process, for details on what to include in Proposal submissions.

Proprietary Information: Information constituting a trade secret, commercial or financial information, confidential personal information, or data affecting national security must be clearly marked. It shall be treated in confidence to the extent permitted by law. This restriction does not limit the Government's right to use information contained if it is obtained from another source without restriction. AFLCMC assumes no liability for disclosure or use of unmarked data and may use or disclose such data for any purpose. If a vendor is awarded a contract as a result of/or in connection with the submission ofproprietary data in the proposal, the Government shall have the right to duplicate, use or disclose the data to the extent provided in the resulting contract. Proposals containing data that is not to be disclosed to the public for any purpose or used by the Government except for evaluation purposes shall include the following sentences in accordance with FAR 52.2 15-l(e)(l) and (2) on the cover page:

"This proposal includes data that shall not be disclosed outside the Government and shall not be duplicated, used, or disclosed-in whole or in part - for any purpose other than to evaluate this proposal. If, however, a contract is awarded to this offeror as a result of- or in connection with - the submission of this data, the Government shall have the right to duplicate, use, or disclose the data t0 the extend provided in the resulting contract. This restriction does not limit the Government's right to use information contained in this data if it is obtained from another source without restriction. The data subject to this restriction are contained in sheets [insert numbers or other identUlcation of sheets]."

Each restricted data sheet should be marked as follows:

Use or disclosure of-data contained on this sheet is subject to the restriction on the title page of this proposal.

Classified Proposals: Classified proposals WILL NOT be accepted under this Call.

Security: Offerors must possess all required personnel security clearances, facility clearances, and other infrastructure requirements necessary to perform any proposed classified work in accordance with a Contract Security Classification Specification (DD Form

254) without reliance on Government resources. Offerors must verify their Cognizant Security Office information is current with the Defense Counterintelligence and Security Agency, DCSA (https://dcsa.mil).

If the vendor intends to perform classified work at their facility (or subcontractor or sub-awardee's facility), they will need to provide a Facility Accreditation Letter (FAL) for each facility to the Contracting Officer by no later than (NLT) contract/instrument award.

Small Business: FAR-based contracts awarded pursuant to this CSO Call shall include FAR

52.2 19-8, Utilization of Small Business Concerns (FEB 2024). FAR-based contracts awarded pursuant to this CSO Call which meet FAR Subpart 19.7 criteria for small business subcontracting plans shall include FAR 52.2 19-9, Small Business Subcontracting Plan (SEP 2023).

OTHER INFORMATION

DFARS 252.239-7017 -NOTICE OF SUPPLY CHAIN RISK (DEC 2022):

(a) Definitions. "Supply chain risk," as used in this provision, means the risk that an adversary may sabotage, maliciously introduce unwanted function, or otherwise subvert the design, integrity, manufacturing, production, distribution, installation, operation, or maintenance of a covered system so as to surveil, deny, disrupt, or otherwise degrade the function, use, or operation of such system (10 U.S.C. 3252).

Supplier Performance Risk System: In order to receive a DOD contract, every vendor will be required to perform a Basis NIST SP 800-17 1 DoD Assessment. Once the Basic NIST 800-171 DoD Assessment is complete, each vendor will need to follow the instructions contained within https://vvww.sprs.csd.disa.rnil to enter the results in the SPRP on the PIEE website.

Telecommunications: All contracts awarded under this call will contain prohibitions on the use of certain telecommunications devices in accordance with DFARS 52.204-25.

Data Rights: All proposal submissions shall include data rights assertions, if applicable. This will be an essential element of each proposal submission. Special Licensing Agreements may be negotiated upon request. AFLCMC reserves the right to negotiate data rights as part of the Contracting process.

The award will include the H Clause in Attachment 2: H200 COMMERCIAL COMPUTER

SOFTWARE LICENSE (NOVEMBER 2023).

Export-Controlled Items: The awarded contract may be subject to Export Control (International Traffic in Arms (ITAR) 22 CFR 120-131, or Export Administration Regulations (EAR) 15 CFR 7 10-774). Only Offerors who are registered and certified with the Defense Logistics Services Center (DLSC) and have a legitimate business purpose may participate in this solicitation. Contact the DLSC, 74 Washington Avenue N., Battle Creek, Michigan 40917-3084 (1-800- 352-3572) for further information on the certification process.

Offerors shall submit a current and active Certified DD Form 2345, Military Critical Technical Data Agreement, with their proposal. The form, instructions, and FAQs may be found at the United States/Canada Joint Certification Program website, http ://www.dla.mil/HQ/lnformationOperations/Offers/Products/LogisticsApplications /JCP/DD2345Instructions.aspx. Approval of the DD Form 2345 will be verified if proposal is chosen for award. DFARS 252.225-7048, "Export Controlled Item (JUN 2013)" clause shall be contained in all resulting contracts.

LIST OF ATTACHMENTS:

ATTACHMENT 1— STATEMENT OF OBJECTIVES — CYBER DEFENSE

PLATFORM

ATTACHMENT 2— H Clause — H200 COMMERCIAL COMPUTER SOFTWARE

LICENSE (NOVEMBER 2023)

NOTE: Vendors may be ineligible for award jf all requirements of this solicitation are not met in the proposal (when applicable).

Statement of Objectives

For

Cyber Defense Platform

Updated 1 August 2025

1. Objectives

a. This Statement of Objectives defines the Government's need for cyber defense capability at an 1L6+ (S//SAR) level to assist in the sourcing, configuration, and deploying a cyber defense platform near Dayton, Ohio. The cyber defense platform must utilize

Elastic Stack, Elastic EDR, and SOAR software on dedicated hardware to support 4,000 endpoints.

2. Scope

a. The scope of this effort includes the following tasks and options for:

i. Procurement, Preparation, and Configuration of the following areas:

1. Specified Equipment and Software Licensing

2. Platform Configuration

3. Documented Knowledge

4. Technical Support

The Government intends to use the below CLIN structure for this effort:

CLIN Title Type Period of Performance Task/Description

0001 Security Operations Center Deployment/Licenses/Technical Support/Bulk Training

Firm Fixed Price

3 November 2025 — 2 May 2026

Taski, Task 2, Task3

0002 Phase 2 Known Licenses/Technical Support (OPTION)

Firm Fixed Price

3 May 2026 — 2 May

OPTION Task 4

0003 Phase 2 Expansion Licenses

(OPTION)

Firm Fixed Price

3 May 2026 — 2 May

OPTION Task 5, CLIN will be exercised to purchase up to 63 licenses.

0004 Phase 3 Known Licenses/Technical

Support (OPTION)

Firm Fixed Price

3 May 2027 — 2 May

OPTION Task 4

0005 Phase 3 Expansion Licenses

(OPTION)

Firm Fixed Price

3 May 2027 — 2 May

OPTION Task 5, CLIN will be exercised to purchase up to 63 licenses.

0006 Phase 4 Known Licenses/Technical Support (OPTION)

Firm Fixed Price

3 May 2028— 2 May

OPTION Task 4

0007 Phase 4 Expansion Licenses

(OPTION)

Firm Fixed Price

3 May 2028— 2 May

OPTION Task 5, CLIN will be exercised to purchase up to 63 licenses.

0008 Phase 5 Known Licenses/Technical Support (OPTION)

Firm Fixed Price

3 May 2029 —2 May

OPTION Task 4

0009 Phase 5 Expansion Licenses

(OPTION)

Firm Fixed Price

3 May 2029 — 2 May

OPTION Task 5, CLIN will be exercised to purchase up to 63 licenses.

0010 Travel (OPTION) Cost 3 November 2025 — 2 May 2026

Contractor will obtain Contracting Officer approval PRIOR to travel

0011 Data - CDRL5 Not Separately Priced

3 November 2025 — 2 May 2026

0012 Contractor Acquired Property Not Separately 3 November 2025 — 2 Contractor shall deliver Priced May 2026 CAP to the Government.

Contractor shall maintain a list of CAP.

3. Performance Requirement

a. Task 1: Security Operations Center Deployment (CLIN 0001)

i. A vendor shall procure hardware according to the Government's specifications as perTable 1.

ii. The Government shall zero any and all removable hard drives prior to connecting the equipment to an active network connection.

b. Task 2: Bulk Training (CLIN 0001)

i. The vendor shall request the Elastic training as per Table 3 from Elastic for government use.

ii. The government shall provide seven names to receive bulk training to the awarded vendor.

iii. The selected individuals from the government will attend the training either virtually or at a local location near Dayton, Ohio.

c. Task 3: Technical Support/Licenses (CLIN 0001)

i. The vendor shall procure software according to the Government's specifications as per Table 2.

ii. The vendor shall request Elastic contracting hours from Elastic for an Elastic

Architect for the deployment. Elastic Architect must have experience deploying

Elastic in a Windows and Linux environment utilizing virtual machines or containers.

iii. The Government shall provide RHEL Operating System licenses for the

Government contractors to install onto the servers.

iv. The Government shall configure servers utilizing the RHEL Operating System and implement best practices for cybersecurity, application security, and platform security.

v. The Government shall enable auditing on each server for cybersecurity monitoring.

vi. The Government shall install the QRADAR and Teleseer software onto the new hardware.

vii. The Elastic architect shall install and configure Elastic Stack, Elastic EDR/XDR, Elastic Beats, and Kibana on the servers designated as "hot" servers alongside the Government.

viii. The Elastic architect shall install and configure Elastic Stack, Elastic EDR/XDR, Elastic Beats, and Kibana on "cold" servers alongside the Government.

ix. The Elastic architect shall use a Government-issued account to deploy Elastic agents and Elastic EDR/XDR on Government-owned assets with the support of the local Information Technology team. Agent deployment should not exceed

4,000 Government-owned assets for the initial deployment.

1. Government will provide a list of assets to the Elastic architect that cannot have agents deployed onto them.

x. The Elastic architect shall create and/or provide clear and concise documentation detailing installation, configuration, and common troubleshooting for the installed hardware and software

4. Performance Requirement (Optional Tasks)

a. Task 4 (Option): Known Licenses/Technical Support (CLIN 0002, 0004, 0006, 0008)

i. The Government shall create a request for the vendor to renew the number of active licenses 90 days before the active licenses expire

ii. At the request of the Government, the awarded vendor shall procure software licenses to meet the Government's needs.

b. Task 5 (Option): Expansion Licenses (CLIN 0003, 0005, 0007, 0009)

i. At the request of the Government, the awarded vendor shall procure up to 63 additional Federal Elastic licenses and additional Elastic consulting hours within

30 days of the request.

ii. The Elastic architect shall update the cyber defense platform configuration to include up to an additional 63 Federal Elastic licenses within 90 days of the initial expansion request.

iii. This request may be a yearly reoccurring request based on Government's needs.

c. Task 6 (Option): Travel (CLIN 0010)

i. At the request of the Government, the awarded vendor shall request an Elastic

Architect to travel to the site near Dayton, Ohio to perform on-site deployment, on-site troubleshooting, or on-site expansion.

5. Project Management

a. Government oversees financial, staffing, scheduling, contractual, security reporting, and risk mitigation aspects of the project and attend project meetings.

b. Vendor will participate in virtual meetings prior to purchasing materials, onsite configuration, post-installation, and as requested by the Government.

c. Elastic architect will participate in in-person and virtual meetings prior to onsite configuration, post-deployment, and as requested by the Government.

6. Period of Performance (PoP)

a. The period of performance (PoP) of this task order will be will be Nov 2025 — May 2030, consisting of an initial 6 months award with additional options. Within the initial 6 month awarded PoP, contractors shall complete tasks 1-3. The following 4.5 years will be dedicated to additional support and/or license sustainment.

b. Option Task: Optional task 4 may be approved by the Government dependent on the completion of Tasks 1-3.

c. Option Task: Optional task 5 may be approved by the Government dependent on the completion of Tasks 1-3.

7. Deliverables

a. At the completion of the procurement of hardware and software task,

i. The awarded vendor shall provide a Bill of Landing with serial numbers associated to AFLCMC/WA's SOC unclassified organization box, AFLCMC.WA.SOC@us.af.mil, NLT 30 calendar days after contract award.

Revisions due NLT 3 business days after response from government.

ii. The awarded vendor shall provide weekly reports of equipment in transit starting NLTthe first Wednesday after awarded vendor purchases equipment.

iii. The awarded vendor shall provide a list of license keys and Point of Contacts for purchasing licenses NLT 30 days before scheduled installation date.

iv. Elastic architect shall provide a list of employee names that would be qualified to be read into a Special Access Program at the SECRET classification level NLT

60 calendar days before scheduled installation date.

b. At the start of the bulk training task,

i. The awarded vendor shall provide an Elastic trainer to train three identified individuals NLT 30 days after contract award date.

ii. The awarded vendor shall provide an Elastic trainer to train four identified individuals NLT 90 days after contract award date.

c. At the completionof the deployment task,

i. The Elastic architect shall provide a report of Elastic Stack configurations in text format NLT 14 calendar days post deployment.

ii. The Government shall document the configuration of hardware and additional software integrated into the equipment

d. At the completion of document creation task, I. The Elastic architect shall provide clear and concise guides for each application's installation and common issue troubleshooting to the AFLCMC/WA SOC organizational mailbox NLT 14 calendar days post installation/configuration.

8. Security

a. Task Order requires all personnel accessing classified documents, programs, areas, and etc. to possess at least an active SECRET level clearance with the capability to be read in to Special Access Programs.

b. The Elastic architect shall comply with security requirements specified in contractor's

DD Form 254, Contract Security Classification Specification.

9. Government Funded Equipment

a. Government shall provide necessary GFI to allow the Elastic architect to successfully complete the objectives of this Task Order. This includes network diagrams and network accounts.

b. Government shall provide access to the environment with a dedicated terminal during installation to ensure availability on a non-interfering basis.

c. Government shall disable and remove access the Elastic architect had to the environment once installation is complete.

Table 1: Government's Hardware Specifications

QTY Equipment Description

3 Server Dell PowerEdge R7615

7 Server Dell PowerEdge R7725

10 Server/Sensor Dell PowerEdge R440

3 CPU AMD EPYC 9754 2.25 GHz 128-Core 360W Processor

14 CPU AMD EPYC 9755 2.70 GHz 128-Core 500W Processor

24 Storage 7.68TB SSD Up to SAS 24 GB/s FIPs

9 RAID Storage 480GB SSD SATA-RAID

77 Storage 15.36 TB Enterprise NVMe Read Intensive

140 RAM 64GB RDIMM 6400MT/s Dual Rank - -

12 RAM 128 GB RDIMM

7 Power Supply Dell Dual Non-Redundant 2U 1500W

3 Power Supply Dual, Hot-plug Fully Redundant FR Power Supply 1100W

7 Heat Kit Heat Sink for 2 CPU Configuration

3 Heat Kit High Performance Heat Sink v2

10 Rail Kit ReadyRails Sliding Rails with Cbl Mgmt

3 Fan Kit High performance fan kit

7 Fan Kit PowerEdge 2U High Performance Platinum Fan Kit

3 NIC Broadcom 57414 Dual Port 10/25G SFP28 OCP 3.0 NIC

7 NIC Broadcom 57504 25G SFP28 Quad Port Adapter OCP 3.0 NIC

10 Support Dell ProSupport and Next Day —3 Yr

10 Cable CISCO 25G Active Optical Cable 6.56 FT

10 Cable Ethernet Cord Cat 6 2M

10 Connector 1000BASE-T SFP Transceiver for CISCO -GLC-TE

1 Switch CISCO NEXUS 9372PX Switch

1 Support CISCO Digital Network Architecture Advanced — 3 YR Term —48 port

1 Server Cyberspatial Teleseer Spark Server

Table 2: Government's Software Specifications

License QTY Category Description

63 SIEM/EDR/XDR Federal Elastic Enterprise (ERUs per 120GB) *include EDR/XDR

1 Network Cyberspatial Teleseer

5 SOAR IBM ORADAR SOAR

(Optional) 63 SIEM/EDR/XDR Federal Elastic Enterprise (ERUs per 120GB) *include EDR/XDR

Table 3: Bulk Training

Seat Quantity Vendor Course name

7 Elastic Elasticsearch Engineer

(U) H200 COMMERCIAL COMPUTER SOFTWARE LICENSE (NOVEMBER 2023)

(a) (CUT) The Contractor shall acquire licenses to commercial computer software or commercial computer software documentation as those customarily provided to the public, except to the extent that the licenses are inconsistent with Federal procurement law (see DFARS 227.7202- 1(a) and paragraph b below) or do not otherwise satisfy user needs. The Contractor shall list the commercial licenses in the proposal, and the licenses will be attached as part of the contract.

(b) (U) The Contractor shall ensure that:

1. (U) The licenses are legally transferrable to the Government.

2. (U) All the rights under the licenses will fully insure to the benefit of and be transferred to the Government.

3. (U) The license shall not subject the Government to the laws of a particular jurisdiction.

4. (U) The license shall not comment on the entitlement to attorney fees if a matter goes to trial.

5. (U) The license shall not attempt to have an individual other than a warranted Contracting Officer bind the Government to certain terms and conditions.

6. (U) The license shall not be inconsistent with the Prompt Payment Act.

7. (U) The license shall not attempt to impose a vendor lock-out provision, which is a mechanical or electronic method imbedded in the system that prevents unauthorized use or distribution of the program. This method can result in an impermissible unilateral change to the contract initiated by the vendor and involve a vendor having free access to a computer system that must be secure.

8. (U) The license shall not state that it sets forth the entire agreement between the vendor and the Government because applicable Federal laws and regulations always govern Federal contracts.

9. (U) The license shall not impose an automatic renewal provision on the Government or the possibility of unilateral price increases.

10. (U) The license shall not permit the vendor to unilaterally terminate the contract or license.

11. (U) The license shall not require the Government to pay any taxes or duties.

12. (U) The license shall not state the sole remedy available to the Government is the refund of money.

13. (U) The license shall not be inconsistent with FAR 52.233-1, DISPUTES (MAY 2014), FAR 52.249-6, TERMINATION (COST-REIMBURSEMENT) (MAY 2004), or

FAR 52.249- 8, DEFAULT (FIXED-PRICE SUPPLY AND SERVICE) (APR 1984).

14. (U) The license shall not create a contingent liability for the Government.

15. (CUI) The license shall not restrict the Government from using the product at various sites or restrict the use of the product by various Government agencies or third parties performing work on behalf of the Air Force.

(c) Any license that contains terms or conditions inconsistent with the restrictions laid herein shall be read out of the license and unenforceable by the contractor or its subcontractors.

(d) The contractor shall provide copies of the license agreements within 90 calendar days of license purchase or at least 90 calendar days prior to the delivery of the license, whichever occurs first.

(end of clause)