CSS_SOW_Data_Diode.docx

NATIONAL INSTITUTE OF STANDARDS & TECHNOLOGY

One-Way Data Gateway/Data Diode System

RFQ NUMBER 1333ND24QNB610664

TABLE OF CONTENTS

SECTION E: Statement of Work Page, 6-10

SECTION A: COMBINED SYNOPSIS/SOLICITATION

A.1 COMBINED SYNOPSIS/SOLICITATION

a. This is a combined synopsis/solicitation for commercial items prepared in accordance with the format in FAR subpart 12.6 Streamlined Procedures for Evaluation and Solicitation for Commercial Items, as supplemented with additional information included in this notice. This announcement constitutes the only solicitation; quotations are being requested, and a separate written solicitation document will not be issued. This solicitation is being issued under the authority of FAR Part 13 Simplified Acquisition Procedures. This solicitation is a Request for Quotations (RFQ). The solicitation document and incorporated provisions and clauses are those in effect through Federal Acquisition Circular (FAC) 2024-05 published April 22, 2024, and effective May 22,2024.

b. The associated North American Industrial Classification System (NAICS) code for this procurement is 541519, Other Computer Related Services which has a small business size standard of $34 million, is the best fit for this acquisition. This acquisition is being competed as a total small business set-aside.

c. 1352.215-72 Inquiries (APR 2010); Offerors must submit all questions concerning this solicitation in writing to ranae.armstrong@nist.gov . Mailed and/or faxed questions will not be accepted. Any responses to questions will be made in writing, without identification of the questioner, and will be included in an amendment to the solicitation. Amendments to this solicitation (if applicable) will be posted on the SAM.GOV website under the solicitation. Inquires must be received no later than three (3) days after the RFQ is posted for Government response.

A.2 Solicitation Posting

a. This solicitation is only posted on the System for Award Management (SAM) website, www.sam.gov.

b. Attachments, amendments and other associated documents as applicable will be posted to the SAM.GOV website, under the solicitation.

A.3 Contract Type

a. This is a firm fixed-price contract type.

END OF SECTION A

SECTION B: SYSTEM FOR AWARD MANAGEMENT (SAM) REGISTRATION REQUIREMENT

B.1 SAM Registration

a. An Offeror is required to be active and registered in the System for Award Management when submitting an offer or quotation and shall continue to be registered until time of award, during performance, and through final payment of any contract, basic agreement, basic ordering agreement, or blanket purchasing agreement resulting from this solicitation, in order to comply with the annual representations and certification requirements. If an offeror is not active and registered in SAM, their submission will not be considered for award offer and will not be reviewed the Government. The Government will review the Offeror’s SAM registration and affirm the determination of responsibility. In addition, the Government will review the currently available credit/assessment/performance reports. The Government will also review an Offeror’s SAM exclusions record. A non-responsible determination may be made if an Offeror lacks adequate financial resources or has demonstrated poor past performance.

END OF SECTION B

SECTION C: QUOTATION SUBMISSION. LATE SUBMISSIONS, & RESPONSE DEADLINE

C.1 General Instructions Quotations are expected to conform to solicitation provisions and be prepared in accordance with this section. To aid in evaluation, the quotation shall be clearly and concisely written as well as being neat, indexed (cross-indexed as appropriate) and logically assembled. All pages of each part shall be appropriately numbered and identified with the name of the offeror, the date, and the solicitation number.

C.2 Electronic Submission Only The offeror shall submit their quotation electronically to ranae.armstrong@nist.gov with a cc to Donald.collie@nist.gov, FAXED AND/OR MAILED QUOTATIONS WILL NOT BE ACCEPTED. Quotations must be received in the email inbox on or before the due date and time specified above. Only information received on or before the due date and time shall be considered for award. Any quotation, or part thereof, received after the due date and time, shall be deemed late and not considered for award. Offeror’s quotations shall not be deemed received by the Government until the quotation is entered in the e-mail inbox provided above.

C.3 All Offerors Shall Submit the Following:

a. For the purpose of evaluation of technical acceptability, the offeror must submit documentation that demonstrates the offered equipment/services meet the technical specifications and requirements as detailed in the Statement of Work.

Offerors shall provide a firm fixed-price offer for the following line items.

b. A completed version of all required solicitation provisions (see attached provisions/clauses document – required submissions highlighted in blue). THE BUY AMERICAN ACT PORTION OF THE RFQ MUST BE COMPLETED AND RETURNED WITH THE QUOTATION.

c. Any award resulting from this solicitation will contain the following statement: “The Government’s terms and conditions, identified herein, shall be the prevailing terms and conditions governing this award. In the event of a conflict between the Government’s and contractor’s terms and conditions, the Government’s terms and conditions take precedence.” If the Contractor objects to any of the terms and conditions contained in this solicitation, the contractor shall state “The terms and conditions in the solicitation are acceptable to be included in the award document with the exception, deletion, or addition of the following:” [Contractor shall list exception(s) and rationale for the exception(s)]. It is the sole responsibility of the Contractor to identify in their quote any exceptions to the terms and conditions of the solicitation. If the contractor does not include such a statement, the submission of a quotation in response to this solicitation will be regarded as the Contractor’s acceptance of the Government’s terms and conditions for inclusion into the resultant purchase order as prevailing.

d. Offeror shall provide an active UEI # for the System for Award Management (SAM) registration.

e. Please note that this procurement IS NOT being conducted under the GSA Federal Supply Schedule (FSS) program or another Government-Wide Area Contract (GWAC). If a contractor submits a quotation based upon an FSS or GWAC contract, the Government will accept the quoted price. However, the terms and conditions stated herein will be included in any resultant Purchase Order, not the terms and conditions of the contractor’s FSS or GWAC contract, and the statement required above shall be included in the quotation.

C.4 Due Date for Quotations

a. All quotations must be submitted via e-mail to Contract Specialist Ranae Armstrong at RANAE.ARMSTRONG@NIST.GOV. Submission must be received not later than 08/29/24, 4:00 p.m. Eastern Time. A quotation shall be considered received when it is received in the electronic inbox of Ranae Armstrong not later than the date and time identified herein.

b. The clauses and provisions applicable to this solicitation can be found under Applicable Clauses & Provisions. The full text of a FAR provision or clause may be accessed electronically at or www.acquisition.gov/far. The full text of a CAR provision or clause may be accessed electronically at or https://www.ecfr.gov/current/title-48/chapter-13

C.5 Late Submissions and Withdrawals of Quotes

a. Any quote received in the inbox of ranae.armstrong@nist.gov after the date and time specified for receipt of Quotes may not be considered unless it is determined by the Contracting Officer that the submitted quotation is advantageous to the Government and/or is received before a purchase order is issued.

b. Quotes can only be submitted electronically. This is also applicable to any modified quotes. The request to withdraw a quote must be submitted electronically to the contract specialist and contracting officer.

Description: One-Way Data Gateway/Data Diode to capture reactor data.

Quantity: Two (2)

END OF SECTION C

SECTION D: EVALUATION CRITERIA

D.1 Lowest Price Technically Acceptable (LPTA)

D.2 Evaluation Criteria The Government intends to award a single purchase order from this RFQ to the responsible offeror whose quotation, conforming to the solicitation, is the lowest price, technically acceptable quotation. The Government reserves the right not to award a purchase order.

Technically acceptable means that the offeror provides the equipment/services as specified in the Statement of Work (attached to the SF1449). No prototypes or demonstration models will be considered. Evaluation of technical capability shall be based on the information provided in the quotation. The National Institute of Standards and Technology (NIST) will evaluate whether the offeror has demonstrated that its proposed equipment/supplies meet all minimum requirements. If an offeror does not demonstrate how the equipment/services meet the required technical specifications NIST will determine the offer is not technically acceptable.

The proposed pricing will be evaluated to determine that the total price is consistent with the technical portion of the quotation and is a fair and reasonable overall price to the Government.

NIST intends to evaluate quotations and issue a purchase order based on the initial quotes received. Therefore, the offerors initial quote should contain the offerors best terms from a price and technical standpoint. NIST reserves the right to request revised quotes from, or negotiate final contract terms with, one or more, but not all, Contractors if later determined by the Contracting Officer to be necessary.

END OF SECTION D

SECTION E: STATEMENT OF WORK

STATEMENT OF WORK

Title: One-Way Data Gateway/Data Diode System Requesting Laboratory: National Institute of Standards & Technology Center for Neutron Research (NCNR)

BACKGROUND

The NCNR seeks a one-way data gateway (or "data diode") to replace the in-house data diode system currently used for reactor data. The data diode will capture ethernet messages through various industrial protocols from the transmitter side ("anode") located on the reactor OT network. These messages will then be compiled and stored in an SQL database on the research network's receiver side ("cathode"). The cathode is the receiver side of the data diode and is located on the research IT network.

Purpose: Replace existing data diode system to capture reactor data.

SCOPE

The Contractor must deliver and install a quantity of two (2) One-Way Data Gateway/Data Diode System, inclusive of FOB Destination delivery terms and 12-month warranty, in accordance with the requirements of this document. Additionally, a data diode replacement system will be supplied as a spare unit.

REQUIRED MEETINGS/SITE VISITS

1. The contractor must schedule a site survey (post award) prior to submitting the initial design drawings of the proposed system, to verify the form, fit, and function of the proposed system with the existing system.

2. The Contractor must schedule a virtual (Teams) or on-site Kick-Off meeting no later than (NLT) one (1) week after receipt of order (ARO).

3. The Contractor must schedule a virtual (Teams) or on-site Initial Design Review meeting NLT two (2) weeks after receipt of order.

4. The Contractor must schedule a virtual (Teams) or on-site Final Design Drawing Review meeting NLT two (2) weeks after acceptance of the initial design of the proposed system.

MINIMUM REQUIREMENTS

The Contractor must provide a firm fixed-price quotation for equipment that meets all technical specifications identified below. All items must be new. Used or remanufactured equipment will not be considered for award. Experimental, prototype, or custom items will not be considered. The use of “gray market” components not authorized for sale in the U.S. by the Contractor is not acceptable. All line items must be shipped in the original manufacturer’s packaging and include all original documentation and software, when applicable. The Offeror must submit a firm fixed-price quotation for all line items.

Line Item 0001:

Description: One-Way Data Gateway/Data Diode to capture reactor data.

Quantity: Two (2) A. Technical Specifications

a. The system must be capable of one-way data transfer of TCP, UDP, Modbus TCP/IP, and OPC-AE packets and associated timestamps.

b. The system must be capable of receiving and applying security patches and hotfixes for vulnerabilities discovered by the manufacturer. These security patches must be delivered to NIST and installed by NCNR staff.

c. The system must be installed in the NBSR confinement building’s PAC room.

d. The system must be powered by the standard 120 VAC. If a power supply or converter is necessary, the contractor must supply the power supply and its necessary installation.

e. The system must be capable of time-server synchronization with the NIST Time Protocol (NTP).

f. The system must be capable of transmitting no less than 1 gigabit of data every 1 second.

g. The system must be evaluated at a minimum Evaluation Assurance Level (EAL) of EAL4.

h. The system must create and store logs that allow potentially malicious or otherwise harmful events to be inspected, troubleshot, and investigated by NIST staff.

i. The system must operate in an office environment (i.e. low humidity, approximately 65-75°F). It will be located in the PAC room, C206.

j. The system must be capable of data encryption between anode-to-cathode and between cathode-to-database.

k. System must be capable of integrating future protocol updates.

l. The proposal must conform to the Department of Commerce Enterprise Cybersecurity Policy (DOC ECP) as it relates to the collection, processing, transmitting, storing, and disseminating of DOC information.

B. Design Requirements

a. Initial Design Drawings of the proposed system must be submitted to the NIST COR not later than (NLT) 2 weeks after receipt of award. The Contractor must provide computer-generated, scaled, top and side view drawings of the system in AutoCAD format. The initial design drawings must serve as detailed design drawings for the system the Contractor is proposing to manufacture. Unless the information is proprietary, the initial design drawings must include an internal system design and component drawings to allow for advanced troubleshooting and repair. The proposed system must be approved and accepted by the COR before the Contractor commences work and incurs material costs associated with the proposed system.

b. Final Design Drawing. The final design drawing is the final drawing of the proposed system which will be installed at NIST.

c. Approval by the Government as required above must not relieve the Contractor of its obligation to comply with the specifications and with all other contract requirements, nor must it impose upon the Government any liability it would not have had in the absence of such approval.

d. A failure mode analysis of the system must be provided which outlines common or expected failure modes as it relates to the proposed installation.

DELIVERABLES

Only one (1) system will be installed, with a spare system provided.

180 Days After Acceptance of the Proposed System.

DELIVERABLE ACCEPTANCE STANDARDS: The NIST COR will provide written or electronic comments on each deliverable within five (5) business days from receipt of a given deliverable. The Contractor must make any needed changes and resubmit the deliverable within 5 business days from receipt of electronic or written comments from the COR. The COR will provide written notification via email when a deliverable is accepted. The deliverable is not considered accepted until the Contractor receives written notification from the COR the deliverable is determined to be final and accepted.

DELIVERY TERMS

Domestic Delivery Terms: Delivery must be F.O.B Destination (or equivalent INCOTERMS) and must occur in accordance with the delivery due dates provided in the above table.

FOB Destination means: The contractor must pack and mark the shipment in conformance with carrier requirements, deliver the shipment in good order and condition to the point of delivery specified in the purchase order, be responsible for any loss of and/or damage to the goods occurring before receipt and acceptance of the shipment by the consignee at the delivery point specified in the purchase order; and pay all charges to the specified point of delivery. The contractor must deliver all Line Items to:

The National Institute of Standards and Technology Shipping and Receiving 100 Bureau Drive, Building 301 (Shipping & Receiving) C/O TBD Building 235 Gaithersburg, MD 20899-1640

PERIOD OF PERFORMANCE

Six (6) months after receipt of order.

TESTING & ACCEPTANCE

In addition to the inspection and acceptance terms articulated in 52.212-4, the Government reserves the right to perform such performance tests and evaluations as defined below to verify specified system performance. Such tests and evaluations, if performed, must be conducted within the environment that the system is to be operated. The Contractor has the right to be present during the tests and evaluations, if performed, at the Contractor’s expense.

Performance Tests:

1. Data diode must be inspected for physical damage and neatness upon installation. This step may include but is not limited to examining for broken parts, loose or missing screws, loose or misaligned devices, circuit board workmanship, loose wires, loose connectors, or loose components.

2. Upon installation, the system must be tested for data transmittal from the reactor OT network to the NCNR's data historian, and associated web GUI "Reactor @ Your Desktop". Data transmittal must be uninterrupted for no less than 1 hour after initial device startup and contractor check-out. The data historian is used for the post-hoc analysis and feeds the NCNR’s internal reactor data webpage.

3. The equipment must be monitored for a minimum period of forty (40) days, with a preferred, extended period of ninety (90) days after initial device startup. During a forty (40) day period, the equipment must not fail, else it will be deemed unacceptable. In a ninety (90) day period the equipment must require no more than one instance of manual intervention by personnel to maintain data transmittal to the data historian. A ninety (90) day extended testing and acceptance period is required to 1) ensure the system demonstrates ongoing stability as required and 2) monitor the system for failures. This ninety (90) day period is representative for a full evaluation of the system.

4. Any instance of manual intervention will be reported to the contractor for investigation and repair if necessary.

5. If a second instance of manual intervention is made, the 90-day performance period and intervention count will be reset. The 90-day count will start from the day of the manual intervention, and the intervention count will start from 0.

NIST may choose at its discretion to forego this part of acceptance testing.

A visual inspection of the equipment will be performed by the NIST TPOC to identify surface defects or any form of indication that any equipment was damaged during transport to NIST. The Government must have sole discretion to require repair or replacement of damaged and/or nonconforming supplies at no cost to the Government. The Government at any time prior to acceptance must reject the equipment due to defects and/or nonconformance. The vendor is responsible for latent defects discovered any time after final inspection. However, the extent of its liability must be prorated over the useful life of the equipment. Ownership of the equipment must transfer to NIST upon acceptance by the Government.

The Government will test, inspect, and accept or reject the equipment within ninety (90) working days of the receipt of the equipment unless otherwise indicated above. The Government reserves the right to conduct quality assurance testing to confirm that a given instrument(s) meets the manufacturer’s and/or the Government’s performance specifications. It is anticipated that the equipment will meet all manufacturer’s specifications and/or the Government’s performance specifications identified in the most recent operations and maintenance manual for each piece of equipment and/or in this document.

INSTALLATION REQUIREMENTS

The system must be installed in the PAC room of the confinement building, in building 235 of the NIST Gaithersburg, MD campus NLT 180 days after the Government accepts the system proposed by the Contractor. Installation at a minimum includes delivery of the system, unpacking of the system, full installation of the system in the assigned place in the PAC room (without assistance from NIST staff), clean up of the installation area, and disposal of all waste. The system will be installed in a live working area. Contractor staff is required to keep the installation free of clutter and safety hazards, to ensure NIST staff who are actively working are not impeded by the installation process. The Contractor is responsible to be knowledgeable about and adhere to NIST safety practices and regulations.

NOTE: Cable routing between the system and existing ethernet access points must be routed following NFPA 70 national electrical code (NEC) standards. The system may be installed into the existing rack or the Contractor may install a new server rack for installation.

Installation must be completed Monday – Friday between the hours of 8:00am - 6:00pm, except for Federal holidays or federal closings.

TRAINING REQUIREMENTS

Training must be provided on-site at the NIST Gaithersburg, MD campus, for up to six (6) NIST staff. Training is required to be provided NLT fourteen (14) days after the successful installation of the system.

Training must include, at a minimum, configuration, maintenance, and troubleshooting of the data diode. At the end of the training, NIST staff must be capable of configuring and reconfiguring the data diode, perform regular maintenance to maintain the reliability of the system, troubleshoot and repair the device in the case of standard hardware or software failures, and troubleshoot and gather diagnostic data from the device in the case of nonstandard hardware or software failures that must be addressed by the Contractor. The Contractor must provide an electronic copy of the provided training, including graphs, images, word documents, PDFs, PPTs, and so forth provided during the live training.

Training must be completed Monday – Friday between the hours of 8:00am - 6:00pm, except for Federal holidays or federal closings.

WARRANTY

The Contractor must provide, at a minimum, a one-year warranty period for the system in accordance with FAR 52.212-4. Warranty work must be completed on-site at NIST or at the Contractor's facility, as mutually agreed upon by both parties. All costs and responsibilities associated with parts, labor, travel and shipping must be incurred solely by the Contractor. The Government is not responsible for any costs associated with providing warranty services. The warranty must commence upon final acceptance of the system by the Government.

PAYMENT TERMS

Advanced payment is not authorized. Invoices must be submitted in the arrears. The Contactor must be paid in accordance with NET 30-day payment terms upon receipt and acceptance of a proper invoice. An invoice must be submitted in accordance with the billing instructions provided in the purchase order and after the system has been accepted by the Government. Invoices submitted prior to government acceptance may be rejected.

ATTACHMENTS

1. ISO/IEC 15408: Common Criteria for Information Technology Security Evaluation

2. MODBUS Application Protocol (2012). MODBUS APPLICATION PROTOCOL SPECIFICATION.

3. MODBUS Application Protocol (2012). MODBUS MESSAGING ON TCP/IP IMPLEMENTATION GUIDE.

4. IEC 62541: OPC Unified Architecture

5. NIST SP 800-82: Guide to Operational Technology (OT) Security

6. NIST SP 800-53: Security and Privacy Controls for Information Systems and Organizations

7. Department of Commerce Enterprise Cybersecurity Policy (ECP) Version 1.1

END OF SECTION E

SECTION F: SOLICITATION ADMINISTRATION

F.1 Amendments and Modifications

a. Changes in terms and conditions of this solicitation shall be accomplished by written amendment only.

b. Changes in terms and conditions of any resulting contract shall be accomplished only by written modification signed by the Contracting Officer.

END OF SECTION F

image1.png