DRAFT RFP 70RTAC22R00000010 Attachment 6 - Pricing Template.xlsx
XLSX spreadsheet 38 KB Posted
- Attached to
- DRAFT Solicitation for Hack DHS: Crowdsourced Vulnerability Assessment Services (CVAS) Federal contract opportunity
- Solicitation number
- 70RTAC22R00000010
About this file
This document contains a draft request for proposal for vulnerability assessment services and a sample pricing template. The Department of Homeland Security seeks to conduct a private, invite-only bug bounty program over four months involving six systems in total. Bounty payouts will be determined at the order level based on severity of issues found. The pricing template provides an example scenario and requests pricing for administrative costs for running the program against private assets. Responses to the final solicitation are due by May 3, 2022.
View the file
Other files for this federal contract opportunity
| File | Type | Posted |
|---|---|---|
| DRAFT RFP 70RTAC22R00000010 Attachment 1 - Performance Work Statement.pdf | ||
| DRAFT RFP 70RTAC22R00000010 Attachment 4 - Offeror Cert of Compliance with HSAR 3052.204-70 and Data Storage and Processing Req.pdf | ||
| DRAFT RFP 70RTAC22R00000010.pdf | ||
| DRAFT RFP 70RTAC22R00000010 Attachment 5 - Past Performance Questionnaire.pdf | ||
| DRAFT RFP 70RTAC22R00000010 Attachment 2 - Offeror Cert of IDIQ VCC Platform Compliance.pdf | ||
| DRAFT RFP 70RTAC22R00000010 Attachment 3 - Offeror Cert of Active Researcher Community.pdf |
On GovTribe
Work with this file on GovTribe
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
IDIQ Pricing
| Request for Proposal for 70RTAC22R00000010 | |||
| Attachment 6: Pricing Template | |||
| Tab 1 of 3: IDIQ Pricing | |||
| Offeror Name: | |||
| Instructions: | Please fill in the yellow-highlighted cells. | ||
| Base Period | |||
| CLIN Number | Description | Quantity | Price |
| 0001 | Bounty Payouts (Fixed-Unit-Price) Note: Quantity and price will be established at the order level. | Quantity will be established at the order level. | Price will be established at the order level. |
| 0002 | Administrative Cost – Public Asset (Firm-Fixed-Price) | ||
| 0002AA | Fixed-Duration Bounty Challenge | 1 Lot | |
| 0002AB | Continuous Bounty Challenge | 1 Lot | |
| 0002AC | Live Events | 1 Lot | |
| 0003 | Administrative Cost – Private Asset (Firm-Fixed-Price) | ||
| 0003AA | Fixed-Duration Bounty Challenge | 1 Lot | |
| 0003AB | Continuous Bounty Challenge | 1 Lot | |
| 0003AC | Live Events | 1 Lot | |
| Option Period 1 | |||
| CLIN Number | Description | Quantity | Price |
| 1001 | Bounty Payouts (Fixed-Unit-Price) Note: Quantity and price will be established at the order level. | Quantity will be established at the order level. | Price will be established at the order level. |
| 1002 | Administrative Cost – Public Asset (Firm-Fixed-Price) | ||
| 1002AA | Fixed-Duration Bounty Challenge | 1 Lot | |
| 1002AB | Continuous Bounty Challenge | 1 Lot | |
| 1002AC | Live Events | 1 Lot | |
| 1003 | Administrative Cost – Private Asset (Firm-Fixed-Price) | ||
| 1003AA | Fixed-Duration Bounty Challenge | 1 Lot | |
| 1003AB | Continuous Bounty Challenge | 1 Lot | |
| 1003AC | Live Events | 1 Lot | |
| Option Period 2 | |||
| CLIN Number | Description | Quantity | Price |
| 2001 | Bounty Payouts (Fixed-Unit-Price) Note: Quantity and price will be established at the order level. | Quantity will be established at the order level. | Price will be established at the order level. |
| 2002 | Administrative Cost – Public Asset (Firm-Fixed-Price) | ||
| 2002AA | Fixed-Duration Bounty Challenge | 1 Lot | |
| 2002AB | Continuous Bounty Challenge | 1 Lot | |
| 2002AC | Live Events | 1 Lot | |
| 2003 | Administrative Cost – Private Asset (Firm-Fixed-Price) | ||
| 2003AA | Fixed-Duration Bounty Challenge | 1 Lot | |
| 2003AB | Continuous Bounty Challenge | 1 Lot | |
| 2003AC | Live Events | 1 Lot | |
| Option Period 3 | |||
| CLIN Number | Description | Quantity | Price |
| 3001 | Bounty Payouts (Fixed-Unit-Price) Note: Quantity and price will be established at the order level. | Quantity will be established at the order level. | Price will be established at the order level. |
| 3002 | Administrative Cost – Public Asset (Firm-Fixed-Price) | ||
| 3002AA | Fixed-Duration Bounty Challenge | 1 Lot | |
| 3002AB | Continuous Bounty Challenge | 1 Lot | |
| 3002AC | Live Events | 1 Lot | |
| 3003 | Administrative Cost – Private Asset (Firm-Fixed-Price) | ||
| 3003AA | Fixed-Duration Bounty Challenge | 1 Lot | |
| 3003AB | Continuous Bounty Challenge | 1 Lot | |
| 3003AC | Live Events | 1 Lot | |
| Option Period 4 | |||
| CLIN Number | Description | Quantity | Price |
| 4001 | Bounty Payouts (Fixed-Unit-Price) Note: Quantity and price will be established at the order level. | Quantity will be established at the order level. | Price will be established at the order level. |
| 4002 | Administrative Cost – Public Asset (Firm-Fixed-Price) | ||
| 4002AA | Fixed-Duration Bounty Challenge | 1 Lot | |
| 4002AB | Continuous Bounty Challenge | 1 Lot | |
| 4002AC | Live Events | 1 Lot | |
| 4003 | Administrative Cost – Private Asset (Firm-Fixed-Price) | ||
| 4003AA | Fixed-Duration Bounty Challenge | 1 Lot | |
| 4003AB | Continuous Bounty Challenge | 1 Lot | |
| 4003AC | Live Events | 1 Lot |
&G
Sample Order Pricing
| Request for Proposal for 70RTAC22R00000010 |
| Attachment 6: Pricing Template |
| Tab 2 of 3: Sample Order Pricing |
| Offeror Name: |
| Instructions: Please utilize the scenario (See Tab "Scenario") in order to complete the sample ordering pricing. The Offeror is requested to fill in the yellow-highlighed cells. The price for CLIN 0001 is provided for evaluation purposes. Offerors do not need to provide additional price for CLIN 0001. This sample ordering pricing will not result in an actual order issued against the resultant contract. The total evaluated price will be used as part of the price evaluation and for a potential trade-off analysis between price and non-price evaluation factors, as needed. |
| Task Order CLIN | Description | Quantity | Price |
| 0001 | Bounty Payout (Fixed Unit Price) | TBD | $ 125,000.00 |
| Critical Severity Bug: $5000 | |||
| High Severity Bug: $3500 | |||
| Medium Severity Bug: $2000 | |||
| Low Severity Bug: $750 | |||
| Informational Bug: No payout | |||
| 0002 | Administrative Cost for Private Assets (All other price elements (e.g. Platform cost, overhead costs, background checks, etc.)) (Firm-Fixed-Price) | 1 Lot | |
| Task Order Total: | $ 125,000.00 |
&G
Scenario
| Request for Proposal for 70RTAC22R00000010 |
| Attachment 6: Pricing Template |
| Tab 3 of 3: Scenario |
| Period of Performance (PoP): 4 months (including pre- and post- event coordination and a three (3)-month bug bounty event) |
Scenario: The Department of Homeland Security (DHS) wishes to conduct a private, invite only remote bug bounty event which includes six (6) DHS systems. The systems will only be in scope for one (1) month each during the PoP. There will be two (2) systems in scope the first month which are replaced by two (2) different systems in the second month, and then those are replaced by the final two (2) systems in the final month of the PoP.
System 1 is an on-premises environment consisting of a web server with an application which takes user input from various forms and stores/retrieves them from a database for further processing and presentation to users or individuals processing records.
System 2 is a Infrastructure as a Service (IaaS) system consisting of three (3) web portals, an email server, and a virtual applies that performs email scanning.
System 3 is a cloud-based environment which supplies desktops as a service to end users after authentication through Department single sign-on.
System 4 is a collaboration platform that allows for text chat, presentation, file sharing, and video/voice chat. The system is heavily reliant on Commercial off the Shelf (COTS), but configuration and maintenance as well as identify/access control is performed by the Department with a mix of single-sign on accounts for the Department and single-factor login/password accounts for partners.
System 5 is a mobile application which uploads photos tagged with geolocation from multiple devices across the United States to a data center for machine learning based image classification and categorization.
System 6 is a Department coded cloud application which parses documents for Personally Identifiable Information (PII), Personal Health Information (PHI), and financial information before placing them into a publicly searchable archive.
&G image1.png
File details come from the government source that posted it. Updated .