Attachment_1_-_ITO_SW_DevSecOps_9Oct19.pdf

Attachment 1 Request for Quote FA8307-19-R-0133

Revised Instructions to Offerors/Basis for Entering into Agreement Software DevSecOps Services

9 October 2019

1. Instructions to Offerors:

A. This is a competitive action conducted in accordance with (IAW) Federal Acquisition Regulation (FAR) Part 16. The intent of this action is to enter into multiple Basic Ordering Agreements (BOAs). It is not a source selection that is subject to FAR 15.3 procedures.

B. Any quote submitted in response to this Request for Quote (RFQ) must be in compliance with the terms and conditions outlined in the RFQ and attachments, and the Statement of Objectives (SOO), dated 13 September 2019. All claimed capabilities to meet the requirements shall be realistic and are subject to verification by the Government. Non-conformance with these instructions may result in rejection of the quote or an unfavorable quote evaluation, or being deemed ineligible for a BOA.

C. Contractors must clearly identify any exception to RFQ terms and conditions and shall provide complete supporting rationale. The Government reserves the right to determine any such exceptions are unacceptable. Any exception determined unacceptable by the Government may result in the Offeror’s quote being determined unacceptable and ineligible for a BOA. This information shall be provided in the format and content of the table below within the Offerors quote cover letter. If no exceptions are taken, include a statement stating so within the quote cover letter.

BOA RFQ Exceptions

RFQ

Document

Page/ Paragraph

Requirement/ Portion Rationale

SOO,

ITO,

Evaluation Factor, etc.

Applicable Page and Paragraph Numbers

Identify the requirement or portion to which exception is taken

Describe why the requirement can/will not be met

D. The quote shall be clear, concise, and shall include sufficient detail for effective evaluation and for substantiating the validity of stated claims. The quote should not simply rephrase or restate the Government's requirements but, rather, shall provide convincing rationale to address how the Offeror intends to meet these requirements. Offerors shall assume that the Government has no prior knowledge of their experience and will base its evaluation on the information presented in the Offeror's quote.

E. Discrepancies. If an Offeror believes that the requirements in these instructions contain an error, omission, or are otherwise unsound, the Offeror shall immediately notify the CO in writing with supporting rationale as well as the remedies the Offeror is asking the CO to consider as related to the omission or error.

F. Consent to Disclosure and Company-to-Company Non-Disclosure Agreements (NDAs)

A. The Government has determined that neither personnel from the requesting agency, nor from another agency, with adequate training and capabilities to perform the required quote evaluation are readily available. Therefore, the Government intends to make use of the following companies to perform advisory and assistance services (A&AS) for this RFQ:

• MITRE Corporation

B. Pursuant to FAR 9.505-4(b), Obtaining Access to Propriety Information, a contractor that gains access to proprietary information of other companies in performing A&AS for the Government must agree with the other companies to protect their information from unauthorized use or disclosure for as long as it remains proprietary and refrain from using the information for any purpose other than that for which it was furnished. The CO shall obtain copies of these agreements and ensure that they are properly executed. While FAR 9.505-4(b) affords Offerors the ability to obtain an NDA from any company that will provide A&AS to the Government for this RFQ, Offerors may choose not to do so. If an Offeror chooses the latter, the Offeror must provide clear indication of that choice in writing to the CO prior to or at the time of submission of its quote. If an Offeror chooses to obtain an NDA, to facilitate that process the Government is providing the MITRE point of contact, with address, to whom Offerors should submit both their and any subcontractor NDAs for signature:

MITRE POC Information:

Michael Leonard michael.leonard.11.ctr@us.af.mil The MITRE Corporation 7323 Hwy 90 West, Suite 402 San Antonio, TX 78227-3562

C. Offerors' NDAs should be:

(1) In the format and with the content preferred by the Offeror so long as it meets the intent of FAR 9.505-4(b),

(2) Signed by the Offeror,

(3) Written such that it can be signed by an appropriate employee of the A&AS provider; and,

(4) By the RFQ due date mailed or emailed to:

Ms. Christina Fernandez 130 Norton St San Antonio, TX 78226 christina.fernandez@us.af.mil mailto:michael.leonard.11.ctr@us.af.mil mailto:christina.fernandez@us.af.mil

D. If an Offeror objects to disclosure of any part of its quote to the A&AS provider identified above, then within three working days of the date of issuance of this RFQ, its objection to disclosure of a portion of its quote (a) shall be provided in writing to the CO within 3 days of RFQ issuance, and, (b) shall include a detailed statement of the basis for the objection. The detailed statement shall identify the specific portions of the quote to which the Offeror objects to disclosure to the A&AS advisor. Note that the failure to permit disclosure of any part of an Offeror's quote to the A&AS advisor could result in those withheld portions of the Offeror's quote not being evaluated, which could impact the Offeror's ability to receive a BOA.

G. Period of Performance: The ordering period for this BOA shall be five years from date of issuance. The performance period for all orders placed under this BOA shall not exceed five (5) years from the completion of the ordering period.

H. Offerors shall submit one (1) electronic copy of their quote via email on or before the RFQ closing date of 17 October 2019, 12:00 PM CDT. Quotes received after the time and date listed will not be considered or evaluated for receipt of a BOA. The Government will not be responsible for any failure of receipt of the quote or any failure of the Offeror to verify receipt of the quote.

I. Offerors submitting a quote in response to this RFQ shall submit an administrative volume, technical volume, and portfolio review volume. Quotes shall be clear, concise, and shall include sufficient detail for effective evaluation. Quotes should not simply rephrase or restate the Government’s requirements; but rather, shall provide convincing rationale to address how the Offeror has the required capabilities to meet requirements.

Quotes shall be single-spaced, on 8.5 x 11 paper, have a minimum of one-inch margin all around and not less than Times New Roman 12 pt. font. Fold-outs may be used for tables, figures, and charts only, on 11 x 17 paper and not less than Times New Roman 10 pt. font. Offerors shall number each page. All quote information shall be submitted in either MS Word, MS Excel, or PDF searchable format.

Page limits do not include covers for volumes, tables of contents, glossaries of abbreviations and acronyms, indices, title pages, cross reference indexes, section dividers/tables if they are inserted solely to provide ease to the reader in locating parts/sections of the quote, and pages marked “This page intentionally left blank”.

The following table identifies the page limits to which Offerors must adhere. Pages in excess of these page limits will not be read or considered in the evaluation of the quote. Submit your quote in accordance with the table below. All submissions shall reference the complete RFQ number.

Volume Title Page Limit

I ADMINISTRATIVE 2

II FACTOR 1: TECHNICAL

CAPABILITY 5

III FACTOR 2: PORTFOLIO REVEW 10

(1) Volume I: ADMINISTRATIVE

Offerors shall provide a cover letter with their quote to include current points of contact (Contract Manager and Program Manager) that are authorized to obligate your firm, mailing address, current e-mail address and phone number, a statement that the company understands the requirements specified and will meet the performance standards and requirements therein, a statement that the company does or does not take exception to any of the requirements of this order, and acknowledges use of non-Government advisors. Offerors shall also confirm quote validity for 120 days. Limited to no more than two (2) pages.

(2) Volume II: TECHNICAL CAPABILITY (FACTOR 1)

Offerors shall include technical narratives for FACTOR 1. The technical narrative should be specific, complete, clear, legible, and coherent. Provide as specifically as possible your firm’s capabilities to meet the general scope, demonstrate an ability to hire and maintain qualified personnel, and be co-located in various geographic locations. All the requirements specified in the RFQ are mandatory. By your quote submission, you are representing that your firm will perform all the requirements specified in the RFQ. It is not necessary or desirable for you to tell us so in your quote. Do not merely reiterate the objectives or reformulate the requirements specified in the RFQ. This section is limited to five (5) pages.

(3) Volume III: PORTFOLIO REVIEW (FACTOR 2)

Offerors shall provide a portfolio and/or source code repository with links to demonstrate a technical understanding of DevSecOps engineering, software development, cybersecurity and/or IT support and operations. Offerors may provide information for several Government or commercial clients that they consider most relevant in demonstrating their ability to perform the proposed effort. This section is limited to ten (10) pages.

2. Basis for Entering into BOA:

A. Determination to enter into BOAs will be made IAW the procedures specified in the RFQ and after an assessment by the Government once both phases of evaluation are completed of which Offerors appear most capable of satisfying the Government’s requirements. A BOA may be entered into with an Offeror deemed responsible IAW FAR 9.1, as supplemented, whose quote conforms to the RFQ’s requirements (to include all stated terms, conditions, representations, certifications, and all other information required by the RFQ instructions) and is judged, based on the evaluation factors, as most capable of satisfying the Government’s requirements.

B. The Government evaluation process is as follows:

Step 1: The Government will review all quotes to determine if they are responsive to the RFQ requirements. A responsive quote is one that meets all the terms, conditions, and specifications of the RFQ. Offerors must provide all documents listed and comply with all submission instructions in order for their quote to be considered “responsive” to this RFQ.

Step 2: Evaluate technical capability and portfolio review information for all responsive quotes received in response to the RFQ.

Step 3:

- Offerors who receive a Highly Capable Technical rating and a higher than Acceptable Portfolio Review rating will be invited to the BOA Event Day tentatively scheduled for 13 November 2019 as a continuation of the technical evaluation.

- Offerors who receive a Capable Technical rating and a higher than Acceptable Portfolio Review rating may be invited to the BOA Event Day to continue with the technical evaluation.

- Offerors who receive a Not Capable Technical rating and lower rating than Good for the Portfolio Review are not eligible for a BOA. The Offeror will not be invited to the BOA Event Day.

Note that the BOA Event Day is a continuation of the technical evaluation and attendance is mandatory in order to receive a BOA. BOA determination will be contingent on the results of the BOA Event Day. Details regarding the event will be provided to Event attendees on or about 1 November 2019.

3. Evaluation Factors

A. Responses to this RFQ will be evaluated against the following factors:

Factor 1: Technical Capability Factor 2: Portfolio Review

FACTOR 1: TECHNICAL CAPABILITY

This factor will be used to determine whether the quote is TECHNICALLY CAPABLE. Please note that any assumptions provided with your quote will be reviewed and may affect your technical capability.

This factor is met when the Offeror proposes a technical narrative that is technically sound, realistic, and clearly and completely demonstrates the Offerors’ ability to meet the general scope, ability to hire and maintain qualified personnel, and be co-located in various geographical locations. A sound technical narrative means the overall narrative is well constructed, logically valid, and meets the requirements of the RFQ. A realistic narrative is one that is achievable based on known facts within the commercial marketplace and customary practices. The Government will evaluate this factor based on the following:

– Highly Capable indicates that the company thoroughly discusses how it will meet the general scope of the agreement in great technical detail, is able to co-locate in various geographical locations, and provides a robust mechanism for hiring and retaining highly capable personnel to perform services.

– Capable indicates that the company discusses some of how it will meet the general scope of the agreement, but does not provide specific technical information, does demonstrate the ability to co-locate in various geographical locations, and provides some mechanism to hire and retain capable personnel to perform services.

– Not Capable indicates that the company does not discuss if/how it will meet the general scope of the agreement; an ability to hire and maintain talent, does not demonstrate the ability to co-locate in various geographical locations, and/or does not want to, or is unable to, perform services.

Note: Quotes with a NOT CAPABLE rating in Factor 1 will not be eligible for a BOA.

FACTOR 2: PORTFOLIO REVIEW

This factor is met when the Offeror provides a detailed portfolio and/or source code repository with links to sufficiently demonstrate a technical understanding of DevSecOps engineering, software development, cybersecurity and/or IT support and operations. The Government will evaluate this factor based on the following:

RATINGS DEFINITIONS

Excellent Portfolio indicates a strong technical understanding of DevSecOps engineering, software development, cybersecurity and/or IT support and operations. Positive aspects of the portfolio outweigh any negative aspects.

Good Portfolio indicates a good technical understanding of DevSecOps operations. Positive aspects of the portfolio outweigh any negative aspects.

Acceptable Portfolio indicates an average technical understanding of DevSecOps operations. Positive aspects of the portfolio outweigh any negative aspects.

Unacceptable Portfolio does not demonstrate technical understanding of DevSecOps engineering, software development, cybersecurity and/or IT support and operations. Portfolio does not meet requirements and contains one or more deficiencies.

NOTE:

Positive aspects indicate the Offeror provided its code repository or equivalent, provided highly functional and reliable portfolio products, and portfolio demonstrates technical rigor.

Negative aspects indicate the Offeror was not a main contributor to the products and processes submitted, provided products with bugs or poor code, and did not demonstrate technical rigor.

4. Although past performance will not be used as an evaluation factor, such information obtained from other sources available to the Government, e.g., the Past Performance Information Retrieval System (PPIRS), will be used as part of the responsibility determination made IAW FAR 9.104-1.

5. Ombudsman. In accordance with AFFARS 5352.201-9101, Ombudsman (JUN 2016), an Ombudsman has been appointed to hear and facilitate the resolution of concerns from Offerors, potential Offerors, and others for this acquisition If resolution cannot be made by the CO, concerned parties may contact the following: Deputy Director, Acquisition Excellence & Program Execution Directorate at AFLCMC/AQ-AZ Workflow (email: ASCA@us.af.mil) or at 937-255- 5512/DSN 785-5512, Wright-Patterson AFB, OH.