Rev 2 Enterprise Data Loss Prevention Combined Synopsis Solicitation.pdf

DEPARTMENT OF THE AIR FORCE

38TH CONTRACTING SQUADRON (ACC)

LACKLAND AIR FORCE BASE, TEXAS

Enterprise Data Loss Prevention

Combined Synopsis/Solicitation

FA8773-20-R-0003

I. Instructions

This is a combined synopsis/solicitation for commercial items prepared in accordance with

(IAW) the format in Subpart 12.6, as supplemented with additional information included in this notice. This announcement constitutes the only solicitation; quotes are being requested and a written solicitation will not be issued. Pursuant to FAR 12.602, contract award will be made using Simplified Acquisition Procedures in accordance with FAR 13.106.

The Request for Quotation (RFQ) number FA8773-20-R-0003 shall be used to reference any written quote provided under this RFQ.

The solicitation document and incorporated provisions and clauses are those in effect through the

Federal Acquisition Circular 2020-04.

The North American Industry Classification System (NAICS) code for this project is 541519 with a size standard of $27.5M.

The purpose of this combined synopsis and solicitations is to procure an Enterprise Data Loss

Prevention (E-DLP) Proof of Concept IAW the attached Statement of Objectives (SOO). The contract CLIN structure and Period of Performance are stated below

Item Description Qty Unit Unit Price Total Amount

0001 Labor

0002 CDRLS Not Separately Priced (NSP)

The Period of Performance is expected to begin August 2020. Period of performance will be 5 months.

NOTICE: Funds are not presently available for this effort. No award will be made under this

RFQ until funds are available. The Government reserves the right to cancel this RFQ, either before or after the closing date. In the event the Government cancels this RFQ, the Government has no obligation to reimburse an Offeror for any costs.

FAR Provision 52.212-1, Instructions to Offerors – Commercial Items (Jan 2017) applies to this acquisition. See Attachment 2 Provisions and Clauses.

RFQ due date: 22 June 2020___________________ http://farsite.hill.af.mil/reghtml/regs/far2afmcfars/fardfars/far/FAR12.DOC#s126 http://farsite.hill.af.mil/reghtml/regs/far2afmcfars/fardfars/far/52_000.htm#P1070_147634

LACKLAND AIR FORCE BASE, TEXAS

RFQ due time: 4:00 P.M. Central Standard Time

Email to: evan.chapman.2@us.af.mil

QUOTES MUST BE SENT TO evan.chapman.2@us.af.mil ANYTHING OTHERWISE

CAN AND WILL BE CONSIDERED NONRESPONSIVE. YOU MAY WISH TO PLACE

A READ/DELIVERY RECEIPT.

Note: .zip files are not an acceptable format for the Air Force Network and will not go through our email system.

All questions regarding this RFQ are due on 27 May 2020 and must be emailed to evan.chapman.2@us.af.mil by 4:00 P.M. Central Standard Time. Offerors shall utilize

Attachment 6 to submit questions regarding this RFQ.

Please provide the following information with your quote:

Company Name: ____________

DUNS Number: ____________

Cage Code: _______________

*Number of Employees_____________

*Total Yearly Revenue_______________

*Information required determining size of business for the NAICS referenced above

Estimated Delivery Time: ____________

Payment Terms: _________________________

Warranty: ________________

FOB (Select): ____ Destination _____ Origin

Shipping Cost included? ____ Yes _____ No _____N/A

Each Offeror agrees to hold the prices in its quote firm for 60 calendar days from the date specified for receipt of quotes.

All companies must be registered in the System for Award Management at https://www.sam.gov/portal/public/SAM/ to be considered for award. The Government will not provide contract financing for this acquisition. Invoice instruction shall be provided at time of award.

Offerors must clearly identify any exception to RFQ terms and conditions and must provide complete supporting rationale. The Government reserves the right to determine any such exceptions are unacceptable. Any exception determined unacceptable by the Government may result in the Offeror’s quotation being determined unacceptable and ineligible for award. If an

Offeror believes the requirements in these instructions contain an error, omission, or are otherwise unsound, the Offeror shall immediately notify the CO in writing with supporting mailto:evan.chapman.2@us.af.mil mailto:evan.chapman.2@us.af.mil https://www.sam.gov/portal/public/SAM/

LACKLAND AIR FORCE BASE, TEXAS

rationale as well as the remedies the Offeror is asking the CO to consider as related to the omission or error.

The Offeror(s) shall prepare the quotation as set forth in Table 1 below. All titles and content shall be within the required page limits and with the number of copies as specified. The Price

Quotation data shall be submitted in a separate volume from technical data. Pages shall be numbered consecutively within each volume. If the quotation exceeds the total page count, the excess pages will not be considered for evaluation purposes. Page size shall be 8.5 x 11 inches.

Pages may be single-spaced but shall have at least one blank line spacing between paragraphs and the text size shall be no less than 12 point, Times New Roman, Arial or Courier type. For tables, charts, graphs and figures, the text shall be no smaller than 8 point. Do not include pricing information in the technical quotation. If pricing information is found within the technical quotation, the quotation will not be considered for award.

Table 1 – Quotation Organization

Volume I Technical Responses

REFERENCE TITLE PAGE LIMIT

COVER LETTER (not included in quotation page count; not evaluated)

No Page Limit

TABLE OF CONTENTS

(not included in quotation page count; not evaluated)

No Page Limit

Contractor Statement of

Work (CSOW)

25 pages total

Factor 1 Scenario Responses 15 pages total

Volume II Price Quotation

REFERENCE TITLE PAGE LIMIT

Factor 2 Pricing No page limit

II. Evaluation

Pursuant to FAR 12.602 contract award will be made using Simplified Acquisition Procedures in accordance with FAR 13.106. The Government will award a contract resulting from this RFQ to the responsible Offeror whose quote conforming to the RFQ and SOO will provide the best value to the Government. The Government will utilize a technical/price tradeoff with technical being somewhat more important than price. The following factors shall be used to evaluate quotes:

(1) Technical:

a. Sub Factor 1.1- CSOW Submittal Requirements

LACKLAND AIR FORCE BASE, TEXAS

Offerors shall provide a CSOW that identifies the technical methodology, approach, and procedures to be used in performing the requirements of the SOO. The technical evaluation assesses the Offeror’s demonstrated understanding and capability to satisfy the Government’s requirements listed in the SOO. The Offeror shall address every area of the SOO. The technical evaluation team will evaluate the CSOW and assign ratings of Unacceptable, Acceptable, Outstanding. Unacceptable rating is CSOW does not meet the requirements in the SOO. Acceptable rating is CSOW meets the requirements in the SOO. Outstanding rating is CSOW meets and exceeds the requirements in the SOO.

b. Sub Factor 1.2 Technical Approach Scenario Response Submittal Offerors shall provide a technical response to the below technical scenarios.

Offerors shall address all 3 scenarios. If an offeror choses to not respond to a scenario, its quotation will be unawardable. The responses will be used to identify the Offeror’s technical methodology, approach, and procedures to be used in performing the requirements of the Statement of Objectives. The Government technical evaluation team shall evaluate the responses by assigning ratings of

Unacceptable, Acceptable, or Outstanding, based on their knowledge of the scenario and the Offeror’s response to the scenarios. For all criteria below, responses shall be complete, logical and compliant with applicable regulations/instructions. Include references to the applicable CSOW sections in each response to the technical scenario.

Rating Description

Outstanding Technical scenario responses meet and exceed the requirements of the

SOO/RFQ.

Acceptable Technical scenario responses meet the requirements in the SOO/RFQ.

Unacceptable Technical scenario responses do not meet the requirements in the SOO/RFQ

The following technical scenarios are based on E-DLP features that are MUST

HAVES/NON-NEGOTIABLE.

1. Offeror and proposed solution must have experience integrating with Cross

Domain Solutions.

2. The proposed technical solution must have a Central Security Policy Management console/function that can be operated from Lackland AFB TX that enables an operator to “Write Once, Publish Everywhere” rule/policy management (e.g., endpoint, email, network, cloud, storage).

3. The proposed technical solution must integrate with the AF Cloud Hosted

Enterprise Services (CHES) environment.

4. The proposed solution must be pre-populated with standard data tagging/labeling/sensitivity rules/policies, must support custom data

LACKLAND AIR FORCE BASE, TEXAS

tagging/labeling and must support auto-discovery and auto-tagging of information on the endpoint, cloud, email, and storage. For the purposes of this POC, the target base is Langley AFB VA.

5. Offeror must have consulting experience providing assistance and guidance to the client for onboarding an organizational E-DLP Program, not just focused on technical implementation.

Scenario 1: Cross Domain Solution Integration The 688CW in partnership with the AF Insider Threat Program has been tasked to provide an E-DLP solution that will span all networks and all classifications. For this proof of concept, the

Offeror shall describe the approach to be used that will enable an operator working from Lackland AFB on SIPRNET to be alerted to a DLP violation that occurs on the NIPRNET at Langley AFB VA. Include references to the applicable

CSOW section.

IN FIVE PAGES OR LESS:

1. Include references to the specific Cross Domain Solution the Offeror intends to employ in support of E-DLP at Langley AFB VA and past experience employing a CDS to enable E-DLP across multiple networks and classifications.

2. Describe your approach to management of system hardware, software, and data, focusing on data assurance and preservation.

3. Explain the Risk Management Framework (RMF) process. Describe past efforts applying this process to include system authorization deliverables within the DOD RMF governance structure.

Scenario 2: Central Security Policy Management and integration with AF

CHES The 68 Network Warfare Squadron (68 NWS) at Lackland AFB will be responsible for administering E-DLP rules and policies and responding to system-based reporting and alerting. The Offeror shall demonstrate how 68 NWS will write E-DLP rules and policies at a console at Lackland AFB and apply those policies to endpoints, storage, cloud, network, and email devices and applications on both NIPRNET and SIPRNET at Langley AFB VA. Specific descriptions of how the Offeror will integrate their solution with the AF CHES O365 environment is required. The Offeror shall also demonstrate the ability of the solution to alert and provide reports to 68 NWS operators of E-DLP violations and/or automated or recommended actions taken at Langley AFB. Include references to the applicable CSOW section.

IN FIVE PAGES OR LESS:

1. Describe your approach to central security policy management across all data egress points, with special emphasis on integrating with O365.

2. Describe the architecture for how an operator at Lackland AFB can publish a policy and apply it to all data egress points at Langley AFB.

LACKLAND AIR FORCE BASE, TEXAS

3. Describe any of your company’s architecture that already exists on the network that would be utilized in your solution.

4. Describe the architecture for alerting and reporting based on E-DLP violations at Langley.

Scenario 3: Technical and Procedural Approach to an Organizational E-DLP

Program The number one risk to implementing E-DLP in an organization is when it is treated as an IT Project and not an Organizational Program. A significant aspect of an E-DLP program is how data tagging/labeling/sensitivity is assessed in an organization (i.e., policies and procedures) and how those results are implemented and curated in the E-DLP technical solution. Another key aspect is to remove the manual burden from the end user, data owners, and other key members of the organization charged with data loss prevention by implementing automated tagging through context-aware capabilities and unsupervised/supervised learning. Include references to the applicable CSOW section.

IN FIVE PAGES OR LESS:

1. Describe your approach to onboarding E-DLP services in an organization.

Describe training requirements for operators, end-users, data owners, etc.

2. Describe recommended organizational governance structures that successful organizations have implemented to gain the most benefit from their E-DLP investments.

3. Describe your approach to enable/assist operators, end users, data owners and others in defining data tags/labels/sensitivity.

4. Describe your approach to enable auto tagging and/or providing decision support aids to users to recommend potential tags/labels/sensitivity.

(2) Price: The Government intends to evaluate Offeror’s price quotation using Price Analysis to determine fair and reasonable pricing IAW FAR 15.404-1. Offerors shall complete Attachment 5 pricing matrix and submit along with Volume II Price Quotation.

Factor 1, Technical Approach, is somewhat more important than Factor 2, Price.

An Offeror must be determined to be responsible by the Contracting Officer in order to be eligible for award. Responsibility is described in Federal Acquisition Regulation (FAR) Subpart

9.1, “Responsible Prospective Contractors.” Part of the determination addresses financial capability. Please provide the names, addresses and points of contact for all financial institution

LACKLAND AIR FORCE BASE, TEXAS

organizations utilized to determine if contractor has adequate financial resources to perform the contract or the ability to obtain them to include written authority to contact the provided financial institution.

Interchanges are fluid interaction(s) between the CO and the Offerors which may address any aspect of the quotation. The Government intends to make award based on the initial quotation submissions without conducting interchanges. Therefore, each offer should contain the Offeror’s best terms from a price and technical standpoint. However, the Government reserves the right to hold interchanges using Interchange Notices (INs) if, during the evaluation, it is determined to be in the best interest of the Government. Offeror responses to INs will be considered in making the order selection decision. The Government is not required to conduct interchanges with any or all

Offerors responding to this RFQ. The Government may conduct Interchanges with one, some, none or all Offerors at its discretion.

A written notice of award or acceptance of a quote, furnished to the successful Offeror within the time for acceptance specified in the quote, shall result in a binding contract without further action by either party. Before the quote’s specified expiration time, the Government may accept a quote

(or part of a quote), whether or not there are negotiations after its receipt, unless a written notice of withdrawal is received before award.

Attachments:

1. E-DLP Statement of Objectives (SOO)

2. Provisions and Clauses

3. DD254 Contract Security Classification Specification

4. DD1423 Contract Data Requirements List

5. Pricing Matrix

6. Question and Answer Template

7. Langley NIPR Annotated CHES

Approved by the Contracting Officer ___________________________________________ 10 June 2020