GSA RFI 0023 Bug Bounty SaaS.pdf

REQUEST FOR INFORMATION (RFI)

GSA# 0023

General Services Administration (GSA)

GSA Security Operation Division (SecOps)

Bug Bounty Saas Platform

July 28, 2020

THIS IS A REQUEST FOR INFORMATION (RFI) NOTICE FOR MARKET RESEARCH ONLY.

THIS IS NOT A REQUEST FOR PROPOSAL. THIS IS NOT A SOLICITATION.

The General Services Administration, Office of Chief of Information Security, Office of Internal Acquisition (OIA), is issuing this RFI notice to measure the interest and availability of vendors that are capable of delivering a public Bug Bounty Platform utilizing Software as a Service (SaaS) delivery services. The purpose of this RFI is to gain knowledge of interest, capabilities, and qualifications of various companies. It is not to be construed as a commitment by the Government. A contract will not be awarded as a result of this RFI. No reimbursement will be made for any costs associated with providing information in response to this RFI or any follow up information requests. Failure to respond will not in any way prevent a potential offeror from participating in future solicitations. All information provided will be given consideration and may influence the development of future solicitation requests.

1.0 PURPOSE:

The purpose of this RFI is to conduct market research for a Bug Bounty SaaS platform. The goal of this RFI is to determine the feasibility of partnering with vendors who have the capabilities and capacity to provide a Bug Bounty SaaS platform to support the General Services Administration’s (GSA) Office of the Chief of Information Security objectives and desired solution capabilities as noted in the following sections.

U.S. General Services Administration

GSA RFI - Bug Bounty SaaS Page 2 of 8

2.0 INTRODUCTION:

With bug bounties becoming an established industry-wide best practice, GSA Security Operations Division (SecOps) desires to establish one of its own. As part of its programmatic focus on security, SecOps needs to purchase access to a pre-existing, commercially available Bug Bounty SaaS Platform that will allow it to launch and manage the Bug Bounty program. In addition, the platform will allow GSA to implement a Vulnerability Disclosure policy to handle and triage reports from researchers for GSA. GSA IT CIO, SecOps division requires access to a large network of security researchers, people who have an interest - both personally and financially - in helping to find and address bugs and other technical issues within GSAs web applications. Bug bounties serve as a legal and social arrangement with the security community:

bounty operators, define what researchers are permitted to do in regards to discovering and reporting security issues of a production system, and in turn, researchers are assured they will not be punished for anything they do within that scope and are awarded for their findings.

3.0 OBJECTIVE OF RFI:

GSA seeks to obtain information about Bug Bounty SaaS, commercially available Bug Bounty SaaS Platform. GSA IT would like to leverage access to a large network of security researchers, who have an interest in helping to find and address bugs and other technical issues within GSA IT owned web applications. The vendor that provides a Bug Bounty SaaS Platform must be one that is well-established.

4.0 SOLUTION PLATFORM

4.1 Public/Private Platform:

A Software-as-a-Service platform, with publicly available websites, for researchers to report security vulnerabilities on publicly available government websites in a manner consistent with the GSA Vulnerability Disclosure Policy.

The platform will:

● Communicate the procedures of how to discover and report the security vulnerabilities on publicly available government websites in manner consistent with the GSA Vulnerability Disclosure Policy.

● Provide a secure means for researchers to submit the site vulnerabilities they discover.

● Ensure that researchers are aware of GSA Vulnerability Disclosure Policy and any other relevant discovery or reporting procedures.

● Permit SecOps to add or remove any of the posted applications at any time during the period of performance.

● Provide access to a network of security researchers and bounty hunters.

● Provide a platform for SecOps staff to view reported vulnerabilities and update their status as the issues are managed and resolved.

● Support both public bounties (open to any researcher on the platform) and private, invite-only bounties (open to only researchers SecOps and select).

● Provide a platform that can generate a customized reporting submission form page

GSA RFI - Bug Bounty SaaS Page 3 of 8

● Provide a platform that is FedRAMP authorized

● Provide audit Logs to any modification to GSA dashboard

4.2 Provide program management and triage services:

● Program management services include services related to promotion of the program, tracking and workflow, and payouts.

● There must also be a level of expertise in relation to how submissions will be received and how they will be managed throughout their lifecycle.

● For valid payouts, including the numerous small payments that will be made for the low-severity bugs that are found to be viable.

4.3 Triage services:

● All submissions need responses

● Assign a severity-rating to each vulnerability (e.g., low, medium, high), providing responses to invalid reports, providing initial responses to valid reports, and forward valid reports to SecOps within a reasonable time based on the severity.

4.4 Platform Services:

● Platforms should provide triage services as a separate option, involving three components, all of which are necessary:

1. The cost of access to the network and use of the SaaS platform;

2. The cost of first-line triage and communication services; and,

3. A “bounty pool” from which researchers are paid for valid reports.

4.5 Other Platform Services:

● Provide SecOps ability to:

○ Manage and track issues across multiple public services exposed to the Internet

○ Triage services for those reported vulnerabilities

○ Disburse rewards for effective vulnerabilities

4.6 Vulnerability Report Triage Services:

● Explain the reasons behind rejections in the Vulnerability Report Triage Services

● Vulnerability Report Triage Services, must be provided on a “per web application”

● Operate Bug Bounty for web applications independent of other web applications utilizing the Platform.

● SecOps access for their own tests.

● Staff who are specialists in reviewing vulnerability reports and communicating with researchers.

● Prorate the Optional CLINS if not used within the time period.

4.7 Triage of severity of reported vulnerabilities:

Provide services to:

● Screen reported vulnerabilities and filter out invalid and duplicate reports

GSA RFI - Bug Bounty SaaS Page 4 of 8

● Classify vulnerabilities according to SecOps guidelines developed for and assign them to the proper SecOps staff, while SecOps maintains the rights to update these guidelines at any time

● Communicate with researchers about their reports, escalating to SecOps staff if needed

● The vendor agrees that any funds not used within the current POP will rollover into the next POP

4.8 Bug Bounty Pool Management:

● Work with SecOps to identify the proper scope of vulnerability identification, disclosure and assessment, controlling for risk. Also, criteria for most significant vulnerabilities will be established with the SecOps before applications are advertised.

● Work with SecOps to identify the proper scope of vulnerability identification and ranking. With SecOps assistance, determine, and/or adjust bounty reward tiers to manage our bounty pool most effectively.

● Once classified and deemed within the scope of the vulnerabilities, will manage payout to the reporter based on the agreed up bounty reward tiers by and SecOps.

● will consult with SecOps before release of any funds.

● Agree to any funds not used within the current period will rollover into the next period.

● Forward SecOps all vulnerability reports, names of the researchers, and award amounts.

5.0 OPERATIONAL REQUIREMENTS

5.1 Key Personnel .The Vendor shall provide a Technical Account Manager ("TAM") as the primary point of contact for the government’s program office to enable timely problem resolution, reporting in a timely manner, and properly aligning staffing requirements.

6.0 REPORTS

6.1 Vulnerability Reports

The Vendor will submit through their security disclosure platform vulnerability reports for those on the SecOps application list. These vulnerabilities will be triaged and classified based on the severity of the vulnerability before submitted to SecOps Team.

6.2 Monthly Status Reports

At the conclusion of each month, the Vendor will submit a status report summarizing the Vendor’s work and submit it to the CO/COR and the SecOps Team. This report will be mutually agreed to between the CO/COR, SecOps Team, and the Vendor.

GSA RFI - Bug Bounty SaaS Page 5 of 8

6.3 Impact Reports

The Vendor shall be responsible for providing timely notification to the CO/COR and the SecOps Team when activities or issues outside of the Vendor’s control may directly impact the Vendor’s performance. This notification shall be provided in writing or via email within 24 hours of any anticipated or known impact.

6.3.1 List of Deliverables

Deliverable Due Date Description

Vulnerability reports delivered through the bug bounty platform

24 hours during business hours

Through the platform, the Vendor will alert SecOps Team that there is a triaged vulnerability report pending on one of the listed applications.

Monthly status reports

At the end of each month of the period of performance

Monthly report of the metrics of the Vendor delivered in a format to be agreed upon by the SecOps Team and the Vendor.

Impact Reports Within 24 hours of any anticipated or known impact

Activities or issues outside of the Vendor’s control may directly impact the Vendor’s performance.

The Vendor shall submit all reports to CO/COR and SecOps Team.

6.3.2 Vulnerability Triage

The Vendor will submit through their platform vulnerabilities triaged and classified within 24 hours during business hours.

7.0 PRICING METHODOLOGY/APPROACH

The respondents shall describe the overall methodology/approach to pricing, including both commercial and federal price lists as well as the following:

● Explain the billing methodology

● Explain the impact of adding more systems to the bounty program

● Discuss other potential additional costs for

● Whether the startup/conversion and implementation costs are charged as actually expended and used only if needed, or whether it would be a ‘fixed price - not to exceed’ cost.

GSA RFI - Bug Bounty SaaS Page 6 of 8

Please provide the Proposed cost and Remarks (if any) for each items in the table below:

Item Proposed

Cost Remarks Vulnerability Disclosure Program

(VDP)

VDP Managed Triage Private Bug Bounty Private Bug Bounty Triage Private BugBounty Funding Pool

Public Bug Bounty

Public Bug Bounty Triage

Public BugBounty Funding Pool Special Event Bounty Challenge Special Event Bounty Challenge Triage Special Event Bounty Pool Funding

8.0 RESPONSE STRUCTURE

The Respondent shall structure and number their response sections as prescribed below and address all items/topics listed:

8.1 COVER PAGE

The cover page of all submissions shall contain the following information:

● Company name

● Company description

● Primary Point of Contact Name, Address, Telephone Number, and Email Address

● Headquarter Location, Telephone Number

● NAICS Code

● Business Size

8.2 SOLUTION OVERVIEW

Respondents shall provide a brief high level description of existing capabilities to perform the capabilities and requirements referenced herein.

GSA RFI - Bug Bounty SaaS Page 7 of 8

8.3 DISCUSSION TOPICS

Discussion Topics.

Please respond to the following questions and discussion topics:

Questions:

1) GSA Schedule(s) and Government-wide Acquisition Contracts (GWAC)

a) Does your company hold Contract(s) under GSA Schedule(s) or Government- wide Acquisition Contracts (GWAC)? i) If so, please list them and provide your GSA contract number(s)

b) What SINs are available as part of your GSA schedule?

c) Do you have partners or teaming arrangements under your GSA vehicle?

i) If so please include a list of all potential partners along with Business type (large business, small business, small disadvantaged business, 8(a) - certified small disadvantaged business, HUBZone small business, woman-owned small business, very small business, veteran-owned small business, service-disabled veteran-owned small business.)

2) Please provide list commercial customers

3) Provide commercial price lists

4) Provide list of all government contracts previous and existing who have this requirement

9.0 ORGANIZATION EXPERIENCE/PAST PERFORMANCE

Respondents shall provide a brief description of their experiences with implementing, operating and maintaining their solution for both commercial and government organizations.

9.1 OTHER

Please provide any other information directly related to this RFI deemed helpful and relevant to this Market Research. This section is optional.

10.0 RESPONSE INFORMATION

The Government is not obligated to and will not pay for any information received from the potential sources as a result of this RFI. It is requested that interested businesses submit to GSA’s Contract Officer a brief capabilities statement package (single spaced, one sided, letter size, Times Roman, 12 point font minimum, and maximum of 40 pages including the cover page) demonstrating their ability to provide a solution and perform the requested services.

RESPONSES ARE DUE BY NO LATER THAN 2:00 PM EST, Wednesday, August 12, 2020.

LATE RESPONSES WILL NOT BE ACCEPTED. Responses shall be sent via email to the Contracting Officer, Vivian Fields at vivian.fields@gsa.gov. This is an RFI. No solicitation exists; therefore, do not request a copy of the solicitation. If a solicitation is released, it will be synopsized in FedbizOpps or GSA Schedules. It is the potential offeror’s responsibility to monitor the release of any solicitation. The information provided in this RFI is subject to change and is not binding on the Government. GSA has not made a commitment to procure any of the items discussed, and release of this RFI should not be construed as a commitment or as

GSA RFI - Bug Bounty SaaS Page 8 of 8 authorization to incur cost for which reimbursement would be required or sought. All submissions become Government property and will not be returned

Do not include the following in your response:

● Proposals or offers

● Requests to be considered for award or to be notified of a future solicitation

● Requests to be added to a mailing or distribution list

● Questions or comments not related to this RFI.

6.3.2 Vulnerability Triage