HC1028-12-R-0077-0002.doc

SECTION SF 30 BLOCK 14 CONTINUATION PAGE

SUMMARY OF CHANGES

SECTION A - SOLICITATION/CONTRACT FORM

The required response date/time has changed from 14-Aug-2012 10:00 AM to 20-Aug-2012 10:00 AM.

The following have been modified:

RFP INFORMATION

1. Defense Information Technology Contracting Organization (DITCO), is pursuing a small business set-aside to continue the software maintenance for Symantec enterprise software licenses for anti-virus (AV) and anti-spyware (AS) capabilities for the Defense Information Systems Agency (DISA), Program Executive Office Mission Assurance and Network Operations (PEO-MA/IA5), located in Ft. Meade, MD 20755-0549.

2. The Request for Proposal (RFP) HC1028-12-R-0077 responses are due no later than Monday, 20 August 2012, at 10:00 am CST. The proposal will be e-mailed to tara.d.schmitt.civ@mail.mil and mary.a.hall1.civ@mail.mil. See Addendum L for further proposal delivery instructions. Questions pertaining to this RFP shall be submitted electronically to tara.d.schmitt.civ@mail.mil and mary.a.hall1.civ@mail.mil not later than Monday, 13 August 2012, 4:00 pm, CST. The Government cannot guarantee a response to any questions received after this date/time.

3. In response to this RFP, no terms, conditions, or assumptions will be entertained. All issues will be resolved with questions and answers during the time period described above. Submission of terms, conditions, or assumptions included in your proposal may be cause for your proposal to be determined non-responsive to this RFP and may be excluded from further consideration.

4. DITCO/PL8321 is requesting proposals from authorized small business Symantec authorized resellers. DITCO is requesting discounts from authorized small business Symantec authorized resellers. The agency will award a firm-fixed price contract under Lowest-Price, Technically Acceptable evaluation criteria as further described in section M. The government intends to make award to one single contract for the continued software maintenance for Symantec enterprise software licenses for AV/AS capabilities; however, the Government reserves the right to make no award at all in response to this solicitation. The proposal must include information clearly establishing that the vendor is an authorized small business Symantec authorized resellers. Failure to do so may result in the proposal being eliminated from further consideration. Proposals shall be valid for acceptance up to 90 days from the date of proposal submission. NAICS for this requirement is 541519 – $25,500,000.00.

SECTION C - DESCRIPTIONS AND SPECIFICATIONS

The following have been modified:

PERFORMANCE WORK STATEMENT

Symantec AV/AS License Maintenance and Support Services

PWS

as of 3 August 2012

1. Contracting Officer Representatives (CORs).

a. Primary COR.

Department of Defense Activity Address Code (DODAAC):

Address:

Phone Number:

Fax Number:

E-Mail Address:

b. Alternate COR.

DODAAC:

Address:

Phone Number:

Fax Number:

E-Mail Address:

2. Task Title

Symantec AV/AS License Maintenance and Support Services

3. Background

The DISA, at the request of the Enterprise-Wide Information Assurance/Computer Network Defense Solutions Steering Group (ESSG) which is Co-chaired by both the United States Strategic Command (USSTRATCOM) and the United States Cyber Command (USCYBERCOM) and in support of National Security goals established by the President, intends to acquire from industry a AV/AS solution.

The Department of Defense (DoD) requires a scalable enterprise AV/AS solution that provides real-time zero-day protection capabilities for multiple operating systems against vendor and security community identified threats utilizing industry best practices.

The Government requires an AV/AS solution that will largely be a client based assessment capability deployed on IT infrastructure throughout DoD with the capability extending to virtual clients, and mobile protection for personal electronic devices. Tier III helpdesk support will be required, in addition to training and optional SMEs. AV/AS will have the capability to protect against various malicious code (malware) from sources that want to weaken the DoD information systems and technologies.

The DoD currently utilizes two solutions to meet its AV/AS needs. This effort is to continue the use of the existing anti-virus and anti-spyware mature capabilities that are in operational use on the DoD enterprise.

4. Objectives

The objective of this support is to provide the continuation of brand name, Symantec, enterprise software licenses for AV/AS capabilities. The Symantec AV/AS capabilities includes maintenance updates for existing perpetual licenses for the currently installed AV/AS solutions for all DoD Components. The currently installed AV/AS solutions includes:

-10780374 - 4,000,000 Symantec Anti-virus Enterprise Edition 10.2 NODE BNDL STD LIC GOV BAND H ESSENTIAL (SMTP Gateway (for email traffic) Symantec System Center (mgmt console). Symantec Client Security 3.1 NODE BUNDL STD LIC GOV BAND H BASIC (Centrally Manageable Client FW, IPS on Desktop, Content Filtering. Symantec Web Security for MSFT ISA Server 5.0 NODE BNDL STD LIC GOV BAND H BASIC (AV only for web traffic (http and ftp). (AV Domino, AV/Filtering for MS Exchange, AV Command Line Scanner.

-11662794 - 4,000,000 Anti-virus Scan Engine 5.1 USER BNDL STD LIC GOV BAND H BASIC (Palm AV protection).

-10760016 - 4,000,000 Symantec Anti-virus for MACINTOSH 10.0 BNDL STD LIC BAND H ESSENTIAL

-11022463 - 4,000,000 Symantec Mobile Anti-virus 4.0 WIN BNDL STD LIC BAND H ESSENTIAL

-10759757 - 4,000,000 SYMC ANTIVIRUS HOME USE 10.1 Node STD LIC EXPRESS BAND H.

- TC-VA-BEWS-CASO REG - Symantec Endpoint Security Center Web Based subscription

AV/AS Tier III Help Desk Support will be required in addition to training and optional SMEs. SME’s will be used on an as needed basis only. The solution shall continue to accurately protect the DoD enterprise networks and connected systems against malware and implement DoD standards (e.g. Federal Desktop Core Configuration (FDCC), Security Technical Implementation Guides (STIGs), and all known vulnerabilities.

4.1 Enterprise Definition

The AV/AS solution(s) shall be the DoD Enterprise-wide solution(s). The Enterprise is defined as all unclassified and classified networks where DoD operated assets reside. This includes Non-Secure Internet Protocol Router-Network (NIPRNet), Secure Internet Protocol Ruter Network (SIPRNet), Joint Worldwide Intelligence Communications System (JWICS), other classified networks, and foreign networks that are connected to the Global Information Grid (GIG) or where DoD assets are operating.

The licensing shall extend to all DoD (to include Reserve components and National Guard), contractor and coalition partners operating on those networks. Authorized users include, but are not limited to: DoD sites within GIG boundaries, DoD sites external to the GIG but operating on non .MIL networks, contractor facilities with authorized connections to the GIG, DoD facilities on leased commercial circuits, coalition networks, partners connected through the Releasable De-Militarized Zone (REL DMZ), and stand-alone networks operated by DoD but supporting external entities.

The licensing shall also extend to contractors performing a service for DoD related to the AV/AS solution that requires them to use the software on their own computers and networks for the purpose of completing tasks related to the AV/AS solution under their contract with DoD.

4.2 Implementation Overview

The goal is to continue to support the existing AV/AS solution deployed on systems in the DoD Enterprise, and to deploy the AV/AS solution to systems not currently utilizing one of the existing DoD AV/AS solutions. Deployment will require implementation personnel, a fully operational helpdesk and training systems.

5. Scope

The scope of this PWS is to continue the use of the brand name, Symantec, enterprise software licenses for AV/AS capabilities and Internet-based, supplementary non-signature antivirus file reputation services. The Symantec AV/AS capabilities includes maintenance updates for existing perpetual licenses for the currently installed AV/AS solutions for all DoD Components, as well as deployment of the AV/AS solution to systems not currently utilizing one of the existing DoD AV/AS solutions. AV/AS Tier III Help Desk Support will be required in addition to training and optional SMEs. SME’s will be used on an as needed basis only.

6. Performance Requirements

· Task Area 1 – Project Control and Planning

· Task Area 2 – Security Engineering Certification and Accreditation

· Task Area 3 – Operations Support

· Task Area 4 – Software The AV/AS solution shall meet the requirements captured in this PWS; comply with DoD information assurance requirements and security requirements; and shall establish and maintain interoperability with the current Host Based Security System (HBSS) Baseline. AV/AS solution shall support the use of Internet-based, supplementary non-signature antivirus file reputation services by DoD clients.

6.1 Task Area 1 – Project Control and Planning

6.1.1 Contract Reporting

The Contractor shall provide a Weekly Activity Report (WAR) outlining the progress of current and future tasks with completion status, as well identifying any issues that require Government interaction for resolution and/or impact agreed upon delivery. The Contractor shall submit Monthly Status Reports (MSRs) that include financial and schedule status, proposed changes to the schedule, technical accomplishments, issues and risks, and planned activities for the next reporting period. Any issues requiring Government response or action shall be readily identified in both weekly and monthly reports.

Deliverables:

(1) WAR

(2) MSR

6.1.2 Technical Interchange Meeting

A Technical Interchange Meeting (TIM) will take place in the National Capital Region (NCR). The TIM will be the beginning of a dialogue between the government and the Contractor to ensure successful execution of this contract. The Contractor shall coordinate the date, place and agenda for the TIM with the COR. The agenda shall include, at a minimum, the following:

· Introduction of management and technical teams

· Presentation of Draft Management and Engineering Plans

· Ensure common understanding of contract

Deliverable:

(3) TIM Minutes

6.1.3 Progress Review

A formal progress review shall be conducted by the contractor within 90 days of the contract award and quarterly thereafter, either in person or via teleconference or a combination of both. The government also reserves the right to conduct informal progress reviews on an as needed basis to ensure that the contract and supported programs are executing according to the integrated master plan. Progress reviews shall consist of a review of the contract status to ensure execution is on schedule and to discuss any open issues or actions.

(4) Progress Review Meeting Minutes

(5) Quarterly Progress Review Meeting Minutes

6.1.4 Integrated Master Schedule

The Contractor shall provide key milestone and activity information for the program or task in support of the PEO-MA Integrated Master Schedule. The Contractor shall be prepared to coordinate with the PEO-MA scheduling team on a weekly basis to incorporate changes to the schedule. The Contractor shall provide updates on regular or ad hoc basis to the PEO-MA Scheduling Team, based on changing events and/or on funding decisions that affect the activity of the program. The Contractor shall analyze deviations from the schedule baseline once it is established, and determine impacts to the overall program.

Deliverables:

(6) Integrated Master Schedule

6.2 Task Area 2 – Security Engineering Certification and Accreditation

6.2.1 Unified Capabilities (UC) Approved Products List (APL) Certification The contractor shall enter the AV/AS software capability into the APL process for certification and shall maintain certification for the length of the contract. DISA will provide sponsorship through the UC-APL process. The contractor shall be responsible for providing all necessary documentation and testing support per the UC APL process.

The contractor shall assist the government in preparing all required Security Plan of Action and Milestones (POA&M). A Security POA&M is required for any accreditation decision that requires corrective action and is also used to document Non-Compliant or Non-Applicable IA controls that have been accepted by the responsible Designated Accrediting Authority (DAA). The Security POA&M will address why the system needs to operate, any operational restrictions imposed to lessen the risk during an interim authorization, the DAA’s rationale for accepting certain IA controls that are categorized as Non-Compliant (NC) or Non-Applicable (NA), specific corrective actions necessary to ensure that assigned IA controls have been implemented correctly and are effective, the agreed-upon timeline for completing and validating corrective actions, and the resources necessary and available to properly complete the corrective actions. The Security POA&M is a permanent record and once posted, weaknesses will be updated, but not removed after correction or mitigation actions are completed. The contractor will assist the government by recommending corrective actions and implementing the corrective actions identified in the Security POA&M and, with the support and assistance of the Information Assurance Manager (IAM), provides visibility and status to the DAA.

Additional information on the DoD UC APL and the associated requirements can be found at the following websites:

www.disa.mil/ucco/apl_process.html https://aplits.disa.mil/processAPList.do

(7) Proof of UC APL Certification (and updates as required)

(8) Installation/Upgrade Guide

(9) Administrator Guide

(10) User Guide

(11) Release Notes

(12) Requirements Traceability Matrix

(13) Migration Guide (Mitigation strategy for findings that cannot be fixed immediately)

(14) Functional Delta

(15) Binary and Documentation

(16) Binary Dependencies

(17) POAM Documentation

(18) Information Assurance & Vulnerability Assessment (IAVA) review and compliance

(19) Application Security and Development Checklist

(20) Ports and Protocol Technical Review Spreadsheet

(21) System Security Plan

(22) Configuration Management Plan

(23) Change Requests for product updates

(24) Certification and Accreditation (C&A) Registration Form

6.3 Task Area 3 – Operations Support

6.3.1 Classroom Training Support Option

The contractor shall provide the government an option to procure the following training support.

The Contractor shall be responsible for developing and updating DoDize (training designed for DoD) AV/AS Training Material content, as well as providing classroom courses and providing prepackaged online training and associated materials described in the Training Plan. The online training will be hosted by the government and the contractor must provide the required content. The contractor is advised that the government will use the DoDize classroom and online training materials provided to establish ‘virtualized’ training options, which are web based, and feature more end user interactivity. In addition, the government may videotape the trainer during the classroom training sessions and use it to provide supplemental virtualized training offerings. More details on training requirements are below. The Contractor proposal shall also include an option for supplemental virtualized training as described in this section.

6.3.1.1 Training Plan

The Contractor shall provide a Training Plan. This plan shall detail all aspects of the vendor’s proposed training method. At a minimum, the plan shall describe:

· The recommended curriculum outline

· The process for providing course content and content updates, including the option to provide rapid updates to address quickly developing real world scenarios.

· The proposed format and structure of the pre packaged online training classes

· NOTE: The Government’s intent is to provide links to the training from Government only portals.

The training shall address installation, operation, and maintenance of the proposed solution. It is essential for students to be able to practice using the tools before accessing the production network. The training plan should have courseware tailored to the roles identified for both system operations and maintenance personnel. The training shall incorporate interactive exercises to assure skillful competency for all participants at the end of the training course.

Deliverable:

(25) Training Plan

6.3.1.2 Training Materials

The Contractor shall develop and provide DoDize training material for implemented capabilities as identified by the Government. The Contractor shall develop a recommended training package with appropriate training material for approval by the Government. Training packages will consist of but are not limited to training documentation, course outline, course learning objectives, test bank of review questions, operational scenarios, story boards, Frequently Asked Questions, and instructor notes. The Contractor shall develop and update training materials based on lessons learned and approved configuration changes. Training materials are anticipated to be developed at the classified and unclassified levels, as needed and appropriate, and will comply with Sharable Content Objective Reference Model (SCORM) industry standards. All training materials should be scrubbed via a thorough quality assurance process prior to delivery. All documentation, software/media used for training must be approved by the Government and shall become the property of the Government upon delivery.

The Contractor shall be responsible for updating the training content. The updated training content shall be delivered with every major software upgrade; with incremental changes as determined by the Government during a monthly review of training to reduce the lag time that may occur in updating or improving individual technical skills. The Contractor will be responsible for making sufficient copies of the student materials, shipping them to the training sites, and developing and proctoring a DISA approved Train-the-Trainer Certification test. Training will be maintained for the life of the contract.

Deliverables:

(26) Course Materials (classroom and online training)

(27) Train-the-Trainer Certification test

6.3.1.3 Training Environment

The training environment will consist of a training facility, training manuals, training software/media, and hardware (to include student workstations). Classes will be held at vendor locations unless Government training locations are available.

Classroom training courses shall accommodate for up to 25 students per class. Classes will only be populated by Defense community personnel. For the enterprise implementation the Government requests a minimum a minimum of 6 class(es) CONUS and 4 class(es) OCONUS be scheduled per year with the option to schedule additional classes as demand requires. The total number of classes scheduled each year should not exceed a quantity of 20 (CONUS) and 10 (OCONUS). The contract shall include the option to add increments of 10 courses per exercised (6 CONUS, 4 OCONUS), not to exceed 30 per year.

6.3.1.4 Classroom Training Schedule

The Contractor will maintain a schedule of classroom courses, which will be approved by the Government. The contractor will work in conjunction with DISA FSO in developing the location and dates of training. The contractor will be responsible for all class material and equipment for classes based on the approved schedule of training. The contractor will provide DISA FSO with an updated copy of the class roster on the first day of class. The contractor will provide to DISA FSO the training site address for mailing of the FSO required course material (i.e. SF182, End of course survey). The Contractor instructor will complete block 36 of each student registration form, SF182, by signing, dating and indicating pass or fail. The contractor will ensure each student is given the opportunity to complete a course evaluation form. The contractor will provide the student a copy of their course completion certification at the end of the class if they passed the course exam and turned in their course evaluation. The contractor will FedEx back to DISA FSO the next duty day the signed SF182s, course evaluation forms and any course completion certificates not issued because of no-shows or student failing the course exam. For students who fail a course, the contractor will inform students upon failing the exam they can coordinate a retest through DISA FSO.

Deliverable:

(28) Training Class Schedule/Coordination, SF182 and End of Course

Surveys.

6.3.2 Virtual Training Support Option

6.3.2.1 Virtual Training

The contractor shall provide the option to support five (5) supplemental virtualized training courses or and/or web based CBT per year to be delivered on the new IASE Supplemental Training Aide Portal. The government will primarily leverage vendor’s ability to produce a supplemental virtualized training or web based CBT course. Each course will be focused on a specific subject of the AV/AS capability and will not exceed a total of two hours of instructional content. The government will identify the training topic needed for the supplemental virtualized training courses.

In certain circumstances the contractor will be requested to leverage the governments existing capability for Defense Connect Online recorded training session. In this circumstance, the vendor will be responsible for producing the training content, provide an instructor for the DCO training session and provide the final competency test. This will substitute for the contractor delivered supplemental virtualized training course.

The IASE Supplemental Training Aide Portal provides a PKI enabled login to a virtual training that offers a variety of teaching tools, e.g. streaming audio and video, downloadable training content and transcripts, and/or web based CBT. The Supplemental Training course shall focus on AV/AS solution/capability, utilization and/or implementation, and shall be capable of student evaluation or testing to ensure adequate skills are obtained. The virtual training will have soft copy training materials available for download. The virtual training will be SCORM compliant and 508 compliant. The IASE provides the capability to run queries for reporting purposes and will provide a mechanism for the student to provide an evaluation and feedback of the course content and instruction.

(29) Five 508/SCORM Compliant web based virtual Training for IASE

(30) Supplemental Training Aide Portal

6.3.3 Testing

Following completion of either the classroom training and web based training; students will be tested to ensure adequate understanding of the AV/AS capability has been obtained. Self-test knowledge checks will be included within the courseware, as well as a final competency check. The final competency test shall be designed to accommodate a variety of competency thresholds as identified by the participating DoD services and organizations.

(31) End of course classroom competency test and/or end of course web based training course competency.

6.3.4 After Action Report

The instructor will submit an After Action Report within five (5) working days after the end of each course. The format of the after action report will be determined by the contractor, and will capture key metrics, as defined by the Government. Upon approval of the Government, the Contractor will support update of courses based on After Action Reports, student evaluations and other relevant feedback.

Deliverable:

(32) Course After Action Reports

6.3.5 Training Updates

The Contractor shall be responsible for updating the training content. The updated training content shall be delivered with every major software upgrade; with incremental changes as determined by the Government during a monthly review of training to reduce the lag time that may occur in updating or improving individual technical skills. Training will be maintained for the life of the contract.

Deliverables:

(33) Train-the-Trainer Certification test update

(34) Updated Course Materials (classroom and online training)

6.3.4 Helpdesk

The Contractor shall provide Tier III Helpdesk technical support for the AV solution. The Contractor must be able to address helpdesk support for CONUS and OCONUS deployment. The contractor shall ensure the availability of a Tier III Helpdesk technical support to the Government Implementation Coordination Center (ICC) (should be available by phone during normal business hours (8 am EST to 6 pm EST, Monday – Friday). The government requires that Helpdesk support be U.S. based, and must not rollover to overseas countries.

Tier III helpdesk support must identify, isolate, and resolve software anomalies. The Tier III Technical Support Engineer shall attend HBS Ticket Scrub bi-weekly meetings to address backlogs, discuss issues, and support standardization of service desk processes. Tier III Technical Support Engineers are responsible for the highest order of resolution with interaction with testers, developers, and PEO-MA for incident correction. Tier III Support Engineers shall isolate and escalate software bugs. The Tier III Technical Support Engineer shall resolve escalated product configuration and compatibility problems submitted through the ticketing system, but also ensure consistency of ticket flow between Enterprise Services Directorate and any vendor supported ticketing system (trouble tickets closed in TMS should also be closed in the vendor's system for consistency -- this would exclude enhancement requests, CRs, and the like, which may be tracked in another management system). The Government will work to ensure that a process is in place to address tickets related to distribution of patches, engine updates and definitions files as arranged for other projects. Tier III Engineers shall not contact end users or be contacted directly by end users or anyone other than the Tier II Engineers unless Tier II and Tier III Engineers agree that direct communications are needed to resolve the issue at hand. Due to the operational intent of the solution, only mission critical Tier III requests will be returned outside normal business hours (8 am EST to 6 pm EST, Monday - Friday). Mission critical requests are defined as (1) a catastrophic network failure or (2) a failure that severely impacts business, as defined by the government. Mission critical requests require an initial response within 2 hours. If there is a critical issue that requires software upgrades or other action to addres the critical issue, resolution is required with 12 hours. The PWS section 6.3.4 has been updated to reflect this clarafication.

The Contractor shall maintain a technical support database, which will be used to track and report frequently asked questions and trouble calls as well as the resolution of those calls. The contractor shall use the government standard ticketing system (Information Technology Service Management) ITSM. Status updates will be captured in the MSRs. Specifically, MSR’s will include reports of total number of tickets opened and number of tickets fixed, number of tickets sent to Tier III, as well as mean time and median time to ticket resolution. The contractor shall ensure that the Tier III reporting for AV/AS will be separate from other DoD programs reporting, such as the HBSS one.

Deliverables: (35) Helpdesk Support Plan

(36) Technical Support Database

6.3.5 SME Support Option

The OPTIONAL SME support provides for 4,800 hours throughout the lifecycle of this contract. For evaluation purposes, 960 hours shall be provided for the base year and each Option year. If the hours in any one year are not completely utilized, the remaining hours may be redistributed to subsequent years within the lifecycle of this contract.

6.3.5.1 OPTIONAL SME Deployment/Implementation Support

The contractor shall provide the government an option to procure the following SME support.

The contractor shall provide operational support for AV/AS Implementation. The contractor shall provide optional support to the ICC to address deployment/implementation issues to include support for service desk tickets (Tier I and Tier II) as required. The contractor shall travel to currently unknown CONUS and OCONUS customer sites, as required, to support implementation issue resolution. Only the English language is required to be spoken at all locations.

• Support identifies, isolates, and resolves software anomalies.

• Provide assistance and guidance regarding Symantec's Best Practices on various security solutions under the PWS and work with the government to develop a strategy for the deployment and use of Symantec suite of tools as required:

• Review existing DoD (STIG) documentation related to anti-virus, and ensures its technical direction is consistent with vendor and industry best practices.

• Work with DISA engineering resources and DISA FSO on adjusting future STIG guidance to be developed in accordance with such a review, and provide engineering support to current Anti-virus optimization studies being conducted by PEO-MA

• Assist DISA FSO in creating DoD best practices guidance for integrating Anti-virus into existing baseline processes.

• Contribute expertise to the development of best practices guidance for Email gateway security products licensed under the AV contract

• Work with government to develop a strategy for the deployment and use of AV tools and assist in the rollout of AV/policies to the production environment.

• Contribute technical and operations focused input into DISA/DoD training development efforts.

6.3.5.2 OPTIONAL SME Engineering Support

The contractor shall provide engineering support for the AV/AS baseline. The contractor shall provide support for beta testing, functional testing, and Information Assurance (IA) testing activities required to maintain the AV/AS baseline. The contractor shall provide SME support to the IA5 test team to ensure successful installation in the lab environment.

(37) Test Plans/Test Reports

(38) Requirements Traceability Matrix (or appropriate requirements document)

(39) AV/AS architecture diagram (to include hardware requirements and configuration for architecture and product customization to support Internet-based, supplementary non-signature antivirus file reputation services requirements.)

6.4 Task Areas 4 – Software

All supporting software, documentation and media for a comprehensive Enterprise AV/AS solution shall be delivered by the contractor, in accordance with the deliverables defined in this document, and more specifically, this Task.

The contractor shall continually assess the capability delivered to the government for future expansion and enhanced capabilities of acquisitions and/or emerging products. This information shall be provided to the government in the monthly status report. The contractor shall ensure that their solution is compatible, or has the ability to be upgraded to run on future DoD platforms.

6.4.1 End of Life (EOL)/End of Service (EOS)

If product maintenance is terminated due to either product EOL or product "sun setting", the contractor shall provide twelve (12) months notice to the COR at the delivery address specified in the contract. The notice may be provided electronically and should be made at the same time the product termination notification is made generally available. The twelve (12) month time period for final maintenance support will not begin until the Contracting Officer or the COR of the contract acknowledges in writing (electronic or physical) to the contractor receipt of notification regarding product support termination. The Contracting Officer or COR will acknowledge receipt of the notice within five business days following receipt. The contractor agrees to work with DISA to identify a functional replacement product, costs for the functional replacement product, possible compatibility concerns and implementation guidance for the functional replacement product. On a case by case basis, the government may, at no additional cost, extend support for EOS product by 1 year, if extended support is available for the EOS product, to allow DoD additional time to upgrade to the supported version.

For the life of the contract, the product upgrades and renamed or repackaged products added to the contract shall retain the same firm-fixed prices provided in the schedule of supplies and services and designated as current versions of these products and services.

If DoD is unable to migrate to another product by the contractor identified EOL/EOS date, then the contractor will agree to temporarily extend support, at no additional cost, for EOS products to allow DoD additional time to upgrade to the supported version.

Deliverable: (40) EOL Notice

6.4.2 Capability Description

The following capabilities have been identified for the AV/AS solution and shall be delivered by the contractor:

6.4.2.1 Operating Environment (Operating Systems, Platforms, Applications) The AV/AS shall be a scalable enterprise AV/AS solution that provides real-time zero-day protection capabilities for multiple operating systems, with the capability extending to virtual clients, and mobile protection for personal electronic devices. The AV/AS solution shall support the DoD Enterprise to include isolated network enclaves (e.g., a tactical environment), at all classifications, to protect computing resources, i.e. laptops, desktops, servers and email gateways, from malicious software to include but not limited to viruses, Trojan horses, worms, bots, and rootkits. This will include, but not limited to, the following operating systems and platforms:

Windows 2000 Pro SP4, Windows XP, Windows Vista, Windows Vista 64, Windows 7, Windows 7 64, Windows Server 2000 . Windows Server 2003, Windows Server 2008, AIX, OS X 10.4, OS X 10.5, HP-UX 11i v1, HP-UX 11i v2, Red Hat Enterprise Linux 4, 5, 5.1, 5.3, Solaris 8,9,10, SuSE Linux Enterprise 9, SuSE Novell Open Enterprise Server (Linux) 10.

The AV/AS solution shall provide capabilities for, but not limited to, today’s DoD mobile devices per OSD-CIO in the “Use of Highly Functional Mobile Devices” Memo. Those include: Apple iOS, Android OS, Windows 7 Mobile, HP WebOS, RIM Blackberry and Open-source Symbian. The main devices that will be required are: Apple iOS, Android, Windows Mobile, and RIM Blackberry. The other named mobile devices are optional.

The AV/AS solution shall provide the capability to sit on the Exchange Server and provide AV/AS capabilities there as well.

6.4.2.2 Detection and Protection

The AV/AS solution shall protect all computing resources, i.e. laptops, desktops, servers and email gateways, from malicious software to include but not limited to viruses, Trojan horses, worms, bots, and rootkits that may be transmitted through various mediums.

6.4.2.3 Reporting

The AV/AS solution shall provide detailed, configurable, exportable reports and shall have audit logging. The reports must show the status/results of scans, and any other available information.

6.4.2.4 Hierarchal Architecture and Management

The AV/AS solution shall allow for implementation of tiered administration, with protected communications between components.

The AV solution needs to be able to report events and state information to its local command-and-control server. Additionally, the server then must integrate with HBSS' ePO server to pass the event and state data.

6.4.2.5 Deployment Ready Tools

The AV/AS solution shall be fully functional in deployable, tactical, and isolated units (low bandwidth/latency/austere remote theater environments).

6.4.2.6 Product Integration

The AV/AS effort requires the ability to interoperate with the DoD HBSS, which requires contractor design, test and deployment of an agent running on the client and HBSS management server. The contractor shall maintain HBSS Client State Plug-in (CSP) and a Log Forwarder (LF) tools. The CSP will forward client state data (i.e. antivirus definition or Data (DAT) file version) from contractor’s managed systems to an HBSS management server via HBSS management agent. The tool will also forward event data (i.e. virus alerts) from the contractor’s management component to an HBSS management server via HBSS management agent.

When forwarded, the data must be placed in the proper existing HBSS tables following the proper database scheme. In turn, the Security Event Incident Management (SEIM) system must receive any security event data (i.e. Antivirus alerts) that is generated. The time interval for event reporting between the contractor solution and the HBSS server will be effective and efficient for successful data correlation. Specifically, efficiency and effectiveness is required regarding performance when sending data from the client to the server as well as the size of the data traveling between client and server. These integration components must be developed, tested for quality assurance, and the test results made available to DISA PEO-MA upon every deliverable.

6.4.3 Employee Use Program

The software licensing structure shall allow all DoD military members and civilian employees the right to use the products on personal/home computers and personal electronic devices.

6.4.4 Enterprise License Maintenance

The Contractor shall provide maintenance to the Government’s currently-owned, perpetual licenses, as defined in PWS paragraph 4, to the enterprise with unlimited usage to the Government.

The government will have limited rights for any commercial software used as part of the solution. For any software developed uniquely to support this effort, the government will have unlimited data rights. Since it is for a perpetual license, the Contractor shall not use a license manager with the solution and shall not require counting the number of assets.

Deliverables:

(41) AV/AS License Maintenance

(42) Software Upgrades, as required (for any/all software license purchased by the Government)

6.4.5 Software and Security Updates

6.4.5.1 Information Assurance Vulnerability Management (IAVM) Team Coordination

The AV contractor is required to provide the IAVM Team with contractor related vulnerabilities to assist the IAVM Team with the development and distribution of IAVM notices. This information should be sent to: IAVM@cybercom.mil, DNDO_WATCH@cybercom.mil. The IAVM Team can be reached at (443)479-5722 and the Dynamic Network Defense Operations (DNDO) Watch can be reached at (443)654-3972.

Deliverable: (43) Vulnerability Updates to IAVM Team

6.4.5.2 Zero-day Emergency Response

The contractor shall provide Zero-day Emergency Response producing mitigation actions and software updates (patches) for zero day attack vulnerabilities in the contractor provided software within 24 hours. If a software update (patch) is not available within 24 hours, the contractor shall provide mitigation actions to minimize risk and as well as schedule outlining when the software update (patch) will be delivered.

Deliverable: (44) Mitigation Actions Report (with schedule for software patch release)

(45) Zero-day software update/patch

6.4.5.3 Software Updates

The contractor shall provide software updates to the AV/AS solution based on publicized release notices within 48 hours of release. The Government requires that the contractor leverage their expertise in order to provide the most up-to-date software available as part of their solution. The software releases are to be delivered to the program office baseline control team who in turn will make the software release available to the DoD community.

Deliverable: (46) Software Updates

6.5 Software Code Review

Upon contract award, the Contractor shall submit the buildable source code of their software (to include appliances, if the software cannot operate on standard commercially available hardware) to the government for evaluation. The purpose of this evaluation is to ensure the integrity of the Contractor's software. The government assures the Contractor that their proprietary intellectual property will be safeguarded to the fullest degree possible. This code review will take place upon contract award and may also be required after any software upgrade and or code change to the proposed solution, as determined by the government, for the life of this contract. The Contractor will provide the following items to the government for review:

1. Buildable Source Code

2. Short description of what each source code files does

3. Short description of which product features are in which source code files

4. Everything needed to build the software product, to include hardware:

· Build Tools (compilers, platform, other software used to execute)

· Build Environment (describe any hardware needed)

· Resource libraries

5. Binaries (for comparison)

6. Test scripts used to test the source code

7. Configuration management tree

8. Documentation

9. Design Documents

10. User Manuals

11. Compiled help files

12. Configuration guides

13. Intended usage scenarios

14. Quality Assurance test vectors

15. Lists of fixed and unresolved bugs

16. Change logs

17. Include all symbols libraries and debugging symbols and codes

Deliverable: (47) Software Code and artifacts

6.5.1 Malicious Code Warranty

The Contractor shall represent and warrant that the Software/Application shall be free from all computer viruses, worms, time-outs, time bombs, back doors, disabling devices and other harmful or malicious code intended to or which may damage, disrupt, inconvenience or permit access to the Software user's or another's software, hardware, networks, data or information.

Deliverable: (48) Malicious Code Warranty

6.6 Standards-based Communications Language

The AV/AS solution shall use a standards-based language/protocol. The Contractor shall use standards, if available, from those in the DoD Information Technology Standards Registry (DISR). If standards are not available in DISR, the Contractor shall use other industry standards. If standards are not available the Contractor shall provide their language/protocol to the Government in an open-source document. The Contractor shall include an indication (check the applicable standards) of interface protocols used and specifically annotate those that are proprietary, industry standard (which standard) or an emerging industry standard. Refer to Appendix A for the DISR Registry of Standards.

Deliverable: (49) Language Protocol Document

6.7 Software Development Kit

The contractor shall provide to the government an open API or Software Development Kit (SDK) for integration of third party data sources.

Deliverable: (50) SDK

6.8 National Information Assurance Partnership (NIAP) Common Criteria Evaluation Validation Scheme (CCEVS) Certification

The Contractor shall submit with their proposal proof of fulfilling a NIAP CCEVS process if the proposed solution has not fulfilled the current NIAP process, the Contractor must submit a letter of intent to commit to the NIAP CCEVS certification process. Five (5) days after award, the Contractor must provide proof of current NIAP CCEVS approval or being in a NIAP CCEVS process approval (with the process having begun prior to contract award). Ten (10) days after each major release of software, the Contractor must deliver updated proof of re-entry into the NIAP CCEVS certification process. The Contractor shall maintain validation for updated versions or modifications by subsequent evaluation or through participation in the NIAP CCEVS Assurance Maintenance Program.

Deliverable: (51) Updated proof of NIAP certification

6.9 Federal Information Processing Standard (FIPS) 140-2 Certification

The Contractor shall submit with their proposal proof of FIPS 140-2 certification. All encrypted communications shall use a cryptographic module certified in accordance with a NIST Certified Cryptographic Module Validation Program under FIPS 140-2, level 1, certification. The Contractor’s Team shall provide, upon proposal submission, proof of NIST Certified Cryptographic Module Validation Program compliance. Ten (10) days after each major release of software, the Contractor must deliver updated proof of FIPS 140-2 certification.

Deliverable: (52) Updated proof of FIPS certification

6.10 STIG Compliance

A STIG Compliance Report is not required to be delivered upon proposal offering , however it is recommended that the Contractor submit a STIG Compliance Report with their proposal. A STIG Compliance Report must be provided to the Government upon each software version upgrade. STIGs provide instructions on securing operations in a specific technical environment. The Contractor shall ensure that the AV/AS solution adheres to the STIGs and all applicable Checklists. Additional information is provided in the AV/AS Test Plan and http://iase.disa.mil. The contractor must provide written documentation of STIG compliance five (5) days after each major release of software.

Deliverable: (53) Updated proof of STIG compliance

6.11 Security Content Automation Protocol (SCAP) and FDCC

The Contractor shall agree to comply with the appropriate DISA and DoD-approved architectures, programs, standards and guidelines, such as, but not limited to, the following: SCAP and the FDCC. The AV program shall include or integrate with third party products to provide SCAP compliant and validated remediation tools supporting patch remediation and mis-configuration remediation. This is only applicable if the AV solution does not do the remediation capability itself.

Deliverables: (54) SCAP compliance report

(55) FDCC compliance report

6.11.1 SCAP Validation

The AV/AS solution shall be validated by an independent laboratory which is accredited by the NIST National Voluntary Laboratory Accreditation Program (NVLAP). The AV/AS solution shall be validated according to the SCAP Capability Validations that are available and applicable to the solution.

http://scap.nist.gov/validation/ The AV/AS solution shall maintain SCAP validation. The contractor shall provide proof of SCAP validation to the government on a yearly basis.

6.12 IPv6 Compliance

IPv6 Capable Compliance (for products, services, and licenses). The contractor's solution shall be in compliance with all applicable Federal and DoD IPv6 policies and the DoD IPv6 Capable definitions as specified in the DoD Chief Information Officer (CIO) Memorandum, DoD Internet Protocol Version 6 (IPv6) Definitions, dated 26 June 2008.

A partial excerpt from the DoD IPv6 Capable Definitions memo articulates:

"IPv6 Capable Products shall be able to interoperate with other IPv6 Capable Products on networks supporting only IPv4, only IPv6, or both IPv4 and IPv6, and shall also:

· Conform with the requirements of the DoD IPv6 Standard Profiles for IPv6 Capable Products document contained in the DISR

· Possess a migration path and/or commitment to upgrade from the developer (company Vice President, or equivalent, letter) as the IPv6 standard evolves

· Ensure product developer IPv6 technical support is available.

· Conform to National Security Agency (NSA) and/or Unified Cross Domain Management Office requirements for Information Assurance products"

Deliverables: (56) IPv6 Letter of Compliance with the DoD IPv6 Standards Profile as documented in the DoD IT Standards Registry (DISR). Refer to:

http://jitc.fhu.disa.mil/apl/ipv6.html https://disronline.disa.mil/

(57) IPv6 Letter of Commitment to upgrade as the IPv6 standard evolves (from the company's Vice President or equivalent).

6.13 Supply Chain Risk Management (SCRM)

There is a serious, growing threat to our national security from computer hardware and software produced/developed by Foreign Ownership, Controlled or Influenced (FOCI) vendors being sold to or being purchased by DoD organizations and installed into DOD communications systems and networks. Of particular concern are capabilities identified with sequenced execution of executable programs locally or remotely; code capable of disabling defenses; enumerate a network, collect credentialing information; plant logic bombs, or shutdown or crash a network or individual machine remotely or based on embedded triggers. In accordance with Directive-Type Memorandum (DTM) 09-016, “SCRM to Improve the Integrity of Components Used in DoD Systems,” it is DoD policy that: Supply chain risk shall be addressed early and across the entire system life cycle through a defense-in-breadth approach to managing the risks to the integrity of ICT within *covered systems.

If a SCRM concern or concerns arise after contract award, the Government will then determine whether a continuation of this contractual effort poses an undue risk or risks to both the common defense and security to this nation. If the Government determines that such a risk or risks exists, the Government reserves the right either to accept or reject a proposed mitigation plan or plans by the Contractor (if one or more is presented within a reasonable time as negotiated by the Contracting Officer) or terminate the contract for convenience.

*Covered Systems: All DoD critical information systems and weapons systems, which includes all major systems as defined by section 2302(5) of title 10, United States Code (U.S.C.) (Reference (d)); National Security Systems (NSS) as defined by section 3542 of title 44, U.S.C. (Reference (e)); all DoD information systems categorized as Mission Assurance Category (MAC) I in accordance with DoD Directive 8500.01E (Reference (f)); and select DoD information systems categorized as MAC II in accordance with Reference (f) (hereafter referred to collectively as “covered systems”).

7.0 Performance Standards

Performance Objective