RFP SF30 HC108426R0005_Amend 0002.pdf

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER (Type or print)

30-105-04EXCEPTION TO SF 30

APPROVED BY OIRM 11-84

STANDARD FORM 30 (Rev. 10-83) Prescribed by GSA

FAR (48 CFR) 53.243

The purpose of this RFP Amendment is as follow s:

A. Attachment 3, CLIN Pricing Worksheet_Amend 0002 has been updated.

B. Attachment 9, RFP Question and Answ ers Template_Amend 0002 has been updated to amend responses to questions 51, 126 & 127.

C. The CLIN description for CLIN x002 has been updated.

D. FAR Clause 52.217-7, Option for Increased Quantity-Separately Priced Line Item has been added.

E. Addendum to 52.212-1 and 52.212-2 Pricing Information has been updated.

F. Question due date remains unchanged. Questions are due by March 11, 2026 at 3PM CST.

G. Proposal due date remains unchanged. Proposals are due March 23, 2026 at 3PM CST.

1. CONTRACT ID CODE PAGE OF PAGES

S 1 18

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

16C. DATE SIGNED

BY 09-Mar-2026

16B. UNITED STATES OF AMERICA15C. DATE SIGNED15B. CONTRACTOR/OFFEROR

(Signature of Contracting Officer)(Signature of person authorized to sign)

8. NAME AND ADDRESS OF CONTRACTOR (No., Street, County, State and Zip Code) X HC108426R0005

X 9B. DATED (SEE ITEM 11)

23-Feb-2026

10B. DATED (SEE ITEM 13)

9A. AMENDMENT OF SOLICITATION NO.

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

X The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offer is extended, is not extended.

Offer must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended by one of the following methods:

(a) By completing Items 8 and 15, and returning copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted;

or (c) By separate letter or telegram which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by telegram or letter, provided each telegram or letter makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

12. ACCOUNTING AND APPROPRIATION DATA (If required)

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS.

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE

CONTRACT ORDER NO. IN ITEM 10A.

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation date, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(B).

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority)

E. IMPORTANT: Contractor is not, is required to sign this document and return copies to the issuing office.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

10A. MOD. OF CONTRACT/ORDER NO.

2. AMENDMENT/MODIFICATION NO. 5. PROJECT NO.(If applicable)

6. ISSUED BY

3. EFFECTIVE DATE

09-Mar-2026

CODE

DISA/DITCO-SCOTT-PS84

2300 EAST DRIVE

SCOTT AFB IL 62225

HC1084 7. ADMINISTERED BY (If other than item 6)

4. REQUISITION/PURCHASE REQ. NO.

CODE

See Item 6

FACILITY CODECODE

EMAIL:TEL:

HC108426R0005

SECTION SF 30 BLOCK 14 CONTINUATION PAGE

SUMMARY OF CHANGES

SECTION SF 1449 - CONTINUATION SHEET

SUPPLIES OR SERVICES AND PRICES

CLIN 0002

The CLIN description has changed from CBII HEAT Shielf Managed Service to CBII HEAT Shield Managed Service.

CLIN 1002

The CLIN description has changed from CBII HEAT Shielf Managed Service to CBII HEAT Shield Managed Service.

CLIN 2002

The CLIN description has changed from CBII HEAT Shielf Managed Service to CBII HEAT Shield Managed Service.

CLIN 3002

The CLIN description has changed from CBII HEAT Shielf Managed Service to CBII HEAT Shield Managed Service.

CLIN 4002

The CLIN description has changed from CBII HEAT Shielf Managed Service to CBII HEAT Shield Managed Service.

The following have been added by full text:

52.217-7 OPTION FOR INCREASED QUANTITY--SEPARATELY PRICED LINE ITEM (MAR 1989)

The Government may require the delivery of the numbered line item, identified in the Schedule as an option item, in the quantity and at the price stated in the Schedule. The Contracting Officer may exercise the option by written notice to the Contractor within five days. Delivery of added items shall continue at the same rate that like items are called for under the contract, unless the parties otherwise agree.

(End of clause)

The following have been modified:

ADDENDUM TO 52.212-1

ADDENDUM TO 52.212-1

Addendum to 52.212-1(b), Submission of Offers is tailored as follows:

(b) Submission of offers:

(12) Other Instructions

(i) General Information

(A) Points of Contact: The contracting officer (KO) and contract specialist (CS) are the sole points of contact for this procurement. Address any questions or concerns you may have to the KO/CS. Written requests for clarification must be sent to:

CS: Melissa Weh - melissa.a.weh.civ@mail.mil KO: Angela Zang - angela.k.zang.civ@mail.mil

(B) Discrepancies: If an offeror believes that the requirements in these instructions contain an error, omission, or are otherwise unsound, the offeror shall immediately notify the KO in writing with supporting rationale. The Government reserves the right to award this effort based on the initial proposal, as received, without discussion.

(C) Electronic Reference Documents: All referenced documents for this solicitation are available on the Contracting Opportunities page (SAM) web site at https://www.sam.gov. Potential offerors are encouraged to subscribe for real-time e-mail notifications when information has been posted to the website for this solicitation.

(D) Communications: Exchanges of source selection information between the Government and offerors will be controlled by the KO and CS. Email will be used to transmit such information to the offeror and will include “Source Selection Information – See FAR 2.101 & 3.104” in the Subject line. Requests for clarification and information concerning the solicitation must be provided in writing via email to the KO and CS using the RFP Questions and Answers Template, Attachment 9. Questions are due no later than (NLT) March 11, 2026.

Proposals are due NLT March 23, 2026. Answers to questions will be posted electronically as an amendment to the solicitation.

(ii) Instructions for Proposal Preparation

(A) Technical Proposal: Offerors are requested to submit an oral technical proposal presentation and a price proposal in response to the attached Performance Work Statement (PWS) (See Attachment 1). The Quality Assurance Surveillance Plan is provided for contractor reference (See Attachment 2). Information on submission of technical and price proposals is provided below. The proposal has written and oral components, as identified in Table 1 – Proposal Organization.

The proposal shall be clear, concise, and include sufficient detail for effective evaluation and for substantiating the validity of statements asserted in the proposal. The proposal should not simply rephrase or restate the Government's requirements, rather, shall provide convincing rationale to address how the offeror intends to meet these requirements. Offerors must assume the Government has no prior knowledge of their facilities and capabilities and will base its evaluation on the information presented in the offeror's proposal. The offeror's proposal must include all data and information requested by the RFP and must be submitted in accordance with these instructions. The technical proposal should sufficiently address the requirements as stated in the evaluation subfactors. Non-conformance with these instructions may result in removal of the proposal from further evaluation.

(B) Oral Proposal Medium: The Government intends to hold oral presentations virtually via a Microsoft (MS) Teams meeting. Offerors are not required to purchase any video teleconferencing (VTC) software in response to this solicitation and will not be reimbursed for any costs associated. Offerors must state in their submission whether they can or cannot present their oral proposal via MS Teams (see addendum to 52.212-1(b)(12)(vii)(A)). If an offeror cannot present their oral proposal via MS Teams, the Government will make every reasonable attempt to accommodate the offeror via another VTC medium or voice-only telephone. By participating in the oral presentations, the offeror acknowledges that it complies with all solicitation rules and parameters, in accordance with applicable laws and statutes.

(C) Recording Oral Presentation of Proposal: Recording oral presentations by offerors or their representatives is strictly prohibited, notwithstanding local laws and regulations with regards to virtual meetings or voice-only telephone oral presentations. However, the Government plans to record oral presentations. In accordance with FAR 15.102(e), the Government will maintain an official record of the oral presentation, which will be the basis of the evaluation.

(iii) Organizational and Consultant Conflicts of Interest (OCCI). In accordance with (IAW) Defense Information Systems Agency (DISA) Special Contract Requirement H1, each offeror shall specifically identify in its proposal whether or not any potential or actual OCCI, as described in Federal Acquisition Regulation (FAR) Subpart 9.5, exists for this instant procurement. If the offeror believes that no OCCI exists, the OCCI response shall indicate no OCCI exists. If an offeror believes that an actual or perceived OCCI does exist on the instant procurement, the offeror shall submit an OCCI plan with the proposal, explaining in detail how the OCCI will be mitigated and/or avoided.

(iv) Administrative Requirements. The written portion of the proposal (Volume I – Cover Page and Execute Summary and Volume IV – Contract Documentation) shall follow the formatting instructions below. Page limitations, if applicable, are identified below and will be treated as maximums. A page is defined as each face of a sheet of paper containing information.

When both sides of a sheet display printed material, it shall be counted as two pages. Page size shall be 8.5 x 11 inches. If exceeded, excess pages will not be read or considered in evaluation of the proposal. The main body of the document must be in a 12-point Arial, Times New Roman, or Courier New font. The following items will not be considered when calculating page limits:

cover page, table of contents, master table of contents, glossary, executive summary, OCCI mitigation plans, Supply Chain Risk Management (SCRM) plans, Original Equipment Manufacturer (OEM) Letter of Authorization, DD254, Government Furnished Property (GFP) attachment, Small Business Subcontracting Plan, DISA Subcontracting Review Checklist, FAR/DFARS Provisions/Clauses attachment, and Section 508 compliance. In the event any evaluation notices are issued, page limitations may also be placed on those. Page limitations shall not be circumvented by including inserted text boxes/pop-ups or internet links to additional information; such inclusions are not acceptable and will not be considered part of a proposal.

The Government reserves the right not to consider for award any proposal that does not adhere to the administrative requirements of this RFP.

(v) Organization/Number of Copies/Page Limits. The offeror shall prepare the proposal as set forth in the Proposal Organization Table below. The titles and contents of the volumes shall be as defined in this table, all of which shall be within the required page limits and with the number of copies as specified. The contents of each proposal volume are described in the information to offerors paragraph as noted in the table below. To the greatest extent possible, each volume shall be written on a stand-alone basis so that its contents may be evaluated with a minimum of cross referencing to other volumes of the proposal. Information required for proposal evaluation which is not found in its designated volume will be assumed to have been omitted from the proposal. Cross-referencing within a proposal volume is permitted where its use would conserve space without impairing clarity. Each volume may contain a more detailed table of contents to delineate the subparagraphs within that volume. Tab indexing may be used to identify sections.

Additionally, each volume may contain a glossary of all abbreviations and acronyms used, and with an explanation for each. Glossaries do not count against the page limitations for their respective volumes.

Table 1 Proposal Organization VOLUME Addendum to

52.212-1 Paragraph Number

VOLUME TITLE ORAL/

WRITTEN

FORMAT PAGE

LIMIT

I (b)(12)(vii)(A) Cover Page and Executive Summary

Written MS Word 2007 or newer

II (b)(12)(vii)(B) Technical/Management Approach for Factor 1, Subfactors 1-4

*Both Power Point or

PDF

III (b)(12)(vii)(C) Cost/Price (Narrative and Attachment 3-CLIN Pricing Worksheet

Written CLIN Pricing Worksheet and

MS Word 2007 or newer

No page limit

IV (b)(12)(vii)(D) Contract Documentation (Includes OCCI, SCRM Plans, Section 508 Compliance, OEM Letter of Authorization, DD254, and FAR/DFARS Provisions/Clauses, Small Business Subcontracting Plan, DISA Subcontracting Review Checklist )

Written No page limit

* The PowerPoint or PDF that will be presented orally, shall be submitted as part of the written proposal by the proposal due date/time.

(vi) Electronic Offers. The offeror shall submit volumes I through IV in electronic format via email and must include the solicitation number and “Source Selection Information – See FAR 2.101 & 3.104” in the Subject line. Each volume shall be a separate file. If files are compressed, the necessary decompression program must be included. The file size of each document shall not exceed 20MB. Proposals shall be submitted to the KO/CS identified below:

CS: Melissa Weh – melissa.a.weh.civ@mail.mil KO: Angela Zang – angela.k.zang.civ@mail.mil

(vii) Proposal Organization:

(A) Volume I – Cover Page and Executive Summary. In the executive summary volume, the offeror shall describe the significant attributes and theme of its proposal. It should be concise to include addressing any significant risks, and highlighting any key or unique features, excluding price. Any summary material presented in the Executive Summary shall not be considered as meeting the requirements for any portions of other volumes of the proposal.

Include a master table of contents for the entire proposal. Cover page and master table of contents are included and not considered when calculating page limits.

(B) Volume II – Technical/Management Approach. The technical/management volume should be specific and complete and will be evaluated against the technical/management subfactors defined in addendum FAR 52.212-2(a), Evaluation – Commercial Items. The technical portion of the proposal is to be submitted as a Power Point or PDF. The file size shall not exceed 20MB. Using the instructions provided below, provide as specifically as possible the actual methodology you would use for accomplishing/satisfying the factors/subfactors.

Volume II - Technical/Management shall be organized as follows:

-Factor 1, Technical/Management Approach -Oral Proposal Presentation Slides:

-Subfactor One, Core Service Capability & Performance -Subfactor Two, Tier II: Contractor Provided Infrastructure Support -Subfactor Three Cybersecurity, Accreditation & Authorization (A&A), Threat Mitigation, Data Protection, and Identity Credential and Management (ICAM) Interoperability -Subfactor Four, Engineering and Mobility Support

(C) Volume III– Price. The price proposal will be evaluated using one or more of the techniques defined in FAR Part 15.404 in order to determine reasonableness and completeness. Reasonableness is established through cost and price analysis techniques as described in FAR 15.404. For a price proposal to be complete, all solicitation requirements must be priced, figures correctly calculated, and prices presented in in a clear and useful format. The Government reserves the right, but is not obligated, to conduct a realism analysis.

The offeror shall submit pricing for the base period and all option periods, including option pricing for an additional 6-month period that may be authorized IAW FAR 52.217-8. See FAR 52.217-8 which authorizes the Government to require continued performance of any services within the limits and at the rates specified in the contract. The CLIN Pricing Worksheet should include a separate line item for the additional 6-month period IAW FAR 52.217-8. These prices shall be identical to the proposed pricing in the 6 months prior to expiration of the base period, or the final option period, if option periods are present. The total evaluated price will consist of the contractor’s proposed price for the base period, all option periods, the option pricing for the additional 6-month period, and surge pricing as requested below.

The offeror shall complete and submit Attachment 3, CLIN Pricing Worksheet. All formulas shall remain present in the spreadsheet for verification. The file size of each document shall not exceed 20MB. Information beyond that required by this instruction shall not be submitted, unless considered essential to document or support the price. All information relating to the proposed price, including all required supporting documentation must be included in the section of the proposal designated as the Price Volume. Under no circumstances shall the information and documentation from the Price Volume be included elsewhere in the proposal other than Volume III, Price Volume and Volume IV, Contract Documentation, which includes CLIN pricing. The Government may eliminate an offeror from consideration for award if an incomplete price proposal is submitted.

The eventual awardee will be authorized to invoice monthly for all approved travel costs incurred and approved by the COR.

Price submissions should be sufficiently detailed to demonstrate their reasonableness in RFP Attachment 3, CLIN Pricing Worksheet. The Offeror’s Proposed Unit Price will be multiplied by the Government’s maximum number of users to arrive at a Total Price for the Base period and each Option period. Utilizing the maximum number of users is for evaluation purposes only. CLIN x001 and CLIN x0002 will be billed monthly in arrears based on the actual number of users. Data other than certified cost or pricing data may be required to support the price reasonableness of your proposal in accordance with FAR 15.403.

Volume III – Price shall be organized as follows:

-Attachment 3, CLIN Pricing Worksheet -Price Narrative

Price Narrative: The Offeror shall describe their methodology used to establish their price. The price narrative shall provide whatever information is necessary to help the Government understand why the proposed prices are reasonable. The offeror’s price proposal shall contain sufficient quantitative and narrative documentation necessary to adequately support and explain the prices proposed, to include subcontractor proposed prices. The document must be in a 12-point Arial, Times New Roman, or Courier New font.

(D) Volume IV - Contract Documentation. The purpose of this volume is to provide information to the Government for preparing the contract document and supporting file.

1. Complete blocks 30 a, b, and c of the SF Form 1449 and return this form with your proposal. Signature by the offeror on the SF1449 constitutes an offer, which the Government may accept.

2. If RFP amendments are released, complete blocks 15 a, b, and c of the SF Form 30 and return this form with your proposal. Signature by the offeror on the SF30 constitutes an offer, which the Government may accept. Include a statement that the offeror’s technical proposal and price proposal incorporates all changes made to the solicitation by each amendment.

3. Include a statement specifying the extent of agreement with all terms and conditions outlined in the solicitation.

4. This solicitation contains provisions that apply and clauses that will be applicable to the resulting award. Some of the provisions and additional DITCO text require a response from the offeror and shall be submitted with the proposal. These provisions are:

FAR 52.204-5, Women-Owned Business (Other than Small Business). (OCT 2014) FAR 52.209-2, Prohibition on Contracting with Inverted Domestic Corporations- Representation (OCT 2025) FAR 52.209-5, Certification Regarding Responsibility Matters (OCT 2025) FAR 52.209-7, Information Regarding Responsibility Matters (OCT 2025) FAR 52.209-11, Representation by Corporations Regarding Delinquent Tax Liability or a Felony Conviction under any Federal Law (OCT 2025) FAR 52.215-6, Place of Performance (OCT 1997) FAR 52.219-1, Small Business Program Representations (OCT 2025) FAR 52.219-4, Notice of Price Evaluation Preference for HUBZone Small Business Concerns (OCT 2025) – only if HUBZONE FAR 52.229-11, Tax on Certain Foreign Procurements-Notice and Representation (OCT 2025) DFARS 252.204-7998, Alternate A, Annual Representations and Certifications

(DEVIATION 2026-O0043)(FEB 2026)

DFARS 252.239-7009, Representation of Use of Cloud Computing (SEPT 2015) DITCO Contract Administration Data G1, Points of Contact.

If the offer has completed any of the provisions listed above as part of its annual representations and certifications at https://www.sam.gov, the Government will consider this information instead of requiring the offeror to complete and submit these provisions for this solicitation. The offeror should include a statement identifying if any of the provisions have been completed at https://www.sam.gov.

5. Provide an OCCI Mitigation Plan or a statement that an OCCI does not exist.

(See paragraph (b)(12)(iii)).

6. Provide the certification as required by FAR 52.222-56, Certification Regarding Trafficking in Persons Compliance Plan (OCT 2020). The full text of this provision is included in this solicitation.

7. A subcontracting plan is required (FAR 52.219-9) for Other than U.S. Small Businesses only (i.e., Large Businesses). ONLY OTHER THAN U.S. SMALL

BUSINESS OFFERORS ARE REQUIRED TO SUBMIT A SUBCONTRACTING PLAN.

Offerors are required to submit either an individual subcontracting plan IAW FAR Clause 52.219-9 (Alternates and Deviations) and DFARS 252.219-7003, an approved commercial plan, or a negotiated DoD Comprehensive Test Program subcontracting plan IAW DFARS 252.219- 7004. In addition, offerors are required to complete the DISA Subcontracting Review Checklist (Attachment 8) by inserting dollar values and percentages from the subcontracting plan as applicable for items 1 and 2 and also items 3 through 19 by completing the paragraph and page number columns.

The subcontracting plan is the organization’s business plan for the inclusion of small businesses within their capture/contracting processes. An individual subcontracting plan highlights the general “potential” for subcontracting opportunities within a specific procurement. The contract awardee has the “life of the contract” to make a “good faith effort” to ensure that subcontracted dollars are awarded to small businesses.

The KO will review subcontracting plans on an acceptable or unacceptable basis for compliance with FAR 19.704, FAR Clause 52.219-9 (Alternates and Deviations), and the applicable DFARS clause. A subcontracting plan is unacceptable if it does not clearly meet the requirements of FAR 19.704, FAR Clause 52.219-9 (Alternates and Deviations) and DFARS 252.219-7003 (or DFARS 252.219-7004 if the Offeror has a DoD Comprehensive Test Program subcontracting plan). Subcontracting plans will only be reviewed for acceptability for those Offeror(s) deemed to be an apparent awardee(s).

The subcontracting plan shall be included in the offer, and the approved subcontracting plan shall be incorporated into the contract.

8. Authorized Offeror Personnel. Provide the name, title, and telephone number of the company/division point of contact regarding decisions made with respect to the proposal and who can obligate the company contractually. Also, identify those individuals authorized to negotiate with the Government. Contractor Point of Contract information will be used for the Contract Administration Data Item G1, Points of Contact.

9. Company/Division Address, Identifying Codes, and Applicable Designations.

Provide company/division's street address, county and facility code; CAGE code; DUNS code;

TIN; size of business (large or small); and labor surplus area designation. This same information must be provided if the work for this contract will be performed at any other locations. List all locations where work is to be performed and indicate whether such facility is a division, affiliate, or subcontractor, and the percentage of work to be performed at each location.

10. Authorized Reseller Letter from the OEM, Menlo Security, Inc.

The offeror must provide proof they are an authorized reseller of Menlo Security, Inc. at initial proposal submission. For the purposes of this procurement, an authorized reseller is defined as an entity authorized by the OEM to sell Menlo Security to the Federal Government and to provide support for said software, including new releases, version upgrades, revisions, corrections of reported errors, enhancements (to include instructions for implementation and operation for all software support levels and product versions), technical support, contractor resolutions to problems or failures, and the most current commercial release or version of the software.

Offeror responses shall include a letter from the OEM confirming that the contractor is an authorized reseller, as defined above, as of the proposal due date and will be an authorized reseller for the period of performance identified in this solicitation. The letter from the OEM shall not be older than 30 days from the date proposals are due, shall be submitted on the OEM's letterhead, and shall be signed by an authorized representative of the OEM. The government will consider proposals submitted without the authorized reseller letter as incomplete and a failure to adhere to the administrative requirements of this RFP, and as a result, the proposal may be considered ineligible for award.

11. Offerors must complete Blocks 6, 7, and 8 of the DD Form 254 (Attachment

5) with the appropriate information for their company and any subcontractors (when applicable).

The Government will validate a Final Secret Facility Clearance by Defense Counterintelligence and Security Agency with Attachment 5. The completed DD Form 254 must be submitted with the initial proposal. Security requirements, as specified in the attached DD254, shall be met no later than the date of proposal submission. The government will consider proposals submitted without the DD254 as incomplete and a failure to adhere to the administrative requirements of this RFP, and as a result, the proposal may be considered ineligible for award.

12. SCRM Plan: The Government has determined that the items or services to be procured under this solicitation are subject to SCRM controls as outlined in the PWS. As a result, offerors are required to submit a detailed organization wide SCRM plan as part of their proposal.

Supply chain risks range from natural threats to counterfeit products and apply to quality, security, resiliency, and product integrity. Mitigation plans to manage risks may involve logistics, cybersecurity, and financial management. The goal is to preclude undue risk to the Government and ensure supply chain continuity in the event normal business operations are interrupted. The offeror’s SCRM plan must include countermeasures which mitigate threats and system vulnerabilities, including:

1. The application of supply chain risk management best practices applied as appropriate to the development of the system. Supply chain risk management key practices may be found in the National Institute of Standards and Technology (NIST) Interagency Report 7622, Piloting Supply Chain Risk Management for Federal Information Systems, and the National

Defense Industrial Association Guidebook, Engineering for System Assurance, both publicly available.

2. The enumeration of potential suppliers of critical components, as they are identified, includes cost, schedule, and performance information relevant to choice among alternatives and planned selection for the purpose of engaging the Government to develop mutually agreeable risk management plans for the suppliers to be solicited.

3. The processes to control access by foreign nationals to program information, including, but not limited to, system design information, DoW-unique technology, and software or hardware used to integrate commercial technology.

4. The processes and practices employed to ensure that genuine hardware, software, and logic elements will be employed in the solution and that processes and requirements for genuine components are levied upon subcontractors.

5. The process to protect unclassified DoW information in the development environment.

52.212-1(b), Period for Acceptance of Offers is tailored as follows:

(b) Period for acceptance of offers. The offeror agrees to hold the prices in its offer firm for 60 calendar days from the date specified for receipt of offers. The offeror shall make a clear statement in the proposal documentation volume that the proposal is valid through this date.

(End of provision revisions)

ADDENDUM TO 52.212-2(a)

Addendum to 52.212-2(a), Evaluation-Commercial Items is tailored as follows:

a. Basis for Contract Award

Award will be made to the responsible offeror whose proposal is determined to represent the overall best value to the Government using a lowest price technically acceptable (LPTA) evaluation process. The Government anticipates awarding to the lowest price technically acceptable respondent from initial contractor responses, without engaging in exchanges with respondents. Respondents are strongly encouraged to submit their best technical solution and price/cost in response to this solicitation.

The technical proposal should include all information the offeror wants the Government to consider and evaluate regarding its ability to perform all work described in the evaluation subfactors. To be eligible for award, the offeror’s proposal must sufficiently address all aspects of the evaluation factors and subfactors. Failure to comply with the terms and conditions of the solicitation may result in the offeror being ineligible for award.

Section 508 Accessibility Standards do apply to this requirement. Section 508 requirements are listed in the attached PWS (Attachment 1). The offeror should notify the Government in its proposal if any exception to Section 508 standards is proposed. Any proposal failing to meet the

Section 508 Accessibility Standards, as listed in the PWS, may be eliminated from consideration for award.

b. Factor 1

(1) The following evaluation factors and subfactors will be used to evaluate each proposal.

The Government intends to utilize oral proposals to evaluate Factor 1, Technical/Management Approach. The presentation shall be limited to 36 PowerPoint slides, which shall be provided to the Government with proposal submission. For an offeror’s proposal to be rated Acceptable for Factor 1, Technical/Management Approach, each of the following subfactors must be rated Acceptable. If any of the subfactors under Factor 1 are rated unacceptable, the offeror will not be further evaluated and is not eligible for award.

(a) Subfactor 1: Core Service Capability & Performance, PWS Paragraphs: 6.2 and 6.2.2 The Government will evaluate the offeror's proposal to determine their ability to perform the core service capability and performance outlined in PWS Section 6.2 and 6.2.2. This factor will be rated as either "Acceptable" or "Unacceptable" basis. To be considered acceptable, the offeror’s proposal must meet all of the minimum requirements set forth below.

The offeror must demonstrate the ability to:

1. Deliver and sustain the core isolation capability for up to 3.4 million users, including the technical methodology to isolate all Internet code execution while ensuring page load times are no more than 5 seconds and round-trip latency is no more than 100ms (PWS 6.2).

2. Integrate the CBII platform with the DISN Joint Infrastructure (DJI) security stack, including Web Content Filtering (WCF) and Enterprise Break & Inspect (EBI), ensuring all required traffic is inspected without performance degradation performance (PWS 6.2).

3. Implement and manage the Data Loss Prevention (DLP) capability natively within the solution. The approach must detail how the system will capture file uploads and user inputs to web forms and how DLP policy violations will be reported for analysis by the Government (PWS 6.2).

4. Enable, manage, and optimize the optional HEAT Shield capability. The approach must describe how AI/ML will be leveraged to provide cyber defensive auto-mitigations that identify and neutralize highly evasive threats in real-time, and how the effectiveness of this capability will be reported (PWS 6.2.2).

(b) Subfactor 2: Tier II: Contractor Provided Infrastructure Support, PWS Paragraph: 6.3.3 The Government will evaluate the offeror's proposal to determine their capability to perform the Tier II requirements outlined in PWS Section 6.3.3. This factor will be rated as either "Acceptable" or "Unacceptable" basis. To be considered acceptable, the offeror’s proposal must meet all of the minimum requirements set forth below.

The offeror must demonstrate the ability to:

1. Handle tickets escalated from Tier I service desk and provide Tier-II support 24x7x365 with technical knowledge to troubleshooting capabilities beyond Tier-I

(PWS 6.3.3).

2. Field calls and emails from Mission Partner (CC/S/A/FAs) Service Desks and perform incident management and problem management to resolve problems

(PWS 6.3.3).

3. Integrate with DISA ticketing systems or developing a process to ensure that all tickets issues are transferred to the DISA ticketing systems to ensure proper tracking, and reporting (PWS 6.3.3).

4. Develop Tactics, Technique and Procedures for Tier I and other Tier II entities

(PWS 6.3.3).

5. Identify trends to Tier III to justify Program Office/System changes for improving the service, routing tickets, as necessary, to appropriate Tier III Technical Support centers, and assisting Tier III, when required (PWS 6.3.3).

(c) Subfactor 3: Cybersecurity, A&A, Threat Mitigation, Data Protection, and ICAM Interoperability, PWS Paragraphs: 6.2, 6.4, and 13 - Patching and Vulnerability Maintenance The Government will evaluate the offeror's proposal to determine their capability to perform the cybersecurity, A&A, threat mitigation, data protection, and ICAM Interoperability requirements outlined in PWS Section 6.2,6.4.3, 6.4.4, and 6.4.5.

This factor will be rated as either "Acceptable" or "Unacceptable" basis. To be considered acceptable, the offeror’s proposal must meet all of the minimum requirements set forth below.

The offeror’s proposal must demonstrate the ability to:

1. Interoperate with and integrate ICAM features, including the use of DoD Public Key Infrastructure (PKI) for user and administrative access to the CBII service

(PWS 6.2).

2. Provide expertise, knowledge, understanding, support and implementation of all phases of the Risk Management Framework (RMF) and A&A lifecycle in support of CBII (PWS 6.4).

3. Detail the management process for ensuring all contractor personnel supporting information assurance functions maintain the appropriate certifications in accordance with DoDI 8570.1 throughout the contract's period of performance

(PWS 6.4).

4. Describe the continuous monitoring strategy for the CBII service, detailing the methodology for testing, coordinating, and implementing security patches across the production environment (PWS 13, Patching and Vulnerability Maintenance).

5. Detail the technical process for managing a Plan of Actions and Milestones (POA&M) for a vulnerability discovered in the CBII platform, explaining the interim mitigation techniques, patch validation process, and reporting within the Enterprise Mission Assurance Support Service (eMASS) (PWS 6.4).

(d) Subfactor 4: Engineering and Mobility Support, PWS Paragraphs: 6.2, 6.7.1, 6.7.3, 6.7.4, 6.7.5, 6.7.6, 6.7.7 The Government will evaluate the offeror's proposal to determine their capability to perform the engineering and mobility requirements outlined in PWS Section 6.2, 6.7.1, 6.7.3, 6.7.4, 6.7.5, 6.7.6, and 6.7.7. This factor will be rated as either "Acceptable" or "Unacceptable" basis. To be considered acceptable, the offeror’s proposal must meet all of the minimum requirements set forth below.

The offeror must demonstrate the ability to:

1. Describe the systems engineering approach (per PWS 6.7.1) for managing the technical baseline of the CBII service, including how changes will be controlled through a formal configuration management process (PWS 6.7.4), tested in an integrated lab environment (PWS 6.7.5), and validated before production deployment.

2. Demonstrate network engineering expertise (per PWS 6.7.3) by detailing the process for diagnosing and resolving an issue where isolated web traffic latency exceeds the 100ms threshold (PWS 6.2). The description must include the specific tools and methods used for root cause analysis and correction.

3. Explain their approach to cybersecurity engineering (per PWS 6.7.6), including the strategy for preventing the compromise of privileged account credentials and the specific methods for assessing the security posture to expose and remediate configuration and operational security issues.

4. Detail the mobility engineering plan (per PWS 6.7.7) for troubleshooting and ensuring seamless integration of CBII services to DoD-approved mobile devices.

This plan must address interoperability with existing and future Mobile Device Management (MDM) solutions and support for derived credentials for authentication (PWS 6.2).

Oral Proposals: Directions for oral proposal elements are set forth below:

(a) See Table 1 in this RFP - Proposal Organization for Factor 1, Technical/Management Approach is to be proposed orally. Contractors shall submit slides of the planned oral proposal in accordance with the proposal due dates contained within this RFP. Slides shall be prepared using Microsoft PowerPoint, in any style the contractor deems reasonable; however, font size for slide text must be 14 points or larger using Arial, Times New Roman, or Courier New font. Font used for graphics, footer and page numbers shall be no smaller than ten points. Any other text present on any and all slides shall be 14-point font. Contractors may use both text slides and graphics slides. All Factor 1, Technical/Management Approach, requirements must be included and discussed within the oral proposal to be considered complete. Slides shall be submitted at the same time proposals are due, in order to establish that a complete proposal has been submitted. It is further noted that the slides submitted with the written portions of the proposal MUST be the same slides used in the oral proposal. No additions or changes are permitted. Contractors shall not include narrative discussions (i.e., note pages, handouts, or other similar narrative material) with the slides. The electronically submitted slides for the oral proposals will constitute the proposal submission for Factor 1, Subfactors 1 – 4 and shall contain all information to be covered in the oral proposal. There is a 36-page limit for the slides, and the proposal is limited to the time period identified below. This limitation does not include a cover slide or an agenda/summary slide.

(b) Oral proposals are limited to a maximum of 60 minutes per contractor. Any information not briefed within the time limit will not be evaluated. At the conclusion of the proposal, there will be a 15-30 minute break followed by an estimated additional 30 minutes for a Question and Answer (Q&A) period to allow the Government to seek clarifications, if required.

This dialogue is a component of the oral proposal and does not constitute discussions. The contractors will not be given the opportunity to revise any part of their previously submitted written proposal or submit any subsequent proposal revisions as a result of the dialogue. The contractor shall not exceed the 60-minute time limit for oral proposals; however, the Government reserves the right to extend the time of the planned 30-minute Q&A session.

(c) Contractors shall identify in their proposal a company point of contact (POC) for oral proposals by providing the POC’s name, phone number, and email address. Menlo Security, Inc.

is excluded from participating in any oral presentations. The Government will schedule oral proposals with the point of contact for contractors who submit a complete package by the due date/time specified within the table in paragraph 1. The Government intends to schedule oral proposals approximately 3-5 working days after submission of the written proposal and slides.

Dates/times will be assigned at random for all contractors.

The Government intends to schedule oral presentations with only the lowest priced offeror or a group of lower priced offerors. The government also reserves the right to cancel scheduled oral presentations if it can award to the technically acceptable lowest priced offeror without conducting further oral presentations.

(d) Representation at the oral proposal is limited to four individuals per contractor. The four individuals shall consist of three speakers/presenters and one silent party driving the presentation. The three individuals that are speakers/presenters must include personnel who are being proposed to work on the effort and at least one individual must be either the individual who will be identified as key personnel upon award or proposing company’s executive. Each company and individual may only attend one oral proposal, either for itself as a prime contractor, or as a subcontractor for another contractor.

(e) The oral proposals will be held virtually via a secure platform using Microsoft Teams.

Contractors will not be required to have a Common Access Card (CAC) in order to access the platform for the briefing. The Government will be recording the briefings. All expenses accrued relating to oral proposals shall be paid by the contractor; no travel or other costs will be reimbursed by the Government. Further logistical information regarding the schedule for oral proposals will be provided to contractors who submit timely, compliant, and responsive written proposals. (f) In the event ambiguities or conflicts exist between the elements within the written portion of the contractor's proposal and the oral proposal, the written portion shall take precedence. (g) The oral proposals and the slides as well as the price volume will be used in the LPTA determination. However, Pricing Information shall only be included in the Price Volume, and not part of the Technical/Management Volume or Oral Proposal.

Factor 2: Price

(a). The Offeror’s firm-fixed price proposal will be evaluated for award purposes based upon the total evaluated price which consists of the offeror’s proposed prices for the base period, all option periods, including option pricing for an additional 6-month period that may be authorized IAW FAR 52.217-8, and surge pricing if addressed below. Evaluation of the options shall not obligate the Government to exercise such options. The offeror’s price proposal will be evaluated, using one or more of the techniques defined in FAR 15.404, in order to determine if it is reasonable and complete. Normally, price reasonableness is established through cost and price analysis techniques as described in FAR 15.404. For a price to be complete, all solicitation requirements must be priced, figures correctly calculated and prices presented in in a clear and useful format. The Government reserves the right, but is not obligated, to conduct a realism analysis.

(b) The Government may require surge support during the base or any option period and surge modifications will be in-scope to provide increased support for the defined task areas of the PWS. Surge support is OPTIONAL and is not a guarantee. If the Government determines that an increased quantity of support is required for the task areas defined in the PWS, the Government reserves the right to exercise the surge option unilaterally. The KO will provide written notice to the contractor at least 45 calendar days prior to any unilateral exercise of the surge option. The Government is providing a percentage value to be used by all offerors when proposing surge: surge support will not exceed 5% of the offeror’s total proposed cost/price for the base and all option periods, excluding any 6-month extension of services pursuant to FAR 52.217-8. Offerors are instructed to propose this EXACT percentage for Surge CLIN 9999. In the event the Government does elect to exercise the surge option, surge support will be realigned under new or existing CLINs for the relevant task areas identified in the PWS, and an equal amount will be deducted from optional surge CLIN 9999. Surge support will be provided at the same labor rates proposed and found fair and reasonable at time of contract award for the applicable period of performance.

(c) Due to the likely inability of any offeror to accurately estimate travel and material/equipment purchases associated with this requirement, the Government is providing plug numbers to be used by all offerors when proposing ODCs. Offerors are instructed to propose plug numbers for ODCs in the following EXACT amounts, however actual travel shall be authorized by the COR in writing prior to performance and will be paid IAW FAR Part 31.205-46.

Travel/Equipment ODCs

Base Year: $15,000 Option Year 1: $15,000 Option Year 2: $15,000 Option Year 3: $15,000 Option Year 4: $15,000

These EXACT amounts shall include all audited markups and burdens and shall not be rounded or adjusted based upon independent decisions regarding actual anticipated ODCs. A proposal that fails to bid the plug numbers EXACTLY as provided may be excluded from further consideration.

c. Ratings

(1) Each technical/management subfactor will receive one of the ratings described in Table

2. The subfactor ratings will not be rolled up into an overall color rating for the Technical/Management factor.

The Technical/Management subfactors will be evaluated and rated either Acceptable or Unacceptable. In order for a proposal to be rated overall Technically Acceptable, each of the subfactors must be rated Acceptable.

Table 2. Technical/Management Ratings Rating Description

Acceptable Proposal clearly meets the minimum requirements of the solicitation.

Unacceptable Proposal does not clearly meet the minimum requirements of the solicitation.

d. Discussions

The Government intends to evaluate proposals and award a contract without exchanges.

However, the Government reserves the right to conduct exchanges or seek clarifications if the KO determines they are necessary. In the event issues pertaining to the solicitation cannot be resolved to the KO's satisfaction, the Government reserves the right to cancel the solicitation. In such event, offerors will be notified in writing.

e. It is the sole responsibility of the offeror to ensure that the electronic files submitted are virus free and can be opened and read by the Government. Proposal submissions shall not be locked, encrypted, or otherwise contain barriers to opening the file(s). The Government is under no obligation to seek clarification regarding electronic proposal submissions if submissions cannot be opened or accessed. The Government reserves the right not to consider for award any proposal that does not adhere to the administrative requirements of this RFP.

(End of provision addendum)

LIST OF ATTACHMENTS

List of Attachments Attachment 1, PWS_Amend 0001 Attachment 2, QASP_Amend 0001 Attachment 3, CLIN Pricing Worksheet_Amend 0002 Attachment 4, CDRLS_Exhibit A_Amend 0001 Attachment 5, DD254 Attachment 6, NDA Attachment 7, GFP Attachment Attachment 8, Subcontracting Plan Review Checklist Attachment 9, RFP Questions and Answers Template_Amend 0001 Attachment 10, CUI, CBII JA, Redacted

(End of Summary of Changes)