RFP_Attachment_1_HQ0034-16-R-0258_(Full_Text).pdf

Page i

COMBINED SYNOPSIS/SOLICITATION FOR COMMERCIAL ITEMS

General Information

Document Type: Combined Synopsis/Solicitation

Solicitation Number: HQ0034-16-R-0258

Posted Date: 9-Aug-16

Original Response Date: 8-Sep-16

Current Response Date: 8-Sep-16

Classification Code: R -- Professional, Administrative, and Management Support Services

Set Aside: Small Business

NAICS Code: 541519 – Other Computer Related Services

Contracting Office Address

Washington Headquarters Services, 1225 S. Clarke Street, Ste 1202, Arlington, VA 22202

Description

This is a combined synopsis/solicitation for commercial items prepared in accordance with the format in Federal Acquisition Regulation (FAR) subpart 12.6, “Streamlined Procedures for

Evaluation and Solicitation for Commercial Items,” as supplemented with additional information included in this notice. Technical Factors 1 & 2 will be evaluated in accordance with FAR subpart 12.602 “Streamlined Evaluation of Offers”. Technical Factor 3 – Past Performance and

Factor 4 – Price will be evaluated in accordance with FAR subpart 15.3 and 15.4, respectively.

This announcement incorporates provisions and clauses in effect through the Federal Acquisition

Circular.

This solicitation is a Request for Proposals (RFP). The solicitation document and incorporated provisions and clauses are those in effect through Federal Acquisition Circular 2005-89 and

DFARS change notice 20160630. Solicitation provisions and contract clauses that pertain to the

IDIQ contract(s) and task orders are contained in RFP Attachments 7 and 8, respectively. There is no assigned Defense Priorities and Allocations System (DPAS) rating for this requirement.

The associated North American Industrial Classification System (NAICS) code for this procurement is 541519 – “Other Computer Related Services”, with a small business size standard of $27.5M. The following documents constitute the complete RFP solicitation and are hereby incorporated:

RFP Attachment 1_ HQ0034-16-R-0258 (Full Text)

RFP Attachment 2_IDIQ PWS

RFP Attachment 3_FA1 PWS

RFP Attachment 4_FA2 PWS

RFP Attachment 5_FA1 Price Scenario

RFP Attachment 6_FA2 Price Scenario

RFP Attachment 7_IDIQ Provisions & Clauses

RFP Attachment 8_Task Order Provisions & Clauses

Attachment 1

RFP # HQ0034-16-R-0258

Page ii

TABLE OF CONTENTS

INSTRUCTIONS TO OFFERORS

Section 1: General RFP Instructions

Section 2: Written Proposal Instructions (Technical and Price)

1. Content and Format

2. Submission and File Naming

3. Questions

4. Proposal Due Date

Section 3: Technical Proposal Instructions – General

Section 4: Technical Proposal Instructions – Compliance and Evaluation Factors

3. Platform Compliance

4. Management Approach and Key Personnel

5. Technical Approach

6. Past Performance

Section 5: Price Data Instructions

EVALUATION FOR AWARD OF IDIQ CONTRACT AND TASK ORDERS

Section 6: Basis for Award

Section 7: Evaluation Process

Phase 1: Compliance Factor:

Phase 2: Evaluation Factors

Section 8: Evaluation Factors

Technical Factor 1 _ Management Approach and Key Personnel

Technical Factor 2 _Technical Approach

Technical Factor 3_Past Performance

Factor 4_Price

Section 9: Technical Capability Performance Evaluation Ratings and Definitions

Section 10: WHS/AD Contracting Points of Contact

INSTRUCTIONS TO OFFERORS

Section 1: General RFP Instructions

1. Offerors shall read this document in its entirety as it contains information and procedures regulating how Offerors will structure its proposals in response to this solicitation.

2. In recognition of the Agency’s small business policies and goals, the DoD is restricting participation in this solicitation to Small Businesses registered under NAICS 541519 – “Other

Computer Related Services” with a size standard of $27.5M. A business is considered a small business concern if its annual receipts (i.e. total income), averaged over a 3 year period, does not exceed $27.5M.

3. The Government anticipates awarding Indefinite Delivery Indefinite Quantity (IDIQ) contract(s), as described below, for Crowdsourced Vulnerability Discovery & Disclosure

Services (CVDD) to the Offeror whose proposal represents the best value to the Government as set forth in the “Evaluation for Award of IDIQ Contract and Task Orders” section below and as outlined in RFP Attachment 2 – IDIQ Performance Work Statement (PWS). The Government may award an IDIQ contract to other than the Offeror quoting the lowest price or achieving the highest adjectival rating.

4. For each task initiated, respective to the functional areas detailed below, it is the intention of the Government to issue task orders under an IDIQ contract vehicle. Each task order will be issued to accomplish a specific work segment or segments. It is highly probable that multiple task orders will be in progress at the same time. Performing in this environment will require all contractors to coordinate their activities, with the Government, to ensure successful completion.

5. The CVDD requirement encompasses two discrete functional areas that, while considered conceptually equivalent, are functionally different in execution. These functional areas are outlined in RFP Attachment 2 – IDIQ PWS and are labeled as Functional Area 1 (FA1) and

Functional Area 2 (FA2). The Government anticipates awarding a maximum of two (2) IDIQ contracts, to satisfy the CVDD requirement, which will consist of a single award IDIQ contract for each of the functional categories FA1 and FA2. Offerors are eligible to propose solely under

FA1, solely under FA2, or under both functional categories FA1 and FA2. If an Offeror submits a proposal under both functional categories, there is a possibility that the proposal could be evaluated and deemed the best value under one functional category and not the other. Proposals, that meet the requirements of the Phase 1 – Compliance Factors detailed below, relative to FA1 and FA2, will be evaluated in accordance with the Phase 2 – Evaluation Factors outlined in the

“Evaluation for Award of IDIQ Contract and Task Orders” section below. In the event that an

Offeror’s proposal is, upon evaluation, considered to be the best value under FA1 and FA2, a single IDIQ contract, encompassing both functional categories, will be awarded to the successful

Offeror.

6. The Government anticipates awarding a total of two (2) task orders immediately subsequent to the IDIQ contract award(s). One (1) task order will be issued relative to FA1 and one (1) task order will be issued relative to FA2. The task orders will be issued to the Offeror, or

Offerors, whose proposal represents the best value to the Government, for the CVDD requirement, as set forth in the “Evaluation for Award of IDIQ Contract and Task Orders” section below. The Government may award the task orders to other than the Offeror proposing the lowest price or achieving the highest adjectival rating.

7. Each Offeror must submit a response to the solicitation, consistent with the instructions herein, in order to be considered for an award. Incomplete proposal submissions will not be evaluated and, therefore, will not be considered for an IDIQ contract or task order award.

Submission of these items, as detailed below, will constitute the Offeror’s compliance with the terms and conditions of the RFP solicitation.

8. The Government intends to award the IDIQ contract(s) and task orders without discussions. Therefore, initial submissions should contain the Offeror’s best terms from a price and technical standpoint. Notwithstanding its intent to award without discussions, the

Government reserves the right to conduct discussions with Offerors, if it deems necessary, and to permit Offerors to revise their proposals. Unless expressly authorized by the RFP, any Offeror planning to take exception to a term or condition of the RFP should consult with the Contracting

Officer (CO) in writing prior to submitting a proposal.

9. Offerors are advised to closely read the technical proposal instructions, technical evaluation process and evaluation criteria contained in the following sections prior to preparing a technical proposal.

Section 2: Written Proposal Instructions (Technical and Price)

1. Content and Format. Proposals shall consist of two (2) separate volumes and shall be organized as follows:

I. Volume 1 – Technical Proposal as set forth below. Offerors proposing under FA1 and FA2 are required to separately submit one (1) Technical Proposal for FA1 and one (1) Technical Proposal for FA2. A Technical Proposal may not cross-reference information in the other Technical Proposal (i.e. Technical Proposal for FA1 cannot cross-reference information in the Technical Proposal for FA2); however, information may be repeated in both.

a. Section Header: Platform Compliance

b. Section Header: Management Approach and Key Personnel

c. Section Header: Technical Approach

d. Section Header: Past Performance

Section Headers (a-d) listed above represent major aspects of the Technical Proposal that should be addressed per the evaluation factors listed in the “Evaluation for Award of IDIQ Contract and

Task Orders” section contained herein. Proposal content organized under these headers should be compiled with regard to the technical proposal instructions and page limitations detailed below. Subsections to these Section Headers should be inserted as necessary to organize content.

The following introductory information is required (cover letter format is acceptable) on the first page of Volume I of each Technical Proposal submitted:

RFP Number & Title, Name and address of Offeror, Name, telephone number & e-mail address of the main point-of-contact, Name of your Contract Administrator, Date of submission, Name, title, and signature of authorized representative, Offeror's DUNS number, Exceptions to RFP/Performance Work Statement (if applicable); and, Statement indicating whether the proposal should be evaluated for an IDIQ

Contract/Task Order award under FA1 or FA2.

II. Volume 2 – Price Proposal as set forth below.

a. Price Scenario FA1 Template*: Offerors must read and interpret the information provided in RFP Attachment 5 – FA1 Price Scenario and use the interpreted information to propose a Firm Fixed Price for accomplishing the work detailed therein. Offerors shall follow the instructions detailed below in Section 5

– Price Data. (*This is applicable only if you are proposing a solution under FA1 or FA1 & FA2)

b. Price Scenario FA2 Template**: Offerors must read and interpret the information provided in RFP Attachment 6 – FA2 Price Scenario and use the interpreted information to propose a Firm Fixed Price for accomplishing the work detailed therein. Offerors shall follow the instructions detailed below in Section 5

– Price Data. (**This is applicable only if you are proposing a solution under

FA2 or FA1 & FA2)

A complete Price Scenario, for each of the respective Functional Areas under which the Offeror proposes, is required for Volume 2 – Price Proposal. Price Proposal instructions are detailed in

Section 5 – Price Data below.

2. Submission and File Naming. Offerors shall submit their technical proposals, for consideration of IDIQ Contract(s)/Task Order award(s), as separate volumes of the total proposal package, as outlined above. Offerors may combine Volume 2 – Price Proposal submissions into a single file in accordance with Section 5 - Price Data Instructions below (E.g.

If you are proposing under FA1 and FA2, your total proposal package will consist of two

“Volume 1” and either one or two “Volume 2” submissions). All non-price information shall be organized by sections, relative to the evaluation factor structure, and be contained within

Volume 1 – Technical Proposal. Offerors shall omit all pricing details from all technical proposal submissions. Offerors shall clearly indicate, via Cover Letter to Volume 1, whether their proposal should be evaluated for an IDIQ Contract/Task Order award under FA1 or FA2.

File attachments for Volumes 1 and 2 shall be named as follows:

Volume 1 – Technical for (FA1 or FA2)_Company Name

Volume 2 – Price Scenario for (FA1, FA2 or FA1-FA2)_Company Name

All other file attachments, submitted as ancillary documents to the proposal package (e.g.

Samples, Tools and/or Templates submitted as evidence of past experience/past performance demonstrating the methodology that will be used for providing CVDD), shall be clearly marked as such and named, at the Offeror’s discretion, based on the document’s content and relevance to the Offeror’s proposal. Each acronym used shall be spelled out in the text the first time it appears in each volume.

3. Questions. All questions regarding this RFP shall be emailed to Kaitlin Locket < kaitlin.f.lockett.civ@mail.mil> and Cc: Chanda Brooks <chanda.r.brooks.civ@mail.mil> no later than August 16, 2016 @ 2:00 PM Eastern Time (ET). Answers to Offeror questions shall be compiled and provided to all Offerors via email.

4. Proposal Due Date. Submission of vendor proposals in response to this RFP shall be emailed to Kaitlin Locket < kaitlin.f.lockett.civ@mail.mil> and Cc: Chanda Brooks

<chanda.r.brooks.civ@mail.mil> . Responses are due no later than September 8, 2016 @ 2:00

PM ET.

The government will not consider the text of the emails, only the attachments. A single email cannot exceed 10 MBs. Files should be in Microsoft Word, Excel, or Adobe .PDF format; zip files are accepted.

Section 3: Technical Proposal Instructions – General

1. The technical proposal shall consist of a comprehensive written proposal containing four

(4) sections: Platform Compliance (FA1 and/or FA2), Management Approach and Key

Personnel, Technical Approach, and Past Performance.

2. The written technical proposal shall be prepared using the following guidelines:

Offerors shall use standard 8 ½ x 11” size paper with, at minimum, 3/4” margins on all sides. The entire written submission shall use a plain font that is easily decipherable. At minimum, a 12 point font size shall be used for text and a 10 point font size shall be used for any tables and/or graphics. All pages shall include page numbering. Any pages in excess of the specific page limitations for each factor, as outlined below, will not be considered.

The following items are excluded from the page limitation: Cover page(s), Table of

Contents, Resumes, and Samples, Tools and/or Templates submitted as evidence of past experience/past performance demonstrating the methodology that will be used for providing CVDD.

Offerors are strongly encouraged to be succinct, clear, and concise in writing their proposal and adhering to the set page limitations. Bullet-sized or outline formats are welcomed where appropriate.

3. Offerors are advised to supply all information in the sequence and format specified below. The Offeror’s proposal must provide a sufficient basis for a thorough evaluation and provide the information necessary to evaluate the proposal in accordance with the information outlined in the “Evaluation for Award of IDIQ Contract and Task Orders” section below. The

Offeror shall organize its proposal, by sections and volumes as stipulated below, in such a manner that the requested information is presented relative to the designated evaluation factor to which it correlates. Any requested information placed outside of the designated factor will not be consider or evaluated under that evaluation factor, regardless to whether it is located elsewhere in the Offeror’s proposal.

4. In the written technical proposal, Offerors are encouraged to use quantitative and graphical methods to portray facts whenever possible through the use of charts, lists, matrices, diagrams, tabulations, etc. These quantitative and graphical methods are included in the overall page limitation.

5. Pricing data is prohibited in, and shall be omitted from, the written technical proposal.

Price proposals must be separately provided in its own volume.

6. Any exceptions or conditional assumptions taken with respect to the requirements and the

RFP shall be fully explained in the proposal.

Section 4: Technical Proposal Instructions – Compliance and Evaluation Factors

1. The technical proposals must contain all of the necessary and required information to enable the Government to evaluate the Offeror in accordance with the “Evaluation for Award of

IDIQ Contract and Task Orders” section below.

2. For each of the technical factors to be appropriately evaluated, Offerors shall provide the following information respective to the functional areas under which their proposal should be considered. Page limitations for each factor are outlined below under each factor, respectively.

3. Platform Compliance. The Offeror’s technical proposal must provide a clear and complete description of its platform and capabilities relative to the functional category work in which it proposes to support. Platform compliance requirements, per functional category, are detailed in

Section 6.10 of the IDIQ PWS. Responses under this factor require Offerors to indicate, in its

Volume 1 response:

Whether the proposed platform meets all of the requirements, relative to FA1 or FA2, in Section 6.10 of the IDIQ PWS.

Whether the Offeror owns and operates the proposed platform.

Whether the Offeror’s proposed platform is proprietary and available for public and commercial use. (Include a description of the platform technology).

Whether the Offeror’s proposed platform is primarily used for crowdsourced vulnerability discovery and disclosure activities.

Whether the Offeror’s proposed platform has the required capabilities to:

Support and allow researchers to participate in challenges with the purpose of reporting vulnerabilities, Triage Vulnerability Reports, and, Facilitate communications between the Government, triage personnel, and the researchers.

The proposal will be reviewed to determine whether the Offeror’s proposed platform complies with requirements relative to FA1 and/or FA2 respectively. Proposals that fail to address, addresses inadequately or fail to meet platform compliance requirements, relative to FA1 and/or

FA2, as established in Section 6.10 of the IDIQ PWS, will be deemed ineligible for award and no further evaluation of the proposal will occur.

*Page Limitation: Offerors shall limit their response to this RFP compliance factor to two (2) single-sided pages per FA addressed.

4. Management Approach and Key Personnel. Instructions for addressing Technical Factor 1, Management Approach and Key Personnel, respective to FA1 and FA2 requirements, are detailed below. Offerors shall tailor its response under this factor based on the functional areas under which it intends to propose.

Applicable to All Offerors: Offerors are instructed to propose a Management Approach that details a sound process for managing researchers, conducting all engagements, ensuring appropriate coordination of researcher skillset to the type of work being performed, researcher recruitment efforts and maintaining communication with

Government stakeholders. Under this factor, the process, proposed by Offerors, must address all aspects, as listed above, in order to meet minimum requirements under

Technical Factor 1a. Technical Factor 1a is an overarching CVDD management factor that is relative to all work performed under the IDIQ PWS and is not exclusive to a specific functional area. As such, all Offerors are required to address this factor.

Applicable to Offerors proposing under FA1 (Only or Both): As part of the proposed

Management Approach, Offerors that are proposing solutions under FA1 are instructed to also propose a sound process for managing strategic communications to include conducting public relations, press inquiries, developing blogs and social media posts for the purpose of recruitment, responding to press and Internet-based inquiries and, managing problematic researchers relative to FA1. Relative to Technical Factor 1b, this response should address the FA1 aspects detailed in the IDIQ PWS as well as the work described in the FA1 Task Order PWS. Under this factor, the process, proposed by

Offerors, must address all aspects, as listed above, in order to meet minimum requirements under Technical Factor 1b. Technical Factor 1b does not apply to FA2. As such, only Offerors proposing under FA1 need to address this.

Applicable to All Offerors: Offerors are also instructed to propose a Program Manager that satisfies the Key Personnel requirements. Offerors shall propose a qualified individual, via resume, that reflects the requirements detailed in section 6.12 of the IDIQ

PWS. Substantiating statements should be included to ensure that the Government can reasonably determine that the proposed resume experience is relative to the

Government’s stipulated Key Personnel requirements. If proposing to both FA1 and

FA2, please provide one (1) Program Manager for each functional area. In addition, resumes shall contain the following information:

Name;

Project assignment;

Name of firm with which associated;

Years of experience with current firm and other firms identified;

Education to include degree(s) type/specialization, Institution name;

Currency, quality and depth of experience in working on similar projects;

Confirmation of ability to meet security requirements of IDIQ PWS Section 7.2 and, if proposing to FA2, must confirm ability to meet security requirements of

FA2 PWS Section 7.2;

Experience and qualifications relevant to the contract; and

Location of the office to which this individual will be permanently assigned during the period of performance of the contract.

*Page Limitation: Offerors shall limit its Management Approach response(s) to Twenty (20) single-sided pages. Offerors shall limit its Key Personnel resume response(s) to four (4) single-sided pages. Resumes do not count against the stipulated page limits for this evaluation factor.

5. Technical Approach. Instructions for addressing Technical Factor 2, Technical Approach, respective to FA1 and FA2 requirements, are detailed below. Offerors shall tailor its response under this factor based on the functional areas under which it intends to propose.

Applicable to Offerors proposing under FA1 (Only or Both): Offerors are instructed to propose a Technical Approach to accomplishing work, detailed in

RFP Attachment 3_ FA1 Task Order PWS, that demonstrates complete understanding of crowdsourced vulnerability discovery and disclosure relative to activities conducted under Functional Area 1. This response should address the FA1 aspects detailed in RFP

Attachment 2_ IDIQ PWS as well as the work detailed in RFP Attachment 3_ FA1 Task

Order PWS. Offerors are cautioned that a proposal’s failure to completely address aspects of FA1 under both PWS’, will not meet the requirements of Technical Factor 2a to

“demonstrate complete understanding of crowdsourced vulnerability discovery and disclosure relative to activities conducted under FA1”. Technical Factor 2a does not apply to FA2. As such, only Offerors proposing under FA1 need to address this factor.

Applicable to Offerors proposing under FA2 (Only or Both): Offerors are instructed to propose a Technical Approach to accomplishing work, detailed in RFP Attachment 4_

FA2 Task Order PWS, that demonstrates complete understanding of crowdsourced vulnerability discovery and disclosure relative to activities conducted under Functional

Area 2. This response should address the FA2 aspects, detailed in the IDIQ PWS (RFP

Attachment 2), as well as the work detailed in RFP Attachment 4_ FA2 Task Order PWS.

Offerors are cautioned that a proposal’s failure to completely address aspects of FA2 under both PWS’, will not meet the requirements of Technical Factor 2b to “demonstrate complete understanding of crowdsourced vulnerability discovery and disclosure relative to activities conducted under FA2.” Technical Factor 2b does not apply to FA1. As such, only Offerors proposing under FA2 need to address this factor.

Applicable to Offerors proposing under FA2 (Only or Both): As an additional portion of its proposed Technical Approach, Offerors are instructed to propose a sound process for conducting a full packet capture of researcher activities for purposes of enabling auditability and continuous monitoring relative to FA2. Relative to Technical Factor 2c, Offerors should address the FA2 aspects, as detailed in the IDIQ PWS (RFP Attachment

2), as well as the work described in RFP Attachment 4_ FA2 Task Order PWS.

Technical Factor 2c does not apply to FA1. As such, only Offerors proposing under FA2 need to address this factor.

Applicable to All Offerors: As an additional portion of its proposed Technical Approach, Offerors are instructed to propose a Triage Plan that includes a sound process for prioritizing vulnerability reports within 48 hours of receipt. The proposed Triage Plan must address the prioritization of vulnerabilities, by severity, for the Government remediation team and must leverage both manual and automated tools for triaging vulnerability reports. Offerors are cautioned that a proposal’s failure to completely address the above mentioned aspects of the Triage Plan, will not receive a rating of

“Acceptable” or above for Technical Factor 2d. Technical Factor 2d is an overarching

CVDD technical capability factor that is relative to all work, performed under the IDIQ

PWS (RFP Attachment 2), and is not exclusive to a specific functional area. As such, all

Offerors need to address this factor.

*Page Limitation: Offerors shall limit its Technical Approach response(s) to Twenty (20) single-sided pages.

6. Past Performance. Instructions for addressing Technical Factor 3, Past Performance, respective to FA1 and FA2 requirements, are detailed below. Offerors shall tailor its response under this factor based on the functional areas under which it intends to propose.

Applicable to All Offerors: The past performance evaluation results in an assessment of the Offeror’s probability of meeting the solicitation requirements. The Past Performance evaluation considers each Offeror’s demonstrated recent and relevant record of performance in supplying products and services that meet the PWS requirements. The currency and relevance of the information, source of the information, context of the data, and general trends in the contractor’s performance are considered. These are combined to establish one performance confidence assessment rating for each Offeror. Currency and relevance of the information, source of the information, context of the data, and general trends in contractor’s performance shall be considered. These are combined to establish one performance confidence assessment rating for each Offeror. With respect to relevancy, Past Performance of greater relevancy will typically be a stronger predictor of future success and have more influence on the Past Performance confidence assessment than Past Performance of lesser relevance.

Applicable to All Offerors: To satisfy minimum requirements under Technical Factor 3a, Offerors are instructed to detail collective corporate experience in managing multiple

CVDD challenges simultaneously for large enterprise organization(s). For each of the projects identified, Offerors shall briefly describe their Past Performance as it relates to the successful delivery of objectives outlined in the requirements, the successful delivery of CVDD Processes, and the degree of customer satisfaction. Offerors should include details on performance that led to positive end results. Offeror’s will need to provide (1) reference, relative to the cited past experience, for verification purposes. References can only be used once and cannot be repeated to satisfy other evaluated areas of Technical

Factor 3.

In addition to the information requested above, Past Performance information may be obtained from any other sources available to the Government, to include, but not limited to, the Past Performance Information Retrieval System (PPIRS), Federal Awardee

Performance and Integrity Information System (FAPIIS), Electronic Subcontract

Reporting System (eSRS), or other databases; the Defense Contract Management

Agency; and interviews with Program Managers, Contracting Officers, and Fee

Determining Officials.

Applicable to Offerors proposing under FA1 (Only or Both): To satisfy minimum requirements under Technical Factor 3b, Offerors are instructed to detail its collective corporate experience in performing work relative to FA1. For each of the projects identified, Offerors shall briefly describe their Past Performance as it relates to the successful delivery of objectives outlined in the requirements, the successful delivery of

CVDD Processes relative to FA1, and the degree of customer satisfaction. Offerors should include details on performance that led to positive end results. Offeror’s will need to provide (1) reference, relative to the cited past experience, for verification purposes.

References can only be used once and cannot be repeated to satisfy other evaluated areas of Technical Factor 3.

Applicable to Offerors proposing under FA2 (Only or Both): To satisfy minimum requirements under Technical Factor 3c, Offerors are instructed to detail its collective corporate experience in performing work relative to FA2. For each of the projects identified, Offerors shall briefly describe their Past Performance as it relates to the successful delivery of objectives outlined in the requirements, the successful delivery of

CVDD Processes relative to FA2, and the degree of customer satisfaction. Offerors should include details on performance that led to positive end results. Offerors will need to provide (1) reference, relative to the cited past experience, for verification purposes.

References can only be used once and cannot be repeated to satisfy other evaluated areas of Technical Factor 3.

In addition to the information detailed above, relative to Technical Factor 3, Offerors shall demonstrate its experience in providing services similar in size and scope to this procurement by identifying the most relevant projects completed or currently active during the past three (3) years. The work identified may be either where the Offeror performed as the prime contractor or performed under a teaming arrangement as a subcontractor. Offerors shall provide the information outlined below for the cited work. Work Experience cited may include those arrangements entered into with Federal, State or local governments or commercial businesses, which are of similar scope, magnitude, relevance, and complexity to the requirement described in the IDIQ PWS (RFP Attachment 2).

*Page Limitation: There are no page limitations relative to Technical Factor 3 – Past

Performance.

Offerors are instructed to provide the following for all work cited:

Name of the entity for whom the services were provided (agency, firm, etc.);

Description of services provided, to include magnitude, scope and responsibilities;

Reference Point of Contact (POC) information, to include name, phone number, and email address (at least one POC for 3a and one POC for 3b or 3c purposes, helpful to include on all projects, but not required); and

Period of Performance.

Section 5: Price Data Instructions

1. Pricing data shall be segregated from the Offeror’s technical proposal. Volume 2 -

Pricing data shall contain only the information requested in this section and shall not be used as an extension of the technical proposal.

2. Offerors shall submit pricing data in a manner consistent with the information contained in the price scenarios, respective to FA1 and FA2, as detailed below. Microsoft Excel and

Microsoft Word are acceptable formats for submitting Volume 2 price data. Offerors shall include any formulas and factors used in calculating the pricing data (if applicable). Offerors shall name the file “Volume 2 – Price Scenario for (FA1, FA2 or FA1-FA2)_Company Name” in accordance with instructions listed above. Offerors proposing under both FA1 and FA2 may submit price scenario responses as separate files or collectively combined and submitted via a single Excel Workbook file. Offerors that intend to use the combined file method must separate requested content into individual Excel Workbook tabs and mark, to the extent possible, each tab as follows: “RFP ATTCH 5- FA1 Price Scenario”, “RFP ATTCH 5- FA1 Bounty Rate

Structure”, “RFP ATTCH 6 – FA2 Price Scenario” and RFP ATTCH 6 – FA2 Bounty Rate

Structure”.

*Page Limitation: There is no page limitation for the submission of the pricing data. In addition to the requisite price information, Offerors can provide any substantiating price-related information it deems necessary. Substantiating price-related information is optional and not a requirement.

3. The Period of Performance for the IDIQ contract(s) will be three (3) years. This will include one (1) twelve-month base period and two (2) twelve-month option periods. Pricing data shall be submitted to cover all ordering periods.

4. Other Direct Costs (ODCs) are not authorized at the IDIQ level. ODCs, if authorized, will be identified at the Task Order level. ODCs are authorized for travel only.

5. Applicable to Offerors proposing under FA1 (Only or Both): Offerors shall use the following price templates for submission of requested pricing data relative to FA1.

RFP Attachment 5 – FA1 Price Scenario: Using the format provided in RFP Attachment

5, Offerors are instructed to propose an overall Firm Fixed Price, for accomplishing the work detailed in the FA1 Price Scenario, and shall include its price build-up utilizing the table structure at the bottom of RFP Attachment 5 – FA1 Price Scenario. Requested information includes proposing a fixed rate or price for bounty, platform service, background check, and DoD service fees commensurate with the Offeror’s assessment of work contained in the FA1 Price Scenario. Travel costs have already been pre-populated in the price template. Offerors are not required to propose separate travel fees.

Additionally, for the bounties, Offerors are instructed to propose a standard rate structure matched to the vulnerability severity level, as identified, in the FA1 Price Scenario.

Offerors may propose its own format for the rate structure, but it should be based on a standard vulnerability severity schema, such as CVSS, market prices and prior Offeror experience. (*This is applicable only if you are proposing a solution under FA1 or FA1 &

FA2)

Volume 2 price proposals, submitted by Offerors proposing under FA1, must contain all of the requested price information as listed above. Omission of any of the requested price data will constitute an incomplete price submission under FA1, deemed non-compliant with the

RFP requirements and unawardable under FA1.

6. Applicable to Offerors proposing under FA2 (Only or Both): Offerors shall use the following price templates for submission of requested pricing data relative to FA2.

RFP Attachment 6 – FA2 Price Scenario: Using the format provided in RFP Attachment 6, Offerors are instructed to propose an overall Firm Fixed Price, for accomplishing the work detailed in the FA2 Price Scenario, and shall include its price build-up utilizing the table structure at the bottom of RFP Attachment 6 – FA2 Price Scenario. Requested information includes proposing a fixed rate or price for bounty, platform service, background check, and DoD service fees commensurate with the Offeror’s assessment of work contained in the FA2 Price Scenario. Travel costs have already been pre-populated in the price template. Offerors are not required to propose separate travel fees.

Additionally, for the bounties, Offerors are instructed to propose a standard rate structure matched to the vulnerability severity level, as identified, in the FA2 Price Scenario.

Offerors may propose its own format for the rate structure, but it should be based on a standard vulnerability severity schema, such as CVSS, market prices and prior Offeror experience. (**This is applicable only if you are proposing under FA2 or FA1 & FA2)

Volume 2 price proposals, submitted by Offerors proposing under FA2, must contain all of the requested price information as listed above. Omission of any of the requested price data will constitute an incomplete price submission under FA2, deemed non-compliant with the RFP requirements and unawardable under FA2.

EVALUATION FOR AWARD OF IDIQ CONTRACT AND TASK ORDERS

Section 6: Basis for Award

1. The anticipated single-award IDIQ contract(s) and task orders for CVDD Services will be awarded to the Offeror(s) whose proposal conforms to the RFP requirements and represents the best value to the Government, as determined by the evaluation criteria described herein, in accordance with Federal Acquisition Regulations (FAR) 15.101-1. Best value will be based on a detailed evaluation of all factors outlined below. Evaluation will be conducted and selection will be made in accordance with the guidelines provided in the FAR, Defense FAR Supplement

(DFARS), and this RFP.

Section 7: Evaluation Process

1. The Government intends to award to the Offeror(s) whose proposal(s) represents the best value and is the most advantageous to the Government. In determining the best value, the

Government may, in accordance with FAR 15.101-1, employ a tradeoff process allowing for an award to other than the lowest priced Offeror or other than the highest technical rated offer.

2. The evaluation process shall consist of the following steps:

Phase 1: Compliance Factor:

The Proposal will be reviewed to determine whether the prime Offeror has a verifiable customer platform. The platform will be evaluated based on the questions below. If this information cannot be verified in the proposal, the proposal will be deemed ineligible for award and no further evaluation will occur.

Customer Platform – FA1: Does the Offeror own and operate a publically/commercially available proprietary platform, for crowdsourced vulnerability discovery and disclosure activities, that allows researchers to participate in challenges with the purpose of reporting vulnerabilities, triaging the reports, and facilitating communications between the government, triage personnel, and the researchers? Does the platform comply with FA1 platform requirements listed in Section 6.10 of the IDIQ PWS?

Customer Platform – FA2: Does the Offeror own and operate a secure proprietary platform, for crowdsourced vulnerability discovery and disclosure activities, that allows researchers to participate in challenges with the purpose of reporting vulnerabilities, triaging the reports and facilitating communications between the government, triage personnel and the researchers, and that includes a secure portal capable of full packet capture and associated tools to enable audits and continuous monitoring of researcher activities? Does the platform comply with FA2 platform requirements listed in Section 6.10 of the IDIQ PWS?

Phase 2: Evaluation Factors

STEP 1: Initially, all Offeror responses will be evaluated for compliance with FA1 and FA2 platform requirements detailed, respectively, in Section 6.10 of the IDIQ PWS. If found compliant under the Phase 1 Compliance Factor, the Offeror’s Volume 1 technical proposal(s) will be evaluated under Technical Factor 1_Management Approach using the “Technical

Capability Performance Evaluation Ratings and Definitions” listed in Section 9 below.

STEP 2: If the Offeror’s Technical Factor 1_Management Approach Technical Rating is

“Acceptable” or higher, then the Offeror’s Technical Factor 2_Technical Approach will be evaluated using the Technical Capability Performance Evaluation Ratings.

STEP 3: If the Offeror’s Technical Factor 2_Technical Approach Technical Rating is

“Acceptable” or higher, then the Offeror’s Technical Factor 3_Past Performance will be evaluated using the Past Performance Evaluation Ratings.

STEP 4: If the Offeror’s Technical Factor 1_Management Approach, Technical Factor

2_Technical Approach is rated as “Marginal” or “Unacceptable” and/or Technical Factor 3_Past

Performance is rated as “No Confidence”, then the price will not be evaluated.

The Technical Factors for Management Approach, Technical Approach and Past Performance are of equal importance. The Technical Factors for Management Approach, Technical Approach and Past Performance when combined, are more important than the Price Factor. Price will be increasingly more important as non-price evaluation factors become increasingly equal.

The Offeror’s initial proposal should contain its best terms from a price and technical standpoint.

However, the Government reserves the right to request revisions if the Contracting Officer later determines the need. Offerors are cautioned that the award may not be made to the Offeror proposing the lowest priced offer.

Section 8: Evaluation Factors

Technical Factor 1 _ Management Approach and Key Personnel

Proposal submissions for this evaluated area shall demonstrate the Offeror’s ability to manage the team proposed and the ability to accomplish the requirements in the PWS. Specifically, the

Government will evaluate:

1a) The extent to which the Offeror’s proposed Management Approach details a sound process for managing researchers, conducting all engagements, ensuring appropriate coordination of researcher skillset to the type of work to be performed, and researcher recruitment efforts.

1b) The extent to which the Offeror’s proposed Management Approach details a sound process for managing strategic communications to include conducting public relations, press inquiries, developing blogs and social media posts for the purpose of recruitment, responding to press and Internet-based inquiries and, managing problematic researchers relative to FA1.

1c) The extent to which the Offeror’s proposed Management Approach details a sound process for maintaining communication with Government stakeholders as applicable.

1d) The extent to which the Offeror’s proposed Program Manager satisfies the Key Personnel requirements detailed in section 6.12 of the IDIQ PWS.

Receipt of a “Marginal” or “Unacceptable” rating for Technical Evaluation Factor 1 will render the proposal unawardable and the Offeror will be considered ineligible for award and not evaluated further.

Technical Factor 2 _Technical Approach

The Technical Approach will be evaluated to determine the extent to which the Offeror demonstrates understanding of the Crowdsourced Vulnerability Discovery and Disclosure

Services requirements. Any proposed approach must reflect a demonstrated understanding of the requirements, and a sound, practical, and feasible method to accomplish all tasks, and proposes acceptable methods for ensuring the quality of deliverables.

Specifically, the Government will evaluate:

2a) The extent to which the Offeror’s proposed Technical Approach demonstrates complete understanding of crowdsourced vulnerability discovery and disclosure relative to FA1.

2b) The extent to which the Offeror’s proposed Technical Approach demonstrates complete understanding of crowdsourced vulnerability discovery and disclosure relative to FA2.

2c) The extent to which the Offeror’s proposed Technical Approach details a sound process for conducting a full packet capture of researcher activities for purposes of enabling auditability and continuous monitoring, relative to FA2.

2d) The extent to which the Offeror’s proposed Triage Plan details a sound process for prioritizing vulnerability reports, by severity, for the Government remediation team within 48 hours of receipt.

Receipt of a “Marginal” or “Unacceptable” rating for Technical Evaluation Factor 2 will render the proposal unawardable and the Offeror will be considered ineligible for award and not evaluated further.

Technical Factor 3_Past Performance

The Government will evaluate the extent to which the Offeror demonstrates quality performance of past work identified. The information provided should include the ability to provide the requested services of the same magnitude and complexity of this procurement.

Specifically, the Government will evaluate:

3a) The extent to which the Offeror’s Past Performance details its collective corporate experience in managing multiple Crowdsourced Vulnerability Discovery and Disclosure challenges simultaneously for large enterprise organizations.

3b) The extent to which the Offeror’s Past Performance details its collective corporate experience in performing work relative to FA1.

3c) The extent to which the Offeror’s Past Performance details its collective corporate experience in performing work relative to FA2.

Receipt of a “No Confidence” rating for Technical Evaluation Factor 3 will render the proposal unawardable and the Offeror will be considered ineligible for award and not evaluated further.

Factor 4_Price

The Government will evaluate the proposed pricing, utilizing pricing proposed under Price

Scenarios FA1 and FA2, in accordance with FAR 15.4 and the process stipulated below.

Price will be evaluated independent of technical evaluations. The Offeror’s price will be evaluated to determine if it is fair and reasonable. Additionally, award will further be contingent upon determinations of contractor responsibility. The Government will determine contractor responsibility through the System of Award Management (SAM) and Federal Awardee

Performance and Integrity Information System (FAPIIS). In order for an Offeror to be considered eligible for award, the Offeror shall have an active record with no exclusions in SAM and shall not have any negative records on FAPIIS. Price will not be rated adjectivally, but will be evaluated based on a comprehensive review. Price volumes will be evaluated with respect to accuracy and completeness based on information submitted in the Offeror’s written submission.

This process will involve verification that figures are correctly calculated, prices are presented in the requested format, and that proposed rates, and any applicable discounts, are accurate.

Additionally, the Government may utilize one or more of the following methods to evaluate price:

Review of the proposed level-of-effort and associated pricing;

Comparison to other proposals received;

Comparison and/or analysis based on Independent Government Cost Estimate; or

Comparison of proposed prices with prices obtained through market research for the same or similar items.

For the purpose of evaluation under this RFP, the Government will consider the entire explanation of the proposed standard rate structure; but reserves the right to determine a Total

Evaluated Rate Structure based on part of the rate structure which would allow a direct comparison to other proposals received.

The Government is not obligated to exercise any options.

Note: Price will not be evaluated for an Offeror receiving an adjectival rating of

“Marginal” or “Unacceptable” for Technical Factor 1 or 2. A rating of Marginal or

Unacceptable will render the proposal(s) unawardable and the Offeror ineligible for award without further evaluation.

Section 9: Technical Capability Performance Evaluation Ratings and Definitions

1. The Offeror’s technical solution will be rated separately from the risk associated with its proposed approach. The technical rating evaluates the quality of the Offeror’s technical solution for meeting the Government’s requirement. The following adjectival rating scale will be utilized to evaluate the Offeror’s Volume 1 – Technical Proposal relative to Technical Factor 1 _

Management Approach and Key Personnel and Technical Factor 2 _Technical Approach:

Adjectival

Rating Description

Outstanding Proposal indicates an exceptional approach and understanding of the requirements and contains multiple strengths.

Good Proposal indicates a thorough approach and understanding of the requirements and contains at least one strength.

Acceptable Proposal indicates an adequate approach and understanding of the requirements.

Marginal Proposal has not demonstrated an adequate approach and understanding of the requirements.

Unacceptable Proposal does not meet requirements of the solicitation and, thus, contains one or more deficiencies and is unawardable.

2. Assessment of technical risk, which is manifested by the identification of weakness(es), considers potential for disruption of schedule, increased costs, degradation of performance, the need for increased Government oversight, and/or the likelihood of unsuccessful contract performance. The following adjectival rating scale will be utilized to evaluate the Offeror’s

Volume 1 – Technical Proposal relative to technical risk affiliated with Technical Factor 1 _

Management Approach and Key Personnel and Technical Factor 2 _Technical Approach:

Adjectival

Rating Description

Low

Proposal may contain weakness(es) which have little potential to cause disruption of schedule, increased cost or degradation of performance. Normal contractor effort and normal Government monitoring will likely be able to overcome any difficulties.

Moderate

Proposal contains a significant weakness or combination of weaknesses which may potentially cause disruption of schedule, increased cost or degradation of performance. Special contractor emphasis and close Government monitoring will likely be able to overcome difficulties.

High

Proposal contains a significant weakness or combination of weaknesses which is likely to cause significant disruption of schedule, increased cost or degradation of performance. Is unlikely to overcome any difficulties, even with special contractor emphasis and close Government monitoring.

Unacceptable Proposal contains a material failure or a combination of significant weaknesses that increases the risk of unsuccessful performance to an unacceptable level.

3. The past performance evaluation results in an assessment of the Offeror’s probability of meeting the solicitation requirements. Currency and relevance of the information, source of the information, context of the data, and general trends in contractor’s performance will be considered. These are combined to establish one performance confidence assessment rating for each Offeror.