RFP_Attachment_5_FA1_Price_Scenario_0001.pdf

RFP Attachment 5 – FA1 Price Scenario

RFP # HQ0034-16-R-0258_0001

Functional Area 1 Price Scenario

Price Analysis:

For purposes of effective price analysis, please price the following scenarios, using the format outlined below, for Functional Area 1. Provide separate lines for: 1) Bounties; 2) Contractor Services; 3) Background checks and, 4) Travel.

FA1 Price Scenario:

Scope: The scope of the challenge includes five domains with all of their relevant sub-domains. The websites are fairly static in nature, but are already known to be vulnerable to basic attacks such as cross site scripting (XSS), cross site request forgery (CSRF), and SQL injection. Websites were coded in HTML with Javascript and use an open source server-side CMS tool (i.e., Drupal or DotNetNuke).

Bounties: The challenge, in this FA1 scenario, is completely open allowing anyone to participate. There are no vetting requirements affiliated with this challenge. Given the expected interest in the targeted DoD websites, the Contractor will have 1,000 registered participants. Twenty-five percent (25%) of the registered participants, are actively finding vulnerabilities and submitting actionable reports. The triage team will receive 200 reports within the first 24 hours. Of the 200 reports received, 75% are duplicates. The challenge phase is administered for three weeks and results in the receipt of 900 vulnerability reports. Of the 900 vulnerability reports received, most are duplicates or otherwise ineligible for bounty awards. ninety (90) reports are deemed eligible for bounties and consist of 45 cross-site scripting vulnerabilities, 15 authentication vulnerabilities, 3 SQL injection vulnerabilities, 6 privilege escalation vulnerabilities, 1 remote code execution vulnerability, and 20 vulnerabilities based on design issues, information disclosures, and missing best practices. DoD expects the triage team to prioritize and assign vulnerabilities through an industry standard severity schema that includes, but is not limited to, the Common Vulnerability Scoring System (CVSS) or the Common Weakness Enumeration (CWE). DoD also expects the triage team to pay bounty awards based on common market prices for the vulnerabilities at the corresponding severity level.

Background Checks: DoD expects the Contractor to conduct commercial background checks of all eligible bounty winners before the bounty payment is made to ensure that DoD resources are not sent to felons and/or known-or-suspected terrorists.

Services: The DoD Component that is responsible for the websites is new to this type of security. They require a lot of assistance developing the scope of the challenge, researcher eligibility criteria, and rules and restrictions for the challenge, and require vulnerability reports to come with recommended fixes, and will require upwards of six weeks before being able to remediate all vulnerabilities. Communication between the contractor’s triage personnel and the remediation team will require persistence.

Travel: The Contractor would be expected to send its Program Manager and designated Technical Lead to attend a one day meeting with the DoD Tech Stakeholders at the Pentagon in Arlington, VA. However, the funding for the Travel Contract Line Item Number (CLIN) will be distributed based on actual cost on a Not to Exceed basis.

Expense Rate or Fixed Price Total Bounties Firm Fixed Platform Services based on bounty amount (This must include any overhead and profit you anticipate)

Background Checks (Rate Per Person) Travel (Not to Exceed) $5,000.00 $5,000.00

Grand Total Amount: $