RFP_Attachment_5_FA1_Price_Scenario.pdf

RFP Attachment 5 – FA1 Price Scenario

RFP # HQ0034-16-R-0258

Functional Area 1 Price Scenario

Price Analysis:

For purposes of effective price analysis, please cost the following scenarios, per your typical business model for one or both of the Functional Areas you plan to propose to. Provide separate lines for: 1) Bounties; 2)

Contractor Services; 3) Background checks (if applicable); and, 4) Travel.

FA1 Price Scenario:

Scope: The scope of the challenge includes five domains with all of their relevant sub-domains. The websites are fairly static in nature, but are already known to be vulnerable to basic attacks such as cross site scripting

(XSS), cross site request forgery (CSRF), and SQL injection. Websites were coded in HTML with Javascript and use an open source server-side CMS tool (i.e., Drupal or DotNetNuke).

Bounties: The challenge would be completely open, meaning anyone can participate and there is no vetting requirements. Given the expected interest of these DoD websites, it is expected that the Contractor may have up to 1,000 registered participants, of which 25% of them are actively finding vulnerabilities and submitting actionable reports. The triage team is expected to receive upwards of 200 reports, of which 75% are likely to be duplicates, in the first 24 hours. The challenge phase is expected to last three weeks and culminate with approximately 600 XSS or CSRF attack reports, 80 SQL injections, 200 privilege escalation, 40 remote code execution, and approximately 600 reports with basic information such as design issues, information disclosures, and missing best practices. DoD expects the triage team to prioritize and assign vulnerabilities through an industry standard severity schema, such as the Common Vulnerability Scoring System (CVSS) or the Common

Weakness Enumeration (CWE), and pay bounty awards based on common market prices for the vulnerabilities at that severity level.

Background Checks: DoD expects the Contractor to conduct commercial background checks of all eligible bounty winners before the bounty is paid out to ensure DoD resources are not sent to felons or known-or-suspected terrorists.

Services: The DoD Component that is responsible for the websites is new to this type of security. They require a lot of assistance developing the scope of the challenge, researcher eligibility criteria, and rules and restrictions for the challenge, and require vulnerability reports to come with recommended fixes, and will require upwards of six weeks before being able to remediate all vulnerabilities. Communication between the contractor’s triage personnel and the remediation team will require persistence.

Travel: The Contractor would be expected to send its Program Manager and designated Technical Lead to attend a one day meeting with the DoD Tech Stakeholders at the Pentagon in Arlington, VA. However, the funding for the Travel Contract Line Item Number (CLIN) will be distributed based on actual cost on a Not to

Exceed basis.

Expense Rate or Fixed Price Total

Bounties

Firm Fixed Platform Services based on bounty amount

(This must include any overhead and profit you anticipate)

Background Checks (Rate Per Person)

Travel (Not to Exceed) $5,000.00 $5,000.00

Grand Total Amount: $

RFP Attachment 5 – FA1 Price Scenario

RFP # HQ0034-16-R-0258