RFP_Attachment_9__Questions_0001_.pdf

RFP Attachment 9 – Questions and Answers

RFP # HQ0034-16-R-0258_0001 Page 1

1. Q Based on the pricing scenario for Functional Area1, there are varying degrees of severity for each of the vulnerability types described. Given that the severity of the vulnerability will determine its payout, can the following assumption be made?

Remote Code Execution: - Critical SQL Injection - High XSS or CSRF - Medium Basic information such as design issues, information disclosures, and missing best practices - Low

If not, what priority level would the DoD assign to the vulnerability types described in pricing scenario for FA1?

A This assumption would be considered appropriate. The key is to ensure that any assumptions made are listed in your price scenario response and, also, that your input aligns with industry standards.

2. Q Are the numbers of vulnerabilities, described in the pricing scenario for FA1, expected for a single task order, or totals across all task orders?

A See revised RFP Attachment #5 - FA1 Price Scenario. The 900 vulnerabilities represent the total number of submissions. The number of qualifying vulnerabilities are approximately 10%, or 90, of the total number submitted. This includes at least one remote code execution, about 45 cross-site scripting vulnerabilities, and at least 20 vulnerabilities that are based on design issues, information disclosures, and missing best practices.

3. Q Does the DoD anticipate changing reward payouts for different task orders?

A Yes.

4. Q Are the minimum/maximum quantities described in Attachment 7 – IDIQ Provisions and Clauses for a single year contract or for three years?

A The minimum quantities represent the minimum amounts guaranteed under the resulting contract(s) respective to FA1 and FA2. The minimum amount represents what is guaranteed over the life of the resulting contract. The maximum amount, referred to as the contract ceiling, established cannot be exceeded over the life of the contract. However, it is possible to reach the ceiling amount prior to a three year timeframe.

5. Q Can the triage team assign vulnerabilities through industry standard severity schema other than CVSS or CWE, such as OWASP Top 10 or the Vulnerability Rating Taxonomy?

A Yes.

6. Q How is triage defined? Given the large magnitude of submissions received within the first days, is triage considered a "first touch"?

A Ideally, triage capability would entail the contractor taking all of the raw reports, filtering out duplicates, conducting a first pass over the reports, in an effort to reproduce the vulnerability (if necessary) and passing reports, that appear to be valid/qualifying, to the Government within the first 48 hours of a report submission. The Government is seeking to avoid situations where it takes more than 48 hours for the Government to be made aware of qualifying vulnerabilities.

7. Q For the requirement [to] “tailor existing platform to the specific challenge environment as specified by the government” what is the process for communicating those specifics and what is the expectation for delivery?

A Tailoring the platform does not include any engineering/software development. Tailoring would likely mean ensuring all necessary government personnel have accounts on the platform, know how to use it, and that effective escalation and work assignment processes are developed and understood (for instance, ensuring that the contractor triage team is aware if there are multiple, separate government remediation teams to ensure reports are assigned effectively). These requirements would be communicated in the planning meeting during the preparation phase and/or through email or phone leading up to the challenge phase.

RFP # HQ0034-16-R-0258_0001 Page 2

8. Q What is expected both technically and from a key personnel perspective to adhere to ISO 29147 and ISO 30111?

A It is incumbent on the contractor to describe how they adhere to these standards.

9. Q In the event that a challenge yields an exceedingly high number of valid vulnerabilities that would either exhaust the reward pool or dilute the reward amounts themselves, would it be considered an incompletion of the task order to suspend the challenge before the expected close date?

A No. This would not be considered as an incompletion of a task order as long as the scope, rules of engagement and payout structure are developed with the Government’s full knowledge. Suspending the challenge, if funds were exhausted, would be an appropriate course of action. However, the COR would need to approve this action in writing.

10. Q Will bids [offers] from Value Added Resellers or other contract vehicles be considered for this RFP, or is it the intent of WHS to contract directly with the Offeror?

A While Offerors are encouraged to establish teaming arrangements, the Government intends to enter into contract directly with the Contractor that complies with the solicitation terms and conditions including the Phase One compliance factor which requires ownership and operation of an FA1 or FA2 compliant customer platform.

11.

Q For Past Performance, is it permissible to provide multiple references relative to the work cited, or is it limited to one?

A Yes. That is permissible. You must submit at least one reference.

12. Q If there is an inadvertent disclosure or discovery of classified material, how or who would be responsible for handling the cleanup and sanitization?

A The Government will be responsible for the handling the cleanup and sanitation in the event of an inadvertent classified material disclosure or discovery. It is expected that the Contractor would notify the Government immediately upon such an event or upon the suspicion of such an inadvertent discovery. Further, it is required that the Contractor would work in good faith to respond to the Government personnel who conduct the sanitization.

13. Q Is this a follow-on requirement? If so, could you please provide the incumbent contract number for this opportunity? If not, is this a new requirement?

A This is a new competitive requirement.

14. Q With regard to RFP Attachment 4, Section 4, Page 2 and Section 6.3, Page 3: Page 2 specifies a PoP of no more than 4 months. Page 3 specifies a PoP of 6 months. Please clarify whether the PoP is no more than 4 months or 6 months.

A Six Months.

15. Q With regard to RFP Attachment 4, Section 6.7, Page 6: Assuming all payments are finalized prior to the conclusion of the Post-Challenge Phase, would the Offeror be authorized to provide monetary awards to researchers for validated and qualifying vulnerability reports during the Challenge Phase? Our normal course of business is to receive, validate and make payment on all accepted vulnerabilities as soon as possible.

A Yes, the Contractor would be authorized to provide monetary awards to researchers for validated and qualifying vulnerability reports. This authorization will not change the terms of payment for each task order. Commercial interim payments and commercial advance payments may be authorized, in accordance with FAR 32.202, at the task order level.

16. Q With regard to RFP Attachment 4, Section 6.5, Page 5: In the Preparation Phase, would providing researchers with a range of payment amounts for specific types of vulnerabilities satisfy the Government's desire to "Socialize payment amounts to the researchers"?

A Yes.

RFP # HQ0034-16-R-0258_0001 Page 3

17. Q With regard to RFP Attachment 4, Section 4, Page 1: The Government requires DoD source code to be hosted on the contractor’s platform and accessible via “DoD-specified authentication methods”. Please clarify the required authentication methods.

A Details of this will be worked out post-award, and may potentially vary from task order to task order. It is not expected to require any unusual authentication methods that may incur additional costs.

18. Q With regard to RFP Attachment 1, Section 5.5 and 5.6, Page 11 and Attachment 6: Attachments 5 and 6 require the Offeror to prepare a price, "per your typical business model". Our business model does not break down pricing on a per vulnerability basis - each challenge includes an unlimited number of vulnerabilities. Therefore, we intend to propose one fixed, all-inclusive platform price and we may not propose a separate price for the Bounty line item since it doesn't fit our normal operating model. Is this approach acceptable to the Government, per the Pricing Instructions provided in Attachment 1 Section

5.5 and 5.6?

A The Government understands that this may not be not your normal business practice. However, the Government needs to receive price-related information, from Offerors, in a format that is comparable.

Pricing scenarios are for evaluation purposes only. As such, the Government requests that Offerors provide price-related information in a manner that is consistent with the consistent with the format requested. Offerors are encouraged to explain their price build-up. Incorporation of a Pricing structure(s), that correlates with the successful Offeror's business model required for task order execution, will be discussed post-award.

19. Q With regard to RFP Attachment 1, Section 5.5 and 5.6, Page 11: For the purposes of providing pricing for the "Bounties" line item, please define the difference between a fixed rate and a fixed price for bounties.

A A fixed price is for the work overall (e.g. the full amount of a task order effort), encompassing all line items (including the bounties, the services, the background checks, and travel). A fixed rate is relative to the different classes of vulnerabilities.

20. Q With regard to RFP Attachment 1, Section 5.5 and 5.6, Page 11: If the Offeror proposes a fixed price for the bounty line item rather than a fixed rate, is it acceptable for the Offeror to omit the Bounty Rate Structure from the proposal submission?

A See Answers #18 and 19 above.

21. Q With regard to RFP Attachment 1, Section 8, Page 15: The RFP indicates that "proposed rates, and any applicable discounts, are accurate." Discounts are not mentioned in the Price Data Instructions nor in Price Scenarios FA1 and FA2. Please describe how the Government intends to allow the use of discounts for purposes of the price evaluation.

A References to “discounts” have been removed.

22. Q With regard to RFP Attachment 1, Section 8, page 13-14: Please confirm that Offerors submitting a proposal for either FA1 or FA2, vice both FA1 and FA2, are subject to evaluation factors pertaining only to the Functional Area for which the proposal was submitted. Specifically, please confirm that Offerors submitting a proposal for FA1 only will not be evaluated against Technical Factors 2b, 2c, and 3c, while Offerors submitting a proposal for FA2 only will not be evaluated against Technical Factors 1b, 2a, and 3b.

A Yes. That is correct. Also, see RFP Attachment 1, Section 4: Technical Proposal Instructions – Compliance and Evaluation Factors for more guidance on how to address the evaluation factors.

23. Q With regard to RFP Attachment 4, 5.1, Page 2: In describing Subcontract & Researcher management, the Government states: "This could include additional triage capacity and security consultants for vulnerability validation, strategic communications, and penetration testing. Additionally, it is expected that individuals conducting the vulnerability discovery and disclosure are independent persons and entities." Please clarify the distinction between "vulnerability discovery and disclosure" and "penetration testing". Additionally, please clarify if it is acceptable for subcontracted penetration testing personnel to conduct and report vulnerability discovery and disclosures.

RFP # HQ0034-16-R-0258_0001 Page 4

A The DoD does not have any preference relative to methods used to "gather the crowd." The contractor can make use of traditional pentesting firms along with the "crowd" if it so chooses. Functionally, for DoD, there is little or no difference between penetration testing and vulnerability discovery activities.

However, under no circumstances, will any subcontractors have privity of contract with the DoD.

24. Q With regard to RFP Attachment 4, Section 8, Page 12: The FA2 PWS requires the Contractor to provide, "the full range of technical and manual services required to support the requirements addressed in section 4 and 7.8 of the PWS". Section 7.8 does not appear in Attachment 4. Please clarify this requirement.

A This should read "The Contractor provides the full range of technical and manual services required to support the requirements addressed in section 4 and 6.6 of the PWS." It has been updated in RFP Attachment 4.

25. Q With regard to RFP Attachment 4, Section 6.3, Page 3: The Government requires Offerors to, "have an existing user-friendly platform with automated services". Please define "automated services".

A The government is interested in any automated tools/services that the contractor can offer to combine with, or augment, researcher activities (e.g. automated scanning tools), as well as to manage researcher submissions (e.g. automated tools to identify and filter duplicate submissions and to communicate with researchers, as appropriate).

26. Q We have interpreted "deep binary hacking" as static application security testing (SAST). Is this a correct interpretation?

A Yes. That is correct.

27. Q Per the Proposal Instructions and Evaluation Factors, we assume that the performance requirement for "Strategic communications and ability to handle public relations" pertains only to FA1. Is this a correct assumption?

A Yes. That is correct.

28. Q The Offeror is required to "complement researcher efforts with automated testing tools for source code analysis, host and application scanning, and vulnerability analysis, if applicable." Please define "vulnerability analysis" in this context.

A Vulnerability analysis or assessment in this context would include identifying vulnerabilities in networks or computers. This refers to contractor-provided automated tools to identify vulnerabilities.