HS0021-15-R-0011_AMENDMENT_0003.pdf

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER (Type or print)

30-105-04EXCEPTION TO SF 30

APPROVED BY OIRM 11-84

STANDARD FORM 30 (Rev. 10-83) Prescribed by GSA

FAR (48 CFR) 53.243

The purpose of this amendment is to:

1) PROVIDE instructions for the in person submissions of laptops

2) PROVIDE instructions for the Proof of Concepts

3) REVISE the solicitation in accordance with the question and answers responses.

1. CONTRACT ID CODE PAGE OF PAGES

S 1 33

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

16C. DATE SIGNED

BY 01-Jun-2015

16B. UNITED STATES OF AMERICA15C. DATE SIGNED15B. CONTRACTOR/OFFEROR

(Signature of Contracting Officer)(Signature of person authorized to sign)

8. NAME AND ADDRESS OF CONTRACTOR (No., Street, County, State and Zip Code) X HS0021-15-R-0011

X 9B. DATED (SEE ITEM 11)

13-Feb-2015

10B. DATED (SEE ITEM 13)

9A. AMENDMENT OF SOLICITATION NO.

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

X The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offer X is extended, is not extended.

Offer must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended by one of the following methods:

(a) By completing Items 8 and 15, and returning 1 copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted;

or (c) By separate letter or telegram which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN

REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by telegram or letter, provided each telegram or letter makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

12. ACCOUNTING AND APPROPRIATION DATA (If required)

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS.

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE

CONTRACT ORDER NO. IN ITEM 10A.

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation date, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(B).

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority)

E. IMPORTANT: Contractor is not, is required to sign this document and return copies to the issuing office.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

10A. MOD. OF CONTRACT/ORDER NO.

2. AMENDMENT/MODIFICATION NO. 5. PROJECT NO.(If applicable)

6. ISSUED BY

3. EFFECTIVE DATE

28-May-2015

CODE

DEFENSE SECURITY SERVICE

SHAWNA MITCHELL 571.305.6548

RUSSELL-KNOX BUILDING

27130 TELEGRAPH ROAD

QUANTICO VA 22134

HS0021 7. ADMINISTERED BY (If other than item 6)

4. REQUISITION/PURCHASE REQ. NO.

CODE

See Item 6

FACILITY CODECODE

EMAIL:TEL:

HS0021-15-R-0011

SECTION SF 30 BLOCK 14 CONTINUATION PAGE

SUMMARY OF CHANGES

SECTION A - SOLICITATION/CONTRACT FORM

The standard size code $27,500,000 has been deleted.

SECTION C - DESCRIPTIONS AND SPECIFICATIONS

The following have been modified:

SOO CONTENT

This is a single award Indefinite Quantity Indefinite Delivery (IDIQ) type contract. Task orders shall be issued under this arrangement. Total orders under this contract shall not exceed $50,000,000 including all options periods.

(One-year base, four one-year options). The guaranteed minimum is $100,000 for the basic period only. There is no guaranteed minimum for the option periods, if exercised. Orders may only be issued by the Defense Security Service (DSS) Office of Acquisitions (AQ) contracting officers.

NATIONAL INDUSTRIAL SECURITY SYSTEM (NISS) STATEMENT OF OBJECTIVES (SOO)

Introduction As one of four Government Security Agencies (GSA) directed to implement the National Industrial Security Program (NISP) per Executive Order 12829, the Defense Security Service (DSS) provides Industrial Security Services and training to the Department of Defense (DoD) and twenty-seven other federal agencies. Administering the NISP to cleared contractors eligible to receive, handle, and protect classified information for DoD and the 27 agencies makes DSS responsible for an industrial base that includes over 13,000 cleared facilities, 40,000 classified information systems, and over 10,000 industrial security professionals.

Purpose There is an existing “gap” between DSS Agency capacity and national security requirements being predominantly driven by a summation of challenges found within three Agency operational activities:

1) Process Facility Clearances (FCL)

2) Conduct Proactive Monitoring

3) Manage Incident Response

DSS currently conducts its critical missions without an integrated enterprise information technology architecture.

The lack of an enterprise IT solution results in cumbersome, inefficient, and exceedingly manual processes that jeopardize the success of DSS missions.

Five primary factors that span across the three forenamed operational activities challenge DSS’s ability to effectively administer the NISP and account for Industry’s rapidly evolving security environment:

1. Limited ability to identify vulnerabilities and mitigate the expanding threat through consistent interaction and partnership with Industry, given resource constraints.

2. Increasing reliance on proactive NISP stakeholder partnerships, which can be met with hesitation.

3. Scaled directorates to meet growing mission sets, resulting in potential service delivery overlap.

4. Required Department-level clarity on critical issues, such as cyber defense, fogging the Agency’s ability to determine mission effectiveness.

5. Legacy technological infrastructure out-stripped by modern information security demands, and actually hampering the Agency’s ability to provide timely support to NISP stakeholders.

The National Industrial Security System (NISS) is the working name for a new, automated business information capability that DSS is seeking to replace and expand upon the following legacy systems: Industrial Security Facility Database (ISFD) and the Department of Energy (DoE) hosted but DSS owned Electronic Facility Clearance System (e-FCL). The NISS Solution will be an integrated automated solution that will facilitate efficient execution of the Agency's core mission. It will use available technology to drive smoother user workflows, enhance decision-making through stronger and timelier synthesis of information, and improve transparency pertaining to the National Industrial Security Program (NISP). The NISS requirements capture the desired ISFD and e-FCL functionality, which includes workflows to enable contractor performance, provide proactive oversight, and complete reactive incident response. The DSS managed ISFD system and DoE managed e-FCL system contain DSS data which must be migrated to the NISS database for Full Operational Capability (FOC). The successful vendor may be required to incorporate additional functionality.

NISS will allow users to sift through vast volumes of information and more easily form linkages about a facility and its Key Management Personnel (KMP), effectively closing Industry’s safeguarding gaps, while allowing DSS field personnel to proactively partner with Industry on-site through Security Vulnerability Assessments (SVAs).

Presently critical resources are diverted from meaningful customer engagement and identification of high-risk threats to menial data entry without an effective NISS enterprise IT solution.

High Level Objectives for the NISS approach include the following:

a. Expedited performance against classified contracts

i. Streamlined facility clearance (FCL) processing

ii. Enhanced FOCI identification and mitigation

iii. Accelerated and improved C&A of Industry information systems

iv. Expedited production of quality information

b. Enhanced data linkages to provide full risk profile

i. Increased information sharing and transparency

ii. Automated prioritization of Industry engagement (FIL)

iii. Implemented enterprise risk analytics capability

c. Improved ability to make metrics-based decisions

i. Enhanced automated metrics capture and analysis

d. Improved vulnerability management from identification through mitigation

i. Improved vulnerability reporting through automation

ii. Streamlined vulnerability oversight

iii. Expedited vulnerability mitigation

e. Improved threat management from identification through mitigation

i. Improved threat reporting

ii. Expedited threat mitigation

f. Increased technology effectiveness and mobility

i. Create a mobile technology solution to meet mobile workforce needs

ii. Improve ability to utilize data from multiple sources, classifications, and types in a single location

iii. Improve analysis

iv. Improve discovery of unknown unknowns. Expedite data submission validation

NISS Required System Attributes

Attributes required for the NISS include the following features:

a. BPMN - The Defense Security Service (DSS) requires a product which enables the capturing of business operations through Business Process Modeling and Notation (BPMN) workflows with work prioritization.

b. Workflow Management – The contractor shall provide NISS users with the ability to manage workflow processes and ensures that out-of-the-box vender functional capabilities are available.

c. Facility Profile Creation – The contract shall provide an end product that will ensure that each facility has a profile within NISS that includes information such as the facility address, region, KMP list, corporate website, corporate legal structure, research data, facility actions, alerts, change conditions, workflow status, etc. The system shall visually display parent-child and related ownership hierarchies between facilities and companies.

d. Search/Content Management – The contractor shall provide a system that will enable site-wide searching for internal and external users on various information within NISS. While search functionality provided as native capabilities will likely require further customization to meet Agency needs.

e. Reporting – The contractor shall provide a system that will calculate and display standard metrics related to all DSS processes conducted within the system. Additionally, the system should enable advanced ad-hoc reporting and analytics that can record and report historical transaction and usage data, and conduct real-time validation of the data. Reporting should facilitate the implementation of the risk management framework which includes identification of potential threats to detection of realized impacts, for the Industrial Security Supply Chain. The reporting should enable data-driven decision making to identify risks within the supply chain and enable executive level reporting for performance management.

f. Analytics – The contractor shall provide a system capable of transforming structured and unstructured data to help identify and develop meaningful and actionable information to inform business decisions and identify trends or risks. This analytic capability should allow for the easy interpretation of volumes of data, and provide historical, current and predictive views of internal (DSS) and external (Industry) operations. The system should acquire, process, and correlate data that is within the system, as well as within linked sources.

g. Integration and Interoperability – The contractor shall provide a system that will enable access to data from databases internal and external to DSS to complete internal processes and validate information included in this DSS system of record. The technical solution shall conform to DoD Guidelines and DSS infrastructure. The expectation is that the delivered product will have already incorporated external system integration activities prior to DSS Pre-Production staging.

h. Storage – The contractor shall provide a system that will allow users to upload and save documents as well as unstructured data.

i. Dashboard Portal/Single User Interface – The contractor shall provide a system that will present workflow data, notifications and messages, dependent upon roles and permission level assigned to each user. The graphical user interface (GUI) must be innovative in nature.

j. Auditing – The contractor shall provide a system with the capabilities to ensure that transactional logs of various actions are recorded and saved. This includes, but is not limited to, the overall system transactions and facility profile transactions.

k. Attribute Based Access Control (ABAC) – The contractor shall provide a system that establishes rules for users’ access, roles, and permissions within the NISS, in accordance with NIST SP 800- 162.

l. Help – The contractor shall provide a system that provides access to job aides, FAQs, and other help-related documentation.

m. Mobile Capabilities – The contractor shall provide a system that converts core NISS capabilities into a mobile version for access over mobile devices.

n. Automated Notifications/Alerts/Messaging – The contractor shall provide a system that provides the ability for internal and external users to liberally manage notifications, alerts and messages.

o. Automated Cross Domain Solution (CDS) – The contractor shall provide a system that enables automated transfer of data between NIPR and SIPR without spillage. The developer must enable a bridge for NIPR information to be ingested up to SIPR, and primary unclassified NISS SIPR information to be available down to NIPR. A near real-time, bi-directional cross-domain data solution will be required to be in place at NISS initial deployment. The CDS will be included within and throughout the workflow processes.

p. NoSQL (Not Only SQL) data repository with modular systems integration to allow for multiple transactional systems to utilize, modify and validate data

q. Data Migration – The existing legacy application contains data which will continue to be used and must be migrated into the NISS. The developer must prepare existing data so that it ports into the new system without losing functional meaning and with minimal disruption of service for daily operations. Data fields for the existing and receiving systems shall be formally documented mapping schemas for review and approved by stakeholders for accuracy.

r. GUI Interfaces – The Agency requires internal and external GUI interfaces. The interfaces should automate the exchange of Industrial Facility Clearance data, between DSS internal systems and extra-Agency systems. Timely exchange of this information will allow Agency representatives to execute proactive monitoring, risk response, and assessment responsibilities.

s. Milcloud Development - The winning Proof of Concept (PoC) will be uploaded to and developed by the contractor to the DSS Milcloud environment. Milcloud will serve as the development environment for the NISS. The contractor will be expected to conduct remote development activities within the DSS provided Milcloud environment. The Agency anticipates two possible infrastructure related end states for NISS Production; a MilCloud Production instance or deployment to physical virtualized hardware located in Quantico, VA and Monterey, CA.

NISS Delivery Increments

Anticipated NISS Delivery increments include the following:

a. TASK ORDER 0001: Incorporate ISFD and E-FCL into Core NISS Foundation Capabilities – The first increment will provide DSS with core ISFD and e-FCL capabilities and establishes the foundation for accessing facility data, site navigation, and fundamental application functionality within the NISS. The NISS requirements, as stated, capture the desired ISFD and e-FCL functionality, which includes workflows to enable contractor performance, provide proactive oversight, and complete reactive incident response. The DSS managed ISFD system and DoE managed e-FCL system contain DSS data which must be migrated to the NISS database for Initial Operational Capability (IOC). The first increment will centralize all processes required for managing the initial facility security clearance (IFCL) process. The estimated duration for this increment is anticipated to be roughly 18 months since it will include all core capabilities listed as system attributes. [Requirements Development Document (RDD) Tabs 1, 12 (excluding “Mobile”), and 13]

i. ISFD currently interfaces with the Office of the Designated Approval Authority (ODAA) Business Management System (OBMS). The interface displays Industry System Security Plan counts and plans status for internal users.

The interconnectivity between OBMS and ISFD reduces the dependency of non-Information System Security Professionals to access the OBMS system. Further details are provided in the ISFD-OBMS Interface Document. As the system of record for Industrial Security Facilities Data, ISFD provides facility information for display only within OBMS.

ii. JPAS Extracts - The NISS shall provide real time Industrial Security Facility system updates to the Joint Personnel Adjudication System (JPAS) and its replacement system; Defense Information Security System (DISS).

The data transferred includes but is not limited to facility cage code, FCL, facility name and address.

iii. NCAISS – The NISS shall interface with National Industrial Security Program (NISP) Central Access and Information Security System (NCAISS). NCAISS is the Agency’s single point of entry or portal for DSS managed applications. PKI authentication through NCAISS supports both Common Access Card (CAC) and External Certificate Authority (ECA) certificates. The Agency leadership expects NCAISS interface with NISS to be operational by the completion of Full Operational Capability (FOC). The NISS contractor shall only support interface work related to the NISS application as the NCAISS application is administered under another contract.

Increment One (1) is Task Order 0001. The following increments will be future Task Orders.

b. Increment Two: Security Vulnerability and Incident Response Management – The second increment will provide DSS stakeholders with essential tools and information required to manage security violations, assess vulnerabilities and respond to incident reports. This increment also builds upon the functionalities developed in Increment-I by enhancing existing system functionality. Processes include Security Vulnerability Assessment (SVA), Suspicious Contact Report (SCR), and Security Violation (SV) processing; the estimated duration for this increment is roughly 12 months. [RDD Tabs 9, 10, 11]

i. NISS will interface with the Joint Personnel Adjudication System (JPAS) and its ultimate replacement, Defense Information Security System (DISS) for real time data transfer. Industrial Security Facility related data, including but not limited to the Commercial and Government Entity (CAGE) Code, Facility Clearance (FCL), facility name and address, and Key Management Personnel (KMP) details, will be automatically transmitted from NISS to DISS, once updated. NISS KMP personnel clearance details shall update NISS from DISS updates. The DISS is comprised of Case Adjudication Tracking System (CATS) and Joint Verification System (JVS).

ii. NCCS - NISS shall interface with and provide real-time Industrial Security Facility data updates to the NISP Contractor Classified System (NCCS). The NISS will provide Facility related data, including but not limited to the facility CAGE code, FCL, facility name and address. The NISS-NCCS interface shall be directional; with NCCS contained Contractor information sent to NISS through real-time data updates. Data transferred will include but is not limited to contract number, Government Contracting Agency (GCA), prime contractor and subcontractor information

iii. Cross Domain Solution - The NISS shall leverage the DISA Cross Domain Solution (CDS) for the near-real time transfer of data to the DSS SIPR instance to NISS and unclassified data from SIPR instance of NISS to NIPR version. The Agency expects CDS capabilities to be incorporated into in NISS Increment II delivery.

c. Increment Three: Change Condition Monitoring – The third increment will enable DSS to efficiently and effectively perform change condition monitoring making use of all core facility data availability within the NISS.

This increment allows for refinement of system functionality to be established by the task order. Processes to be incorporated into NISS include Key Management Personnel (KMP) Monitoring, NATO Control Point Inspections (CPI), Triage Outreach Program (TOP), NISP Facility Oversight, and Foreign Visit Requests (FVR). [RDD Tabs 4, 5, 6, 7, 8]

d. Increment Four: Mobile Access Enablement – The fourth increment will provide stakeholders with the ability to access NISS functionality in a mobile environment, increasing workforce productivity during facility site visits and security assessment visits. The estimated duration for this increment is roughly nine (9) months. [RDD Tab 12 “Mobile”]

e. Increment Five: Information System Accreditation - The fifth increment shall enable processing of Industry Stakeholder submitted information system certification and accreditation (C&A) plans through the system and associated transfer, review, and processing in support of the field operations mission to enable industry performance and secure digital classified information. The scope of this increment will be determined at a later date. The estimated duration for this increment is roughly 9 months. [RDD Tab 2]

f. Increment Six: Command Cyber Readiness Inspections (CCRI) - The sixth increment will provide the ability to electronically manage the process of scheduling, conducting, and perfuming follow-up activities related to DISA mandated CCRI inspections. The estimated duration for this increment is roughly 9 months. [RDD Tab 3]

SECTION F - DELIVERIES OR PERFORMANCE

The following have been deleted:

DELIVERY INFORMATION

SECTION H - SPECIAL CONTRACT REQUIREMENTS

252.234-7002 EARNED VALUE MANAGEMENT SYSTEM (MAY 2011)

(a) Definitions. As used in this clause--

Acceptable earned value management system means an earned value management system that generally complies with system criteria in paragraph (b) of this clause.

Earned value management system means an earned value management system that complies with the earned value management system guidelines in the Integrated Program Management Report (IPMR) Data Item Description (DID) also known as IPMR DID.

Significant deficiency means a shortcoming in the system that materially affects the ability of officials of the Department of Defense to rely upon information produced by the system that is needed for management purposes.

(b) System criteria. In the performance of this contract, the Contractor shall use--

(1) An Earned Value Management System (EVMS) that complies with the EVMS guidelines in the American National Standards Institute/Electronic Industries Alliance Standard 748, Earned Value Management Systems (ANSI/EIA-748); and EVM DID (DI-MGMT-81861) IPMR.

(2) Management procedures that provide for generation of timely, reliable, and verifiable information for the IPMR DID items 1-7 are required data items of this contract.

(c) If this contract has a value of $50 million or more, the Contractor shall use an EVMS that has been determined to be acceptable by the Cognizant Federal Agency (CFA). If, at the time of award, the Contractor's EVMS has not been determined by the CFA to be in compliance with the EVMS guidelines as stated in paragraph (b)(1) of this clause, the Contractor shall apply its current system to the contract and shall take necessary actions to meet the milestones in the Contractor's EVMS plan.

(d) If this contract has a value of less than $50 million, the Government will not make a formal determination that the Contractor's EVMS complies with the EVMS guidelines in ANSI/EIA-748 with respect to the contract. The use of the Contractor's EVMS for this contract does not imply a Government determination of the Contractor's compliance with the EVMS guidelines in IPMR DID for application to future contracts. The Government will allow the use of a Contractor's EVMS that has been formally reviewed and determined by the CFA to be in compliance with the EVMS guidelines in IPMR DID.

(e) The Contractor shall submit notification of any proposed substantive changes to the EVMS procedures and the impact of those changes to the CFA. If this contract has a value of $50 million or more, unless a waiver is granted by the CFA, any EVMS changes proposed by the Contractor require approval of the CFA prior to implementation. The CFA will advise the Contractor of the acceptability of such changes as soon as practicable (generally within 30 calendar days) after receipt of the Contractor's notice of proposed changes. If the CFA waives the advance approval requirements, the Contractor shall disclose EVMS changes to the CFA at least 14 calendar days prior to the effective date of implementation.

(f) The Government will schedule integrated baseline reviews as early as practicable, and the review process will be conducted not later than 180 calendar days after--

(1) Contract award;

(2) The exercise of significant contract options; and

(3) The incorporation of major modifications.

During such reviews, the Government and the Contractor will jointly assess the Contractor's baseline to be used for performance measurement to ensure complete coverage of the statement of work, logical scheduling of the work activities, adequate resourcing, and identification of inherent risks.

(g) The Contractor shall provide access to all pertinent records and data requested by the Contracting Officer or duly authorized representative as necessary to permit Government surveillance to ensure that the EVMS complies, and continues to comply, with the performance criteria referenced in paragraph (b) of this clause.

(h) When indicated by contract performance, the Contractor shall submit a request for approval to initiate an over-target baseline or over-target schedule to the Contracting Officer. The request shall include a top-level projection of cost and/or schedule growth, a determination of whether or not performance variances will be retained, and a schedule of implementation for the rebaselining. The Government will acknowledge receipt of the request in a timely manner (generally within 30 calendar days).

(i) Significant deficiencies.

(1) The Contracting Officer will provide an initial determination to the contractor, in writing, on any significant deficiencies. The initial determination will describe the deficiency in sufficient detail to allow the Contractor to understand the deficiency.

(2) The Contractor shall respond within 30 days to a written initial determination from the Contracting Officer that identifies significant deficiencies in the Contractor's EVMS. If the Contractor disagrees with the initial determination, the Contractor shall state, in writing, its rationale for disagreeing.

(3) The Contracting Officer will evaluate the Contractor's response and notify the Contractor, in writing, of the Contracting Officer's final determination concerning--

(i) Remaining significant deficiencies;

(ii) The adequacy of any proposed or completed corrective action;

(iii) System noncompliance, when the Contractor's existing EVMS fails to comply with the earned value management system guidelines in the IPMR DID; and

(iv) System disapproval, if initial EVMS validation is not successfully completed within the timeframe approved by the Contracting Officer, or if the Contracting Officer determines that the Contractor's earned value management system contains one or more significant deficiencies in high-risk guidelines in IPMR DID standards. When the Contracting Officer determines that the existing earned value management system contains one or more significant deficiencies in one or more of the remaining seven (7) guidelines in IPMR DID standards, the contracting officer will use discretion to disapprove the system based on input received from functional specialists and the auditor.

(4) If the Contractor receives the Contracting Officer's final determination of significant deficiencies, the Contractor shall, within 45 days of receipt of the final determination, either correct the significant deficiencies or submit an acceptable corrective action plan showing milestones and actions to eliminate the significant deficiencies.

(j) Withholding payments. If the Contracting Officer makes a final determination to disapprove the Contractor's EVMS, and the contract includes the clause at 252.242-7005, Contractor Business Systems, the Contracting Officer will withhold payments in accordance with that clause.

(k) With the exception of paragraphs (i) and (j) of this clause, the Contractor shall require its subcontractors to comply with EVMS requirements as follows:

(1) For subcontracts valued at $50 million or more, the following subcontractors shall comply with the requirements of this clause:

[Contracting Officer to insert names of subcontractors (or subcontracted effort if subcontractors have not been selected) designated for application of the EVMS requirements of this clause.]

TBD

(2) For subcontracts valued at less than $50 million, the following subcontractors shall comply with the requirements of this clause, excluding the requirements of paragraph (c) of this clause:

[Contracting Officer to insert names of subcontractors (or subcontracted effort if subcontractors have not been selected) designated for application of the EVMS requirements of this clause.]

TBD

(End of clause)

SECTION I - CONTRACT CLAUSES

52.233-2 SERVICE OF PROTEST (SEP 2006)

(a) Protests, as defined in section 33.101 of the Federal Acquisition Regulation, that are filed directly with an agency, and copies of any protests that are filed with the Government Accountability Office (GAO), shall be served on the Contracting Officer (addressed as follows) by obtaining written and dated acknowledgment of receipt from

Keanna Houston Defense Security Service 27130 Telegraph Road

R-K BLDG, MCBQ

Quantico, VA 22134

(b) The copy of any protest shall be received in the office designated above within one day of filing a protest with the GAO.

(End of provision)

SECTION J - LIST OF DOCUMENTS, EXHIBITS AND OTHER ATTACHMENTS

ATTACHMENTS IN READING ROOM

NISS Reading Room Content

1) NISS Requirements Definition Document (RDD)/Requirements Repository

2) Initial Facility Clearance (iFCL) Use Case

3) NISS Capabilities Increment Mapping, HLOs slide deck

4) NISS Acquisition Friendly Business Case Exert

5) NISS Hardware and Software Specifications

6) NISS Work Breakdown Structure (WBS)

7) NISS Reporting Requirements

8) NISS 508 Software Development – GPAT Evaluation

9) NISS DoD Risk Management Framework 8510.01

10) NISS_Risk Management Controls_Draft DIACAP IA Controls

11) NISS Joint Information Environment (JIE) – DoD Interoperability Guidance

12) NISS Open Systems Language

13) NISS Software Assurance Guidance

14) NISS Sample Data

15) Virtual Image Related

16) Test Folder

17) Industry Day

18) 20150324_Q &As NISS

19) VMWARE_VCD_55_user _guide

20) MILCLOUD_Portfolio_Briefing

21) MILCLOUD_VDC_Secure_Remote_Acess_Options_v0.9

22) Virtual_ Data_ Center_vdc_terms_and_conditions_statements

23) U_IIS_7-0_V1R7-STIG

24) U_IIS_6-0_V6R15-STIG

25) 20150319_Q and A_NISS_v1

26) 20150319_Q and A_NISS

27) 20150304_NISS_Industry_Day_02232015_Consolidated

28) Hard Drive Request Instructions_Final

29) Reading Room Updates (022015) _SIPR Business Case excerpts, Updated RDD and Updated iFCL Use Case

30) NISS Business Case SIPR Excerpt

31) IFCL Use Case Document 1 pt 2 02102015

32) 4 – NISS Requirements Repository_v2pat1

33) NISS Information_12-19-14

34) 20141204_NISS RFI Q & A

35) NISS Industry Day Vendors for Reading Room

36) 20141120_NISS_Industry_Day_Final_v19Nov 20141024

37) Data Center EastWest-Combined 9 Jan 2014

38) Cross Domain

39) Application Model 19 June 2014

40) Removed

41) 20150413_Q and A_NISS

42) NISS Requirements Repository _v5_1_final

SECTION L - INSTRUCTIONS, CONDITIONS AND NOTICES TO BIDDERS

The following have been added by full text:

HAND DELIVERED LAPTOPS

The Defense Security Service (DSS) will accept hand-delivery of laptops for those Offerors who elect to hand-deliver their laptop as part of their proposal submission in lieu of submitting the laptop via mail delivery. The technical and cost proposals WILL NOT be accepted by hand delivery and must be submitted in accordance with the instructions as specified in Section L of the solicitation.

The information provided in this amendment applies only to hand-delivery of laptop proposals.

These instructions are a supplement to, not a replacement for, the instructions otherwise provided in the solicitation.

Designated Delivery Location:

Defense Security Service Russell-Knox Building (RKB) 27130 Telegraph Road Quantico, VA 22134

Date and Time for Hand-Delivery of Laptops:

Laptops submitted via hand-delivery will be accepted only at the designated delivery location on June 3, 2015, between 8:00am ET and 11:00 am ET.

Information Required Prior to Delivery

The following information MUST be submitted for each individual who is requesting access to the RKB for the purpose of delivering the laptop proposal:

a. First and last name

b. Last 4 digits of social security number

The identifying information stated above must be submitted via email to Shawna Mitchell, shawna.mitchell@dss.mil and Keanna Houston, keanna.houston@dss.mil no later than June 2, 2015 at 11:00 am ET. Requests received after this date will be considered late and may or may not be processed.

There is no guarantee that late requests will be accepted or can be processed in sufficient time to allow clearance for a visitor’s badge prior to the due date for hand-deliveries. The Government assumes no responsibility for failure to receive a visitor’s badge due to a late request.

Packaging of Laptop for Hand-Delivery:

Offerors shall package their laptop submission in the manner as described in section L of the solicitation.

No change will be made to the instructions for the content of the box for the laptop submission as a result of this amendment.

Procedures for Submission of Hand-Delivered Laptop Proposals

Arrival Check-in – On the day designated for hand-delivery of laptops, individuals performing the delivery shall stop at the Visitors Control Center (VCC) located directly outside the gate to RKB to check-in. The VCC staff will verify your information (ensure you have a valid driver’s license and vehicle registration) and provide you with a visitor’s badge. Once you obtain your visitor’s badge proceed through the gate to the RKB parking location as instructed by the VCC staff and proceed to the lobby of RKB. Upon arrival to the lobby of RKB, you may check in at the front desk to provide notification that you are awaiting the Acquisition Representative for submission of your laptop (if you arrive early). If the time for acceptance of laptops has begun, you may locate the Acquisition Representative in the lobby to submit your laptop.

Acceptance of laptops : Acceptance of laptops will be processed in the order of Contractor arrival at RKB (not the VCC), to the maximum extent possible. The Acquisition Representative will provide a confirmation receipt of acceptance. All hand delivered laptops will be x-ray scanned upon receipt.

Timely Submission: A timely submission of a hand-delivered laptop is determined as the Contractor’s representative who is delivering her/his laptop and has arrived in the lobby of the RKB (not the VCC) with the boxed laptop no later than June 3, 2015 at 11:00 am ET. Therefore, it is imperative that the Contractor allow sufficient time to process through the VCC and arrive in the RKB lobby no later than the date and time specified for hand-delivery. Note: for planning purposes only, please allow for a minimum of 30 minutes to process through the VCC as VCC processing times vary.

Early Arrivals: DSS will not begin the acceptance of hand-delivered laptops prior to the time designated in this amendment. If a Contractor arrives at the RKB lobby earlier than the designated time for acceptance of proposals, the Contractor will be required to wait until the time for acceptance to begin and the order of acceptance will be determined as reasonably as possible by the order of first arrival.

Late Hand-Delivery: If a Contractor’s Representative arrives at the RKB lobby after the designated time for acceptance of hand-delivered laptops, it may be considered late and may not be accepted.

All other terms, conditions and instructions for submission of proposals remain unchanged.

PROOF OF CONCEPT DEMONSTRATION

NISS PROOF OF CONCEPT DEMONSTRATION

The Defense Security Service (DSS) will hold Proof of Concept (PoC) demonstrations for those offerors who submit a proposal and laptop by the due date and time for receipt of proposals. The PoC demonstrations will be held on the dates and times listed below. Each offer will be allotted four (4) total hours. The first hour will be allotted for set-up, with the remaining three hours for the PoC demonstration.

1. PoC Demonstration Location:

Russell-Knox Building (RKB) 27130 Telegraph Road

2. Information Required For Access to Russell-Knox Building:

The following information must be submitted for each individual who will attend the PoC demonstration:

c. First and last name

d. Last 4 digits of social security number

The identifying information stated above must be submitted via email to Shawna Mitchell, shawna.mitchell@dss.mil, and Keanna Houston, keanna.houston@dss.mil, no later than June 3, 2015 at 4:00 p.m. ET. There is no guarantee that information submitted late can be processed in sufficient time to allow clearance for a visitor’s badge prior to the start date for demonstrations. The Government assumes no responsibility for failure to receive a visitor’s badge due to a late request.

3. Date and Time for PoC Demonstrations: DSS will hold PoC Demonstrations on the following dates and times:

Date Time

June 8, 2015 8:00 a.m. – 12:00 p.m. ET June 8, 2015 1:00 p.m. – 5:00 p.m. ET

June 9, 2015 8:00 a.m. – 12:00 p.m. ET June 9, 2015 1:00 p.m. – 5:00 p.m. ET

June10, 2015 8:00 a.m. – 12:00 p.m. ET June10, 2015 1:00 p.m. – 5:00 p.m. ET

June 11, 2015 8:00 a.m. – 12:00 p.m. ET June 11, 2015 1:00 p.m. – 5:00 p.m. ET

June 12, 2015 8:00 a.m. – 12:00 p.m. ET June 12, 2015 1:00 p.m. – 5:00 p.m. ET

4. Procedures for Scheduling Proof of Concept Date and Time

a. Ensure you have submitted the identifying information for each attendee by the due date and time as specified in these instructions.

b. Each offeror shall be prepared to present its PoC on any of the dates and times specified above.

However, DSS will put forth its best effort to schedule the demonstration on one of the offerors preferred dates and times, thus offerors may select their top three (3) preferences from the list provided above and email their selections to Shawna Mitchell, shawna.mitchell@dss.mil, and Keanna Houston, keanna.houston@dss.mil no later than June 3, 2015 at 4:00 p.m. ET. DSS will assign demonstration dates/times in the order requests are received. For those offerors who submit a proposal, but do not submit an email requesting a preferred date/time, DSS will select a

PoC demonstration date after all requests have been assigned. All offerors will be notified via email of their assigned date and time no later than June 5, 2015 at 4:00 p.m. ET.

c. Cancellations: In the event an offeror needs to cancel their assigned date/time for the PoC demonstration, provide notification to Shawna Mitchell, shawna.mitchell@dss.mil, and Keanna Houston, keanna.houston@dss.mil as soon as the need to cancel is known.

INSTRUCTIONS TO OFFERORS

L.1. EXCEPTIONS OR CONDITIONS CONTAINED IN OFFEROR'S PROPOSAL.

In the event the offeror takes any exception to, or sets any conditions for its proposal under this solicitation, such exceptions or conditions shall be set forth in a cover letter to offeror's proposal. However, exceptions or conditions may make an offeror’s proposal nonresponsive and ineligible for award.

L.2 ELIGIBILITY.

To be eligible to submit an offer under this Solicitation and receive award, an offeror must meet the following requirements to be awarded the basic contract and Task Order 0001 which shall be awarded concurrently.

L.2.1.1 The National Industrial Security System (NISS) requirement is a critical program necessary for DSS to successfully meet its mission. The Government requires that the contractor's performance begin upon notice to proceed without delay. Therefore, the Contractor shall have at least an Interim facility clearance of SECRET in accordance with the DoD 5220.226M, National Industrial Security Program Operating Manual (NISPOM) at the time of contract award. This requirement applies to any entity that may require access to classified material in the performance of any contract that may result from this solicitation. An offeror in line for award will be ineligible for award if any partner, subcontractor or entity in an offeror’s proposal requiring access to classified does not have the required security clearance at the time of award, and the contract will be awarded to the next eligible offeror.

L2.1.2: In order to access additional technical data associated with this requirement please provide the following information shawna.mitchell@dss.mil and keanna.houston@dss.mil : company name, address, and cage code.

Within one business day, you will receive a user id and password with a link to access the NISS Reading Room for this requirement.

L.3. INTRODUCTION.

Proposals shall be sufficiently detailed to enable the Government to perform an accurate and complete evaluation strictly from the proposal contents. However, in the area of Past Performance the Government may use data obtained from other sources. The offeror’s proposal shall consist of four volumes, and a proof of concept (PoC) contained on a laptop computer.

Volumes I: - Solicitation, Offer and Award Documents, Section K, Representations and Certificates.

Volume II: - Technical Capability, including technical approach and Specialized Experience.

Vol III: - Past Performance, completed table and information contained in these instructions.

Vol IV: - Price/Cost. Completed table and information contained in these instructions to include pricing and deliverables for the NISS IAW SOO Increment 1.

Proposals shall not contain any classified data. The use of hyperlinks in proposals is prohibited.

Each Offeror shall indicate in their proposal the validity of proposals for at least 120 days from the closing date of solicitation, HS0021-15-R-0011.

L.4. PROPOSAL FILES.

a. Format. Microsoft (MS) Office Professional 2007 or later shall be used to create the files. All graphics shall be compatible with MS Suite 2007. All information pertaining to a particular file shall be confined to that file.

The titles for each file, along with the references are shown in table 1 below. Each file shall contain the applicable proposal information in the referenced paragraph. All proposal submissions shall be clearly indexed and logically assembled.

Each volume shall be clearly identified and shall begin at the top of a page. All pages of each volume shall be appropriately numbered and identified by the complete company name, date and solicitation number in the header and/or footer. A Table of Contents shall be created. MS Word (.doc) files shall use the following page setup parameters:

Margins – Top, Bottom, Left, Right - 1” Gutter – 0” From Edge – Header, Footer - 0.5” Page Size, Width – 8.5” Page Size, Height – 11”

The following additional restrictions apply:

Each paragraph shall be separated by at least one blank line. A standard, 12-point minimum font size applies. Arial or Times New Roman fonts are required. Tables and illustrations may use a reduced font size not less than 8-point and may be landscape. Single space type will be used with the exception of organization line and block charts and the Price/Cost proposal. Graphics may be submitted in black & white, half-tone or in color, in font sizes sufficient for all information to be read or reproduced without difficulty (but in no case less than 8 point Arial or Times New Roman). Foldout pages, limited to 11x17 inch page size, are permissible and will count as two pages. Page numbers, headers and footers may be within the page margins ONLY, and are not bound by the font requirements.

Company logos are prohibited with the exception of the Title Page. Pages that exceed the margin, font or total page limit will not be evaluated. Page count will NOT be based upon the numbers of pages printed but rather dictated by the number of pages in a print layout view in the application based upon the above-prescribed document setting.

Counting pages in the order they appear for viewing will make up the page count.

b. File Packaging. Proposals shall be limited to four volumes and delivered on one DVD per volume with a hard copy, bound and delivered as follows:

Table 1

PROPOSAL VOLUME VOLUME CONTENTS PAGE LIMITATION REQUIRED # OF

HARD COPIES

I Solicitation, Offer and

Award Document and Section K, Representations and Certificate

Unlimited Original +1

II Technical Capability, Technical Approach, Staffing Plan & Key Personnel, and Specialized Technical Experience

100 Original +8

III Past Performance 15 Original +3 IV Price/Cost Unlimited Original +1

Note: Cover sheets, Table of Contents, Tab Labels and Dividers are not included in the total page count.

Page Count: Those pages that exceed the page counts in Table 1 for each volume or attachment will not be evaluated. Double column pages are allowed. Proposals shall be limited in the number of pages specified in the table above. Page count will NOT be based upon the numbers of pages printed but rather dictated by the number of pages in a print layout view in the application based upon the above-prescribed document settings.

c. Content Requirements. All information shall be confined to the appropriate proposal volume. The offeror shall confine submissions to essential matters, sufficient to define the proposal and provide adequate basis for evaluation.

Offerors are responsible for including sufficient details, in a concise manner, to permit a complete and accurate evaluation of each proposal. Each file of the proposal shall consist of a Table of Contents and Summary Section.

The Summary Section shall contain a brief abstract of the file. The Government may consider any failure on the part of an offeror to comply with these instructions to be indicative of the type of conduct it can expect during contract performance. Information required for proposal evaluation that is not found in its designated volume or presentation will be assumed to have been omitted from the proposal and the proposal may be considered technically unacceptable and may not be considered for award. Therefore, offerors are encouraged to contact the Contract Specialist, Shawna Mitchell Shawna.Mitchell@dss.mil and the Contracting Officer, Keanna Houston Keanna.Houston@dss.mil, in order to request any necessary clarifications or explanations of these instructions.

Proprietary information shall be clearly marked.

d. Proposals shall include one (1) separately bound copy of Volume I, nine (9) separately bound copies of Volume II. One (1) original and three (3) copies separately bound for Volumes, III and two (2) copies of Volume IV. The proposals shall also include a Digital Versatile Discs (DVDs) submission with limited to the number it takes for you to transfer your entire proposal submission into electronic formats containing all the Volumes. The DVD(s) must be clearly labeled with the solicitation number, volume numbers, and the offeror’s name. Digital copies should be submitted as “read only” (pdf) documents or Microsoft Office Professional 2007 Suite (Excel and Word). If there are discrepancies between the electronic version (DVD) and the hard copy, the hard copy shall take precedence and shall be considered binding.

Offerors are responsible for submitting responses to the Government office designated below by the time specified in the solicitation. Offerors shall submit responses to this RFP along with the supporting documents as required by 2:00 p.m. ET, on June 4, 2015 to Keanna Houston. Any response received after the date/time specified for receipt of offers will be considered "late". It is the responsibility of the offeror to ensure that your response is received in a timely manner. The instructions for hand deliveries for PoC submissions are covered in the PoC Deliveries section.

Please ensure you allow sufficient time for delivery of your proposal. The use of a delivery service with a tracking system is strongly encouraged. Submit your response to this RFP to the following:

ATTN: Keanna Houston

27130 Telegraph Road

R-K BLDG, MCBQ

Email – keanna.houston@dss.mil

Technical Questions - shall be sent via email to shwan.mithcell@dss.mil and keanna.houston@dss.mil with the solicitation number reference in the subject line. All questions must be submitted no later than May 8, 2015 5:00 p.m. E.T. TELEPHONIC INQUIRIES WILL NOT BE ACCEPTED.

e. The proposal shall contain the solicitation number, narrative and other data sufficient to describe the associated element of the proposal. An offeror’s failure to furnish the necessary information may result in its proposal not being considered for award. A proposal received after the solicitation closing time and date will be considered LATE in accordance with FAR 52.215-1, Instructions to Offerors – Competitive Acquisition.

f. The Offeror’s proposal, including the Proof of…