A29 HS002124R0033 0001.pdf

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER (Type or print)

30-105-04EXCEPTION TO SF 30

APPROVED BY OIRM 11-84

STANDARD FORM 30 (Rev. 10-83) Prescribed by GSA

FAR (48 CFR) 53.243

The purpose of Amendment 1 to HS0021-24-R-0033 is to update Sections C and L of the solicitation. This amemdment also extends the response due date from 16 August 2024 to 23 August 2024.

1. CONTRACT ID CODE PAGE OF PAGES

J 1 5

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

16C. DATE SIGNED

BY 15-Aug-2024

16B. UNITED STATES OF AMERICA15C. DATE SIGNED15B. CONTRACTOR/OFFEROR

(Signature of Contracting Officer)(Signature of person authorized to sign)

8. NAME AND ADDRESS OF CONTRACTOR (No., Street, County, State and Zip Code) X HS002124R0033

X 9B. DATED (SEE ITEM 11)

16-Jul-2024

10B. DATED (SEE ITEM 13)

9A. AMENDMENT OF SOLICITATION NO.

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

X The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offer X is extended, is not extended.

Offer must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended by one of the following methods:

(a) By completing Items 8 and 15, and returning 1 copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted;

or (c) By separate letter or telegram which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by telegram or letter, provided each telegram or letter makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

12. ACCOUNTING AND APPROPRIATION DATA (If required)

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS.

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE

CONTRACT ORDER NO. IN ITEM 10A.

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation date, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(B).

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority)

E. IMPORTANT: Contractor is not, is required to sign this document and return copies to the issuing office.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

10A. MOD. OF CONTRACT/ORDER NO.

2. AMENDMENT/MODIFICATION NO. 5. PROJECT NO.(If applicable)

6. ISSUED BY

3. EFFECTIVE DATE

23-Aug-2024

CODE

DCSA - CPO

KARLENE SMITH

27130 TELEGRAPH RD

QUANTICO VA 22134

HS0021 7. ADMINISTERED BY (If other than item 6)

4. REQUISITION/PURCHASE REQ. NO.

CODE

See Item 6

FACILITY CODECODE

EMAIL:TEL:

HS002124R0033

SECTION SF 30 BLOCK 14 CONTINUATION PAGE

SUMMARY OF CHANGES

SECTION C - DESCRIPTIONS AND SPECIFICATIONS

The following have been modified:

SPECIFICATION SHEET

15 August 2024

The Contractor shall provide technical requirements necessary to sustain an ongoing communication and social media tool, utilizing Software as a Service (SaaS) to support the Security Training (ST) Directorate, Center for Development of Security Excellence (CDSE) and their wide range of customers across the federal workforce. The SaaS must be able to provide CDSE with a comprehensive set of email templates and design tools, as well as provide reporting and analytic tools. Additionally, the SaaS must include RSS Feed, web site integration capabilities and the ability to post to social media sites enabling the Government to connect with its target and segmented audiences.

The Contractor and any subcontractors must comply with the following:

1) Defense Federal Acquisition Regulation Supplement (DFARS) Cloud Clause:

General Cybersecurity: The Contractor and all subcontractor(s) shall comply with all applicable laws, regulations, and DoD instructions such as: DoD Cloud Computing Security Requirements Guide (DoD CC SRG), Cloud Service Provider SRG, Federal Information Modernization Security Act (FISMA) of 2002, DoDI 8500.01, DoDI 8510.01, DODI 4140.67, DoDI 5000.82, DoDI 5200.44, DoDI 5200.48, DoDI 5240.24, DoDI 5000.02, DoDI 8320.04, DoDI 8100.04, DoDI 8140.01, DoDI 8530.01, DoDI 8580.01, National Institute of Standards and Technology (NIST) 800- 53 Revision 5, Committee for National Security Instruction (CNSSI) 1253, DoD Federal Acquisition Regulation Supplement (DFARS) Clauses 252.239-7009, 252.239-7010, 252.239-7017, 252.239-7018, 262.246-7007, 252.246- 7008, DFARS Subpart 239.71, 239.76, and Federal Acquisition Regulation (FAR) Clauses 52-204-23, 52.204-24, 52.204-25, and 52.204-26.

2) Penetration Testing: Cloud services are required to undergo annual penetration testing in accordance with the FedRAMP process and the DoD CC SRG.

3) System Network Approval Process (SNAP): Cloud use will be registered in SNAP in accordance with the Defense Information Systems Network (DISN) Connection Process Guide and Joint Force Headquarters-DoD Information Network direction.

4) DoD Instruction 8530.01, "Cybersecurity Activities Support to DoD Information Network Operations," July 25, 2017: Cloud use will be supported by Cybersecurity Service Providers in accordance with DoD Instruction 8530.01.

5) CSP is required to maintain within the 50 states, the District of Columbia, or outlying areas of the United States, all Government data that is not physically located on DoD premises, unless otherwise authorized by the authorizing official, as described in DoD Instruction 8510.01, in accordance with the DoD CC SRG.

The period of performance is for a one-year base period with one (1) one-year option:

Base Year: 9/29/2024-9/28/2025 Option Year 1: 9/29/2025-9/28/2026

The Contractor shall provide SaaS and support to meet the following capabilities:

Administration:

•Allow the Government to export/import all subscriber email addresses.

•Desirable: Allow the Government to export/import subscriber email addresses and preferences.

•Allow Government 10 Account Administrators, 25 Topic Administrators, and unlimited Report Viewers.

•Allow the Government to manage unlimited independent campaigns across email, social, mobile, web, and other channels per year.

•Allow the Government to update, query, and edit email list of subscribers.

•Allow the Government to segment subscribers by email domains (i.e., /mil, gov, .com) and other categories.

•Provide the Government a subscription link or page to its registration website.

Subscribership and Segmentation:

•Allow up to 999,999 users.

•Allow subscriber to select digesting rate (instant, daily, weekly, or monthly alerts).

•Allow subscriber to select interests, preferences, location, and job/roles to drive messaging.

•Allow subscribers to manage all aspects of subscription, including sign-up, opt-out, and other preference settings (such as e-mail, e-mail to SMS wireless, RSS and social media channels), from one location.

Email Management capabilities include:

• Personalized (addresses subscriber by name) and contextually relevant messages.

• Analyzes and predicts open rates and optimal send times based on historical engagement metrics.

• Personalized content on a one-to-one basis based on the rules set for each recipient or group.

• Standard and customizable templates with the ability to import photos/graphics.

• Assured content deliverability as a “trusted sender” (without significant format changes) by complying with the requirements necessary to participate in the DOD/DISA Trusted sender program.

• Allows attachments.

• Ability to simultaneously send text and HTML versions of communications based upon.mil/.gov and all other email addresses.

• All communications will be created with HTML and Text versions.

• Allow the Government to schedule communications distribution.

Content and Retention:

• Allow the Government to create content in accordance with WCAG 2.0 requirements.

• Communications can be created by importing Word and /or Text documents or created directly in the template with editing/formatting capability.

• All data created shall be archived and available for at least 12 months.

• The Government will control all email content to include title and body of email.

Testing:

• Ability to view email A/B tests prior to sending.

• Ability to view from web, mobile and email client perspective prior to sending.

Reporting:

• User-friendly, built-in, or tailored reports to analyze email delivery, engagement data, and success of campaigns.

• Automated on a recurring or ad hoc basis.

• Ability to export to other tools for analysis.

• Detailed and aggregated reports with graphical and raw data outputs.

Helpdesk:

• Maintenance and help desk support for the Government administrators with resolution in 3 business days.

Coverage is expected during normal business hours (8 AM-5 PM), Monday-Friday.

• Service uptime: The Government requires the SaaS be available 99%, excluding scheduled maintenance and upgrades, during the Government core business hours for (6:30 AM-6:30 PM ET). Performance is based on a 30-day monthly period; not to exceed 3 hours and 36 minutes of unscheduled downtime.

• The contractor must provide 24/7/365 monitoring to ensure the SaaS availability and provide emergency support if required by the Government.

Other:

• Maintain infrastructure to effectively handle mass email distribution (10,000+) to targeted segments monthly.

• Provide web-based training for the Government administrators.

• Provide information on SaaS tool/communication best practices and feedback on ways to improve tool usage.

Controlled Unclassified Information (CUI) / Receive, Store, or Generate Controlled Unclassified Information:

Contractor will be provided and will abide by DoD Regulation 5400.7, DoD Freedom of Information Act Program, and DoD 5200.01-M, Information Security Program. Guidance provided under separate cover. In accordance with DoD Instruction 5200.48 (DoDI 5200.48) dated March 6, 2020, Contractors are required to ensure all personnel receive and complete Initial and Annual Refresher CUI education and training and maintain documentation of this training for audit purposes. Initial and Annual Refresher CUI security education, training and awareness on the required topics identified in Section 2002:30 of Title 32 CFR, including protection and management of CUI, to DoD personnel and contractors through CDSE.

OPERATIONS SECURITY (OPSEC) REQUIREMENTS

1. The contractor shall comply with OPSEC requirements contained in the contract, addendum thereto, or identified herein. The contractor will comply with all security and OPSEC policies, directives, instructions or mandates as directed. OPSEC and other security guidance issued to the Prime Contractor shall also apply to subcontractors working on this effort.

2. The contractor will ensure compliance with the Agency’s OPSEC Policy Statement, Critical Information and Indicators List (CIL), and unclassified document destruction procedures. Items of critical information are those facts, which individually, or in the aggregate, reveal sensitive details about the mission, operation, etc., and thus require protection from adversarial collection or exploitation.

3. Include OPSEC as part of the security awareness program. The contractor shall be familiar with OPSEC and will be required to take Government furnished initial and annual refresher OPSEC training and will be reminded of their continued responsibility to protect sensitive information as directed by DoDM 5205.02. Sensitive unclassified information includes, but is not limited to, agency identified critical information, legacy “For Official Use Only” (FOUO), CUI, Privacy Act of 1974, Personally Identifiable Information (PII), Department of Defense Unclassified Controlled Nuclear Information (DoD UCNI) and company proprietary information.

4. The contractor shall take the necessary precautions to ensure employees with access to the sensitive and critical information are instructed not to disclose or disseminate any information relating to the conduct and performance of the contract to any individual not authorized to perform on this contract. Assigned personnel shall be knowledgeable of the designated critical information and measures in place to protect it.

5. For programs protected by a Program Protection Plan (PPP) and have identified Critical Program Information (CPI) and/or Critical Technologies Information (CTI), must be identified and protected in accordance with DoD Instruction 5200.39, CPI Identification and Protection within RDT&E. The contractor shall ensure that any program with CPI or CTI has the corresponding supplements and associated plan, such as an OPSEC plan, approved and in effect in support of the PPP.

6. The contractor shall comply with OPSEC content review policies within the Agency. A content review is an evaluation of all information, to include all CUI, intended for release outside the control of the organization or release to the public. OPSEC focuses on identifying and protecting the organization’s unclassified information that may individually or in the aggregate lead to the compromise of classified information and sensitive activities. The contractor will ensure that these reviews are conducted according to agency guidance in accordance with mandates from DoDD 5205.02E, DoD OPSEC Program, DoDM 5205.02-M, DoD OPSEC Program Manual, DoDI 5230.09, Clearance of DoD Information for Public Release, DoDI 5230.29, Security and Policy Review of DoD Information for Public Release, DoDI 5400.04, Provision of Information to Congress, DoDM 5400.07, DoD FOIA Program, and DoDI 8170.01, Online Information Management and Electronic Messaging.

7. Further OPSEC guidance may be obtained by the Prime contractor contacting the OPSEC PM by group e-mail:

dcsa.quantico.dcsa-hq.mbx.operations-security@mail.mil.

All programs and materials developed at Government expense during the performance period of this contract are the property of the US Government.

Contractor personnel shall utilize US Government or official company e-mail for transmitting official US Government business. Official US Government business shall NOT be transmitted via personal, private, and/or commercial e-mail accounts, i.e., YAHOO, HOTMAIL, GMAIL, JUNO, AOL, COMCAST, KNOLOGY, VERIZON, etc.

SECTION L - INSTRUCTIONS, CONDITIONS AND NOTICES TO BIDDERS

The following have been added by full text:

INSTRUCTIONS TO OFFERORS

This procurement will be awarded on a GSA Multiple Award Schedule per FAR 8.405-1. Offerors must provide their GSA schedule contract number in the response to this proposal.

(End of Summary of Changes)