HSHQDC-15-R-00041_A00001.pdf

(x)

HSHQDC-15-R-00041

x x copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted; or (c) By separate letter or telegram which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGEMENT TO BE RECEIVED AT

THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by telegram or letter, provided each telegram or letter makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

x

Washington DC 20528-0210 245 Murray Lane SW

DHS/OPO/S&T/MSSNSPRT

Department of Homeland Security MGMT/OPO/STAD/Mail Stop 0210 Contracting Officer/W. Mallison U.S. Dept. of Homeland Security

06/25/2015000001

13. THIS ITEM ONLY APPLIES TO MODIFICATION OF CONTRACTS/ORDERS. IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

12. ACCOUNTING AND APPROPRIATION DATA (If required) is not extended.is extended, Items 8 and 15, and returning

Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended, by one of the following methods: (a) By completing

The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offers

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

FACILITY CODE CODE

10B. DATED (SEE ITEM 13)

10A. MODIFICATION OF CONTRACT/ORDER NO.

9B. DATED (SEE ITEM 11)

9A. AMENDMENT OF SOLICITATION NO.

CODE

8. NAME AND ADDRESS OF CONTRACTOR (No., street, county, State and ZIP Code)

7. ADMINISTERED BY (If other than Item 6)CODE 6. ISSUED BY

PAGE OF PAGES

4. REQUISITION/PURCHASE REQ. NO.3. EFFECTIVE DATE2. AMENDMENT/MODIFICATION NO. 5. PROJECT NO. (If applicable)

1. CONTRACT ID CODE

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

05/22/2015

CHECK ONE A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE CONTRACT

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority) appropriation date, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(b).

E. IMPORTANT: Contractor is not, is required to sign this document and return __________________ copies to the issuing office.

ORDER NO. IN ITEM 10A.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

a. Solicitation/Request for Proposal (RFP) HSHQDC-15-R-00041 is amended.

b. Offerors must submit a signed copy of this amendment's first page with their proposals.

It is not necessary to acknowledge receipt of this amendment separately.

c. The due date and time for proposals is not extended. It remains 5:00 PM on Monday July 13, 2015.

d. Proposals shall now be submitted to catherine.collins@hq.dhs.gov.

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)15A. NAME AND TITLE OF SIGNER (Type or print)

15C. DATE SIGNED 16B. UNITED STATES OF AMERICA 15B. CONTRACTOR/OFFEROR 16C. DATE SIGNED

(Signature of person authorized to sign) (Signature of Contracting Officer)

Catherine J. Collins

STANDARD FORM 30 (REV. 10-83)

Prescribed by GSA

FAR (48 CFR) 53.243

NSN 7540-01-152-8070

Previous edition unusable

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

NAME OF OFFEROR OR CONTRACTOR

2 60

CONTINUATION SHEET

REFERENCE NO. OF DOCUMENT BEING CONTINUED PAGE OF

(A) (B) (C) (D) (E) (F)

HSHQDC-15-R-00041/000001

e. The previous version of the solicitation is deleted in its entirety and replaced with the version included in this amendment. Deletions are indicated by strikethrough. Additions are indicated by underline.

f. A questions and answers document accompanies this amendment.

g. The amendment is continued on the following pages.

NSN 7540-01-152-8067 OPTIONAL FORM 336 (4-86)

Sponsored by GSA

FAR (48 CFR) 53.110

HSHQDC-15-R-00041 A00001

Part I – The Schedule

Section B. Services/Supplies and Price/Cost

B.1. Services and Supplies

The contractor shall provide services and incidental supplies in accordance with the Statement of Work (SOW, Section C). Incidentals (which may be categorized as material or other direct costs) are expected to include the following: teleconference hosting, videoconference hosting, Web-hosted meeting applications, and publication printing.

B.2. Contract Type

This is a cost-plus-fixed-fee (term) type contract. See SOW Section VI Level of Effort.

B.3. Contract Value

B.3.1.

The total value of the contract, consisting of estimated cost and fixed-fee for each segment of the period of performance, is the following:

Estimated Cost Fixed-Fee CPFF Total Price Base Year $TBD $TBD $TBD Option Year 1 $TBD $TBD $TBD Option Year 2 $TBD $TBD $TBD Option Year 3 $TBD $TBD $TBD Option Year 4 $TBD $TBD $TBD Total $TBD $TBD $TBD

B.3.2.

The contract obligates $to be determined at award, $to be determined at award of which represents estimated cost and $to be determined at award of which represents fixed-fee.

Performance of this contract is subject to the limitations set forth in FAR 52.232-20 Limitation of Cost.

Section C. Statement of Work

The Statement of Work is imbedded in the following pages.

HSHQDC-15-R-00041 A00001 Page 4 of 61

U.S. Department of Homeland Security Science and Technology Directorate

Cyber Security Division

Statement of Work

Cyber Security Research and Technical Execution Support

I. Background

The Department of Homeland Security (DHS) Science and Technology Directorate (S&T) has the mission to conduct research, development, test and evaluation (RDT&E) and facilitate the timely transition of cyber security capabilities to the DHS Enterprise, which includes operational units within DHS as well as federal, state, local, and critical infrastructure sector operational end-users.

II. Scope of Work

As part of the core DHS mission to safeguard cyberspace, the S&T Cyber Security Division (CSD) requires support for management of its existing technical research programs, research and analysis regarding potential new programs, coordinating and participating in technical experiments and exercises, conducting technical foraging, developing technology and sector roadmaps, conducting test and evaluation, coordinating with private industry and the venture capital community, cyber security subject matter expertise, and stakeholder education. This support will be for current, potential, and proposed CSD R&D projects. CSD requires this support to conduct its research projects, outreach, and stakeholder interaction more effectively and efficiently, and to facilitate delivery of new capabilities and successful technology transfer to customers. The support involves interactions with research teams comprising academia, the private sector, and national laboratories. This requirement is known as “Cybersecurity Research and Technical Execution Support (CRATES).”

III. Tasks

Task 1: Technical Research Program Assistance

Sub-task 1.1: Cyber Security Technical Knowledge

To support CSD program managers, the contractor shall provide knowledgeable contributions in the area of cyber security and understand the technology and science behind the challenges the topic presents. Areas of technical work relating to current CSD programs are the following:

1) Cyber Economic Incentives;

2) Cyber Forensic and Investigative Support;

3) Cyber Physical Systems Security;

HSHQDC-15-R-00041 A00001 Page 5 of 61

4) Cyber Security Competitions;

5) Cyber Security Exercise Technologies;

6) Cyber Security Metrics;

7) Data Privacy;

8) Distributed Denial of Service Defenses;

9) Experimental Testbeds;

10) Pilots and Deployments;

11) Identity Management;

12) Insider Threat Analysis;

13) Internet Measurement and Attack Modeling;

14) Mobile Device Security;

15) Moving Target Defense;

16) Data Repositories;

17) Process Control System Security;

18) Secure Routing;

19) Security of Cloud-based Systems;

20) Software Quality Assurance; and

21) Usable Security.

Future areas of technical interest include but are not limited to the following: Anonymous Networks and Currencies; Application Security Threat Attack Modeling; Cyber Technologies for the Financial Sector; Cyber Security Education; Critical Infrastructure Systems (including automotive and aviation); Data Provenance; Static Tool Analysis; and Technical Industry Consortiums.

The contractor must have technical knowledge in the 21 areas listed above as well as the future areas of technical interest. The contractor must understand the state of the art in cyber security.

The contractor must, likewise, understand the research and development (R&D) landscape.

Finally, the contractor must have knowledge and capability in technology transition; this aspect is where venture capital knowledge is crucial.

Additional information can be found at: http://www.dhs.gov/science-and-technology/cyber-security-division.

The contractor shall support CSD program managers in CSD’s researching and creating new cyber security programs. The contractor’s support will include providing periodic assessments on new and evolving cyber security technologies, new uses for existing technology, new challenges and applications in cyber security, and how cyber security technologies or solutions can address future gaps and needs.

The contractor shall also provide program analysis, evaluation, and recommendations through reports and presentations. This information shall be included in the quarterly technical reports, quarterly program reviews, and annual reports. The contractor shall provide training, intended to educate CSD principal investigators and cyber security stakeholders, including CSD and other federal program managers, about innovation characterization and creation, research presentation skills, and transition strategies [these topics are not descriptive].

HSHQDC-15-R-00041 A00001 Page 6 of 61 http://www.dhs.gov/science-and-technology/cyber-security-division http://www.dhs.gov/science-and-technology/cyber-security-division

Sub-task 1.2: Developing Technology and Sector Roadmaps

The contractor shall support CSD in developing cyber security technology and sector roadmaps, identifying R&D needs. In doing so, the contractor shall support CSD in CSD’s engaging businesses and organizations in the transportation (including aviation, automotive, cargo, maritime, mass transit, and pipelines), financial services, chemical, energy (electricity and oil & gas), information technology, telecommunications, and water sectors. Engagements with other sectors are possible. The contractor will never be a representative of the government, and its employees and will identify their employer. The contractor personnel must have sector specific technical knowledge, are required to effectively perform this task.

The contractor shall prepare a summary report from each roadmap or similar document supported. This shall be included in the quarterly technical report.

Sub-task 1.3: Technical Exchange Meetings

The contractor shall support CSD in engaging the academic, business, and government research communities through technical exchange meetings. CSD expects to use such engagements to develop S&T’s R&D agenda, to gather technical ideas prior to S&T issuing a Broad Agency Announcement, report progress on existing research projects, and to conduct testing, experimentation, pilots, and deployment. The contractor will never be a representative of the government, and its employees and will identify their employer.

When CSD identifies the need for a technical exchange meeting, the contractor shall submit its proposed plan for the meeting by providing the following information to the COR as far in advance as possible:

• The purpose of the technical exchange meeting

• Location of the technical exchange meeting (If the location is other than the contractor’s own facilities, the contractor must explain which facilities it considered and why it selected the location. The contractor must consider available government facilities.)

• Anticipated dates

• Anticipated list of attendees and participants

• Itemized expected expenditures for the technical exchange meeting

See Section H.6 Approval of Conferences for restrictions on and procedures for meetings that constitute conferences.

The contractor shall prepare a summary report from each technical exchange meeting. This shall be included in the quarterly technical report.

Sub-task 1.4: New Start Support

It is critical for CSD program managers to be aware continuously of cyber security-related technological developments and to consider new needs, gaps, and requirements for cyber security applications. The contractor shall support CSD program managers in researching and creating new cyber security programs.

HSHQDC-15-R-00041 A00001 Page 7 of 61

The contractor’s support shall take the form of researching and providing periodic input on new and evolving cyber security technologies, new uses for existing technology, new challenges and applications in cyber security, and how cyber security technologies or solutions can address future gaps and needs. Once CSD determines that a new start is appropriate and necessary, the contractor shall also support the planning and development of materials needed to initiate the new start.

Based on their technical knowledge, the contractor shall prepare a summary report for new technologies and applications under consideration as new starts, and shall detail the progress on each new start underway, based upon project documentation and technical meetings. This shall be included in the quarterly technical report.

Sub-task 1.5: Program Analysis and Evaluation

The contractor shall prepare and submit an annual analysis report of the R&D projects that DHS S&T funds. This analysis would include the value proposition, technology content, and transition strategy. This report shall be based on presentations at the annual CSD principal investigator meeting, project or program specific principal investigator meetings, performer site visits, performer presentations at workshops or conferences, and delivered reports from the principal investigators. The contractor shall consult with the COR to determine which CSD projects will be included in the annual analysis report.

Sub-task 1.6: Performer and Stakeholder Education

To improve the likelihood of transition of technologies, it is vital that CSD’s principal investigators and stakeholders are prepared and capable of making an impact in transitioning their technologies. The contractor shall prepare and conduct up to four courses annually to assist principal investigators and cyber security stakeholders in innovation characterization, presentation effectiveness, and technology transition efforts. The contractor shall prepare a summary report after conducting each course. This shall be included in the quarterly technical report.

Task 2: R&D Interaction

As part of establishing and implementing its cyber security research and development program, S&T CSD will coordinate its activities with other parts of DHS (e.g. National Cyber Security Division, United States Computer Emergency Readiness Team, National Cyber Security Center, Federal Law Enforcement Training Center, U.S. Secret Service, Privacy Working Group, and other organizations) as well as other government agencies and entities (e.g. Treasury Department, Commerce Department, Defense Department, Energy Department, and National Science Foundation) and state and local chief information security officers and law enforcement.

The contractor shall support CSD with these interactions through technical meetings. The contractor will never be a representative of the government, and its employees will identify their employer.

HSHQDC-15-R-00041 A00001 Page 8 of 61

See Section H.6 Approval of Conferences for restrictions on and procedures for meetings that constitute conferences.

The contractor shall prepare a summary report from each interaction or meeting. This shall be included in the quarterly technical report.

Task 3: R&D Experimentation

CSD is working with other government agencies, such as the National Science Foundation, to create testbeds for cyber security technologies. When possible, research prototypes developed by DHS-funded researchers are tested using these government-funded testbeds. The contractor shall support CSD in testing research prototypes using such testbeds. The contractor shall coordinate and prepare for such testing. The contractor shall assist with the design and management of such testing. The contractor shall similarly support CSD’s pilot deployments.

In addition, CSD is working with other government agencies and external entities (academia, private sector, national labs, and international partners) to demonstrate cyber security research and development capabilities and results. S&T CSD will sponsor and participate in various experiments and exercises to demonstrate the technical capabilities of the DHS-funded research products. These experiments are expected to occur on a range of supporting environments, including DHS-funded testbeds, facilities funded by other government agencies, networks supporting research and experimentation, lab facilities, and production networks in experimental and controlled deployment settings.

The contractor shall support CSD in its interactions with these other government agencies and external entities while creating, managing, and scheduling these testbeds. The contractor shall also support experiments, pilot deployments, development of exercises, and participation in competitions. The contractor shall support technical evaluation meetings and program coordination. The contractor will never be a representative of the government, and its employees and will identify their employer.

See Section H.6 Approval of Conferences for restrictions on and procedures for meetings that constitute conferences.

The contractor shall prepare a summary report from each experiment or interaction. This shall be included in the quarterly technical report.

Task 4: Private Industry Outreach

The contractor shall support CSD in working with the private sector to develop partnerships and leverage industry participation in government R&D. The contractor shall assist CSD in organizing and conducting meetings with the private sector. Industry owns large portions of the relevant infrastructure, and these partnerships will help ensure that resulting research can be transitioned and used in the private sector.

HSHQDC-15-R-00041 A00001 Page 9 of 61

Such organizations and events include Sector Coordinating Councils, the Industrial Control Systems Joint Working Group, the Scientific Working Group on Digital Evidence, the Federal Mobile App Security Vetting Working Group, Linking the Oil and Gas Industry to Improve Cyber Security, Automotive Industry Consortia Technology Transition Working Groups, the Security Innovation Network, the Infosec Technology Transition Council, and the Software Supply Chain Assurance Working Group.

See Section H.6 Approval of Conferences for restrictions on and procedures for meetings that constitute conferences.

The contractor shall prepare a summary report from each meeting or interaction. This shall be included in the quarterly technical report.

Task 5: Research Support

The contractor shall perform technology seedlings specific to areas of CSD research in which the contractor has particular capabilities. Such seedlings are small-scale R&D efforts complementing existing R&D projects. The number, size, duration, and timing of these seedlings are discretionary and will be specifically approved by the Contracting Officer’s Representative (COR) based on direction from CSD leadership. The magnitude of effort on this task will not exceed 10% of the total Statement of Work.

The contractor shall prepare a summary report from each seedling completed. This shall be included in the quarterly technical report.

Task 6: Media

An important part of transitioning technologies is creating awareness about the technologies. An effective way to create awareness is to distribute videos about the technologies and the sector or industry that they can impact. The contractor shall produce such videos depicting successful CSD R&D projects, transition efforts, and their realized or potential impacts on cyber security.

The COR will identify the purpose and requirements for each video that is needed, and the contractor shall provide a plan for each video, including a cost estimate. The COR shall approve the video plan before the contractor commences work on it. Videos will be limited to not more than five per contract year.

The contractor shall develop creative proposals, make story boards, write scripts, and conduct interviews. The contractor shall capture b-roll footage, edit the video, edit the sound, draft videos and associated edits, do all post-production, and make final edits. The contractor shall work with CSD to get approval from DHS S&T’s Office of Corporate Communications and Office of Public Affairs before producing any media material.

The contractor shall deliver digital copies in .mp4, and .flv format, and also deliver .srt files with the associated .mp4 digital copy. The .flv file shall have closed captioning included.

HSHQDC-15-R-00041 A00001 Page 10 of 61

The contractor shall also deliver 50 copies of the DVDs and a master copy of the DVD (each with closed caption on/off option) for CSD reproduction purposes. All videos produced must be Section 508 compliant (See SOW Section XI).

Transition

The government requires the contractor to transition its duties and knowledge formally to a new performer, if any. The contractor shall archive established workflows and processes, as well as the documentation that is created for CSD under this contract. This documentation shall be passed on to a successor contractor during the transition period.

No later than 120 days before the end of the period of performance, the contractor shall submit a transition plan to the contracting officer and COR. The transition plan will describe how the contractor will minimize disruption to the performance of work as it winds down performance and a new performer commences performance. If there is no new performer, the transition plan is not needed. The transition plan will address and include the following:

• Knowledge transfer to the new performer

• Timeline to phase-out current activities

• Any possible disruptions that may be experienced in the transition, and approaches to avoid or mitigate them

No later than 60 days before the end of the period of performance, the contractor, under the supervision of the relevant government security and IT offices, shall update all access credentials (including usernames, passwords, other account information, access tokens, etc.), if any, which are regularly used by the contractor to perform the work. The contractor shall walk CSD through the processes of gaining access to all equipment, software, and accounts, if any, used in the performance of this Statement of Work. The government intends to provide these access credentials, if any, to the new performer during the transition period. The contractor shall ensure that all materials and documents created or developed under the contract are transferred and under the possession of the government. This includes files and materials developed by subcontractors and email distribution lists.

IV. Facilities

The contractor must have office locations in the Washington, DC and Silicon Valley, CA areas in order to facilitate CSD interactions with cyber security companies and the venture capital community.

The Washington, DC area is defined as meaning the District of Columbia; the cities of Alexandria, Falls Church, and Fairfax, VA; the counties of Arlington and Fairfax, VA; and the counties of Montgomery and Prince George’s, MD. A Washington, DC presence is critical to interacting with government stakeholders.

The Silicon Valley area is defined as meaning the area between Redwood City (westernmost bound) and San Jose (easternmost bound) and including the cities of Menlo Park, Palo Alto, Mountain View, and Sunnyvale as well as other towns and unincorporated areas.

HSHQDC-15-R-00041 A00001 Page 11 of 61

Silicon Valley is where the vast majority of cyber security research takes place, and where the vast majority of the technology venture capital industry is located. A Silicon Valley presence is critical to interacting with those stakeholders. DHS is establishing an office in Silicon Valley, CA; S&T will have a presence in that office, but it will not provide technical research support to CSD. This facility is expected to include office and meeting space for up to 10 people. This SOW requires technical support for the CSD programs and part of the outreach and transition for those programs requires an additional presence in Silicon Valley that can accommodate larger numbers of people. S&T personnel in the DHS Silicon Valley office will interact with the contractor and be included on deliverables and technical reports as directed by the COR.

One of the contractor’s offices must include meeting space for up to 100 people, and the other facility must include meeting space for up to 75 people. Most of the meetings, described in the above tasks, are expected to be conducted at these two locations.

It is anticipated that Task 2 and Task 3 will primarily be performed in the Washington, DC facility. It is anticipated that Task 4, Task 5, and Sub-task 1.6 will primarily be performed in the Silicon Valley facility. It is anticipated that Sub-tasks 1.1, 1.2, 1.3, 1.4, and 1.5 and Task 6 could be performed at either facility.

Both offices should have industry standard audio-visual and presentation equipment adequate to facilitate presentations to the numbers of meeting attendees described herein. This equipment shall include teleconference hosting, videoconference hosting, and WebEx or similar Web-hosted meeting capability. Both offices should have adequate projects and screens to display presentations. Both offices should have white boards.

V. Deliverables

The following deliverables are due on recurring bases, through each contract year:

Ref. Deliverable Format Due All Kick-off Meeting Attendance Within 30 days of contract award All Monthly Financial

Report Word or PDF, submitted by email

15th day of the month, covering previous month; delivery constitutes acceptance

All Quarterly Technical Report

Word or PDF, submitted by email

15th day of the month, covering previous quarter; delivery constitutes acceptance

1.5 Annual Analysis

Report on CSD R&D projects

Word or PDF, submitted by email

60 days after the yearly CSD PI meeting takes pace, covering previous year; delivery constitutes acceptance

1.6 Courses

(Up to four each contract year)

Teaching course;

providing summary in Quarterly Technical Report

Each course conducted within 30 days after COR tasking; COR will provide email acceptance within 3 days after each course taught

HSHQDC-15-R-00041 A00001 Page 12 of 61

7 Videos

(Up to five each contract year)

Digital copies in .mp4, .flv, .srt; 50 DVD copies and one master DVD

Due date for each course will be set when it is tasked; COR will accept in writing within 3 days after final delivery

Kick-off Meeting

The contractor will attend a kick-off meeting within 30 days of contract award. The kick-off meeting will be held at S&T headquarters in Washington, DC. The contractor’s Cyber Security Research Program Manager (principal investigator), contracts administrator, and any relevant corporate personnel directing the effort shall attend. Attendance will constitute delivery and acceptance.

Monthly Financial Report

The Monthly Financial Report describes actual expenditures over the previous month, actual cumulative expenditures for the present contract year, and actual cumulative expenditures since contract award. The Monthly Financial Report also projects expenditures for the upcoming month and for the remainder of the present contract year. Actual and projected expenses should be tracked and group by type, including direct labor, other direct, other indirect, subcontracts, travel, and ODC/material. The report should indicate which task(s) subcontracts are applicable to, and include a breakdown of costs paid to the subcontractor during the invoice period including all fully loaded direct labor, other direct, and travel costs.

Quarterly Technical Report

The Quarterly Technical Report describes technical activities over the previous quarter (three months). The Quarterly Technical Report must include technical progress achieved against goals, difficulties encountered, risks identified, risk mitigation, and plans for the next quarter.

The Quarterly Technical Report shall individually address each task in this SOW’s Section III, and include the following:

• Status of specific objectives identified in the last quarter

• Indicate if each objective was or was not accomplished

• For each objective not accomplished, detail current status of the objective

• Explain objectives planned to be completed during the next quarter (dynamic objectives not necessarily long term milestones; state specific and measurable objectives rather than simple declarations of continued or sustained efforts)

• Technical accomplishments made during this reporting period

• Report the deliverables submitted during this reporting period including deliverable name, description, and date of submission

• Each meeting, presentation, or interaction held or attended during the period, including its name, purpose, summary of attendees, location, start and date dates/times, and presentations made

• Summarize technical, programmatic, and other issues or concerns as well as recommended actions for government consideration

HSHQDC-15-R-00041 A00001 Page 13 of 61

• Planned activities for next reporting period

The Quarterly Technical Report includes roll-ups summarizing activity in the following tasks.

Each summary of an individual element (a roadmap, meeting, technology, course, or seedling) should not exceed two pages:

• Sub-task 1.2: Developing Technology and Sector Roadmaps – A summary report from each roadmap or similar document supported.

• Sub-task 1.3: Technical Exchange Meetings – A summary report from each technical exchange meeting.

• Sub-task 1.4: New Start Support – A summary report for new technologies and applications under consideration as new starts, and detailing the progress on each new start underway.

• Sub-task 1.6: Performer and Stakeholder Education – A summary report after conducting each course.

• Task 2: R&D Interaction – A summary report from each interaction or meeting.

• Task 3: R&D Experimentation – A summary report from each experiment or interaction.

• Task 4: Private Industry Outreach – A summary report from each meeting or interaction.

• Task 5: Research Support – A summary report from each seedling completed.

Annual Analysis Report of CSD R&D Projects

The Annual Analysis Report on CSD R&D Projects should describe the contractor’s assessment of the current state of R&D project, that the contractor has been tasked to support during the past year. The Annual Analysis Report is due within 60 days of CSD’s yearly principal investigators meeting, which typically takes place in December, January, or February. If the principal investigators meeting does not take place, for whatever reason, the COR will provide an alternate due date. The Annual Analysis Report will cover project activities during the previous 12 months. In the report the contractor shall assess the following:

• The current state of technical field in which the project fits;

• The project’s relevance in the context of the current state of the technical field;

• The project’s effectiveness in advancing CSD’s overarching mission and the specific requirements, gaps, and roadmaps;

• The project’s likelihood to achieve success;

• Whether the project is duplicating other government R&D efforts;

• How the project aligns with other projects in government and academia with similar subject matter, including collaboration and transition opportunities;

• Recommendations for the project;

• Transition strategies for the project, as applicable;

HSHQDC-15-R-00041 A00001 Page 14 of 61

VI. Level of Effort

Throughout the period of performance the contractor shall devote no less than the following level of effort to performing this Statement of Work: seven full-time-equivalents (FTEs). The level of effort may be achieved through any combination of prime contractor employees or subcontractors.

VII. Personnel

The tasks described in Section III above will be performed by the following labor categories:

Cyber Security Research Program Manager (one FTE)

Duties: Responsible for the overall management of contractor personnel at all locations.

Oversees all technical efforts as well as contract and financial administration. Monitors and forecasts budgets and spending, works with the COR to allocate personnel resources to specific needs, reviews and monitors deliverables and task schedules, organizes and leads contract program reviews, and coordinates with COR and other CSD personnel as applicable to address all concerns or issues.

Relevant tasks: all

Education Requirements:

• Bachelor’s degree in a cyber security, computer science, information technology, electrical engineering, or related discipline

• Master’s degree or higher in a Science, Technology, Engineering, or Math (STEM) field or business; or J.D.

Experience Requirements:

• At least five years of program or project management experience

• At least five years of technical cyber security experience

• At least five years of experience in an R&D environment or with R&D projects

Note: Experience requirements for this and all following labor categories need not be discrete;

relevant experience in different areas could have been gained from the same position. For example, a contractor could employee could have worked for five years as a program manager of an R&D effort.

Cyber Security Subject Matter Expert (four FTEs)

Relevant tasks: 1.1; 1.2; 1.3; 1.4; 1.5; 1.6; 2; 3; 4; 5

Education Requirement: PhD in cyber security, computer science, information technology, electrical engineering, or related discipline

HSHQDC-15-R-00041 A00001 Page 15 of 61

Experience Requirements:

• At least five years of experience in an R&D environment or with R&D projects

• At least 10 years of technical cyber security experience

• Experience in at least four of the cyber security areas listed in Sub-task 1.1 above; among the four Cyber Security Subject Matter Experts, experience in at least 16 distinct cyber security areas listed in Sub-task 1.1 above is required or

Education Requirement: Master’s degree in cyber security, computer science, information technology, electrical engineering, or related discipline

Experience Requirements:

• At least five years of experience in an R&D environment or with R&D projects

• At least 15 years of technical cyber security experience

• Experience in at least four of the cyber security areas listed in Sub-task 1.1 above; among the four Cyber Security Subject Matter Experts, experience in at least 16 distinct cyber security areas listed in Sub-task 1.1 above is required

Junior Cyber Security Subject Matter Expert (two FTEs)

Relevant tasks: 1.1; 1.2; 1.3; 1.4; 1.5; 2; 4

Education Requirement: PhD in cyber security, computer science, information technology, electrical engineering, or related discipline

Experience Requirements:

• At least five years of experience in an R&D environment or with R&D projects

• At least five years of technical cyber security experience

• At least two years of experience working in an IT operations environment

• Experience in at least four of the cyber security areas listed in Sub-task 1.1 above;

between the two Junior Cyber Security Subject Matter Experts, experience in at least 8 distinct cyber security areas listed in Sub-task 1.1 above is required or

Education Requirement: Master’s degree in cyber security, computer science, information technology, electrical engineering, or related discipline

Experience Requirements:

• At least five years of experience in an R&D environment or with R&D projects

• At least 10 years of technical cyber security experience

• At least two years of experience working in an IT operations environment

• Experience in at least four of the cyber security areas listed in Sub-task 1.1 above;

between the two Junior Cyber Security Subject Matter Experts, experience in at least 8 distinct cyber security areas listed in Sub-task 1.1 above is required

HSHQDC-15-R-00041 A00001 Page 16 of 61

Research Analyst (less than one FTE)

Relevant tasks: 1.4; 5

Education Requirement: Master’s degree or higher in a STEM field

Experience Requirements:

• At least two years of experience in an R&D environment or with R&D projects

• At least two years of technical cyber security experience

Technical Editor/Writer (less than ½ FTE)

Relevant tasks: 1.2; 1.4; 1.5; 6

Education Requirement: Bachelor’s degree in English, Journalism, Literature, Communications, Writing, or related discipline

Experience Requirements:

• At least five years of experience as a technical writer or editor

• Demonstrated experience working in a technical environment

Administrative Support Specialist (less than ½ FTE)

Relevant tasks: 1.3; 1.6; 2; 4

Education Requirement: Bachelor’s degree in any discipline

Experience Requirements:

• At least two years of experience providing administrative support in a technical environment

• At least two years of experience scheduling and coordinating meetings

Media Specialist (less than one FTE)

Relevant task: 6

Experience Requirements:

• At least five years of experience creating and producing videos

• Demonstrated experience creating videos for a technical organization or of technical subject matter

HSHQDC-15-R-00041 A00001 Page 17 of 61

VIII. Access to Additional Technical Expertise

The contractor shall provide additional technical expertise to accomplish the tasks described in Section III, when directed by the COR. This technical expertise will typically be in related areas of cyber security not explicitly covered by a labor category in Section VII.

This technical expertise may also be in one of the same areas covered by a labor category in Section VII, but in greater magnitude than is normally needed. Some of these experts may be subcontractors needed on a limited-term basis. Additional technical expertise will not exceed 25% of the level of effort stipulated in Section VI.

When tasking the contractor to provide expertise under this section, the COR will outline via email (copying the administering contracting officer) the nature of the expertise, its magnitude in terms of number of people or duration, where it is needed, and any other pertinent information.

After the COR identifies a need for additional technical expertise, the contractor shall provide the services within 60 days. If a subcontract is involved; see FAR 52.244-2 Subcontracts in Section I.1.

IX. Travel

Travel, both within and outside of the local area, will be required. The meaning of local travel is defined in the Federal Travel Regulation (FTR); it will not be reimbursed. Travel is subject to advance government approval, by the administering contracting officer or COR. The contractor shall request all travel in writing via email and provide the names of individuals traveling, dates, destinations, purpose, and estimated costs. Travel outside of the defined local area will be reimbursed in accordance with the limits set forth in FAR Part 31 and the FTR. Travel expenses will be minimized, to the maximum extent possible, by taking advantage of discounted airfare rates available through advance booking.

X. Security

Category of Safeguarded Information

This contract involves information that is CLASSIFED at the SECRET level and the TOP SECRET levels, and information that is SENSITIVE BUT UNCLASSIFIED, FOR

OFFICIAL USE ONLY (FOUO).

At least one contractor facility shall provide some portion of office, meeting, and storage space that meets requirements for operating up to the SECRET level. Classified information may be stored at this contractor facility only, not any other contractor facility.

Classified information requires protection in accordance with Executive Order 13526, Classified National Security Information, and supplementing directives.

HSHQDC-15-R-00041 A00001 Page 18 of 61

Position Security Designations and Information Handling

Work on this contract cannot be performed unless the contractor personnel assigned to the labor categories are cleared at the appropriate levels as identified below:

Labor Category Security Clearance Level Cyber Security Research Program Manager Secret

Cyber Security Subject Matter Expert Top Secret Cyber Security Subject Matter Expert Top Secret Cyber Security Subject Matter Expert Secret Cyber Security Subject Matter Expert Unclassified

Junior Cyber Security Subject Matter Expert Unclassified Research Analyst Unclassified

Technical Editor/Writer Unclassified Administrative Support Specialist Unclassified

Media Specialist Unclassified

All work performed under this task order should be considered unclassified unless specified otherwise. When classified work is required, DHS will provide specific guidance to the contractor.

The contractor shall adhere to all applicable government laws, regulations, orders, guides, and directives pertaining to classified, Sensitive But Unclassified, FOUO, or personally identifiable information. The contractor shall safeguard Sensitive But Unclassified, FOUO information specifically in accordance with DHS Management Directive 11042.1.

The contractor shall establish and implement appropriate administrative, technical, and physical safeguards to ensure the security and confidentiality of classified and sensitive government information, data, and/or equipment. If contractor personnel are ever uncertain about the handling or treatment of any information or data, they shall consult the COR.

Prior to performing work, all contractor personnel accessing classified information or receiving proximity passes to work regularly on-government-site must complete the suitability check process.

All contractor personnel must execute non-disclosure agreements (NDA, DHS Form 11000-6).

All contractor personnel accessing DHS IT systems will be required to take DHS security awareness training and IT system rules of behavior training when performance of the contract commences, and thereafter. Contractors will significant security responsibilities may be required to receive specialized training. All personnel who access government IT systems will be monitored in their use. Any unauthorized access, sharing of passwords, or other questionable security procedures should be reported to the local Security Office or Information System Security Officer.

A DD Form 254 will be completed and incorporated into the contract.

HSHQDC-15-R-00041 A00001 Page 19 of 61

Security ID Requirements

Contractor personnel assigned to work at DHS facilities may be issued a proximity pass (also known as PIV card or “badge”) that permits unescorted entry to the facilities without going through a daily visitor access process. Contractor personnel may also be granted certain other privileges such as email accounts and access to DHS information systems.

The proximity pass application will be obtained through the COR or as directed by the contracting officer. The contractor shall provide the COR written notice when all proximity passes have been processed and received. This card is in addition to contractor provided IDs.

This access shall be provided solely at the discretion of DHS, and may be revoked or withdrawn at any time, without notice or cause, by the COR or Contracting Officer. The contractor shall report in writing to the COR to request all personnel access to DHS facilities, email accounts, and information systems be terminated if:

• At any time during the term of this contract, contractor personnel issued a DHS pass or granted access to DHS email or any other DHS information system no longer require any further access; and/or

• At the completion, expiration, or termination of any such contract where access has been granted. Contractor personnel will be considered not to require access to DHS facilities for work performance upon expiration of this contract.

The contractor shall prepare and maintain a roster of its employees (both former and current) that have had proximity passes issued in their names at any time during the term of this contract.

This roster shall be submitted monthly, prior to the last day of each month, to the COR, or on request by the COR. The contractor may submit this report with the monthly progress report.

Each contractor employee shall have the proximity pass and contractor ID in his/her possession at all times when in the government facility. The employee shall surrender the proximity pass to the COR or issuing office at the end of employment, upon completion of this contract, or upon expiration of the form, whichever is sooner.

Contractor personnel must report the loss of a proximity pass or other government ID as soon as possible to the COR or issuing office. Report the same day if lost during duty hours and by 9:00 a.m. the next workday if lost during non-working hours.

XI. Accessibility Requirements (Section 508)

Section 508 of the Rehabilitation Act, as amended by the Workforce Investment Act of 1998 (P.L. 105-220) requires that when federal agencies develop, procure, maintain, or use electronic and information technology (EIT), they must ensure that it is accessible to people with disabilities. Federal employees and members of the public who have disabilities must have equal access to and use of information and data that is comparable to that enjoyed by non-disabled federal employees and members of the public.

HSHQDC-15-R-00041 A00001 Page 20 of 61

All EIT deliverables within this work statement shall comply with the applicable technical and functional performance criteria of Section 508 unless exempt. Specifically, the following applicable EIT accessibility standards have been identified:

• 36 CFR 1194.21 Software Applications and Operating Systems, applies to all EIT software applications and operating systems procured or developed under this work statement including but not limited to GOTS and COTS software.

In addition, this standard is to be applied to Web-based applications when needed to fulfill the functional performance criteria. This standard also applies to some Web based applications as described within 36 CFR 1194.22.

• 36 CFR 1194.22 Web-based Intranet and Internet Information and Applications, applies to all Web-based deliverables, including documentation and reports procured or developed under this work statement. When any Web application uses a dynamic (non-static) interface, embeds custom user control(s), embeds video or multimedia, uses proprietary or technical approaches such as, but not limited to, Flash or Asynchronous Javascript and XML (AJAX) then 1194.21 Software standards also apply to fulfill functional performance criteria.

• 36 CFR 1194.23 Telecommunications Products, applies to all telecommunications products including end-user interfaces such as telephones and non end-user interfaces such as switches, circuits, etc. that are procured, developed or used by the federal government.

• 36 CFR 1194.24 Video and Multimedia Products, applies to all video and multimedia products that are procured or developed under this work statement.

Any video or multimedia presentation shall also comply with the software standards (1194.21) when the presentation is through the use of a Web or Software application interface having user controls available.

• 36 CFR 1194.25 Self Contained, Closed Products, applies to all EIT products such as printers, copiers, fax machines, kiosks, etc. that are procured or developed under this work statement.

• 36 CFR 1194.26 Desktop and Portable Computers, applies to all desktop and portable computers, including but not limited to laptops and personal data assistants (PDA) that are procured or developed under this work statement.

• 36 CFR 1194.31 Functional Performance Criteria, applies to all EIT deliverables regardless of delivery method. All EIT deliverable shall use technical standards, regardless of technology, to fulfill the functional performance criteria.

• 36 CFR 1194.41 Information Documentation and Support, applies to all documents, reports, as well as help and support services. To ensure that documents and reports fulfill the required 1194.31 Functional Performance Criteria, they shall comply with the technical standard associated with Web-based Intranet and Internet Information and

HSHQDC-15-R-00041 A00001 Page 21 of 61

Applications at a minimum. In addition, any help or support provided in this work statement that offer telephone support, such as, but not limited to, a help desk shall have the ability to transmit and receive messages using TTY.

Section 508 Applicable Exceptions

Exceptions for this work statement have been determined by DHS and only the exceptions described herein may be applied. Any request for additional exceptions shall be sent to the COTR and determination will be made in accordance with DHS MD

4010.2. DHS has identified the following exception(s) that may apply:

• 36 CFR 1194.3(b) Incidental to Contract, all EIT that is exclusively owned and used by the contractor to fulfill this work statement does not require compliance with Section 508.

This exception does not apply to any EIT deliverable, service or item that will be used by any Federal employee(s) or member(s) of the public.

This exception only applies to those contractors assigned to fulfill the obligations of this work statement and for the…