HSHQDC-15-R-00041.pdf

HSHQDC-15-R-00041

SOLICITATION, OFFER AND AWARD

4. TYPE OF SOLICITATION2. CONTRACT NUMBER 3. SOLICITATION NUMBER

7. ISSUED BY CODE 8. ADDRESS OFFER TO (If other than Item 7)

ORDER UNDER DPAS (15 CFR 700)

6. REQUISITION/PURCHASE NUMBER

NOTE: In sealed bid solicitations "offer" and "offeror" mean "bid" and "bidder".

NEGOTIATED (RFP)

SEALED BID (IFB)

5. DATE ISSUED

1. THIS CONTRACT IS A RATED RATING PAGE OF PAGES

1 61

C. E-MAIL ADDRESS

EXT.NUMBERAREA CODE

B. TELEPHONE (NO COLLECT CALLS)A. NAME

10. FOR

INFORMATION

CALL:

CAUTION: LATE Submissions, Modifications, and Withdrawals: See Section L, Provision No. 52.214-7 or 52.215-1. All offers are subject to all terms and conditions contained in this solicitation.

(Date)(Hour) local timeuntildepository located in copies for furnishing the supplies or services in the Schedule will be received at the place specified in Item 8, or if hand carried, in the

SOLICITATION

9. Sealed offers in original and

PART IV - REPRESENTATIONS AND INSTRUCTIONS

OTHER STATEMENTS OF OFFERORS

EVALUATION FACTORS FOR AWARD

INSTRS., CONDS., AND NOTICES TO OFFERORS

REPRESENTATIONS, CERTIFICATIONS AND

LIST OF ATTACHMENTS

CONTRACT CLAUSES

PART III - LIST OF DOCUMENTS, EXHIBITS AND OTHER ATTACH.

I

J

K

L

M SPECIAL CONTRACT REQUIREMENTS

CONTRACT ADMINISTRATION DATA

DELIVERIES OR PERFORMANCE

INSPECTION AND ACCEPTANCE

PACKAGING AND MARKING

DESCRIPTION/SPECS./WORK STATEMENT

SUPPLIES OR SERVICES AND PRICES/COSTS

SOLICITATION/CONTRACT FORM

PART II - CONTRACT CLAUSESPART I - THE SCHEDULE

H

G

F

E

D

C

B

A

SEC. DESCRIPTION PAGE(S) (X) DESCRIPTION SEC. (X)

11. TABLE OF CONTENTS

18. OFFER DATE17. SIGNATURE

SUCH ADDRESS IN SCHEDULE.

IS DIFFERENT FROM ABOVE - ENTER

15C. CHECK IF REMITTANCE ADDRESS

EXT.NUMBERAREA CODE

15B. TELEPHONE NUMBER

(Type or print)AND

ADDRESS

OF

OFFEROR

CODE FACILITY

16. NAME AND TITLE OF PERSON AUTHORIZED TO SIGN OFFER15A. NAME

DATEAMENDMENT NO.DATEAMENDMENT NO.

and related documents numbered and dated):

amendments to the SOLICITATION for offerors

(The offeror acknowledges receipt of

14. ACKNOWLEDGEMENT OF AMENDMENTS

CALENDAR DAYS (%)30 CALENDAR DAYS (%)20 CALENDAR DAYS (%)10 CALENDAR DAYS (%)

(See Section I, Clause No. 52.232.8)

13. DISCOUNT FOR PROMPT PAYMENT

designated point(s), within the time specified in the schedule.

by the offeror) from the date for receipt of offers specified above, to furnish any or all items upon which prices are offered at the price set opposite each item, delivered at the

12. In compliance with the above, the undersigned agrees, if this offer is accepted within ______________ calendar days (60 calendar days unless a different period is inserted

NOTE: Item 12 does not apply if the solicitation includes the provisions at 52.214-16, Minimum Bid Acceptance Period.

OFFER (Must be fully completed by offeror)

IMPORTANT - Award will be made on this Form, or on Standard Form 26, or by other authorized official written notice.

28. AWARD DATE

(Signature of Contracting Officer)

27. UNITED STATES OF AMERICA

25. PAYMENT WILL BE MADE BY

26. NAME OF CONTRACTING OFFICER (Type or print)

CODE 24. ADMINISTERED BY (If other than Item 7)

ITEM

(4 copies unless otherwise specified)

23. SUBMIT INVOICES TO ADDRESS SHOWN IN

41 U.S.C. 253 (c) ( 10 U.S.C. 2304 (c) (

22. AUTHORITY FOR USING OTHER THAN FULL AND OPEN COMPETITION:

21. ACCOUNTING AND APPROPRIATION20. AMOUNT19. ACCEPTED AS TO ITEMS NUMBERED

AWARD (To be completed by government)

CODE

RSCY-15-0002205/22/2015

X

DHS/OPO/S&T/MSSNSPRT

U.S. Dept. of Homeland Security Contracting Officer/W. Mallison MGMT/OPO/STAD/Mail Stop 0210 Department of Homeland Security 245 Murray Lane SW Washington DC 20528-0210

1700 ES 07/13/2015

William Mallison william.mallison@hq.dhs.gov

X

X

X

X

X

X

X

X

X

X

X

X

X

PAGE(S)

Catherine J. Collins

AUTHORIZED FOR LOCAL REPRODUCTION

Previous edition is unusable

STANDARD FORM 33 (Rev. 9-97)

Prescribed by GSA - FAR (48 CFR) 53.214(c)

1-3

4-22 24-27 27-32

33-51

53-58

59-61

HSHQDC-15-R-00041 Page 1 of 61

ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

NAME OF OFFEROR OR CONTRACTOR

2 61

CONTINUATION SHEET

REFERENCE NO. OF DOCUMENT BEING CONTINUED PAGE OF

HSHQDC-15-R-00041

(A) (B) (C) (D) (E) (F)

This is a solicitation/Request for Proposal (RFP) to provide cyber security research and technical execution support services to the Department of Homeland Security, Science and Technology Directorate, Cyber Security Division.

DO/DPAS Rating: NONE Delivery: 365 Days After Award Delivery Location Code: DHS Department of Homeland Security Science and Technology Directorate Cyber Security Division Attn: Greg Wigton Washington DC 20528

FOB: Destination

0001 Base Year

Cybersecurity Research and Technical Execution Support (CRATES). Inclusive of all labor, travel, and material.

1001 Option Year 1

Cybersecurity Research and Technical Execution Support (CRATES). Inclusive of all labor, travel, and material.

(Option Line Item)

2001 Option Year 2

Cybersecurity Research and Technical Execution Support (CRATES). Inclusive of all labor, travel, and material.

(Option Line Item)

3001 Option Year 3

Cybersecurity Research and Technical Execution Continued ...

OPTIONAL FORM 336 (4-86)

Sponsored by GSA

FAR (48 CFR) 53.110

NSN 7540-01-152-8067

HSHQDC-15-R-00041 Page 2 of 61

ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

NAME OF OFFEROR OR CONTRACTOR

3 61

CONTINUATION SHEET

REFERENCE NO. OF DOCUMENT BEING CONTINUED PAGE OF

HSHQDC-15-R-00041

(A) (B) (C) (D) (E) (F)

Support (CRATES). Inclusive of all labor, travel, and material.

(Option Line Item)

4001 Option Year 4

Cybersecurity Research and Technical Execution Support (CRATES). Inclusive of all labor, travel, and material.

(Option Line Item)

The solicitation is continued on the following pages.

OPTIONAL FORM 336 (4-86)

Sponsored by GSA

FAR (48 CFR) 53.110

NSN 7540-01-152-8067

HSHQDC-15-R-00041 Page 3 of 61

Part I – The Schedule

Section B. Services/Supplies and Price/Cost

B.1. Services and Supplies

The contractor shall provide services and incidental supplies in accordance with the Statement of Work (SOW, Section C). Incidentals (which may be categorized as material or other direct costs) are expected to include the following: teleconference hosting, videoconference hosting, Web-hosted meeting applications, and publication printing.

B.2. Contract Type

This is a cost-plus-fixed-fee (term) type contract. See SOW Section VI Level of Effort.

B.3. Contract Value

B.3.1.

The total value of the contract, consisting of estimated cost and fixed-fee for each segment of the period of performance, is the following:

Estimated Cost Fixed-Fee CPFF Total Price Base Year $TBD $TBD $TBD Option Year 1 $TBD $TBD $TBD Option Year 2 $TBD $TBD $TBD Option Year 3 $TBD $TBD $TBD Option Year 4 $TBD $TBD $TBD Total $TBD $TBD $TBD

B.3.2.

The contract obligates $to be determined at award, $to be determined at award of which represents estimated cost and $to be determined at award of which represents fixed-fee.

Performance of this contract is subject to the limitations set forth in FAR 52.232-20 Limitation of Cost.

Section C. Statement of Work

The Statement of Work is imbedded in the following pages.

HSHQDC-15-R-00041 Page 4 of 61

U.S. Department of Homeland Security Science and Technology Directorate

Cyber Security Division

Statement of Work

Cyber Security Research and Technical Execution Support

I. Background

The Department of Homeland Security (DHS) Science and Technology Directorate (S&T) has the mission to conduct research, development, test and evaluation (RDT&E) and facilitate the timely transition of cyber security capabilities to the DHS Enterprise, which includes operational units within DHS as well as federal, state, local, and critical infrastructure sector operational end-users.

II. Scope of Work

As part of the core DHS mission to safeguard cyberspace, the S&T Cyber Security Division (CSD) requires support for management of its existing technical research programs, research and analysis regarding potential new programs, coordinating and participating in technical experiments and exercises, conducting technical foraging, developing technology and sector roadmaps, conducting test and evaluation, coordinating with private industry and the venture capital community, cyber security subject matter expertise, and stakeholder education. This support will be for current, potential, and proposed CSD R&D projects. CSD requires this support to conduct its research projects, outreach, and stakeholder interaction more effectively and efficiently, and to facilitate delivery of new capabilities and successful technology transfer to customers. The support involves interactions with research teams comprising academia, the private sector, and national laboratories. This requirement is known as “Cybersecurity Research and Technical Execution Support (CRATES).”

III. Tasks

Task 1: Technical Research Program Assistance

Sub-task 1.1: Cyber Security Technical Knowledge

To support CSD program managers, the contractor shall provide knowledgeable contributions in the area of cyber security and understand the technology and science behind the challenges the topic presents. Areas of technical work relating to current CSD programs are the following:

1) Cyber Economic Incentives;

2) Cyber Forensic and Investigative Support;

3) Cyber Physical Systems Security;

HSHQDC-15-R-00041 Page 5 of 61

4) Cyber Security Competitions;

5) Cyber Security Exercise Technologies;

6) Cyber Security Metrics;

7) Data Privacy;

8) Distributed Denial of Service Defenses;

9) Experimental Testbeds;

10) Pilots and Deployments;

11) Identity Management;

12) Insider Threat Analysis;

13) Internet Measurement and Attack Modeling;

14) Mobile Device Security;

15) Moving Target Defense;

16) Data Repositories;

17) Process Control System Security;

18) Secure Routing;

19) Security of Cloud-based Systems;

20) Software Quality Assurance; and

21) Usable Security.

Future areas of technical interest include but are not limited to the following: Anonymous Networks and Currencies; Application Security Threat Attack Modeling; Cyber Technologies for the Financial Sector; Cyber Security Education; Critical Infrastructure Systems (including automotive and aviation); Data Provenance; Static Tool Analysis; and Technical Industry Consortiums.

The contractor must have technical knowledge in the 21 areas listed above as well as the future areas of technical interest. The contractor must understand the state of the art in cyber security.

The contractor must, likewise, understand the research and development (R&D) landscape.

Finally, the contractor must have knowledge and capability in technology transition; this aspect is where venture capital knowledge is crucial.

Additional information can be found at: http://www.dhs.gov/science-and-technology/cyber-security-division.

The contractor shall support CSD program managers in CSD’s researching and creating new cyber security programs. The contractor’s support will include providing periodic assessments on new and evolving cyber security technologies, new uses for existing technology, new challenges and applications in cyber security, and how cyber security technologies or solutions can address future gaps and needs.

The contractor shall also provide program analysis, evaluation, and recommendations through reports and presentations. This information shall be included in the quarterly technical reports, quarterly program reviews, and annual reports. The contractor shall provide training, intended to educate CSD principal investigators and cyber security stakeholders, including CSD and other federal program managers, about innovation characterization and creation, research presentation skills, and transition strategies [these topics are not descriptive].

HSHQDC-15-R-00041 Page 6 of 61 http://www.dhs.gov/science-and-technology/cyber-security-division http://www.dhs.gov/science-and-technology/cyber-security-division

Sub-task 1.2: Developing Technology and Sector Roadmaps

The contractor shall support CSD in developing cyber security technology and sector roadmaps, identifying R&D needs. In doing so, the contractor shall support CSD in CSD’s engaging businesses and organizations in the transportation (including aviation, automotive, cargo, maritime, mass transit, and pipelines), financial services, chemical, energy (electricity and oil & gas), information technology, telecommunications, and water sectors. Engagements with other sectors are possible. The contractor will never be a representative of the government, and its employees and will identify their employer. The contractor personnel must have sector specific technical knowledge, are required to effectively perform this task.

The contractor shall prepare a summary report from each roadmap or similar document supported. This shall be included in the quarterly technical report.

Sub-task 1.3: Technical Exchange Meetings

The contractor shall support CSD in engaging the academic, business, and government research communities through technical exchange meetings. CSD expects to use such engagements to develop S&T’s R&D agenda, to gather technical ideas prior to S&T issuing a Broad Agency Announcement, report progress on existing research projects, and to conduct testing, experimentation, pilots, and deployment. The contractor will never be a representative of the government, and its employees and will identify their employer.

When CSD identifies the need for a technical exchange meeting, the contractor shall submit its proposed plan for the meeting by providing the following information to the COR as far in advance as possible:

• The purpose of the technical exchange meeting

• Location of the technical exchange meeting (If the location is other than the contractor’s own facilities, the contractor must explain which facilities it considered and why it selected the location. The contractor must consider available government facilities.)

• Anticipated dates

• Anticipated list of attendees and participants

• Itemized expected expenditures for the technical exchange meeting

See Section H.6 Approval of Conferences for restrictions on and procedures for meetings that constitute conferences.

The contractor shall prepare a summary report from each technical exchange meeting. This shall be included in the quarterly technical report.

Sub-task 1.4: New Start Support

It is critical for CSD program managers to be aware continuously of cyber security-related technological developments and to consider new needs, gaps, and requirements for cyber security applications. The contractor shall support CSD program managers in researching and creating new cyber security programs.

HSHQDC-15-R-00041 Page 7 of 61

The contractor’s support shall take the form of researching and providing periodic input on new and evolving cyber security technologies, new uses for existing technology, new challenges and applications in cyber security, and how cyber security technologies or solutions can address future gaps and needs. Once CSD determines that a new start is appropriate and necessary, the contractor shall also support the planning and development of materials needed to initiate the new start.

Based on their technical knowledge, the contractor shall prepare a summary report for new technologies and applications under consideration as new starts, and shall detail the progress on each new start underway, based upon project documentation and technical meetings. This shall be included in the quarterly technical report.

Sub-task 1.5: Program Analysis and Evaluation

The contractor shall prepare and submit an annual analysis report of the R&D projects that DHS S&T funds. This analysis would include the value proposition, technology content, and transition strategy. This report shall be based on presentations at the annual CSD principal investigator meeting, project or program specific principal investigator meetings, performer site visits, performer presentations at workshops or conferences, and delivered reports from the principal investigators. The contractor shall consult with the COR to determine which CSD projects will be included in the annual analysis report.

Sub-task 1.6: Performer and Stakeholder Education

To improve the likelihood of transition of technologies, it is vital that CSD’s principal investigators and stakeholders are prepared and capable of making an impact in transitioning their technologies. The contractor shall prepare and conduct up to four courses annually to assist principal investigators and cyber security stakeholders in innovation characterization, presentation effectiveness, and technology transition efforts. The contractor shall prepare a summary report after conducting each course. This shall be included in the quarterly technical report.

Task 2: R&D Interaction

As part of establishing and implementing its cyber security research and development program, S&T CSD will coordinate its activities with other parts of DHS (e.g. National Cyber Security Division, United States Computer Emergency Readiness Team, National Cyber Security Center, Federal Law Enforcement Training Center, U.S. Secret Service, Privacy Working Group, and other organizations) as well as other government agencies and entities (e.g. Treasury Department, Commerce Department, Defense Department, Energy Department, and National Science Foundation) and state and local chief information security officers and law enforcement.

The contractor shall support CSD with these interactions through technical meetings. The contractor will never be a representative of the government, and its employees will identify their employer.

HSHQDC-15-R-00041 Page 8 of 61

See Section H.6 Approval of Conferences for restrictions on and procedures for meetings that constitute conferences.

The contractor shall prepare a summary report from each interaction or meeting. This shall be included in the quarterly technical report.

Task 3: R&D Experimentation

CSD is working with other government agencies, such as the National Science Foundation, to create testbeds for cyber security technologies. When possible, research prototypes developed by DHS-funded researchers are tested using these government-funded testbeds. The contractor shall support CSD in testing research prototypes using such testbeds. The contractor shall coordinate and prepare for such testing. The contractor shall assist with the design and management of such testing. The contractor shall similarly support CSD’s pilot deployments.

In addition, CSD is working with other government agencies and external entities (academia, private sector, national labs, and international partners) to demonstrate cyber security research and development capabilities and results. S&T CSD will sponsor and participate in various experiments and exercises to demonstrate the technical capabilities of the DHS-funded research products. These experiments are expected to occur on a range of supporting environments, including DHS-funded testbeds, facilities funded by other government agencies, networks supporting research and experimentation, lab facilities, and production networks in experimental and controlled deployment settings.

The contractor shall support CSD in its interactions with these other government agencies and external entities while creating, managing, and scheduling these testbeds. The contractor shall also support experiments, pilot deployments, development of exercises, and participation in competitions. The contractor shall support technical evaluation meetings and program coordination. The contractor will never be a representative of the government, and its employees and will identify their employer.

See Section H.6 Approval of Conferences for restrictions on and procedures for meetings that constitute conferences.

The contractor shall prepare a summary report from each experiment or interaction. This shall be included in the quarterly technical report.

Task 4: Private Industry Outreach

The contractor shall support CSD in working with the private sector to develop partnerships and leverage industry participation in government R&D. The contractor shall assist CSD in organizing and conducting meetings with the private sector. Industry owns large portions of the relevant infrastructure, and these partnerships will help ensure that resulting research can be transitioned and used in the private sector.

HSHQDC-15-R-00041 Page 9 of 61

Such organizations and events include Sector Coordinating Councils, the Industrial Control Systems Joint Working Group, the Scientific Working Group on Digital Evidence, the Federal Mobile App Security Vetting Working Group, Linking the Oil and Gas Industry to Improve Cyber Security, Automotive Industry Consortia Technology Transition Working Groups, the Security Innovation Network, the Infosec Technology Transition Council, and the Software Supply Chain Assurance Working Group.

See Section H.6 Approval of Conferences for restrictions on and procedures for meetings that constitute conferences.

The contractor shall prepare a summary report from each meeting or interaction. This shall be included in the quarterly technical report.

Task 5: Research Support

The contractor shall perform technology seedlings specific to areas of CSD research in which the contractor has particular capabilities. Such seedlings are small-scale R&D efforts complementing existing R&D projects. The number, size, duration, and timing of these seedlings are discretionary and will be specifically approved by the Contracting Officer’s Representative (COR) based on direction from CSD leadership. The magnitude of effort on this task will not exceed 10% of the total Statement of Work.

The contractor shall prepare a summary report from each seedling completed. This shall be included in the quarterly technical report.

Task 6: Media

An important part of transitioning technologies is creating awareness about the technologies. An effective way to create awareness is to distribute videos about the technologies and the sector or industry that they can impact. The contractor shall produce such videos depicting successful CSD R&D projects, transition efforts, and their realized or potential impacts on cyber security.

The COR will identify the purpose and requirements for each video that is needed, and the contractor shall provide a plan for each video, including a cost estimate. The COR shall approve the video plan before the contractor commences work on it. Videos will be limited to not more than five per contract year.

The contractor shall develop creative proposals, make story boards, write scripts, and conduct interviews. The contractor shall capture b-roll footage, edit the video, edit the sound, draft videos and associated edits, do all post-production, and make final edits. The contractor shall work with CSD to get approval from DHS S&T’s Office of Corporate Communications and Office of Public Affairs before producing any media material.

The contractor shall deliver digital copies in .mp4, and .flv format, and also deliver .srt files with the associated .mp4 digital copy. The .flv file shall have closed captioning included.

HSHQDC-15-R-00041 Page 10 of 61

The contractor shall also deliver 50 copies of the DVDs and a master copy of the DVD (each with closed caption on/off option) for CSD reproduction purposes. All videos produced must be Section 508 compliant (See SOW Section XI).

Transition

The government requires the contractor to transition its duties and knowledge formally to a new performer, if any. The contractor shall archive established workflows and processes, as well as the documentation that is created for CSD under this contract. This documentation shall be passed on to a successor contractor during the transition period.

No later than 120 days before the end of the period of performance, the contractor shall submit a transition plan to the contracting officer and COR. The transition plan will describe how the contractor will minimize disruption to the performance of work as it winds down performance and a new performer commences performance. If there is no new performer, the transition plan is not needed. The transition plan will address and include the following:

• Knowledge transfer to the new performer

• Timeline to phase-out current activities

• Any possible disruptions that may be experienced in the transition, and approaches to avoid or mitigate them

No later than 60 days before the end of the period of performance, the contractor, under the supervision of the relevant government security and IT offices, shall update all access credentials (including usernames, passwords, other account information, access tokens, etc.), if any, which are regularly used by the contractor to perform the work. The contractor shall walk CSD through the processes of gaining access to all equipment, software, and accounts, if any, used in the performance of this Statement of Work. The government intends to provide these access credentials, if any, to the new performer during the transition period. The contractor shall ensure that all materials and documents created or developed under the contract are transferred and under the possession of the government. This includes files and materials developed by subcontractors and email distribution lists.

IV. Facilities

The contractor must have office locations in the Washington, DC and Silicon Valley, CA areas in order to facilitate CSD interactions with cyber security companies and the venture capital community.

The Washington, DC area is defined as meaning the District of Columbia; the cities of Alexandria, Falls Church, and Fairfax, VA; the counties of Arlington and Fairfax, VA; and the counties of Montgomery and Prince George’s, MD. A Washington, DC presence is critical to interacting with government stakeholders.

The Silicon Valley area is defined as meaning the area between Redwood City (westernmost bound) and San Jose (easternmost bound) and including the cities of Menlo Park, Palo Alto, Mountain View, and Sunnyvale as well as other towns and unincorporated areas.

HSHQDC-15-R-00041 Page 11 of 61

Silicon Valley is where the vast majority of cyber security research takes place, and where the vast majority of the technology venture capital industry is located. A Silicon Valley presence is critical to interacting with those stakeholders. DHS is establishing an office in Silicon Valley, CA; S&T will have a presence in that office, but it will not provide technical research support to CSD. This facility is expected to include office and meeting space for up to 10 people. This SOW requires technical support for the CSD programs and part of the outreach and transition for those programs requires an additional presence in Silicon Valley that can accommodate larger numbers of people. S&T personnel in the DHS Silicon Valley office will interact with the contractor and be included on deliverables and technical reports as directed by the COR.

One of the contractor’s offices must include meeting space for up to 100 people, and the other facility must include meeting space for up to 75 people. Most of the meetings, described in the above tasks, are expected to be conducted at these two locations.

It is anticipated that Task 2 and Task 3 will primarily be performed in the Washington, DC facility. It is anticipated that Task 4, Task 5, and Sub-task 1.6 will primarily be performed in the Silicon Valley facility. It is anticipated that Sub-tasks 1.1, 1.2, 1.3, 1.4, and 1.5 and Task 6 could be performed at either facility.

Both offices should have industry standard audio-visual and presentation equipment adequate to facilitate presentations to the numbers of meeting attendees described herein. This equipment shall include teleconference hosting, videoconference hosting, and WebEx or similar Web-hosted meeting capability. Both offices should have adequate projects and screens to display presentations. Both offices should have white boards.

V. Deliverables

The following deliverables are due on recurring bases, through each contract year:

Ref. Deliverable Format Due All Kick-off Meeting Attendance Within 30 days of contract award All Monthly Financial

Report Word or PDF, submitted by email

15th day of the month, covering previous month; delivery constitutes acceptance

All Quarterly Technical Report

Word or PDF, submitted by email

15th day of the month, covering previous quarter; delivery constitutes acceptance

1.5 Annual Analysis

Report on CSD R&D projects

Word or PDF, submitted by email

60 days after the yearly CSD PI meeting takes pace, covering previous year; delivery constitutes acceptance

1.6 Courses

(Up to four each contract year)

Teaching course;

providing summary in Quarterly Technical Report

Each course conducted within 30 days after COR tasking; COR will provide email acceptance within 3 days after each course taught

HSHQDC-15-R-00041 Page 12 of 61

7 Videos

(Up to five each contract year)

Digital copies in .mp4, .flv, .srt; 50 DVD copies and one master DVD

Due date for each course will be set when it is tasked; COR will accept in writing within 3 days after final delivery

Kick-off Meeting

The contractor will attend a kick-off meeting within 30 days of contract award. The kick-off meeting will be held at S&T headquarters in Washington, DC. The contractor’s Cyber Security Research Program Manager (principal investigator), contracts administrator, and any relevant corporate personnel directing the effort shall attend. Attendance will constitute delivery and acceptance.

Monthly Financial Report

The Monthly Financial Report describes actual expenditures over the previous month, actual cumulative expenditures for the present contract year, and actual cumulative expenditures since contract award. The Monthly Financial Report also projects expenditures for the upcoming month and for the remainder of the present contract year. Actual and projected expenses should be tracked and group by type, including direct labor, other direct, other indirect, subcontracts, travel, and ODC/material. The report should indicate which task(s) subcontracts are applicable to, and include a breakdown of costs paid to the subcontractor during the invoice period including all fully loaded direct labor, other direct, and travel costs.

Quarterly Technical Report

The Quarterly Technical Report describes technical activities over the previous quarter (three months). The Quarterly Technical Report must include technical progress achieved against goals, difficulties encountered, risks identified, risk mitigation, and plans for the next quarter.

The Quarterly Technical Report shall individually address each task in this SOW’s Section III, and include the following:

• Status of specific objectives identified in the last quarter

• Indicate if each objective was or was not accomplished

• For each objective not accomplished, detail current status of the objective

• Explain objectives planned to be completed during the next quarter (dynamic objectives not necessarily long term milestones; state specific and measurable objectives rather than simple declarations of continued or sustained efforts)

• Technical accomplishments made during this reporting period

• Report the deliverables submitted during this reporting period including deliverable name, description, and date of submission

• Each meeting, presentation, or interaction held or attended during the period, including its name, purpose, summary of attendees, location, start and date dates/times, and presentations made

• Summarize technical, programmatic, and other issues or concerns as well as recommended actions for government consideration

HSHQDC-15-R-00041 Page 13 of 61

• Planned activities for next reporting period

The Quarterly Technical Report includes roll-ups summarizing activity in the following tasks.

Each summary of an individual element (a roadmap, meeting, technology, course, or seedling) should not exceed two pages:

• Sub-task 1.2: Developing Technology and Sector Roadmaps – A summary report from each roadmap or similar document supported.

• Sub-task 1.3: Technical Exchange Meetings – A summary report from each technical exchange meeting.

• Sub-task 1.4: New Start Support – A summary report for new technologies and applications under consideration as new starts, and detailing the progress on each new start underway.

• Sub-task 1.6: Performer and Stakeholder Education – A summary report after conducting each course.

• Task 2: R&D Interaction – A summary report from each interaction or meeting.

• Task 3: R&D Experimentation – A summary report from each experiment or interaction.

• Task 4: Private Industry Outreach – A summary report from each meeting or interaction.

• Task 5: Research Support – A summary report from each seedling completed.

Annual Analysis Report of CSD R&D Projects

The Annual Analysis Report on CSD R&D Projects should describe the contractor’s assessment of the current state of R&D project, that the contractor has been tasked to support during the past year. The Annual Analysis Report is due within 60 days of CSD’s yearly principal investigators meeting, which typically takes place in December, January, or February. If the principal investigators meeting does not take place, for whatever reason, the COR will provide an alternate due date. The Annual Analysis Report will cover project activities during the previous 12 months. In the report the contractor shall assess the following:

• The current state of technical field in which the project fits;

• The project’s relevance in the context of the current state of the technical field;

• The project’s effectiveness in advancing CSD’s overarching mission and the specific requirements, gaps, and roadmaps;

• The project’s likelihood to achieve success;

• Whether the project is duplicating other government R&D efforts;

• How the project aligns with other projects in government and academia with similar subject matter, including collaboration and transition opportunities;

• Recommendations for the project;

• Transition strategies for the project, as applicable;

HSHQDC-15-R-00041 Page 14 of 61

VI. Level of Effort

Throughout the period of performance the contractor shall devote no less than the following level of effort to performing this Statement of Work: seven full-time-equivalents (FTEs). The level of effort may be achieved through any combination of prime contractor employees or subcontractors.

VII. Personnel

The tasks described in Section III above will be performed by the following labor categories:

Cyber Security Research Program Manager (one FTE)

Duties: Responsible for the overall management of contractor personnel at all locations.

Oversees all technical efforts as well as contract and financial administration. Monitors and forecasts budgets and spending, works with the COR to allocate personnel resources to specific needs, reviews and monitors deliverables and task schedules, organizes and leads contract program reviews, and coordinates with COR and other CSD personnel as applicable to address all concerns or issues.

Relevant tasks: all

Education Requirements:

• Bachelor’s degree in a cyber security, computer science, information technology, electrical engineering, or related discipline

• Master’s degree or higher in a Science, Technology, Engineering, or Math (STEM) field or business

Experience Requirements:

• At least five years of program or project management experience

• At least five years of technical cyber security experience

• At least five years of experience in an R&D environment or with R&D projects

Note: Experience requirements for this and all following labor categories need not be discrete;

relevant experience in different areas could have been gained from the same position. For example, a contractor could employee could have worked for five years as a program manager of an R&D effort.

Cyber Security Subject Matter Expert (four FTEs)

Relevant tasks: 1.1; 1.2; 1.3; 1.4; 1.5; 1.6; 2; 3; 4; 5

Education Requirement: PhD in cyber security, computer science, information technology, electrical engineering, or related discipline

Experience Requirements:

• At least five years of experience in an R&D environment or with R&D projects

HSHQDC-15-R-00041 Page 15 of 61

• At least 10 years of technical cyber security experience

• Experience in at least four of the cyber security areas listed in Sub-task 1.1 above; among the four Cyber Security Subject Matter Experts, experience in at least 16 distinct cyber security areas listed in Sub-task 1.1 above is required or

Education Requirement: Master’s degree in cyber security, computer science, information technology, electrical engineering, or related discipline

Experience Requirements:

• At least five years of experience in an R&D environment or with R&D projects

• At least 15 years of technical cyber security experience

• Experience in at least four of the cyber security areas listed in Sub-task 1.1 above; among the four Cyber Security Subject Matter Experts, experience in at least 16 distinct cyber security areas listed in Sub-task 1.1 above is required

Junior Cyber Security Subject Matter Expert (two FTEs)

Relevant tasks: 1.1; 1.2; 1.3; 1.4; 1.5; 2; 4

Education Requirement: PhD in cyber security, computer science, information technology, electrical engineering, or related discipline

Experience Requirements:

• At least five years of experience in an R&D environment or with R&D projects

• At least five years of technical cyber security experience

• At least two years of experience working in an IT operations environment

• Experience in at least four of the cyber security areas listed in Sub-task 1.1 above;

between the two Junior Cyber Security Subject Matter Experts, experience in at least 8 distinct cyber security areas listed in Sub-task 1.1 above is required or

Education Requirement: Master’s degree in cyber security, computer science, information technology, electrical engineering, or related discipline

Experience Requirements:

• At least five years of experience in an R&D environment or with R&D projects

• At least 10 years of technical cyber security experience

• At least two years of experience working in an IT operations environment

• Experience in at least four of the cyber security areas listed in Sub-task 1.1 above;

between the two Junior Cyber Security Subject Matter Experts, experience in at least 8 distinct cyber security areas listed in Sub-task 1.1 above is required

HSHQDC-15-R-00041 Page 16 of 61

Research Analyst (less than one FTE)

Relevant tasks: 1.4; 5

Education Requirement: Master’s degree or higher in a STEM field

Experience Requirements:

• At least two years of experience in an R&D environment or with R&D projects

• At least two years of technical cyber security experience

Technical Editor/Writer (less than ½ FTE)

Relevant tasks: 1.2; 1.4; 1.5; 6

Education Requirement: Bachelor’s degree in English, Journalism, Literature, Communications, Writing, or related discipline

Experience Requirements:

• At least five years of experience as a technical writer or editor

• Demonstrated experience working in a technical environment

Administrative Support Specialist (less than ½ FTE)

Relevant tasks: 1.3; 1.6; 2; 4

Education Requirement: Bachelor’s degree in any discipline

Experience Requirements:

• At least two years of experience providing administrative support in a technical environment

• At least two years of experience scheduling and coordinating meetings

Media Specialist (less than one FTE)

Relevant task: 6

Experience Requirements:

• At least five years of experience creating and producing videos

• Demonstrated experience creating videos for a technical organization or of technical subject matter

VIII. Access to Additional Technical Expertise

The contractor shall provide additional technical expertise to accomplish the tasks described in Section III, when directed by the COR. This technical expertise will typically be in related areas of cyber security not explicitly covered by a labor category in Section VII.

HSHQDC-15-R-00041 Page 17 of 61

This technical expertise may also be in one of the same areas covered by a labor category in Section VII, but in greater magnitude than is normally needed. Some of these experts may be subcontractors needed on a limited-term basis. Additional technical expertise will not exceed 25% of the level of effort stipulated in Section VI.

When tasking the contractor to provide expertise under this section, the COR will outline via email (copying the administering contracting officer) the nature of the expertise, its magnitude in terms of number of people or duration, where it is needed, and any other pertinent information.

After the COR identifies a need for additional technical expertise, the contractor shall provide the services within 60 days. If a subcontract is involved; see FAR 52.244-2 Subcontracts in Section I.1.

IX. Travel

Travel, both within and outside of the local area, will be required. The meaning of local travel is defined in the Federal Travel Regulation (FTR); it will not be reimbursed. Travel is subject to advance government approval, by the administering contracting officer or COR. The contractor shall request all travel in writing via email and provide the names of individuals traveling, dates, destinations, purpose, and estimated costs. Travel outside of the defined local area will be reimbursed in accordance with the limits set forth in FAR Part 31 and the FTR. Travel expenses will be minimized, to the maximum extent possible, by taking advantage of discounted airfare rates available through advance booking.

X. Security

Category of Safeguarded Information

This contract involves information that is CLASSIFED at the SECRET level and the TOP SECRET levels, and information that is SENSITIVE BUT UNCLASSIFIED, FOR

OFFICIAL USE ONLY (FOUO).

At least one contractor facility shall provide some portion of office, meeting, and storage space that meets requirements for operating up to the SECRET level. Classified information may be stored at this contractor facility only, not any other contractor facility.

Classified information requires protection in accordance with Executive Order 13526, Classified National Security Information, and supplementing directives.

Position Security Designations and Information Handling

Work on this contract cannot be performed unless the contractor personnel assigned to the labor categories are cleared at the appropriate levels as identified below:

Labor Category Security Clearance Level Cyber Security Research Program Manager Secret

Cyber Security Subject Matter Expert Top Secret

HSHQDC-15-R-00041 Page 18 of 61

Cyber Security Subject Matter Expert Top Secret Cyber Security Subject Matter Expert Secret Cyber Security Subject Matter Expert Unclassified

Junior Cyber Security Subject Matter Expert Unclassified Research Analyst Unclassified

Technical Editor/Writer Unclassified Administrative Support Specialist Unclassified

Media Specialist Unclassified

All work performed under this task order should be considered unclassified unless specified otherwise. When classified work is required, DHS will provide specific guidance to the contractor.

The contractor shall adhere to all applicable government laws, regulations, orders, guides, and directives pertaining to classified, Sensitive But Unclassified, FOUO, or personally identifiable information. The contractor shall safeguard Sensitive But Unclassified, FOUO information specifically in accordance with DHS Management Directive 11042.1.

The contractor shall establish and implement appropriate administrative, technical, and physical safeguards to ensure the security and confidentiality of classified and sensitive government information, data, and/or equipment. If contractor personnel are ever uncertain about the handling or treatment of any information or data, they shall consult the COR.

Prior to performing work, all contractor personnel accessing classified information or receiving proximity passes to work regularly on-government-site must complete the suitability check process.

All contractor personnel must execute non-disclosure agreements (NDA, DHS Form 11000-6).

All contractor personnel accessing DHS IT systems will be required to take DHS security awareness training and IT system rules of behavior training when performance of the contract commences, and thereafter. Contractors will significant security responsibilities may be required to receive specialized training. All personnel who access government IT systems will be monitored in their use. Any unauthorized access, sharing of passwords, or other questionable security procedures should be reported to the local Security Office or Information System Security Officer.

A DD Form 254 will be completed and incorporated into the contract.

Security ID Requirements

Contractor personnel assigned to work at DHS facilities may be issued a proximity pass (also known as PIV card or “badge”) that permits unescorted entry to the facilities without going through a daily visitor access process. Contractor personnel may also be granted certain other privileges such as email accounts and access to DHS information systems.

HSHQDC-15-R-00041 Page 19 of 61

The proximity pass application will be obtained through the COR or as directed by the contracting officer. The contractor shall provide the COR written notice when all proximity passes have been processed and received. This card is in addition to contractor provided IDs.

This access shall be provided solely at the discretion of DHS, and may be revoked or withdrawn at any time, without notice or cause, by the COR or Contracting Officer. The contractor shall report in writing to the COR to request all personnel access to DHS facilities, email accounts, and information systems be terminated if:

• At any time during the term of this contract, contractor personnel issued a DHS pass or granted access to DHS email or any other DHS information system no longer require any further access; and/or

• At the completion, expiration, or termination of any such contract where access has been granted. Contractor personnel will be considered not to require access to DHS facilities for work performance upon expiration of this contract.

The contractor shall prepare and maintain a roster of its employees (both former and current) that have had proximity passes issued in their names at any time during the term of this contract.

This roster shall be submitted monthly, prior to the last day of each month, to the COR, or on request by the COR. The contractor may submit this report with the monthly progress report.

Each contractor employee shall have the proximity pass and contractor ID in his/her possession at all times when in the government facility. The employee shall surrender the proximity pass to the COR or issuing office at the end of employment, upon completion of this contract, or upon expiration of the form, whichever is sooner.

Contractor personnel must report the loss of a proximity pass or other government ID as soon as possible to the COR or issuing office. Report the same day if lost during duty hours and by 9:00 a.m. the next workday if lost during non-working hours.

XI. Accessibility Requirements (Section 508)

Section 508 of the Rehabilitation Act, as amended by the Workforce Investment Act of 1998 (P.L. 105-220) requires that when federal agencies develop, procure, maintain, or use electronic and information technology (EIT), they must ensure that it is accessible to people with disabilities. Federal employees and members of the public who have disabilities must have equal access to and use of information and data that is comparable to that enjoyed by non-disabled federal employees and members of the public.

All EIT deliverables within this work statement shall comply with the applicable technical and functional performance criteria of Section 508 unless exempt. Specifically, the following applicable EIT accessibility standards have been identified:

• 36 CFR 1194.21 Software Applications and Operating Systems, applies to all EIT software applications and operating systems procured or developed under this work statement including but not limited to GOTS and COTS software.

HSHQDC-15-R-00041 Page 20 of 61

In addition, this standard is to be applied to Web-based applications when needed to fulfill the functional performance criteria. This standard also applies to some Web based applications as described within 36 CFR 1194.22.

• 36 CFR 1194.22 Web-based Intranet and Internet Information and Applications, applies to all Web-based deliverables, including documentation and reports procured or developed under this work statement. When any Web application uses a dynamic (non-static) interface, embeds custom user control(s), embeds video or multimedia, uses proprietary or technical approaches such as, but not limited to, Flash or Asynchronous Javascript and XML (AJAX) then 1194.21 Software standards also apply to fulfill functional performance criteria.

• 36 CFR 1194.23 Telecommunications Products, applies to all telecommunications products including end-user interfaces such as telephones and non end-user interfaces such as switches, circuits, etc. that are procured, developed or used by the federal government.

• 36 CFR 1194.24 Video and Multimedia Products, applies to all video and multimedia products that are procured or developed under this work statement.

Any video or multimedia presentation shall also comply with the software standards (1194.21) when the presentation is through the use of a Web or Software application interface having user controls available.

• 36 CFR 1194.25 Self Contained, Closed Products, applies to all EIT products such as printers, copiers, fax machines, kiosks, etc. that are procured or developed under this work statement.

• 36 CFR 1194.26 Desktop and Portable Computers, applies to all desktop and portable computers, including but not limited to laptops and personal data assistants (PDA) that are procured or developed under this work statement.

• 36 CFR 1194.31 Functional Performance Criteria, applies to all EIT deliverables regardless of delivery method. All EIT deliverable shall use technical standards, regardless of technology, to fulfill the functional performance criteria.

• 36 CFR 1194.41 Information Documentation and Support, applies to all documents, reports, as well as help and support services.