ID08200031 VDP Clarifications 8.14.20 Amendment 002.pdf

Question # Question Answer

PWS 4.3 -- Task 3: We are not aware of any existing Vulnerability Disclosure Platform (VDP) solution that offers “Bug Bounty” program reporting management/capabilities. We are prepared to present a robust platform that addresses all RFP concerns, but it will require additional engineering/development within the platform before the Bug Bounty reporting solution is fully integrated into a “single pane” VDP solution. Is the government expecting that this platform, including the Bug Bounty capability, to be fully operational at the time of delivery or can we propose these

While the Government cannot anticipate what the offeror means by additional engineering/development, the Government expects the Platform to be “an existing, commercially available Software as a Service (SaaS) platform” as stated in PWS Section 1 - Background that meets requirements of PWS Section 3 – Technical Requirements and will require some initial configuration as noted in Subtask 1.2 “The service provider shall initially configure, and then operate and administer the Platform…”

RFP 9.2.2 Factor 2 – Past Performance. “If a CPARS evaluation report is not available, the Offeror shall provide a Government Point of Contact (.gov email address) and a completely filled out Attachment 5 - Past Performance Questionnaire (PPQ) for each contract submitted in response to Factor 2 by the initial proposal closing date and time to david.shamburger@gsa.gov and diana.zoppi@gsa.gov.” Does “completely filled out” include Government Point of Contact comments and signatures, are of offerors required to only fill out and submit sections 1 -3? If completely filled out includes signatures and comments, should the forms be sent directly to the Government?

The offeror provides the PPQ to the Government or Private Business Point of Contacts (POC)s to fill out past performance information, then the Government or Private Business Point of Contacts (POC)s will send the completed PPQs to GSA (david.shamburger@gsa.gov and diana.zoppi@gsa.gov).

3 As this RFP presents the opportunity to participate via numerous VARs, I want to be respectful of the CISA team's time when scheduling Bugcrowd's 90 minute demonstration. That being said, we see value in submitting a response with said VAR(s) but also understand our position in delivering the direct requirements that are outlined in the RFP as a whole...When scheduling the 90 minute demonstration, are we expected to participate in only (1) 90 minute demonstration or will we be allowed to participate in multiple demonstrations if we were to submit directly vs. partnering.

Please let me know as I would like to schedule our 90 minutes window within the acceptable time frame outlines in the

RFP.

The solicitation under Factor 1 - Platform states "Offeror shall have an existing Vulnerability Disclosure Platform that meets the technical specifications outlined in Attachment 3 - VDP Demonstration Checklist." The intention of the Government is for the offeror to have an existing VDP, accordingly we were not anticipating participation via "numerous VARs." We anticipate that each offeror will only participate in one (1) 90 minute demonstration.

Could I kindly ask you to provide the confirmed list of the FCEB AgenciesI understand there may not be a set list of FCEB agencies that are designated as official participants and this will be made available to any/all under that category...However, are you able to provide a list of all FCEB Agencies so we can ensure operationally we have a confirmed understanding for what could potentially be in scope as well as prepare for our Demonstration.?

New agencies can be created or deleted at any give time. There is no current list for Attachment A to the PWS until agencies have decided to participate. As noted in the Scope section of the PWS: “Participation in the Platform will be voluntary for FCEB agencies, and therefore the platform needs to scale to support a potentially varying number of agencies at any time. “ The provided link should provide overall guidance on current makeup of FCEB agencies.

https://www.govinfo.gov/app/collection/govman/2019/03executive_United%20States%20Governm ent%20Manual

1) There is an embedded cost for Bug Bounties each year. Does that get added in the total evaluated cost that CISA has budgeted for this program?

Yes, this will be included in the total evaluated cost.

2) Does CISA pay the bounties or is the platform provider expected to pay the bounties? The bounties will be paid by the Government via CLIN X003, which acts a pass through for agencies to fund their individual bug bounty program.