RFQ_-__Videos_for_GSAs_Security_Awareness_Training_Program_-_Jun_22,_2017.pdf

GENERAL SERVICES ADMINISTRATION (GSA)

OFFICE OF INFORMATION TECHNOLOGY (IT)

STATEMENT OF WORK

Video content for GSA’s Security Awareness Training Program

Request For Quote (RFQ) ID No. ID14170115 Issued to: All Prospective Offerors under Federal Business Opportunities (FBO), as a 100% Small Business Set-Aside

Conducted IAW FAR subpart 12.6

Period of Performance: (See 3.0 deliverable schedule)

Issued By:

GSA, Office Administrative Services (OAS)

Office of Internal Acquisition (OIA)

Issue Date: June 22, 2017

1.0 Introduction

This is a Firm Fixed Price (FFP) single-award purchase order request issued to all prospective offerors under the Federal Business Opportunities (FBO).

GSA’s Office of the Chief Information Security Officer (CISO) is the focal point for all GSA IT security. Each year, this office conducts security training for all GSA employees and contractors.

This training is focused on raising awareness of the latest cyber threats and vulnerabilities so GSA personnel are able to keep GSA’s IT systems safe and secure. GSA wants to improve the content delivered as part of the Security Awareness training program in 2017/2018.

2.0 Scope and Requirements

2.1 Scope

GSA is seeking content for their security awareness training program. GSA will deliver this content using their Learning Management System (LMS) or intranet platform over the course of 6 to 12 months from Date of Award (DOA).

2.2 Course Audience

All employees and contractors within the Agency will be the primary audience for this training.

Given the breadth of this audience, some people will have more knowledge than others.

Therefore, the content should be developed with considerations for varied backgrounds in Information Technology and CyberSecurity.

2.3 Course Length Requirements

Content MUST be modularized with one topic per module. These modules MUST NOT exceed 5 minutes. (e.g. micro-learning). GSA prefers videos between 2 and 4 minutes in length, per topic area.

2.4 Course Content Requirements

● Content MUST be in video (e.g. mp4) format.

● Content MUST be 508-compliant

● Each module MUST only cover one (1) threat vector per video.

● Vendor’s course catalog should include modules on the following topics:

○ Ransomware o Spear Phishing o Password re-use o Public WiFi o Rogue USB devices

● Content should be based on a real-world incidents (e.g. SHELLSHOCK, HEARTBLEED)

● Content should be use an anime theme.

● Content should align to NIST standards

3.0 DELIVERABLES/DELIVERY SCHEDULE:

DELIVERABLE

TYPES

ESTIMATED DELIVERY

TIMELINE

DETAILS

Course Catalog Delivered during the kick-off meeting, which is no later than 5 calendar days after award of contract/purchase order.

A list of videos the Agency can chose from and that qualify for use by the Agency under the terms and conditions outlined in the Vendor’s proposal.

Written transcriptions of audio

Within 3 business days of agency’s request Vendor needs to provide written transcripts of the videos’ audio track.

Transcripts should clearly identify who and when somebody is speaking, especially if video has multiple actors. Transcripts should be time stamped.

Four (4) videos in MP4 format

Within 3 business days of agency’s request Four videos are being requested under this SOW. These videos should be delivered in MP4 format. Videos need to be pure video w/o no interaction from the viewer (e.g. video doesn’t require any mouse or keyboard interaction to finish the video)

508 VPAT The contractor shall respond to the Section 508 technical requirements by submitting a VPAT that indicates compliance for 1194.24 and 1194.41.

At a minimum, all deliverables under this contract shall be Section 508 compliant and conform to the following technical standards:

● 1194.24 Video and Multi-Media Products

● 1194.41 Information, Documentation and Support https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-section-508-standards/section-508-standards#subpart_b http://h/ https://www.google.com/url?q=https%3A%2F%2Fwww.access-board.gov%2Fguidelines-and-standards%2Fcommunications-and-it%2Fabout-the-section-508-standards%2Fsection-508-standards%23subpart_b&sa=D&sntz=1&usg=AFQjCNENu7aWtja7l974yDMjMqwlNzWh9g https://www.google.com/url?q=https%3A%2F%2Fwww.access-board.gov%2Fguidelines-and-standards%2Fcommunications-and-it%2Fabout-the-section-508-standards%2Fsection-508-standards%23subpart_b&sa=D&sntz=1&usg=AFQjCNENu7aWtja7l974yDMjMqwlNzWh9g https://www.google.com/url?q=https%3A%2F%2Fwww.access-board.gov%2Fguidelines-and-standards%2Fcommunications-and-it%2Fabout-the-section-508-standards%2Fsection-508-standards%23subpart_b&sa=D&sntz=1&usg=AFQjCNENu7aWtja7l974yDMjMqwlNzWh9g

4.0 Inspection and Acceptance of Deliverables

The government will review and verify that the content meets their expectations. The GSA Contracting Officer Representative (COR) will accept/reject the deliverable. The COR has the right to reject or require correction of any deficiency(s) found. The Contractor will be notified in writing by the COR of the specific reasons why the deliverable is being rejected.

The government will have ten (10) workdays to complete the review of the deliverable and accept or reject the deliverable by giving written notice. This review time frame may include meetings with vendor’s business and technical points of contacts for clarification/questions that the GSA COR may have. When the government fails to complete the review within the review period, the deliverable will become acceptable by default, unless an extension of the review period is requested and mutually agreed upon. In the event of rejection of the deliverable, the Contractor will be so notified in writing by the COR, giving the specific reason (s) for the rejection. The Contractor will have five (5) work days to correct the rejected deliverable and return it to the government COR.

4.1 Section 508

Technical standards from 36 CFR part 1194 Subpart B have been determined to apply to this acquisition. Solicitation respondents must describe how their proposed Electronic and Information Technology (EIT) deliverables meet at least those technical provisions identified in

1194.24 in their VPAT.

Information, documentation, and support requirements from 36 CFR part 1194 Subpart D have been determined to apply to this acquisition. Solicitation respondents must describe how their information, documentation, and support deliverables meet at least those information, documentation, and support requirements identified in 1194.41 in their VPAT.

5.0 SPECIAL INSTRUCTIONS

5.1 CONTRACTOR DEVELOPED MATERIALS

Any information or materials developed by the contractor in performance of this contract are the exclusive property of the Government. Under no circumstances shall a contractor place a copyright on any of the materials that the contractor develops, provides and receives payment for under this contract.

5.2 HANDLING OF GOVERNMENT FURNISHED MATERIAL

The materials and information made available to the contractor by the Government, or that the contractor comes into contact with in completing this contract, are the exclusive property of the Government. Upon completion or termination of this contract, the contractor shall turn over to the Government all information and materials (copies included) that were furnished to the contractor by the Government.

5.3 PROTECTION OF INFORMATION

The contractor shall protect from unauthorized disclosure, any materials or information made available by the Government, or that the contractor has access to by virtue of the provisions of this contract, that are not intended for public disclosure.

The Contractor shall be responsible for properly protecting all information used, gathered, or developed as a result of work under this Task Order. In addition, the Contractor shall protect all Government data and information produced in monthly reports by treating the information as sensitive, as this information is the property of the Federal Government.

5.4 PRIVACY AND SECURITY

The Contractor is responsible for adhering to all aspects of the Privacy Act, Title 5 of the U.S.

Code, Section 552a and applicable agency rules and regulations, including GSA Public Building Rules and Regulations.

The Contractor shall adhere to all security-related laws, requirements, and regulations that bind the Government. Detailed security responsibilities for the Contractor are found in the GSA Orders/Handbooks/Acts listed below:

GSA Order CIO-D 2100.1D, GSA Information Technology (IT) Security Policy:

GSA Order ADM 1800.3B, CHGE 1, Safeguarding Sensitive Unclassified Information

The contractor is prohibited from removing from the work site any government owned equipment, documentation, or data without the knowledge and written approval of the COR.

GSA information systems are the property of the Federal Government. All deliverables and work products covered under this requirement become the property of the Government. The use of any information that is subject to the Privacy Act shall be utilized in complete accordance with all rules of conduct as applicable to Privacy Act Information.

http://uscode.house.gov/uscode-cgi/fastweb.exe?getdoc+uscview+t05t08+26+1++()%20%20AND%20((5)%20ADJ%20USC):CITE%20AND%20(USC%20w/10%20(552)):CITE%20%20%20%20%20%20%20%20%20 http://uscode.house.gov/uscode-cgi/fastweb.exe?getdoc+uscview+t05t08+26+1++()%20%20AND%20((5)%20ADJ%20USC):CITE%20AND%20(USC%20w/10%20(552)):CITE%20%20%20%20%20%20%20%20%20 http://insite.gsa.gov/graphics/staffoffices/itsecpolicy.doc http://insite.gsa.gov/graphics/staffoffices/CIO_P_2181_HSPD-12_Handbook_FINAL.pdf

5.5 CONFIDENTIALITY AND NONDISCLOSURE

The Contractor shall not release any information outside the GSA without the written consent of the COR. Personnel working on any of the described tasks may, at the Government’s request, be required to sign formal non-disclosure and/or conflict of interest agreements to guarantee the protection and integrity of Government information and documents.

6.0 PROCEDURES FOR PAYMENT

Invoice(s) shall be submitted electronically to https://vcss.ocfo.gsa.gov. Complimentary copies of each invoice to be emailed to: mark.thomsen@gsa.gov.

The invoice must include the following information:

1) Name of Contractor

2) GSA Task Order Number

3) Pegasys GP Number

4) Remittance Address

5) Point of Contact and Phone Number

6) Invoice Amount

7.0 GOVERNMENT POINTS OF CONTACT

The Contracting Officer (CO) is the only person authorized to make or approve any changes to any of the requirements of this delivery order and notwithstanding any clauses contained elsewhere in this purchase order, this authority remains solely with the CO. In the event the Contractor makes any changes at the direction of any other person other than the CO, the change will be considered to have been made without authority and no adjustment will be made in the contract price to cover any increase in cost incurred as a result thereof. All questions concerning the delivery order will be directed to the CO. The Contractor shall contact the CO with any questions regarding performance issues.

Contracting Officer (CO) Denise D. Young United States General Services Administration OAS/Office of Internal Acquisition (OIA) 1800 F Street, N.W., 6th Floor, 3rd Wing Washington, DC 20405-0001 Office Phone: (202) 694-8165 denise.young@gsa.gov mailto:denise.young@gsa.gov

Contracting Officer’s Representative (COR) Richard Krauss United States General Services Administration OAS/Office of Internal Acquisition (OIA) 1800 F Street, N.W. Washington, DC 20405-0001 Office Phone: (202) 236-6393 richard.krauss@gsa.gov

8.0 QUOTE SUBMISSION INSTRUCTIONS

In response to this Statement of Work (SOW), the Offeror will need to prepare and provide the following:

● A sample video that demonstrates their product. The offeror will need to provide an entire video of their choice to GSA. This video will be used to evaluate the offeror’s product. We encourage the offeror to provide a video that best represents their offering. The Agency will use this video solely for evaluation.

● Vendor’s course catalog of video offerings that meet requirements listed in this SOW

● A written transcript of audio for the sample video.

● Completed VPAT

● A price quote that is based on (see pricing table on page 12 below) o A package of four videos o A max viewership of 5000 individual viewers. GSA will ensure content is not available to anyone after this condition is met.

● Quotes are due by July 6, 2017 at 4:00PM EST.

● Quotes shall be submitted electronically to: Denise D. Young, Contracting Officer @ denise.young@gsa.gov.

● Electronic submissions must be compatible with MS Office 2007 unless otherwise specified herein. Quotes, and all supporting documentation, must be submitted so that receipt by is no later than the date and time specified.

● QUANTITIES LESS THAN SPECIFIED: Quotes may not be submitted for less than the quantities specified in the pricing schedule.

● All questions must be submitted in writing via email to denise.young @gsa.gov no later than 4:00 pm EST June 26, 2017 to ensure a response. All questions must be in writing and NO

QUESTIONS WILL BE ACCEPTED BY TELEPHONE.

mailto:richard.krauss@gsa.gov mailto:denise.young@gsa.gov mailto:helene.horrell@gsa.gov mailto:helene.horrell@gsa.gov

9.0 BASIS FOR AWARD

Lowest Price Technically Acceptable (LPTA) will be the best value methodology used for this effort.

This is a request for an OPEN MARKET PRICED quote for Video content for GSA’s Security Awareness Training Program. The proposed acquisition is 100% Small Business set-aside.

The associated North American Industrial Classification System (NAICS) code for this requirement is 512110 - Motion Picture and Video Production, SIC Code is: 7812 - Motion Picture and Video Tape Production.

The Government will solicit and award this contract using simplified acquisition procedures, in accordance with FAR Part 13, Simplified Acquisition Procedures. It is the Government's intention to issue a single firm-fixed price purchase order on an "all or none" basis for all products/services listed herein. The Government intends to award to the offeror who represents the Lowest Price Technically Acceptable (LPTA) quote.

The Government intends to evaluate quotations and select a quote based on the initial evaluation received in response to the solicitation. Therefore, vendors are cautioned that their initial quotes should contain their best terms from a technical and price standpoint.

Technical Compliance: To ensure technical compliance:

(1) Complete description of quoted item to include part number, manufacturer and specification to meet the salient characteristics stated in the solicitation for each line item.

(2) Offerors shall provide literature and description of all quoted items. A statement that the offeror will meet the Government’s requirement is NOT sufficient.

Delivery: The Government requires delivery to be in accordance with the terms and conditions contained in the deliverables schedule listed herein.

Pricing: All quotes shall be the Contractor’s Best Pricing.

10.0 EVALUATION CRITERIA/FACTORS

Award will be made to the Offeror whose quote represents the best value to the government.

The Government intends to select ONE contractor for award of this requirement.

The factors listed below will be used to evaluate each quote on a pass or fail basis:

10.1 EVALUATION FACTORS:

FACTOR 1 508 Acceptability (Pass/Fail)

The offeror must submit a VPAT.

The government will evaluate the manner and extent to which the Offeror’s solution meets Section 508 requirements. To be determined technically acceptable (Pass), the offeror’s quote must adequately address the requirements for Section 508 as provided in the VPAT. If the Offeror fails this requirement, no other consideration will be provided.

FACTOR 2 Quality of Content (Pass/Fail)

In accordance with the terms and conditions of Section 2.4 above, content is relevant to the threat-landscape of 2017. Presented in plain English and easy to understand to people with varying levels of background in Information Technology and CyberSecurity. Content flows.

Avoids covering unnecessary technical detail. Based on real-world cyber breaches. Cartoon or Anime themed. Covers topic sufficiently. Aligns with NIST standards.

FACTOR 3 Video Length (Pass/Fail)

3 to 4 minutes long in accordance with the terms and conditions of Section 2.3 above.

FACTOR 4 Quality of Video (Pass/Fail)

Video is smooth, not choppy

FACTOR 5 Price

Total proposed cost for videos shall be firm-fixed-price on the basis of Lowest Price Technically Acceptable (LPTA):

a. Offerors are encouraged to utilize the table below for pricing or one similar:

Offerors MUST fill-in all blank areas within the pricing table below.

b. The quote must include prices for each task area and all deliverables to perform all of the specific requirements in accordance with terms and conditions of the statement of work herein.

Discounts: Vendors are encouraged to offer additional discounts; quotes must clearly identify each discount amount for each line item.

c. Lowest Price Technically Acceptable (LPTA): resulting from selection of the technically acceptable quote with the lowest evaluated price. It is the Government's intention to issue a single firm-fixed price purchase order on an "all or none" basis for all products/services listed herein. The Government intends to award to the offeror who represents the Lowest Price Technically Acceptable (LPTA) quote.

The Government intends to evaluate quotations and select a quote based on the initial evaluation received in response to the solicitation.

PRICING TABLE

VIDEO CONTENT FOR GSA’S SECURITY AWARENESS TRAINING PROGRAM

Note: Offerors MUST fill-in all blank areas within the pricing table below:

Item Part/Serial Number MFR Description Unit of lssue Qty Unit Price Extended Price

0001 Video #1: Each 1

0002 Video #2: Each 1

0003 Video #3: Each 1

0004 Video #4: Each 1

Total Price: