ID23190003_-_RFQ_-_TTS-wide_DMARC_FBO.pdf

General Services Administration Federal Acquisition Service

Technology Transformation Services 1800 F St NW | Washington, DC | 20405

DMARC Analytics Services

Request for Quotation Solicitation Number

ID23190003

Contracting Officer: Stephen Carroll, Contracting Officer (CO), General Services Administration (GSA), Federal Acquisition Service (FAS), Technology Transformation Services (TTS), Office of Acquisition (OA)

Posting Date: 02/27/2019 Questions Due Date: 03/05/2019, 4:00 pm Eastern Time (ET) Quotation Due Date: 03/14/2019, 4:00 pm ET

Set Aside: Small Business NAICS Code: 541511 - Custom Computer Programming Services

1.0 General

TTS OA hereby issues this Request for Quotation (RFQ), under Federal Acquisition Regulation (FAR) 12.6 and FAR 13.5 ordering procedures for Domain-based Message Authentication, Reporting & Conformance (DMARC) Analytics Services.

This is a combined synopsis/solicitation for commercial items prepared in accordance with the format in Subpart 12.6, as supplemented with additional information included in this notice. This announcement constitutes the only solicitation; quotations are being requested and a written solicitation will not be issued.

General Services Administration / Federal Acquisition Service / Technology Transformation Services https://www.naics.com/naics-code-description/?code=541511

This solicitation document and incorporated provisions and clauses are those in effect through Federal Acquisition Circular 2005-101

This solicitation, and any published updated, are being published to Federal Business Opportunities.

Solicitation Attachments:

● Attachment 1 - RFQ Response Form

● Attachment 2 - RFQ Pricing Form

● Attachment 3 - Purchase Order Provisions

● Attachment 4 - Past Performance Questionnaire - Customer

● Attachment 5 - Past Performance Questionnaire - Quoter

● Attachment 6 - The Agreement and its attachments (contained within this document below)

● Attachment 7 - Purchase Order Clauses

2.0 Quotation Instructions

Vendors shall submit their quotations in accordance with the instructions, terms, and conditions of this RFQ. The government intends to award the order based on initial quotations. Therefore, it is critical that vendor submissions are for their best quotation and that they are fully responsive to the RFQ.

In order to be considered for award, quotations must be received per the following instructions no later than 03/14/2019, 4:00 pm ET:

Technical Submittal: All quotations for Phase 1, except Past Performance, shall be submitted via the RFQ Response Form. Past Performance shall be submitted in accordance with the instructions contained in Section 3.0. “Quotation Submission.” (under Factor 4). All quotations for Phase 2, as applicable, shall be submitted in accordance with Section 3.2.

For clarity, the Phase 1 ‘Technical Submittal” includes the Technical Product Evaluation, Security Requirements, Past Experience, and Past Performance.

Phase 2 of the Technical Submittal includes the Software Demonstration.

Price Submittal: Detailed price quotations shall be entered in the RFQ Pricing Form. Quoters should download the form, enter the required information in

General Services Administration / Federal Acquisition Service / Technology Transformation Services https://www.acquisition.gov/browse/index/far https://www.fbo.gov/ https://www.fbo.gov/ https://docs.google.com/forms/d/e/1FAIpQLScd4_hhQXVf69WbMSf8vjkNupdaEnkaT66LudOrpRUZBvY7Eg/viewform?usp=sf_link https://docs.google.com/forms/d/e/1FAIpQLSdLRzanx6wPq7UwE4JjDs4Gzv2PjT8edaQAyUdGilpg6YwgOA/viewform?usp=sf_link https://docs.google.com/forms/d/e/1FAIpQLSdSlI7qG3TxLcavQXO57tB3t0dZFA89RSQfxhzhfgHwEdWMlQ/viewform?usp=sf_link https://docs.google.com/forms/d/e/1FAIpQLScd4_hhQXVf69WbMSf8vjkNupdaEnkaT66LudOrpRUZBvY7Eg/viewform?usp=sf_link accordance with the instructions, and then upload it to the RFQ Response Form. Price is considered part of Phase 2.

Unless expressly authorized by the RFQ, any quoter planning to make an exception to a term or condition of the RFQ should consult with the Contracting Officer (CO) in writing before submitting a quotation.

3.0 Quotation Submission

Quotes shall consist of the following content:

3.1 Technical Quotation - Phase 1

Factor 1: Technical Product Evaluation SaaS Functions and Capabilities Quoters shall describe the Basic Functions and Capabilities of their proposed solution within the RFQ Response Form. Quoters will specifically be asked to validate that their proposed solution incorporates all of the DMARC Basic Functions and SaaS Dashboard Capabilities described in Section 3.2.1 of Attachment 6 - Agreement. This response will include a series of Yes or No radio buttons, descriptive narrative explanations, and the ability to upload visual aids to support the narrative explanations.

Commercial Supplier Agreement (CSA) Quoters shall provide a copy of the Commercial Supplier Agreement (CSA) (a.k.a.

Service Level Agreement). At a minimum, this document shall include:

● Any terms and conditions intended to be incorporated into the contract and/or agreed to by the Government prior to use of the Quoter’s proposed solution;

and

● The minimum service availability of the proposed solution.

Factor 2: Security Requirements Quoters shall describe their firm’s Security Practices and relevant Compliance measures and experience of their proposed solution within the RFQ Response Form.

Factor 3: Past Experience Quoters shall describe the experience and capability of their organization in providing their proposed solution, preferably to the U.S. Federal Government. Commercial experience (non-government) may also be submitted.

The proposed solution must have been provided by either:

a. The Quoter itself,

b. A teaming partner or subcontractor that is included in response to this solicitation.

Here, “similar work" is meant to convey similarity in subject matter, dollar value, duration, and complexity, in providing DMARC Analytics Services to fulfill requirements as outlined in the Section 3.0 of Attachment 6 - Agreement.

While the government may elect to consider data from other sources, the burden of providing detailed, current, accurate, and complete similar experience information rests with the Quoter.

At a minimum, the quote shall include a narrative describing similar experience with DMARC Analytics Services. Please provide at least one (1) experience example (at minimum), but no more than three (3). Quoters providing more than one (1) example (that is considered relevant) may be given additional consideration. At a minimum, experience shall reflect at least six (6) months of continuous duration or period of performance performing work similar to that stated in Section 3.1. of Attachment 6 - Agreement, however, experience over six months in continuous duration, especially at least 12 months of continuous duration, may be given additional consideration.

Duration is determined from the order start until the due date of this quotation.

Additionally, at a minimum, experience examples shall have been completed within 3 years of the due date for quotations, however, experience examples that have been completed more recently to the due date of this quotation may be given additional consideration (for example, the government may consider relevant experience examples completed in the last 12 months more favorably than positive experience examples completed in three years previously).

Factor 4: Past Performance Offerors shall provide project descriptions and contact information, PPIRS information (as applicable), including phone numbers and email addresses, for references for a minimum of one (1), but no more than three (3), reference projects for the quoter utilizing the Past Performance Questionnaire - Quoter form. References may be from government customers, or commercial customers, however, the government may give additional consideration to references with government customers.

At a minimum, references shall reflect at least six (6) months of continuous duration or period of performance performing work similar to the requirements stated in Section 3.1.

of Attachment 6 - Agreement, however, references over six months in continuous duration, especially at least 12 months of continuous duration, may be given additional consideration. Duration is determined from the order start until the due date of this quotation. Additionally, at a minimum, reference projects shall have been completed within 3 years of the due date for quotations, however, references that have been completed more recently to the due date of this quotation may be given additional consideration (for example, the government may consider positive past performance completed in the last 12 months more favorably than positive past performance completed in three years previously).

Project descriptions should clearly identify similarities (scope, duration, dollar value for example) between the reference project and this one, and specifically PWS 3.1. of Attachment 6 - Agreement.

For PPQs references (to be completed by the quoter’s customer(s) or client(s) using Past Performance Questionnaire - Customer, the quoter will send their reference(s) a copy of the Past Performance Questionnaire in order for them to complete. Once the questionnaire has been completed by the reference, the reference can either email the questionnaire directly to the Contracting Officer, Jennifer Calik, at Jennifer.Calik@gsa.gov, and carbon copy Stephen Carroll at stephen.carroll@gsa.gov, with the subject line: “RFQ ID23190003 Past Performance Reference for (Your Firm’s Name Here)” or submit the form via the Google Forms functionality. Contractors are highly encouraged to request confirmation of the submissions of these questionnaires from their references. The Government is not responsible for ensuring reference questionnaires are received.

For PPQ descriptions (to be completed by the quoter), quoters shall use Past Performance Questionnaire - Quoter.

The government also reserves the right to review the Governmentwide Past Performance Retrieval System (PPIRS) beyond what is provided, use any other reasonable basis for reviewing past performance, and review the Federal Awardee Performance and Integrity Information System (FAPIIS) and the Excluded Parties Lists System (EPLS) (within System for Award Management (SAM)) information on the awardee in order to make a past performance responsibility determination in accordance with FAR 9.104-6 FAPIIS and FAR 9.105-1, “Obtaining Information.”

The quoter may use subcontractor past performance as well as prime contractor past performance, as long as it is recent and relevant and of similar size and scope to the work described in Attachment 6 - Agreement. Prime level past performance may be given greater consideration than subcontractor level past performance, depending on the project scope (value, Period of Performance, and type of work performed and its applicability to the current requirement). The offeror must identify whether it was the prime or a subcontractor for each project.

3.2 Technical Quotation - Phase 2

Software Demonstrations During this phase of the evaluation processes, the Government seeks to gain a thorough understanding of the Quoter’s proposed solution, with particular emphasis on the functionality and usability of the SaaS product to be provided.

Software Demonstration Format Quoter software demonstrations will consist of Quoters giving a live demonstration of their proposed solution as it exists in a live production use, not a prototype or wireframe, and shall demonstrate all functions and features identified in Section 3.2.1 of the Agreement. Additionally, the Quoter will be expected to answer any questions related to the technical factors identified in this solicitation. The answers given in this session are considered part of the quoter’s quotation.

Additionally, the Government requests access to the SaaS product during the demonstration. The Government would prefer being given access to the software with a direct account login for the demonstration via an existing test environment, free trial, or by other means as proposed by the Quoter. Access should be granted a minimum of one hour prior to the scheduled demonstration and be available for a minimum of one hour following the conclusion of the meeting. Alternatively, the Government will accept an interactive demonstration using screen-share capabilities.

Software Demonstration Rules The software demonstration sessions will be:

● Scheduled by the Government with each quoter after evaluation of their Phase 1 submission. The Government reserves the right to reschedule any quoter’s software demonstration at the discretion of the CO;

● Scheduled to last for no more than one hour, but may end early if all content and questions are covered in a shorter amount of time; and

● Conducted by videoconference. The Government will coordinate and set up the conferencing tool accordingly (providing dial in or links to the tool).

The Government may take notes during the interview at its discretion, and may use such notes in the evaluation. No copies will be provided to any quoters.

The quoter may include as many participants as it feels is necessary and is the sole responsibility of the quoter. Quoters are advised to have technical personnel present since the Government will ask technical questions during the software demonstration.

After the software demonstration, quoters shall provide the names of all participants to the CO via email (please CC Stephen Carroll - stephen.carroll@gsa.gov).

This exchange does not and will not constitute discussions or negotiations. However, the Government reserves the right to conduct discussions if necessary.

3.3 Price Quotation - Phase 2 continued

Quoters shall provide a detailed price quotation that clearly identifies the DMARC Analytics Service pricing at each potential Total Annual Email Volume Tier.

All pricing information shall be submitted via the RFQ Pricing Form as described in Section 2.0 Quotation Instructions of this solicitation.

3.4 Potential Conflict of Interest Statement:

Quoters, including subcontractors as applicable, shall provide a signed Organizational Conflict of Interest statement. The statement shall concisely describe all relevant facts concerning any past, present, or planned interest (financial, contractual, organizational, or otherwise) relating to the work to be performed under the proposed purchase order and bearing on whether the Quoter has a possible organizational or personal conflict of interest with respect to:

1. Being able to render impartial, technically sound, and objective assistance or advice; or,

2. Being given an unfair competitive advantage.

Quoters may also provide relevant facts that show how its organizational structure and/or management systems limit its knowledge of possible organizational conflicts of interest relating to other divisions or sections of the organization and how that structure or system would avoid or mitigate such organizational conflict.

No award shall be made until any potential conflict of interest has been neutralized or mitigated to the satisfaction of the CO in accordance with FAR Subpart 9.5 Organizational and Consultant Conflicts of Interest. Refusal to provide the requested information or the willful misrepresentation of any relevant information by a Quoter shall disqualify the Quoter from further consideration for award under this solicitation. If the CO determines that a potential conflict can be avoided, effectively mitigated, or otherwise resolved through the inclusion of a special contract clause, the terms of the clause will be subject to negotiation.

4.0 Questions

Any questions concerning the RFQ must be submitted to stephen.carroll@gsa.gov, using the email subject line ‘RFQ ID23190003 - Questions - [Your Name]’ no later than 03/05/2019 at 4:00 ET. The government will try to provide responses no later than 03/08/2019 via Federal Business Opportunities under the same posting for the original

RFQ.

It is the vendor’s responsibility to monitor FBO for additional postings and information regarding this requirement.

5.0 Evaluation

5.1 Evaluation Criteria and Basis for Award

This procurement is being conducted in accordance with FAR subpart 12.6, “Streamlined Procedures for Evaluation and Solicitation for Commercial Items,” as supplemented with additional information included in the RFQ. Technical Factors will be evaluated in accordance with FAR subpart 12.602 “Streamlined Evaluation of Offers”. Price will be evaluated in accordance with FAR subpart 13.106. Provision 52.212-2, Evaluation -- Commercial Items, does not apply to this requirement. The offerors agree to and are bound by all instructions, procedures and rules of this RFQ.

The Government is not obligated to determine a competitive range, conduct discussions, solicit final revised quotations, or use other techniques associated with FAR part 15.

The final award for this requirement will be based on best-value principles, utilizing the trade-off process. Accordingly, award will be made to the responsible and technically acceptable Quoter whose quotation conforms to the RFQ and provides the greatest overall value to the government, price and non-price factors considered. In addition to

General Services Administration / Federal Acquisition Service / Technology Transformation Services mailto:stephen.carroll@gsa.gov http://farsite.hill.af.mil/reghtml/regs/far2afmcfars/fardfars/far/52_000.htm#P1584_221596

Price, the following non-price factors shall be used to evaluate quotations. The factors are in descending order of importance:

1) Software Demonstration

2) Technical Product Evaluation

3) Security Requirements | Past Experience | Past Performance

To be clear, the software demonstration is the most important non-price factor, the technical product evaluation is the second most important non-price factor, and the security requirements, past experience, and past performance are of equal importance, and together are the third most important non-price factor collectively.

The government is more concerned with obtaining a technically superior solution than with making an award at the lowest overall price to the government. However, the government will not make an award at a significantly higher overall price to achieve slightly superior technical value. Quoters are advised that the technical evaluation factors combined are significantly more important than price.

There is no requirement to capture relative strengths, deficiencies, and significant weaknesses as outlined in FAR 15.305. The evaluation will be streamlined by using simple narrative statements to justify the Confidence Ratings assigned and the ultimate award decision.

5.2 Quotation Evaluation

Quoters shall provide sufficient information within the various non-price factors for the government to determine its level of confidence in the ability of the quoter to perform the requirements of the solicitation.

Note: “Technical Acceptability” in this section is used to refer to a means of providing some or higher confidence to the government

5.2.1 Technical Quotation - Phase 1

Factor 1: Technical Product Evaluation - Phase 1 SaaS Functions and Capabilities The government will evaluate each Quoter’s demonstrated ability to deliver the basic functions and dashboard capabilities as specified in Section 3.2.1 of Attachment 6 -the Agreement. Offerors should highlight the unique aspects of their service that help the organization achieve and maintain email authentication.

Technical Acceptability will be based on the vendor demonstrating that their product includes all specified functions and capabilities.

Commercial Supplier Agreement (CSA) The government will evaluate each Quoter’s CSA for:

● Compliance with applicable Federal statutes and regulations, as well as the content of this solicitation, including GSAR Clause 552.212-4. The Government shall not accept or agree to any terms and conditions within the Quoter’s CSA that are in direct conflict with any of these items.

● The level of service availability of the proposed solution. Vendors with higher levels of service availability will be rated more favorably.

Technical Acceptability will be based on the vendor providing a compliant CSA that includes their level of service availability.

Factor 2: Security Requirements - Phase 1 The government will evaluate each Quoter’s security practices, as described in section

3.2.2 of Attachment 6 - the Agreement. Technical Acceptability will be based on:

● Vendor demonstration that their security and risk management program includes, at a minimum, all of the elements listed in Section 3.2.2 of Attachment 6 - the Agreement, and that there is no evidence of security vulnerabilities or malpractice within the vendor’s program;

● Confirmation that all non-public U.S. Government data received by the system shall be stored and processed solely within the U.S.A.; and

● Confirmation that all contractor staff having privileged access to this data shall be based within the U.S.A.

The Government will also evaluate the vendor’s compliance with applicable security programs. Vendors will be rated more favorably if:

● Their product has already received an Authority to Operate (ATO) from GSA or a LI-SaaS FedRAMP Agency ATO and/or a FedRAMP Tailored baseline for Low-Impact Software-as-a-Service (LI-SaaS) (https://tailored.fedramp.gov/) at the time of quote submission;

● They demonstrate experience with various security compliance practices customary when pursuing these authorizations. The more similar the experience, the more favorably the vendor will be rated.

https://tailored.fedramp.gov/

Factor 3: Past Experience - Phase 1 The Government will evaluate each Quoter’s past experience as an indicator of each Quoter’s capacity to perform under the Purchase Order contemplated by this solicitation.

Past Experience will be evaluated on the basis of information provided by each Quoter indicating completion of similar work as described in Section 3.1 Technical Quotation of this solicitation.

Quoters providing more than one (1) example (that is considered relevant and similar) may be given additional consideration. At a minimum, experience shall reflect at least six (6) months of continuous duration or period of performance performing work similar to that stated in Section 3.1. of Attachment 6 - Agreement, however, experience over six months in continuous duration, especially at least 12 months of continuous duration, may be given additional consideration. Duration is determined from the order start until the due date of this quotation. Additionally, at a minimum, experience examples shall have been completed within 3 years of the due date for quotations, however, experience examples that have been completed more recently to the due date of this quotation may be given additional consideration (for example, the government may consider relevant experience examples completed in the last 12 months more favorably than positive experience examples completed in three years previously).

Prime level experience may be given greater consideration than subcontractor level experience, depending on the project scope (value, Period of Performance, and type of work performed and its applicability to the current requirement). The offeror must identify whether it was the prime or a subcontractor for each project.

Factor 4: Past Performance - Phase 1 The Government will evaluate each Quoter’s past performance based upon project descriptions provided by the Offeror (Past Performance Questionnaire - Quoter) and the responses to the Past Performance Questionnaire - Customer.

During the evaluation of this factor, additional consideration will be given to projects that are more similar to this requirement and additional consideration may be given where quoter’s provide more than one reference that reflects positive past performance (‘Very Good’ or ‘Excellent’ or similar adjectival ratings as defined by CPARs definitions or reasonable commercial definitions) for project similar to this requirement.

In the case of an quoter without a record of relevant past performance or for whom information on past performance is not available, the Offeror may not be evaluated favorably or unfavorably on past performance, and will therefore result in the quoter being rated as "neutral" on the past performance factor. The Government is not required to conduct or complete reference checks on more than the one required references for each Offeror, but may conduct or complete reference checks on as many as the government needs. In addition to contacting references provided by the Offeror, the Government may solicit other sources to find references for other relevant, similar work performed by the Offeror.

The government also reserves the right to review the Governmentwide Past Performance Retrieval System (PPIRS) beyond what is provided, use any other reasonable basis for reviewing past performance, and review the Federal Awardee Performance and Integrity Information System (FAPIIS) and the Excluded Parties Lists System (EPLS) (within System for Award Management (SAM)) information on the awardee in order to make a past performance responsibility determination in accordance with FAR 9.104-6 FAPIIS and FAR 9.105-1, “Obtaining Information.”

The quoter may use subcontractor past performance as well as prime contractor past performance, as long as it is recent and relevant and of similar size and scope to the work described in Attachment 6 - Agreement. Prime level past performance may be given greater consideration than subcontractor level past performance, depending on the project scope (value, Period of Performance, and type of work performed and its applicability to the current requirement). The offeror must identify whether it was the prime or a subcontractor for each project.

5.2.2 Technical Quotation - Phase 2

Factor 5: Software Demonstration - Phase 2 The Government will evaluate each quoter’s software demonstration as an indicator of each quoter’s capacity and ability to meet the needs stated in Attachment 6 - Agreement.

5.2.3 Price Quotation - Phase 2 continued

The price quotation for each quoter invited to participate in the Software Demonstration process will be evaluated separately in order to ensure that the quoted price is fair and reasonable.. Pricing shall reflect reasonableness and consistency with industry standards. In an effort to receive the highest quality solution at the lowest possible price the government requests all available discounts (or most favored customer pricing) on all services offered by the quoter for this requirement.

As submissions become more technically equal in their merit, the evaluated price will become more important. Therefore, quoters are encouraged to provide their best price up front.

Evaluation of options under FAR 52.217-8 will be accomplished by using the prices quoted for the last option period to determine the price for a 6-month option period, which will be added to the base and other option years to arrive at the total price.

Evaluation of options will not obligate the government to exercise the option(s).

5.3 Evaluation Process

The government intends to utilize a phased approach for this procurement as described below. To be considered for award, each quoter’s quotation must successfully pass through each phase.

● Phase 1: Technical Evaluation - The government will evaluate the quoter’s responses to the factors identified in Section 3.1. as provided in the RFQ Response Form and PPQ information. Quotations rated as technically acceptable or higher by the Technical Evaluation Team will move on to Software Demonstrations. Quoters not moving on to Phase 2 will not be notified that the quoter will no longer be considered for award at this point. The quoter will be notified however when an award has been made. Pricing will not be evaluated for those not moving to Phase 2.

● Phase 2: Software Demonstrations - This phase will focus on validating and clarifying the technical capabilities of the Vendor’s proposed solution. During the demonstration, the Quoter will provide a demonstration of their proposed solution and the government may ask the Quoter questions.

● Phase 2 Continued: Price Submittal - The Quoter’s price, as provided in the RFQ Pricing Form, will be reviewed separately from the technical evaluation and will only include quoters who rated acceptable or higher upon completion of the Software Demonstration process.

6.0 Solicitation Provisions

See Purchase Order Provisions Attachment.

General Services Administration Federal Acquisition Service

Technology Transformation Services 1800 F St NW | Washington, DC | 20405

DMARC Analytics Services

Agreement - Attachment 6 Purchase Order Number

ID23190003

Solicitation Number: ID23190003 Date of Award: {{Provided at Time of Award}} Issued by: {{Provided at Time of Award}}

1.0 General

The Government intends to award a Time and Material (T&M) Purchase Order. The award will consist of the entire content of this Agreement document, including following documents:

Agreement Attachments:

● Attachment 1 - SaaS/Web Tool Service Level Agreement (Provided by Contractor with Quotation)

● Attachment 2 - Purchase Order Clauses

2.0 Background

In early October 2017, the Login.gov project began implementing Domain-based Message Authentication, Reporting & Conformance (DMARC) in order to improve email security for users of Login.gov. DMARC allows users to protect its brands by informing email receivers that all genuine email traffic sent by the user will be properly signed, which allows email receivers to reject all unauthenticated email. DMARC also provides a mechanism for email service providers to send reports containing detailed information on and visibility into email authentication failures.

In mid-October 2017, the Department of Homeland Security (DHS) issued Binding Operational Directive (BOD) BOD 18-01, a compulsory directive that requires all Federal agency domains to implement strict DMARC policies by October 2018. In November 2017, Login.gov published a strict “reject” DMARC policy, complying with this directive. The BOD 18-01 does not require performing any processing or analytics of DMARC reports.

By using DMARC analytics services to process these DMARC reports, TTS will be better able to protect the public against fraudulent and malicious email, including phishing attacks.

DMARC is standardized by IETF RFC 7489, Sender Policy Framework (SPF) is standardized by RFC 7208, and DomainKeys Identified Mail (DKIM) is standardized by

RFC 6376.

3.0 Requirements

3.1 Statement of Need

TTS is seeking to acquire DMARC analytics services for its domains and subdomains to improve existing DMARC procedures, to protect its brand, and to analyze the sources of email traffic. TTS will use the DMARC analytics services to verify that all legitimate email is passing authenticity checks and to discover sources of fraudulent email.

3.2 DMARC Analytics Services

3.2.1 DMARC Analytics Web SaaS/Web Tool

The Contractor must provide a DMARC Analytics Software as a Service (SaaS) / Web Tool (service) that includes the following:

DMARC Basic Functions:

● Automated mailboxes for receiving and processing DMARC aggregate and forensic feedback reports from email receivers;

● Dashboards and reports available through a web interface as noted below; and

● Service developed using user-centered design principles.

https://cyber.dhs.gov/bod/18-01/ https://tools.ietf.org/html/rfc7489 https://tools.ietf.org/html/rfc7208 https://tools.ietf.org/html/rfc6376

SaaS Dashboard Capability:

● Categorize and monitor messaging and sender data for DMARC Analytics purposes by providing the following:

○ Categorization and tracking of messages and senders for compliance with SPF, DKIM, and DMARC;

○ Monitoring and reporting broken down by email domains, subdomains, sets of IP addresses / CIDR blocks;

○ Automatic categorization of email senders by IP address into known organizations, showing legitimate vs. unexpected senders with their SPF/DKIM pass rates;

○ Ability to add categorization of new custom senders by IP address range;

○ Trend analyses of data from other domains across government and industry for attacks and fraud;

○ Alerts of suspicious activity or spikes in DMARC failure rates; and

○ Identification of relevant domains and subdomains that may require authentication and DMARC policies.

● Basic DMARC Analysis:

○ Analysis dashboard of aggregate DMARC reports with user ability to drill down in a user portal/dashboard for detailed information; and

○ Analysis dashboard of failure/forensic DMARC reports with user ability to drill down in a user portal/dashboard for detailed information.

● A User Portal and Dashboard that includes the following functionality:

○ Ability to detect DMARC policies from Domain Name Systems (DNS).

○ Ability to specify the tracked email domain names and subdomains.

○ Ability to create and manage additional user accounts with fine-grained permissions, e.g. read-only privileges or permissions scoped to a particular set of domains.

○ Views of real-time/near-real time and historical reporting.

○ Ability to view reports on demand or to schedule a report (monthly, weekly, daily, or other point in time).

○ Ability to print reports.

○ Ability to send reports by email.

○ Ability to export reports.

● Reporting:

○ Report on the following DMARC Analysis topics at a minimum:

■ DMARC pass/fail rate of sender domains’ email traffic over time;

■ Ability to investigate causes of DKIM and SPF failures;

■ Historical data on pass/fail compliance for user-selected IP ranges or domains;

■ Categorization of known and legitimate senders, as well as known forwarders;

■ Email disposition, including quarantined, rejected, and server override dispositions;

■ IP address reputation of email senders; and

■ Geographic categorization of senders.

○ Reports must present DMARC Analytics data organized by sender IP address, domain names, geography, recipient email provider, and other options.

● Integrations:

○ Incorporate data feeds from major email providers, such as Google

Gmail, Microsoft Outlook.com, and Oath / Yahoo! / AOL;

○ Integrate on an automated basis with one or more phishing takedown providers; and

○ Offer a programmatic Application Programming Interface (API) for custom integrations.

3.2.2 Security Requirements

Practices

● The contractor must maintain a robust security and risk management program, including incident response SLAs, patching schedules, and documentation including threat model and data flow diagrams.

● Any non-public U.S. Government data received by the system shall be stored and processed solely within the United States of America.

Compliance

● Authority To Operate (ATO): The vendor’s SaaS product shall either:

○ Already have received an Authority To Operate (ATO) for the SaaS from GSA or a LI-SaaS FedRAMP Agency ATO; or

○ The Contractor shall work with GSA security staff to receive an Authority To Operate (ATO) for the SaaS from GSA within one month of the Purchase Order award. The contractor shall make appropriate personnel available for interviews and provide all necessary documentation during this review. The contractor shall continuously maintain this ATO thereafter, including compliance with relevant GSA security standards.

Note: The government will not release monthly payment until the low-impact ATO is granted. Payment will also only continue as long as the ATO is maintained.

General Services Administration / Federal Acquisition Service / Technology Transformation Services https://before-you-ship.18f.gov/ato/types/ https://before-you-ship.18f.gov/ato/types/

3.2.3 Deliverables:

Required Services:

● Deliver access to the web interface of the DMARC Analytics SaaS, offering all of the features noted above.

○ The number of user accounts should not be limited. The initial number of user accounts anticipated to be used is between 5-10.

○ Support for 2 to 50 sending domain names

○ Support for the following total annual email message volume tiers:

■ 10 million total emails per year

■ 25 million total emails per year

■ 40 million total emails per year

■ 60 million total emails per year

■ 90 million total emails per year

■ 120 million total emails per year

■ 200 million total emails per year

■ Each additional increment of +100 million emails per year

○ Initial award is anticipated to support 2 domains with a total aggregated volume of 25 million email messages sent per year (as measured by DMARC aggregate reports).

● Implementation Support Services: Should any consulting services be required in order to implement the proposed solution, these services shall be provided and included in the price quotation for DMARC Analytics Service. The government’s preference is for the solution to be fully automated without a requirement for additional implementation support.

● Technical support available via phone, chat, and email 24 hours per day, 7 days per week, 365 days per year)

● Monthly Cost Report: The contractor shall deliver a report on a monthly basis showing:

1. The cost of services consumed year-to-date in the billing period, preferably broken down on a per-domain basis; and

2. The projected annual cost with the current monthly email sending rate extrapolated annually. This will allow the government to anticipate the annual cost in advance and avoid incurring costs above any relevant ceiling.

4.0 Purchase Order Details

4.1 Contract Line Items

The Contract Line Item Numbers (CLIN’s) are as follows:

CLINs Description Ceiling Price

(NTE)

Base Period - Period of Performance Time of Award – TBD 0001 DMARC Analytics Services (T&M)

Option Period 1 - Period of Performance TBD 1001 DMARC Analytics Services (T&M)

Option Period 2 - Period of Performance TBD 2001 DMARC Analytics Services (T&M)

Option Period 3 - Period of Performance TBD 3001 DMARC Analytics Services (T&M)

Option Period 4 - Period of Performance TBD 4001 DMARC Analytics Services (T&M)

4.2 Period of Performance

The period of performance (PoP) includes a base period of one year with four one-year option periods.

Each Purchase Order PoP will commence within 3 days of the Contractor’s receipt of the partial and full Notice to Proceed (NTP).

Notice to Proceed The Government intends to issue a partial NTP at the time of award to allow the vendor to proceed with preliminary activities, including, but not limited to, stand-up/implementation activities and meeting the stated requirements for receiving a full NTP.

A full NTP shall not be issued until the following have been met:

● Authority to Operate (ATO) and/or FedRamp approval has been received from

GSA

● Login credentials to SaaS dashboard delivered to TTS team members

4.3 Government Furnished Information

See Section 6.3.

5.0 Purchase Order Administration

5.1 Government Points of Contact

This acquisition will be administered by the following points of contact (POCs), who will also monitor the contractor’s performance:

1. Contracting Officer (CO): Jennifer Calik/Stephen Carroll

2. Contracting Officer Representative (COR): Bridget Fields

3. Technical Point of Contact (TPOC): Andrew Brody

5.2 Contractor Point(s) of Contact

At a minimum, the Contractor shall identify at least one person that:

● Has a full understanding of the technical solution presented through the Contractor’s quotation and delivered after award;

● Will be a direct liaison to the GSA POCs whom the Government can reach out to with any questions or concerns about the administration of the contract.

5.3 Post Award Orientation Conference

The Government's team, including the CO, COR, and the TPOC, will hold a Post-Award Orientation Conference with the Contractor within 10 business days of the Purchase Order award, unless otherwise agreed upon by all parties in writing. This meeting will include the Contractor’s team and other relevant Government staff to review and clarify the project’s objectives, expectations of the Government, and address any questions the Contractor may have.

5.4 Quality Assurance

5.4.1 Place of Inspection and Acceptance

Inspection and acceptance of all deliverables under this Purchase Order will be performed by the COR. The contractor must deliver all items to the satisfaction of GSA TTS. The COR will review the Monthly Cost Reports and all reports submitted by the contractor to GSA to ensure compliance with this acquisition and provide written feedback, if any, concerning the contractor’s DMARC analytics services during the performance of the Purchase Order.

5.4.2 Nonconforming Product and Services

Non-conforming services will be rejected. If the deficiencies cannot be corrected within ten (10) business days, the Contractor will immediately notify the COR of the reason for the delay and provide a proposed corrective action plan within five (5) work days.

5.5 Invoicing

Billing and payment shall be accomplished in accordance with the Purchase Order terms and GSA payment procedures.

5.5.1 Invoicing Schedule

The Contractor may invoice for items or services at the conclusion of each period of performance.

The Contractor must submit a final invoice at the end of the final period of performance within 60 calendar days from Purchase Order completion. No further charges are to be billed following the final invoice submission. A completed and signed Release of Claims (GSA Form 1142) shall be provided to the CO with the submission of a final invoice.

5.5.2 Content of Invoice

The Contractor will be provided with the following information when the Purchase Order has been awarded:

● Purchase Order Number

● CLIN number and title

● The Accounting Number associated with the Purchase Order.

All of this information, along with the Period of Performance covered by the invoice, must be included on each invoice in addition to the requirements for a proper invoice specified in FAR 52.212-4(g) and the Prompt Payment clause, FAR 52.212-4(i)(2).

5.5.3 Invoice Submission

The Contractor shall submit invoices for this Purchase Order through the GSA Office of the Chief Financial Officer, Vendor and Customer Self Service (VCSS) web portal (https://vcss.ocfo.gsa.gov).

The funding reference to use when submitting invoices is QP0023014.

https://www.gsa.gov/forms-library/release-claims https://meet.google.com/linkredirect?authuser=0&dest=https%3A%2F%2Fvcss.ocfo.gsa.gov%2F

Once invoices are submitted by the Contractor, the Government will make payment after verification that the goods or services listed on the invoice have been received and accepted.

If you have problems submitting your invoice, please contact one of the following, as applicable.

VCSS General System, Login ID, Password Issues GSA Financial Systems Service Desk:

Ph: 866-450-6588 Email: OCFOServiceDesk@gsa.gov

Invoice & Payment Related Questions BCEB Help Desk:

Ph: 800-676-3690, Opt 3

Fax: (816)926-7800 Email: kc-accts-payable.finance@gsa.gov

VCSS Inquiries with Invoicing Issues Email: kc-acctspayable.vcss@gsa.gov”

5.6 Early Termination

Should the Purchase Order be terminated prior to the end of the PoP, the Contractor shall transfer all project materials, including, without limitation, all deliverables (whether completed or in progress) such as DMARC aggregate and failure reports, to the CO, COR, and the TPOC. This will be completed within 14 calendar days of termination.

The government is requesting continual delivery of work product throughout the period of performance.

5.7 Transition Activities

During the transition to the Government or a new selected vendor, the Contractor shall perform all necessary transition activities. Expected transition activities will include, but are not limited to:

● Export of historical data including DMARC aggregate and failure reports.

● Continuation of full services to Login.gov and customers.

General Services Administration / Federal Acquisition Service / Technology Transformation Services https://meet.google.com/linkredirect?authuser=0&dest=mailto%3AOCFOServiceDesk%40gsa.gov https://meet.google.com/linkredirect?authuser=0&dest=mailto%3Akc-accts-payable.finance%40gsa.gov https://meet.google.com/linkredirect?authuser=0&dest=mailto%3Akc-acctspayable.vcss%40gsa.gov

● Participation in meetings with the Government, and possibly a successor contractor, to conduct a smooth transition and provide detailed information on the operation of all deliverables (at the COR and TPOC’s discretion).

5.8 System Security and Availability

The vendor must provide services in accordance with the availability SLA they submit in their quote. The vendor must continuously maintain compliance with relevant security standards necessary to maintain Authority To Operate (ATO) and/or FedRamp from GSA.

6.0 Terms and Conditions

6.1 TTS Transparency Policy

Vendors are advised that TTS reserves the right to publish documents associated with this acquisition on a publicly-available website, including any Requests for Quotation or their amendments, as well as question and answer exchanges with vendors without source-identifying information removed. TTS reserves the right to publish any other relevant information that is not confidential or proprietary in nature, but will not publish any source selection sensitive information that would otherwise implicate procurement integrity concerns.

Upon award of the acquisition, TTS may publish the total price of the selected proposal and certain non-source-identifying data (e.g. the number of bids, the mean price, the median, and the standard deviation of price). During the performance of the Purchase Order, TTS may similarly publish data related to project management (e.g. user stories, milestones, and performance metrics) and top-line spending data.

6.2 Section 508 Compliance

The Contractor shall support the government in its compliance with Section 508 throughout the development and implementation of the work to be performed.

Section 508 of the Rehabilitation Act of 1973, as amended (29 U.S.C. 794d) requires that when Federal agencies develop, procure, maintain, or use electronic information technology, Federal employees with disabilities have access to and use of information and data that is comparable to the access and use by Federal employees who do not have disabilities, unless an undue burden would be imposed on the agency. Section 508 also requires that individuals with disabilities, who are members of the public http://uscode.house.gov/view.xhtml?req=(title:29%20section:794d%20edition:prelim)%20OR%20(granuleid:USC-prelim-title29-section794d)&f=treesort&edition=prelim&num=0&jumpTo=true seeking information or services from a Federal agency, have access to and use of information and data that is comparable to that provided to the public who are not individuals with disabilities, unless an undue burden would be imposed on the agency.

6.3 Data Rights and Ownership of Deliverables

The Government will review and negotiate (if necessary) any commercial terms and conditions governing the SaaS offering prior to award, and the applicable GSAR clauses for Commercial Supplier Agreements will be included in the solicitation.

The government intends that any software source code created as a result of the work performed under the purchase order be publicly posted. Accordingly, FAR 52.227-17 (Rights in Data -- Special Works) will be included in the solicitation.

Any non-public data, such as DMARC aggregate or failure reports, received by the contractor from third parties as a direct result of the government’s published DMARC policies, will be considered Government-Furnished Information (GFI) for purposes of this procurement, and the contractor shall not acquire any rights in such data.

The government shall have unlimited rights in any data or deliverable created as a result of the work performed under the task order, including the output of DMARC analytics reports and dashboards.

The contractor shall use open source technologies wherever possible, in support of the 18F source code policy. All licenses must be expressly listed in the deliverable.

Regardless of license(s) used (i.e., MIT, GPL, Creative Commons CC0), the license(s) shall be clearly listed in the documentation.

If an open source license provides implementation guidance, the contractor shall ensure compliance with that guidance. If implementation guidance is not available, the contractor shall attach or include the license within the work itself. Examples of this include code comments at the beginning of a file or contained in a license file within a software repository.

6.4 Data Ownership

All Government data collected in the system is the property of the Federal Government.

All data collected by the system and all deliverables shall be provided by the Contractor (system provider) immediately upon requested during the Purchase Order https://18f.gsa.gov/open-source-policy/ period and at the completion of the Purchase Order period at no additional cost to the Government.

6.5 Data Release

Any information made available to the Contractor by the Government shall be used only for the purpose of carrying out the provisions of this contract and shall not be divulged or made known in any manner to any persons except as may be necessary in the performance of the contract. In performance of this contract, the Contractor assumes responsibility for protection of the confidentiality of Government records and shall ensure that all work performed by its subcontractors shall be under the supervision of the Contractor or the Contractors responsible employees. Each officer or employee of the Contractor or any of its subcontractors to whom any Government record may be made available or disclosed shall be notified in writing by the Contractor that information disclosed to such officer or employee can be used only for that purpose and to the extent authorized herein. Further disclosure of any such information, by any means, for a purpose or to an extent unauthorized herein, may subject the offender to criminal sanctions imposed by 18 U.S.C. §§ 1030.

The Contractor will not disclose customer data to any Government or third party or access or use customer data; except in each case as necessary to maintain the SaaS or to provide the SaaS to the customer in…