M67854-22-R-7701_Government response to Industry CVR feedback (for Public Release).pdf

Marine Corps Systems Command Program Manager, Marine Corps Cyberspace Operations

Government Responses to Industry Feedback on CVR DRAFT Request for Proposal Cyber Vulnerability Research (CVR) Services M67854-22-R-7701

Comment Number

Solicitation Section Document/Page/Paragraph/Line Number Comment/Question Government Response To Industry

1 RFP Section L Section L 5 Volume II B 2 (page 32) The instructions to prepare the technical approach references PWS 5.2.1 through 5.2.11, 5.3.1, 5.3.2. Could the Government please clarify PWS 5.3.1 and 5.3.2 are

5.2.1 and 5.2.2 in the Task Order 0001 PWS?

In Section L of the RFP, the instructions to prepare the technical approach, which reference PWS 5.2.1 through 5.2.11, 5.3.1, and 5.3.2, will be corrected to reflect the correct paragraphs in the Task Order PWS upon release of the formal solicitation.

2 RFP Section L Section L 5 Volume I (page 28) The first sentence under the Go/No-Go Criteria is “the Technical Proposal shall include the following.” Can the Government confirm this should read "Go/No Go volume shall include the following"?

Yes, it should read Go/No-Go Criteria Volume. The formal solicitation will be edited to make this correction.

3 RFP Section L Section L 5 Volume I #10 (page 31) A Small Business Subcontracting Plan (an Individual Subcontracting Plan or a Government approved Master Subcontracting Plan) must be submitted in accordance with clauses: FAR 52.219-9 Small Business Subcontracting Plan (Nov 2021) Alternate II (Nov 2016); and DFARS 252.219-7003 Small Business Subcontracting Plan (DoD Contracts)-Basic (Dec 2019) by all large business Offerors. (Page 31 of 41 CVR RFP) Question: As the government is allowing large businesses to submit their master subcontract plan, would the government allow Small Business Subcontracting Plans to be submitted as an attachment to Go/No Go Criteria Volume with no page limit?

A Subcontracting Plan will no longer be required.

4 Attachment 5 - Task Order 1 Pricing Worksheet

CVR Task Order 001 (Tab) The first tab of attachment 5 has line items for CLINs 001 - 003 but does not include 004, 005, 006. Is this an oversight?

No, the scope of the posted, draft task order PWS is to procure Lead VR/RE;

exploit subject matter expertise; and target market analysis.

5 RFP Section L Section L 5 Volume II A 1 d (page 31) Section L requests the normal work location for each labor category on attachment 3 Staffing Matrix. There is no field for location. Can the Contractor modify the template as needed to add columns?

No, the Government will update Attachment 3 to add a work location column.

6 RFP Section L Section L 5 Volume III 3b (page 34) Does the Government want the PPQs delivered with Volume III from the offeror or should the Government customer submit them directly to the CVR CO?

The PPQ should be emailed directly to the CVR PCO and Contract Specialist listed in the formal solicitation.

7 Attachment 4 - Pricing Worksheet v1.1

Attachment 4 - Pricing Worksheet v1.1 Would the Government please clarify the PWS elements that are priced on Attachment 4?

The Worksheet will be updated to mirror the formal solicitation's CLIN descriptions, which will indicate the relevant PWS paragraphs.

8 Attachment 4 - Pricing Worksheet v1.1 and Attachment 5 - Task Order 1 Pricing Worksheet

Attachment 4 - Pricing Worksheet v1.1 and Attachment 5 - Task Order 1 Pricing Worksheet

Can the Government identify the PWS elements associated with CLIN 0004 for bidding purposes?

The Government has revised the PWS paragraphs and CLINs where this question is no longer relevant to the formal solicitation.

9 RFP Section B Item 6 Section B Item 6 (page 4) Are exploit purchases included in the anticipated ODC NTE? Yes, exploits should be included in Other Direct Costs.

10 Attachment 6 - PWS TO

Attachment 6 - PWS TO 001 Section 5.2 (page 15)

Are PWS elements 5.2 for TO 001 evaluated against the response to the IDIQ technical PWS? Or is there a separate technical response required for TO001 5.2?

If so where does this response get included?

The formal solicitation's Section L and M will be clarified to reflect the technical responses required for the IDIQ and TO 001.

11 Attachment 1 - PWS v6.8 Attachment 1 PWS v6.8 (page 31) Paragraph number 5.2.11 is repeated twice for both Task 11 and Task 12, making

5.2.12 as Task 13. Please clarify and if Task 12 and 13 are to be included as a Specific Cyber Vulnerability Task.

The PWS is being updated that will remove the repetitive language and further clarify these tasks; therefore, the numbering of the tasks will change. However, Tasks 11, 12, and 13 are separate tasks.

12 RFP Section L Section L 5 Volume II A 1 e (page 31) Section L requests whether a labor category is a full or part-time position on attachment 3 Staffing Matrix. There is no field for full or part-time status. Can the Contractor modify the template as needed to add columns?

The Government will update Attachment 3 to add a column for Offerors to include that information.

Government Responses to Industry Feedback on CVR DRAFT Request for Proposal Cyber Vulnerability Research (CVR) Services M67854-22-R-7701

Comment Number

Solicitation Section Document/Page/Paragraph/Line Number Comment/Question Government Response To Industry

13 RFP Section L Section L Volume II Technical Proposal A.2 (page 31)

Can the government clarify the minimum qualification delineated in 5.3.1.4.1 and 5.3.1.4.2

Minimum qualifications for any key personnel will be listed in the PWS or Task Order PWS, where applicable.

14 How many task orders are anticipated? The Government plans to award five to seven task orders per ordering year.

15 If a firm has the ability to purchase non-public vulnerabilities in the form of ‘proof of concept’ demonstration tools, does the government anticipate funding some of these purchases?

Yes, these will be funded through the ODC CLIN.

16 The Scrum process includes steps by which quality is maintained in engineering deliverables and has been used successfully to deliver cyber tools to the government. Does the government see Scrum as including duplicative processes adjacent to a separate quality control mechanism or does the government consider SCRUM as part of the quality assurance/control plan?

Offerors should propose their best quality control/assurance solution based on this requirement. If an Offeror chooses to utilize the Scrum process, the Offeror shall determine how to utilize it and incorporate the process within their proposed solution.

17 Can the government provide sanitized instances of issues with quality control? An instance the Government has experienced receiving exploits that have been patched.

18 Does the government have examples of a preferred quality control plan template? No, the Government does not have a preferred quality control plan template to provide.

19 Is Task Order 0001 primarily focused on sourcing exploits and then verifying/validating operation on specified targets and subsequent integration/test with pre-existing implants and C2 infrastructure? If so, where will the testing/integration be conducted - sponsor facilities or contractor lab?

Task Order 0001 of the draft RFP is to search for kill chains that will satisfy CVR requirements. Testing and integration may be conducted at the sponsor facility or the contractor lab. The place of performance for testing and integration will be defined in the individual Task Orders to be issued during the contract period of performance.

20 What is the operational cadence of contractor deliveries through the POP of Task Order 0001?

The contractor should expect to be available and respond to the Government via Top Secret email and phone calls 40 hours per week and have in-person meetings 2-3 times per month.

21 Does the sponsor envision performance of fundamental VR to identify and weaponize defects in sponsor selected target systems?

Yes, the Government envisions performance of fundamental VR to identify and weaponize defects in Government selected target systems.

22 The RFP states the contractor should own or lease a SCI facility accredited by the NSA from the DSS. We are not aware of leasing or purchasing SCIFs from DSS.

Can you explain?

The SCIF does not need to be purchased from NSA; it can be leased. The contractor shall have a valid Top Secret/Sensitive Compartmented Information Facility Clearance (TS/SCI) and a TS/SCI Safeguarding Level prior to classified performance. FAQ are on the NSA website at: https://www.state.gov/facility-security-clearances-faq/.

23 If the contractor has built a DSS approved SCIF and it has been accredited by a DoD organization will the sponsor consider a CO-USE agreement with the other DoD organization?

No, the Government will not consider co-use agreement with the other DoD Organization. The Government sees having a co-use agreement as a risk, in that it can be terminated at anytime.

24 Does any of the Labor Category require any prior Security clearance? Personnel who are performing work under CVR and its associated Task Orders must have a current TS/SCI clearance.

25 Is there an estimated labor hours from the Government's side for the labor categories available?

This is a performance based acquisition. All Offerors should propose accordingly based on the requirement. The Government is seeking a solution based on the Offerors response to the formal solicitation.

26 In addition to the labor categories mentioned in the RFI and Pricing Document draft, can offerer submit additional labor categories (per requirement ) ?

Yes, this is a performance based acquisition, and, therefore, the Offeror may submit labor categories based on their proposed technical solution.

Government Responses to Industry Feedback on CVR DRAFT Request for Proposal Cyber Vulnerability Research (CVR) Services M67854-22-R-7701

Comment Number

Solicitation Section Document/Page/Paragraph/Line Number Comment/Question Government Response To Industry

27 Will the government inform the RFP release in advance to the interested offerers via email ?

No, the Government will not notify interested offerors via email. The formal solicitation will be posted on SAM.gov.

28 DRAFT+--+M67854-22-R-

7701_CVR_RFP+Attach ment+4- Pricing+Worksheet+v1.1

N/A The pricing breakdown by CLIN tab requires labor, materials, shipping and travel detail for each CLIN. What materials, shipping and travel costs are anticipated to be in CLINs X001-X004? What labor costs are anticipated to be in CLINs X005 and X006?

The contractor shall be required to travel anywhere in the Continental United States (CONUS) or Outside the Continental United States (OCONUS).

Specifically, there is anticipated travel to: Texas, Florida, Alabama, Colorado, California, Hawaii, and within the National Capital Region (NCR) during the performance of this contract to attend meetings, conferences, and training.

Specific materials, shipping, and travel requirements will be defined further in each Task Order's PWS.

29 RFP Section B 3 and 4 Travel and ODCs are listed as Not to Exceed. What are these amounts and what detail are offerors expected to provide to support them in the pricing worksheet?

The Government will provide a plug number for all travel and ODC. All travel will be IAW FAR Part 31.205-46. All ODCs will require approval by a COR prior to purchase, with documentation submitted at the time an invoice is submitted in WAWF supporting the purchase. Also, all travel will be approved prior to traveling and supporting documents shall be submitted in WAWF to support the cost of travel.

30 RFP N/A For pricing purposes what is the estimated start date of the IDIQ and Task Order 1?

The estimated start date is the first quarter of Fiscal Year (FY) 2023.

31 DRAFT+--+M67854-22-R-

7701_CVR_RFP+Attach ment+5-Task+Order+1- Pricing+Worksheet+v1.1

N/A Attachment 5 has pricing detail associated with Cyber Vulnerability Research (CVR), however the PWS for Task Order 1 does not include CVR data. Please confirm that CVR is not part of Task Order 1.

Yes, the draft Task Order PWS did not include CVR data.

32 RFP Section B 3 CLIN 0003 is listed as 60 months in duration. Attachment 5 lists CLIN 0003 as only 12 months in duration. Please confirm how offerors are to complete Section B as 1 year CLINs or 5 year CLINs.

The period of performance for the IDIQ is a 5 year ordering period. However, the Task Orders will be priced on a per year basis with potential options, but not to exceed the 5 year ordering period of the base contract.

33 DRAFT+--+M67854-22-R-

7701_CVR_RFP+Attach ment+5-Task+Order+1- Pricing+Worksheet+v1.1

N/A The staffing matrix, Attachment 3, calls for labor hours for the base year and each option year. Is the period of performance of this contract five years in duration or is it a base period and 4 option periods?

Refer to the response to question 32.

34 DRAFT+--+M67854-22-R-

7701_CVR_RFP+Attach ment+6- Task+Order+1+PWS+v1.

16 Which CLIN(s) should offerors use to estimate the activities associated with tasks

5.2.5 and 5.2.6?

Refer to CLIN for Cyber Vulnerability Research.

35 DRAFT+--+M67854-22-R-

7701_CVR_RFP_v1.7 (2)

17 Which CLIN(s) should offerors use to estimate activities needed for completion of CDRLs B001 - B006?

Refer to the response to question 34.

36 DRAFT+--+M67854-22-R-

7701_CVR_RFP_v1.7 (2)

Is this a new or existing requirement? If existing requirement, please identify the performing incumbent contractor.

This is a new requirement.

Government Responses to Industry Feedback on CVR DRAFT Request for Proposal Cyber Vulnerability Research (CVR) Services M67854-22-R-7701

Comment Number

Solicitation Section Document/Page/Paragraph/Line Number Comment/Question Government Response To Industry

37 DRAFT+--+M67854-22-R-

7701_CVR_PWS_v6.8 page 3 1.6.6 Type of Contract and page 17

1.6.21 Task Orders

Will the government provide a forecast of the number and type of task orders and associated technical requirements title projected for the IDIQ vehicle?

Refer to the response to question 14. At this time, the Government does not have a forecast for the type of task orders and associated technical requirements.

38 DRAFT+--+M67854-22-R-

7701_CVR_PWS_v6.8

12 1.6.10 Key Personnel "The following personnel are designated as key personnel by the Government: (1) Lead Vulnerability Researcher (VR)/Reverse Engineer (RE), and (2) Exploit Procurement subject matter expert." Does this represent the totality of labor categories associated with the IDIQ and anticipated task orders? or may offerors / awardees propose additional technical and programmatic labor categories at the task order level.

No, the Lead VR/RE and Exploit Procurement SME are not the total labor categories. This is a performance based acquisition, and, therefore, the offeror may propose more labor categories based on their proposed technical solution.

39 DRAFT+--+M67854-22-R-

7701_CVR_PWS_v6.8

Page 3 - 1.6.5 Place of Performance "1.6.5 Place of Performance The work to be performed under this contract shall be performed at the contractor’s facility, unless stated otherwise in a task order. " Would the government advise on expectation for secure lab space and connectivity requirements for program execution.

Refer to the response to question 23. With regards to connectivity requirements, the contractor shall have the ability to connect to a TS/SCI network.

40 DRAFT+--+M67854-22-R-

7701_CVR_PWS_v6.8

13 - 1.6.12 Contractor Travel "1.6.12 Contractor Travel The contractor shall be required to travel anywhere OCONUS or CONUS, with anticipated travel to Texas, Florida, Alabama, Colorado, California, Hawaii, and within the National Capital Region (NCR) during the performance of this contract to attend meetings, conferences, and training." Would the government disclose expected OCONUS travel sites? For estimating purposes, would the government disclose the anticipated number of trips, travelers, and duration for both CONUS and OCONUS locations?

OCONUS travel is anticipated to be Hawaii. Interested Offerors can anticipate one OCONUS trip per year and four CONUS trips per year. Duration is expected to be 5 business days. The number of travelers will depend on the individual Task Order's PWS requirements.

41 DRAFT+--+M67854-22-R-

7701_CVR_RFP_v1.7

P. 27 , section 3 Proposal Format, letter H The RFP states “Electronic proposal volumes (except for Volume I, Section 1 and Volume III) shall be submitted in Adobe Acrobat, Portable Document Format (PDF), Version 10.0.” Would the government please consider making exceptions to Volume IV (Price Proposal) therefore we can show the formulas in the buildup of our rates?

Yes, Sections L and M of the formal solicitation will be clarified to allow offerors to modify Attachment 4 Pricing Workbook. The workbook will remain in an Excel format to allow for editing as needed or to show the buildup of rates.

42 DRAFT+--+M67854-22-R-

7701_CVR_RFP_v1.7, DRAFT+--+M67854-22-

R- 7701_CVR_RFP+Attach ment+5-Task+Order+1- Pricing+Worksheet+v1.1, DRAFT+--+M67854-22-

R- 7701_CVR_RFP+Attach ment+6- Task+Order+1+PWS+v1.

P. 34 , Volume IV – Price Proposal – 2nd

Paragraph The RFP states, “The Offeror shall utilize the Task Order 0001-Pricing Worksheet (Attachment 5), included with this RFP, in which pricing per CLINs 000X will be filled out by the Offeror and submitted with their proposal. The Offeror shall submit pricing for each CLIN listed in the Task Order 0001-Pricing Worksheet.

Failure to do so will result in the Task Order being unawardable.” In DRAFT+-- +M67854-22-R-7701_CVR_RFP+Attachment+5-Task+Order+1- Pricing+Worksheet+v1.1 - Tab “Labor Hours Breakdown” it ask for pricing data to be provided for CLIN 004 Cyber Vulnerability Research but I don’t see this CLIN in DRAFT+--+M67854-22-R-7701_CVR_RFP+Attachment+6- Task+Order+1+PWS+v1.5. Should CLIN 004 Cyber Vulnerability Research be removed from DRAFT+--+M67854-22-R-7701_CVR_RFP+Attachment+5- Task+Order+1-Pricing+Worksheet+v1.1 - Tab “Labor Hours Breakdown”?

The Government is modifying the task order workbook to ensure that it matches TO 1 PWS, which does not include the CLIN for CVR services.

Government Responses to Industry Feedback on CVR DRAFT Request for Proposal Cyber Vulnerability Research (CVR) Services M67854-22-R-7701

Comment Number

Solicitation Section Document/Page/Paragraph/Line Number Comment/Question Government Response To Industry

43 DRAFT+--+M67854-22-R-

7701_CVR_RFP+Attach ment+5-Task+Order+1- Pricing+Worksheet+v1.1

DRAFT+--+M67854-22-R-

7701_CVR_RFP+Attachment+5-Task+Order+1- Pricing+Worksheet+v1.1 - Tab “Labor Hours Breakdown”

There is a note that states “ In reference to PWS Paragraph 5.3, “The period of performance for TO 0001 shall be 365 days after award”. What is the award date?

The Government anticipates that the award date is first quarter of FY23.

44 DRAFT+--+M67854-22-R-

7701_CVR_RFP_v1.7

P. 27 - Section 3 – Proposal Format, Paragraph

e. & P 32 – Volume II – Technical Proposal – Section 1 - Item 3

Within the RFP under the section called “format for Cross-Reference Matrix”, Paragraph f states “Inclusion of cost or pricing information, or information which cost or pricing could be reasonably inferred, in the Technical Proposal may render the proposal non-compliant and ineligible for evaluation and award.” However, on P. 32 under Volume II – Technical Proposal, item 3 ask for a Compensation Plan.

Should the compensation plan be part of Volume IV – Price Proposal since cost data in Volume II – technical Proposal could render the proposal non-compliant?

Yes, the Government will update the formal solicitation to move the Compensation Plan to Volume IV.

45 DRAFT+--+M67854-22-R-

7701_CVR_RFP_v1.7

P 32 – Volume II – Technical Proposal – Section 1 - Item 3

To ensure we have sufficient information for the Compensation Plan which is asked for on P 32, Item 3., Can we increase the page count?

The RFP is being modified to remove the requirement for a Compensation Plan as part of the offeror's proposal.

46 DRAFT+--+M67854-22-R-

7701_CVR_RFP_v1.7

CLIN 0001 and (CLIN 0002) Please clarify that the stated "PWS paragraph 5.3.1 and PWS-Attachment 3" refer to the T0001 PWS paragraph 5.2.1 (5.2.2) and T0001 PWS Attachment 3.

The final solicitation will be updated to clarify the correct PWS paragraphs.

47 DRAFT+--+M67854-22-R-

7701_CVR_RFP_v1.7

CLIN 0003 Please clarify which PWS the stated "IAW PWS paragraphs 5.2.1 and 5.3.2:"

refers to as both have a paragraph 5.2.1 but neither have a 5.3.2.

Refer to the response to question 46.

48 DRAFT+--+M67854-22-R-

7701_CVR_RFP_v1.7

Volume II Technical Proposal, B. Section 2:

Technical Approach

For item 2, please clarify the document where paragraph 5.3.1.4.1 and 5.3.1.4.2 are located. Neither PWS contains a section 5.3.

Refer to the response to question 46.

49 DRAFT+--+M67854-22-R-

7701_CVR_RFP_v1.7

Volume II Technical Proposal, B. Section 2:

Technical Approach

Item 2 references sections 5.3.1 and 5.3.2 of the PWS. The base PWS dows have both section 5.3.1 and 5.3.2 in the Table of Contents neither are contained in the document. It appears 5.3.1 may correlate to 5.2.1 in the T0001 PWS and 5.3.2 correlate to 5.2.2 in the T0001 pws. Please clarify or provided the missing PWS sections.

Refer to the response to question 46.

50 DRAFT+--+M67854-22-R-

7701_CVR_RFP+Attach ment+6- Task+Order+1+PWS+v1.

1.6.5, 1.6.7.2.1 Stated place of performance is in the contractor facility (1.6.5). Para 1.6.7.2.1 states the Government, at its option, may replace the affected lock or locks or perform rekeying. It is really the Government's intent to replace these locks/perform rekeying or to direct the contractor - at the contractor's own expense

- to perform this in the contractor's facility? Or is the intent of this section directed at keys issued to the contractor in a Government facility?

The intent of this section is directed at keys issued to contractors for a Government facility.

51 32 Section L Bullet 2 references paragraphs 5.3.1 and 5.3.2 of the PWS. However, neither the SATOC PWS nor the TO 0001 PWS has a section 5.3 or subordinate sections.

Will the customer please provide the referenced PWS sections to ensure compliance to the requirements?

Refer to the response to question 46.

52 18 Task Order 0001 PWS The PRS references PWS Sections 5.3.2 in the first table entry, and sections 5.3.3, 5.3.4, and 5.3.5 of the PWS. However, neither to SATOC PWS nor the TO 0001 PWS has a section 5.3 or subordinate sections. Will the customer please provide the referenced PWS sections to ensure compliance to the requirements?

Refer to the response to question 46.

Government Responses to Industry Feedback on CVR DRAFT Request for Proposal Cyber Vulnerability Research (CVR) Services M67854-22-R-7701

Comment Number

Solicitation Section Document/Page/Paragraph/Line Number Comment/Question Government Response To Industry

53 30 Section L Section L states, "Offerors shall submit evidence of a fully adjudicated and active Top-Secret Clearance identified in the Joint Personnel Adjudication system (JPAS) for all personnel proposed to support Task Order 0001, which will be awarded simultaneously with the award of the single source, IDIQ contract pursuant to this solicitation." The PWS does not state the clearance requirement for individuals performing on the contract other than the identified Key Personnel. Will the customer confirm the clearance requirement for non-key personnel bid in support of Task Order 0001 is Top-Secret clearance?

The Government will update PWS Section 1.6.7 to indicate the type of security clearance required for all personnel performing under this potential contract. The requirement is for all personnel to have and maintain a TS/SCI clearance.

54 30 Section L Section L states, "Offerors shall submit evidence of a fully adjudicated and active Top-Secret Clearance identified in the Joint Personnel Adjudication system (JPAS) for all personnel proposed to support Task Order 0001". To allow offerors to source a wider variety of candidates which helps to reduce costs to the Government, will the Customer accept evidence of a fully adjudicated and active clearance from JPAS or Scattered Castles for non-key personnel bid in support of Task Order 0001?

The Government requires that personnel who will perform work under CVR and its associated Task Orders to be fully adjudicated and possess active TS clearances in DISS (which replaced JPAS). If offerors are in scattered castles, the Government would be able to see their clearance in DISS.

55 30 Section L To allow offerors to source a wider variety of candidates, which helps to reduce costs to the Government, will the Customer accept evidence of a fully adjudicated and active clearances from JPAS or Scattered Castles for key personnel bid?

Refer to the response to question 54.

56 3 SATOC PWS The SATOC PWS states the "place of performance will be at contractor facility, unless stated otherwise in a Task Order". In the Task Order 0001 PWS, section 1.6.5, the place of performance states " it will be at contractor facility unless stated otherwise in a task order." Will the customer please confirm the Place of Performance for TO 0001?

The place of performance will be the contractor facility for the task order.

57 General To help the Government ensure that it is only evaluating proposals in Phase 2 from credible offerors, would the Government consider adding proof of catalog purchases to the GO/NO-GO criteria? Per PWS Section 5.2.1 the Government intends to purchase via a catalog and awarding to an offeror that has the corporate capabilities to invoice and support a catalog will increase the speed that solutions can be brought to the mission under this vehicle.

The Government will not modify the Go/No-Go criteria to require proof of catalog purchases.

58 General This offeror recommends a requirement for inclusion of the following items for Volume 1 GO/NO-GO evaluation: 1) proof of a draft catalog with similar list items to the solicitation PWS, and 2) at least one (1) invoice for catalog services as proof of sale from the referenced catalog.

The Government reviewed the recommendation and will not modify the Go/No-Go criteria to reflect a requirement for both items.

59 25 General Some Government entities only allow discussion and reference to work similar to this Scope in classified environments. Would the Government allow classified submissions for the Past Performance volume to allow contractors to accurately show relevance?

No, the Government will not allow classified submissions. The Government requires all proposal information to be at the unclassified level.

60 25 General Some Government entities only allow discussion and reference to work similar to this Scope in classified environments. Would the Government allow classified submissions for the Past Performance Questionnaires, and include classified POC details for submission?

Refer to the response to question 59.

Government Responses to Industry Feedback on CVR DRAFT Request for Proposal Cyber Vulnerability Research (CVR) Services M67854-22-R-7701

Comment Number

Solicitation Section Document/Page/Paragraph/Line Number Comment/Question Government Response To Industry

61 Section L For the Small Business Subcontracting Plan, in order to meet FAR 52.219-9 Small Business Subcontracting Plan (Nov 2021) Alternative II (Nov 2016) and DFARS 252.219-7003, please confirm that the Small Business Contracting Plan is not included in the 5 Page Limit for Volume I.

It is not included.

62 Section L Some Government entities only allow discussion and reference to work similar to this Scope in classified environments. Would the Government allow for a classified Organizational Experience response?

Refer to the response to question 59.

63 DRAFT -- M67854-22-R-

7701_CVR_RFP_v1.7.pdf/Section 5/Number 9

To better allow "Go" decisions for Offerors who have successfully applied innovative solutions outside of the DoD, would the Government allow for relevant past performance examples from the IC as well as the DoD?

In accordance with the RFP, Section L, paragraph 5 Proposal Content, Volume III - Past Performance Proposal, Offerors are allowed to submit relevant past performance examples from DoD or outside of DoD as long as it is not classified.

64 N/A N/A Would the Government consider awarding a multiple award task order contract to promote broader access to industry technology partners and emerging capabilities?

No. This will be a single award contract.

65 N/A N/A Would the Government consider providing the number of task orders anticipated throughout life of the IDIQ?

Refer to the response to question 14.

66 Pricing Worksheets Would the Government consider providing the level of effort (LOE) and/or the specific # of FTE per CLIN?

Since this is a performance based requirement, the Government is unable to provide a LOE and/or specific # of FTEs. All Offerors should propose a LOE that is based on their solution to the Government's requirement.

67 Pricing Worksheets Would the Government consider providing detailed travel information (# of trips, destination, length of stay, etc.) to assist contractors with pricing travel?

Refer to the response to question 40.

68 Pricing Worksheets Would the Government consider providing targeted ODC information to assist contractors with pricing ODC?

The Government will provide a plug number for ODC, and, based on the requirements of the PWS, the Offeror should identify to the Government what they are requesting approval to purchase.

69 PWS Place of Performance Will the Government provide additional details of the secure space to include number of expected seats Lab space to include power and cooling needs for specialized equipment, and secure communications connections?

The Government will not specify how many secure space(s), lab space(s), or cooling/power equipment needed to perform CVR. The Government seeks a performance based solution from the offerors.

70 PWS 5.1.5 Would the Government elaborate on the number of implant equity tiers and levels it expects to conduct starting with the base year and out year options? Will a single TTO cover multiple implant equity tiers?

The Government has budgeted for 30 Low Complexity Exploits and 20 Medium Complexity Exploits, 2 High Complexity Implants, and 2 Medium Complexity Payloads, per year. Based on funding constraints, one or more task orders may be issued to fulfill the requirements each year of the contract.

71 CVR RFP Vol1.7 4b Would the Government consider increasing the Technical Volume Page count to include the submission of a Catalog (Vulnerabilities, PoC Exploits, and Low equity tools)?

The Government plans to increase the page count to allow for a focused submission of an offerors catalogs. The Government does not want hundreds of pages of catalog information to review and assess during the source selection process.

72 RFP Volume 1;Go/No Go #1; Pg. 29 Does the OCI pertain to the Prime vendor or does it also pertain to any subcontractors?

The OCI pertains to Prime and all Subs.

Government Responses to Industry Feedback on CVR DRAFT Request for Proposal Cyber Vulnerability Research (CVR) Services M67854-22-R-7701

Comment Number

Solicitation Section Document/Page/Paragraph/Line Number Comment/Question Government Response To Industry

73 RFP Volume 1; Go/No Go#1; Pg. 28 Would the Government consider listing any known contractors and/or contracts maintaining an actual and/or potential OCI?

There are no known contractors and/or contracts maintaining actual and/or potential OCIs.

74 RFP Volume II-Tech Proposal Since offerors that do not have significant capabilities or, at a minimum, low equity tools to offer on day one increase risk and cost to the Government, would the Government consider a requirement for offerors to also include their catalog for evaluation either as part of the Technical Volume or as a an appendix to the Technical volume?

No, the Government will not require catalog submissions but plans to increase the page count for this Volume in order to allow offerors to submit catalog information that is focused. Refer also to the response to question 71.

75 RFP Volume IV-Price Proposal Can the Government confirm that offerors without approved DCAA accounting systems are not eligible to bid?

Offerors are required to have an acceptable accounting system per DFARS clause 252.242-7006.

76 RFP Volume IV-Price Proposal Can the Government confirm if offerors should include their approved DCAA accounting system certification and approved rates in the Pricing Volume?

Yes, the formal solicitation will be modified so that offerors include their approved DCAA accounting system and approved rates if they have them.

77 RFP, Section J List of Attachments, page 17 of 41 Table in Section J of the RFP shows Attachment 1, Performance Work Statement (PWS), Date Created 7 April 2022 listed as 45 pages. Adobe file for Attachment 1 ends at page 34. Total file length is 38 pages. Can government clarify if PWS document file is missing pages?

Section J will be updated to correct the page count once the PWS is finalized.

78 RFP, Section L Section L, Section 1, sub-paragraph e, page 25 of

Para e says "The Offeror shall not include classified material in any proposal section." In an effort to allow for a fair and competitive playing field; and so that Offerors can fully demonstrate and substantiate technical experience in accordance with Section M Factor 1 - Technical Approach Section 2: "As such, the Government will evaluate the Offeror’s Technical Approach Section of its Technical Proposal to determine the extent to which it demonstrates the Offeror’s competence, technical understanding" and Section M Factor 2 - Past Performance criteria: "Past Performance Relevancy Rating," and "Performance Confidence Assessment would the government allow for classified proposal submissions at the TS/SCI level to allow for differentiation and to prevent from unduly limiting competition?

Refer to the response to question 59.

79 RFP, Section L Section L, Section 1, sub-paragraph i, page 26 of

In order to adequately detail and describe relevant past performance to the requirements in the CVR PWS, would the Government consider accepting a classified response (TS/SCI) for Volume III, Past Performance, and if so, would the Government please provide a JWICS email for submission?

Refer to the response to question 59. The Government will not provide a JWICS email.

80 RFP, Section L Section L, paragraph 5, Volume I (Go/No-Go Criteria), sub-paragraph 4 through 8, page 30 of

Paragraphs 4 through 8 of the Go/No-Go Volume requires evidence of several items including SCIF space, classified e-mail, secure phone and key personnel clearance in JPAS. Collectively providing lease documents and JPAS screen shots will far exceed the 5 page limit of this volume. Can this evidence be provided in an Appendix to Volume I with no page limit?

The formal solicitation will be updated to allow a page increase so Offerors can show evidence to support their Go/No-Go criteria proposal submission.

81 RFP, Section L Section L, paragraph 5, Volume I (Go/No-Go Criteria), sub-paragraph 10, page 31 of 41

Paragraph 10 of Volume 1 (Go/No-Go) requires a Small Business Subcontracting Plan in accordance with FAR 52.219-9. To meet FAR requirements, this plan far exceeds the five page limitation for Volume 1 (over 30 pages for Small Business Subcontracting Plan alone). Will the government consider moving the Small Business Subcontracting Plan to Volume IV (Cost Volume)?

The Small Business Subcontracting Plan will remain as an attachment to the Go/No-Go Criteria Volume.

Government Responses to Industry Feedback on CVR DRAFT Request for Proposal Cyber Vulnerability Research (CVR) Services M67854-22-R-7701

Comment Number

Solicitation Section Document/Page/Paragraph/Line Number Comment/Question Government Response To Industry

82 RFP, Section L Section L, paragraph 5, Volume II (Technical) , sub-paragraph 3, page 32 of 41

Subparagraph 3 of Technical Volume requires the offeror to submit a compensation plan to include salaries, burdened costs, fringe benefits, etc. Section L, paragraph 3.f states "Inclusion of cost or pricing information, or information which cost or pricing could be reasonably inferred, in the Technical Proposal may render the proposal non-compliant and ineligible for evaluation and award." Can the government confirm the Compensation Plan should be included in the Cost/Price Volume IV and NOT in the Technical Volume II?

Yes, the compensation plan should be included in Volume IV. The formal solicitation will reflect this change.

83 RFP, Section L Volume II - Technical Proposal, sub-paragraph B- 1, page 32 of 41

Section L states: "For evaluation purposes only, the Offeror’s Technical Approach will not address all of the requirements delineated in the TO. Instead, the Offeror’s Technical Approach should clearly demonstrate the Offeror’s competence, technical understanding and approach in order to: 1. Meet all of the requirements delineated in paragraph 5.2.1 through 5.2.11." Did the government intend this to reference the SATOC PWS rather than the TO PWS?

Section L and M will be modified to clarify which PWS is being referenced and the respective proposal instructions and evaluation criteria.

84 RFP, Section L Volume II - Technical Proposal, sub-paragraph B- 2, page 32 of 41

Section L states: "For evaluation purposes only, the Offeror’s Technical Approach will not address all of the requirements delineated in the TO. Instead, the Offeror’s Technical Approach should clearly demonstrate the Offeror’s competence, technical understanding and approach in order to: 2. Meet all of the requirements delineated in paragraph 5.3.1 and 5.3.2 of the PWS and all subordinate PWS paragraphs thereunder. Can the government clarify where these PWS paragraphs are located?

Refer to the response to question 83.

85 RFP, Section L Section L, paragraph 5, Volume IV (Price Proposal), page 34 of 41

Will the government be providing plug values for ODC and Travel? The Government will provide plug numbers for ODC and travel.

86 RFP, Section L Section L, paragraph 6, page 35 of 41 Para 6 says "The successful Offeror’s proposed key personnel who are evaluated during the source selection process may be selected as part of the performance of the CVR contract." In which volume are the Key resumes required? Is there a page limit on the resumes?

Key personnel resumes will be included in proposal submissions at the task order level. The Government anticipates limiting resumes to no more than 2 pages.

87 RFP, Section L Section L, paragraph 6, page 35 of 42 Para 6 says "The successful Offeror’s proposed key personnel who are evaluated during the source selection process may be selected as part of the performance of the CVR contract." Can the government provide the evaluation criteria for the key resumes and their relative weight with the other sub factors?

Key personnel resumes will be evaluated at the task order level. As such, the evaluation criteria will be defined at the task order level.

88 Section 1.6.16 CYBER VULNERABILITY

RESEARCH (CVR)

PERFORMANCE WORK STATEMENT

SINGLE AWARD TASK ORDER CONTRACT

(SATOC)

Phase In/Phase Out Period states the contractor shall have personnel on board during the phase in period, which is the first 30 days after contract award. During the Phase in period, the contractor shall become familiar with performance requirements in order to commence full performance of services on the contract start date, which is the first day after the phase in period starts. There is no contract in place and there is no CLIN to cover Phase In. Will the government please clarify how work performed during the phase in period will be reimbursed and where the phase in costs should be allocated?

Since this is a new requirement, there will not be a Phase In period upon commencement of the requirement. However, if there is a follow on contract resulting from this contract, there will be a Phase Out period, which will be the last task order awarded under this contract.

89 Draft RFP / Vol 2 B Technical approach, Page 32 Sections 5.3.1 to 5.3.2 are not in draft RFP, will they be provided in final RFP? Yes, the formal solicitation will be updated to clarify the correct PWS paragraphs.

90 Draft RFP / Vol 2 B Technical approach, Page 32 Sections 5.2.1 to 5.2.11 there are duplicates of 5.2.11 and 13 tasks listed. Please clarify if all 13 tasks are to be responded.

Refer to the response to question 11.

Government Responses to Industry Feedback on CVR DRAFT Request for Proposal Cyber Vulnerability Research (CVR) Services M67854-22-R-7701

Comment Number

Solicitation Section Document/Page/Paragraph/Line Number Comment/Question Government Response To Industry

91 General Draft RFP Will Key Personnel (KP) be listed in the staffing plan, section 1? Will KP listing count against page count?

The Government will identify key personnel for the base contract and for all Task Orders. The Staffing Plan workbook is for the offerors to propose their staffing plan in response to the CVR solicitation and the PWS. Any key personnel listed in the staffing plan workbook or the narrative of the staffing plan will count against the page count.

92 Does the government intend to use the VR/RE and Exploit Procurement SME as an intermediary between the direct support office and various USG Agency Acquisition Offices?

The VR/RE and Exploit Procurement SME will be the intermediary between the USMC and the contractor.

93 Will the IDIQ allow for R&D activities to build new capabilities for the customer base? Additionally, if services are developed and procured under the scope of the IDIQ, will the offeror be contracted for sustainment activities?

The IDIQ will encourage R&D activities to build new capabilities for the customer base. Sustainment will be considered for 1 year after delivery and Operational Acceptance on a task order basis.

94 Does the scope of work relate to OCO (Offensive Cyber Operations) or Cyber ISR (Intelligence Surveillance and Reconnaissance)?

It is related to OCO.

95 Does the government intend to release an ICE as part of the formal RFP? No, the Government will not release an ICE.

96 Will the programmatic office allow a 1:1 meeting to let our team better grasp the stated requirements as they relate to the mission space?

No, the Government will not meet one on one with Offerors.

97 What is the expected procurement ceiling for exploits and vulnerabilities? Refer to the response to question 70.

98 What is the labor ceiling for testing and vetting of vulnerabilities and exploits? Since this is a performance based acquisition, the Government is unable to provide a labor ceiling. All Offerors should propose labor that is based on their solution to the Government's requirement for testing and vetting of vulnerabilities and exploits.

99 How will you rate the contractor related to vulnerability and exploit sourcing capabilities?

Offerors will be evaluated based on their competency, technical understanding and approach to performing vulnerability and exploit sourcing capabilities. Refer to Section M of the formal solicitation for more information.

100 Are you considering a multi-award option to allow for small offensive cyber, small Vulnerability Research Firms, and Exploit/Vulnerability Brokers to participate directly?

This is a single award contract.

101 Are you considering a staged approach to the facility security requirements? The Government is not considering a staged approach. The SCIF will require safeguarding of classified material.

Government Responses to Industry Feedback on CVR DRAFT Request for Proposal Cyber Vulnerability Research (CVR) Services M67854-22-R-7701

Comment Number

Solicitation Section Document/Page/Paragraph/Line Number Comment/Question Government Response To Industry

102 Can this be supported from multiple classified locations within 50 mile radius of Fort Meade?

Yes, the requirement can be supported from multiple classified locations.

103 Will the contractor be required to have SCIF space available at Award for 15+ individuals?

The Government does not have a space requirement for the contractor's SCIF.

Offerors should determine their space needs based on their solution proposed to fulfill the Government's requirement.

104 Will the contractor have spaces adjacent to the classified environments that support unrestricted Open source research?

The Government is unable to provide information regarding contractor specific facilities. The Government will not provide spaces in Government facilities to the contractor.

105 • Will Offerors be we able to leverage alternate classified locations to support the work? (e.g., Colorado Springs, San Antonio, Etc).

• Can the requirements for the years of experience be lowered to 8 years? This will provide the government maximum flexibility and reach back. Individuals in this space rarely have 16-year careers experience solely in Exploit development or engineering and have spent more time in Management, supervisory or rotational roles. The optimum individuals are those with 8 years of experience who may have 8 years of total experience.

• Can the Government change this to get the true target of the ask for the 8 years of exploit development/tool development /testing experience.

The Government will not require just one classified facility. The Government's requirement is for offerors to have a NSA accredited SCIF, either owned or leased.

Offerors should determine the location and number of facilities that they will utilize to fulfill the Government's requirement.

No, the Government requires the years of experience and expertise of a senior or higher level equivalent for these labor categories.

106 Will the government provide requirements for the Target and Market Analysis position, and the Cyber Vulnerability Research position?

The requirements will be listed in the follow-on Task Order's PWS. Due to the nature of this requirement, details are classified and cannot be provided in this document.

107 Could Offeror’s use company systems for research since it is cyber vulnerability research or is government proprietary?

Company systems can be used for research, as long as classified material is handled in accordance with the PWS.

108 Is the work specific to JTF – ARES or JFHQ- (C) Marine Corps, because these two organizations have two different missions?

The work supports the Marine Corps only.

Government Responses to Industry Feedback on CVR DRAFT Request for Proposal Cyber Vulnerability Research (CVR) Services M67854-22-R-7701

Comment Number

Solicitation Section Document/Page/Paragraph/Line Number Comment/Question Government Response To Industry

109 Can the Government please confirm that there is no way for bidders to provide classified responses, annexes, or past performance for this proposal response? Our company has significant experience in the requirements outlined in the PWS but due to customer sensitivities, we are limited in what we can share at the unclassified level. Providing the Government with a classified response would enable a more thorough review of bidders' qualifications and ensures the Government has all the information required to chose the best value solution.

The Government will not accept classified data in response to the formal solicitation.

110 RFP V1.7 Page 30/Bullet 4 "Offerors shall submit evidence that it owns or leases a National Security Agency (NSA) accredited Sensitive Compartmented Information Facility accredited to handle and store Top Secret, Sensitive Compartmentalized Information."

Would the Government consider non-NSA accredited SCIF's. For Example DIA accredited SCIFs.

The Government will only accept NSA accredited SCIFs.

111 RFP V1.7 Page 30/Bullet 8 "Offeror shall submit evidence that it currently has access to an NSA Secure Telephone System."

Would the Government consider non-NSA Secure Telephone Systems. For Example DIA Secure Telephone systems.

The Government will only accept a NSA Secure Telephone System.

112 SATOC PWS V6.8 pg.25/Bullet 5.1.5 In reference to the 5.1.5; Are any potential Low & medium equities obtained from 3rd party open sources and/or modified for this proposal within scope for the

CVR?

-That would be If so, that would affect the solutioning space for proposed responses.

There may be potential for low and medium equities obtained from 3rd party open sources. The CVR requirement is to determine if implants, exploits, or targets are possible, and the Government desires to leverage the expertise and knowledge of the CVR contractor to see if some of the tasks or mission sets are possible.

Therefore, the Government will not direct the contractor on how software is developed, but rather will leverage the knowledge, skills, and abilities of the service provider.

113 SATOC PWS V6.8 pg.27/Bullet 5.2 In reference to the 5.2; Are there any restrictions on the classes of target devices that Vulnerability Research (VR) Tasks will be performed on? (eg. Mobile, Middleware, Layer-2, IoT, MilSpec, CLOUD, etc..) The answer to this question will affect the scope of our proposed solutioning for the CVR response.

There are no restrictions on the "classes" of targets. This will be further defined in follow-on task orders. However, to provide a few examples of what the contractor may expect to see in a task order: Low Complexity: Readily found via market research. Available to the public, and publish to public forums for over 60 days.

The software code is over 90% established with little work required for use by the government.

Medium Complexity: Not advertised to the public and not discoverable by market research. Typically proprietary software protected by a business or entity. Not available to the public and not discoverable nor published to public forums. The software code is between 50%-89% established and requires significant work for the code to be used by the government.

High Complexity: Not advertised to the public and not discoverable by market research. Not yet developed by a business or entity. The software code is between 0%-49% established and requires significant work for the code to be used by the government.

114 SATOC PWS V6.8 pg.27/Bullet 5.2 With respect to the 5.2 para. II, are there any foreseen sensitivities regarding performing government contractor analysis and…