M67861-15-T-0070_.doc

Section SF 1449 - CONTINUATION SHEET

Software Licenses

FFP

“Brand Name or Equal” to Splunk Mfr. Part # SE-T-LIC-ESUP. Splunk Enterprise - Term License with Enterprise Support - 100 GB/day. 12 Months. Please reference Statement of Work (SOW) herein.

FOB: Destination

PURCHASE REQUEST NUMBER: M0009415RC00085

NET AMT

Onsite Software Training

“Brand Name or Equal” to Splunk Mfr. Part # EDU-ADMIN ONSITE. Administering Splunk V6, Onsite, Maximum 12 Students. Contractor consultant and training services shall be completed no later than June 30, 2016. Please reference Statement of Work (SOW) herein.

FOB: Destination

MILSTRIP: M0009415RC00085

NET AMT

Onsite Software Training

“Brand Name or Equal” to Splunk Mfr. Part # EDU-ADSRPT ONSITE. Advanced Searching and Reporting with Splunk V6.2, Onsite, Maximum 12 students. Contractor consultant and training services shall be completed no later than June 30, 2016. Please reference Statement of Work (SOW) herein.

FOB: Destination

NET AMT

Onsite Software Training

“Brand Name or Equal” to Splunk Mfr. Part # EDU-BUSER ONSITE. Using Splunk V6, Onsite, Maximum 12 students. Contractor consultant and training services shall be completed no later than June 30, 2016. Please reference Statement of Work (SOW) herein.

FOB: Destination

NET AMT

Onsite Software Training

“Brand Name or Equal” to Splunk Mfr. Part # EDU-DEPL ONSITE. Architecting and Deploying Splunk V6, Onsite, Maximum 12. Contractor consultant and training services shall be completed no later than June 30, 2016. Please reference Statement of Work (SOW) herein.

FOB: Destination

NET AMT

Onsite Software Training

“Brand Name or Equal” to Splunk Mfr. Part # EDU-SRPT ONSITE. Searching and Reporting with Splunk V6, Onsite, Maximum 12 students. Contractor consultant and training services shall be completed no later than June 30, 2016. Please reference Statement of Work (SOW) herein.

FOB: Destination

NET AMT

Onsite Software Training

“Brand Name or Equal” to Splunk Mfr. Part # EDU-KNWL ONSITE. Creating Splunk Knowledge Objects, Onsite, Maximum 12 Students. Contractor consultant and training services shall be completed no later than June 30, 2016. Please reference Statement of Work (SOW) herein.

NET AMT

Onsite Installation Support

“Brand Name or Equal” to Splunk Mfr. Part # PS-DEP-US-5. Splunk Professional Services Deployment, 5 Days. Contractor consultant and training services shall be completed no later than June 30, 2016. Please reference Statement of Work (SOW) herein.

NET AMT

Travel and Expenses

“Brand Name or Equal” to Splunk Mfr. Part # EDU-TS-PP. Travel and Expenses. Contractor consultant and training services shall be completed no later than June 30, 2016. Please reference Statement of Work (SOW) herein.

NET AMT

INSPECTION AND ACCEPTANCE TERMS

Supplies/services will be inspected/accepted at:

DELIVERY INFORMATION

TSO

135 N PENNSYLVANIA ST.

SUITE 2215

INDIANAPOLIS IN 46204

317-200-3322

M00094

M00094

M00094

M00094

M00094

M00094

M00094

M00094

M00094

STATEMENT OF WORK (SOW)

1.

Scope.

This Statement of Work covers the procurement of a commercial-off-the-shelf (COTS) Security Information and Event Management (SIEM) suite and vendor-provided, on-site customer support and training for a pre-defined period of time. This on-site support is to be provided by a consultant for installation support and a trainer to provide the SIEM tool specific training. This support shall include, but is not limited to, technical installation, maintenance training and assistance; assistance with integration into applicable applications, software and servers and devices; additional software security and any task that would directly affect the effective operation of the product for the TSO.

1.1 Background.

The Technology Services Organization (TSO) is a software development organization which develops and maintains web-based applications that rely on internally generated data to provide support to the entire range of Marine Corps manpower and financial management information systems and applications, which process Personally Identifiable Information (PII) and financial data for all active duty and retired Marines. As such it is imperative that the systems enforce system and application log related security controls in accordance with DoDD 8500.01E, Cybersecurity DoDI 8510.01 Risk Management Framework (RMF) for DoD IT, DISA Security Technical Implementation Guidelines (STIGs), DISA Security Requirements Guides (SRGs) National Defense Authorization Act (NDAA). Furthermore, NIST Special Publication 800-137 Information Security Continuous Monitoring (ISCM) encourages SIEM to integrate the analysis of vulnerability scanning information, performance data, network monitoring and system audit record information in order to enhance the ability to identify inappropriate or unusual activity. The SIEM suite allows administrators and security analyst to centrally store, analyze and correlate log data in support of cybersecurity incident response and IT infrastructure incident management.

2.

Applicable Documents.

2.1 Industry documents.

· Gartner: Magic Quadrant for Security Information and Event Management, June 2014

3.

Tasks.

3.1 General Requirements.

The TSO requires a commercially-developed SIEM in order to alert, monitor, store, correlate and analyze operating system, web server, application server, database, network device, government-off-the-shelf (GOTS) and COTS application log data. Further, the TSO requires a distributed SIEM suite that can be integrated into two production and one test & development enclave with centralized management. The acquisition of such a tool will aide in ensuring PII breaches and cybersecurity incidents are identified and addressed as early as possible, and in accordance with requirements as established by the Department of Defense (DoD), Department of the Navy (DoN), and Headquarters Marine Corps (HQMC) C4 Cybersecurity.

3.2 Technical Objectives and Goals.

· Provide the TSO’s Incident Management and Cybersecurity Incident Response capabilities by allowing system administrators and security analysts to centrally store, monitor, analyze and correlate log data; decreasing the man-hours devoted to manually reviewing log data.

· Provide the TSO support in automating the implementation, assessment, and continuous monitoring of several NIST SP 800-53 security controls to include but not limited to; AC-5, Separation of Duties; AU-2, Auditable Events; AU-6, Audit Review, Analysis, and Reporting; Au-7, Audit reduction and Report Generation; CA-7, Continuous Monitoring; IR-5, Incident Monitoring; RA-3, Risk Assessment; RA-5, Vulnerability Scanning; and SI-4, Information System Monitoring.

· Provide security metrics reports, dashboards, log parsing via searches for reporting monitoring and compliance effectiveness management and stakeholders.

3.3 Specific Requirements.

Splunk brand name items or equal:

Splunk enterprise is an application that performs log management to include authentication, distributed search, deployment management, scheduling of alerts and role based accesses controls. It provides the capability to scale the amount of logs the application monitors. It allows for customization of the GUI and search criteria.

The TSO requires:

· A tool that integrates with various operating systems, web server applications, application servers, database servers, Lightweight Directory Access Protocol (LDAP) servers, network devices, government-off-the-shelf (GOTS) web applications and COTS applications, to include but not limited to; Microsoft Windows Server 2008 and 2012; Microsoft IIS 6.0; Microsoft SQL Server 2008 and 2014, Microsoft Windows 7; RedHat Enterprise Linux 5 and 6; Oracle Linux; Oracle Fusion Middleware 11g; Oracle Database 11.2g and 12c and Database Management Servers, Oracle Real Application Clusters 112.2g and 12c and Grid Infrastructure; Oracle WebLogic 12c; Oracle Identity Management; IBM Cognos Business Intelligence 10.2 Big-IP F5 Local Traffic Manager, Access Policy Manager and Application Security Manager; IBM WebSphere; ESX VMWare ESXi; TACACS+ servers and NetApp Storage Area Network devices.

· Log management automation that allows for the representation of historical log data.

· Facilitates review and log data analysis for indications of unusual or malicious events or incidents.

· Integrated threat intelligence feeds in support of risk based analysis, risk assessments and cybersecurity incident detection.

· Automated correlation searches and engine utilizing various data sources as well as, allowing for real-time threat analysis and baseline anomaly detection.

· Ability to utilize raw data in the creation of graphics, dashboards, reports, security metrics as well as, the ability to export into .pdf or .csv formats.

· User identity and asset correlation features that allow administrators to correlate specific users.

· Distributed SIEM solution with centralized management of both the tool and log data.

· Log retention capability allowing for compression and storage for a period of no less than two years.

· Capable of LDAP or Microsoft Active Directory authentication integration.

· Tamper-proof and audit quality protection measures ensuring the integrity of log data.

· Detection and administrator alerting of event collection failures as well as; ability to validate original event sources are still sending events.

Automatic Log Management and Repository Requirements:

General

· The solution shall provide a lightweight agent that resides on the servers to be managed. It shall be able to consume no more than 1 GB of memory and minimum CPU cycles.

· The agent based solution shall scale to support at least 100 GB of log traffic per day.

· The solution shall support agents for multiple Operating Systems including Windows XP, Windows Vista, Windows 7, Windows 2003 Server, Windows 2008 Server, VMWare ESX Server, Redhat Enterprise Linux, Solaris Unix, etc.

· The solution shall support the multiple files systems including NFS3 and 4, ext, UFS, NTFS, FAT32, etc.

· The solution shall not be dependent on OS components such as Windows Management Interface (WMI).

· The solution shall use a single configurable port for all client-server communication.

· The solution shall be FIPS certified and have a Common Criteria certification of EAL Level 2.

· The solution shall be accredited to run on USMC networks with an ATO for MCEN on NIPR and SIPR.

· The solution shall be capable of storing up to 2 years of information or up to 24TB of data.

· The solution shall be capable to scale to monitor up to 2,000 servers.

· The solution shall provide security updates and patches as needed to maintain DoD STIG requirements.

Search capabilities and log monitoring

· The solution shall have search capability of the logs for log monitoring.

· The solution shall have a web based front end to allow multiple users. The GUI shall be supported on DoD approved application servers (WebLogic, OAS, Apache, IIS).

· The solution shall provide the capability of real-time monitoring and alerts.

· The solution shall be able to monitor several variations of logs. Logs from application servers, Operating Servers, and Database’s.

· The solution shall provide the ability to customize out of the box inspection content to meet USMC organizational needs.

3.3.1 Contractor Services.

The purpose of the services provided by the contractor hereunder is to support the TSOs audit logging requirements and the associated roll-out of SIEM products. The contractor shall provide a SIEM suite Consultant and a SIEM suite Trainer to fulfill this effort.

Contractor consultant and training services shall be completed no later than June 30, 2016. The Contracting Officer’s Representative will coordinate consultation and traning dates with contractor as Government prepares and transitions to SIEM suite.

Consultant:

The contractor shall provide a SIEM suite Consultant on a “Full-Time” basis for a term of twenty (20) days, with “Full-Time” defined as eight (8) hours per day.

The SIEM suite Consultant shall provide the following Services:

· Assist in the installation, configuration, and tuning of SIEM suite.

· Assist in integration of SIEM suite log indexing into all TSO supported environments.

· Assist TSO in establishing organization specific configurations that will allow the TSO to tune, retrieve, and correlate relevant data and alerts.

· Assist TSO in creating security related correlation searches.

· Assist TSO in configuring SIEM suite to meet NIST 800-53 Audit and Accountability Security controls.

· Assist in creating custom reports and security metrics with the SIEM suite.

· Assist in creating custom alerts and correlation searches in support of cybersecurity requirements as outlined in section 3.3 “Specific Requirements”

· Assist in integrating the SIEM suite into the TSO Cybersecurity Incident Response Procedures.

· Perform additional SIEM suite related tasks as mutually agreed

Trainer:

The contractor shall provide a SIEM suite Trainer on a “Full-Time” basis for a term of ten (10) business days, no less than eight (8) hours a day The trainer shall work in conjunction with the U.S. Marine Corps designated contact.

The SIEM suite Trainer shall perform the following Services: (Splunk brand or comparable)

· Teach the six (6) purchased SIEM Education classes to targeted administrators and information security personnel in accordance with training purchased in the contract. The topics to be covered are:

· Using Splunk brand or comparable

Introduction to Splunk brand or comparable interface

Using pivot

Searching and saving results

Using fields

Creating reports and visualizations

Working with Dashboards

· Searching and Reporting

Search Fundamentals

Reporting Commands

Analyzing, Calculating, and Formatting Results

Correlating Events

Enriching Data with Lookups

· Creating Knowledge Objects

Fields (Field aliases, field extractions, calculated fields, source type renaming)

Tags and Event Types

Workflow Actions

Alerts

Macros

Data Models

· Advanced Searching and Reporting

Beyond Search Fundamentals

Using Sub-searches

Using Advanced Statistics

Manipulating & Filtering Data

Using Advanced Charting

Using Advanced Transactions

Using Advanced Lookups

· Splunk brand or comparable Administration

License management

Getting data in

Managing Splunk brand or comparable apps

Splunk brand or comparable configuration files

Universal forwarder and forwarder management

Data inputs in detail

Index administration, maintenance and optimization

Users, roles, and authentication

Event Parsing with data preview

Manipulating raw data

Field extraction

Distributed search

Search performance tuning

Introduction to large-scale Splunk brand or comparable deployment

Monitoring and troubleshooting

· Architecting and Deploying

Deployment Planning

Infrastructure planning

Data collection

Data comprehension

Search considerations

Development tools and external integration concepts

Operations and management

PWS/SOW ADDENDUM (INJURY/ACCIDENT REPORTING AND REPORTING LABOR HOURS)

SAFETY GUIDANCE

Contractors shall adhere to all relevant safety guidance, including (but not limited to):

(a) EM 385-1-1 – U.S. Army Corps of Engineers Safety and Health Requirements Manual

(b) OPNAVINST 5100.23 (series), Navy Occupational Health and Safety Program Manual

(c) MCO 5100.29 (series), Marine Corps Safety Program

(d) MCO 5100.8, Marine Corps Occupational Safety and Health (OSH) Policy Order

(e) NAVMC DIR 5100.8, MARCOR OSH Program Manual

Contracting Officer’s Representatives shall immediately report accidents/injuries sustained during contract performance to the Contracting Officer so that the Contracting Officer may report said accidents/injuries to responsible agency safety officials.

CONTRACTOR REPORTING OF LABOR HOURS

Pursuant to NMCARS 5237.102(90), the contractor shall report contractor labor hours (including subcontractor labor hours) required for performance of services provided under this contract for the Technology Services Organization via a secure data collection site. Contracted services excluded from reporting are based on Product Service Codes (PSCs). The excluded PSCs are:

(1) W, Lease/Rental of Equipment;

(2) X, Lease/Rental of Facilities;

(3) Y, Construction of Structures and Facilities;

(4) S, Utilities ONLY;

(5) V, Freight and Shipping ONLY.

The contractor is required to completely fill in all required data fields using the following web address https://doncmra.nmci.navy.mil.

Reporting inputs will be for the labor executed during the period of performance during each Government fiscal year (FY), which runs October 1 through September 30. While inputs may be reported any time during the FY, all data shall be reported no later than October 31 of each calendar year. Contractors may direct questions to the help desk, linked at https://doncmra.nmci.navy.mil.

All responses to this solicitation shall indicate whether the firm is offering a 'brand name manufacturer's products' or ‘equal products.' Firms offering equal products shall submit sufficient descriptive literature to permit the contracting agency to assess whether the equal product meets all the salient characteristics specified in the solicitation. Firms offering "equal" items shall provide the make, model, description of the items, and provide their own product literature/brochures (not the manufacturer's product literature/brochures nor a reiteration of the salient characteristics provided in the solicitation). This agency will not be responsible for locating or obtaining any information not included as a hardcopy attachment in a response to this solicitation.

All Government software contracts are required to include warranty provisions from authorized sellers/resellers of all commercial and non-commercial publisher software products. The Government will not accept any seller/reseller disclaimers of implied publisher standard commercial warranty. As a minimum software warranties shall cover the performance of all required product capabilities, free from defects/bugs, for all intended authorized users, process for reporting/fixing defects remedied at no charge to the Government, effective after Government tests of delivered software product(s), and include the seller/reseller's return policy and procedures. Bidders shall include End User Licensing Agreement (EULA)/ Warranty with all bids consistent with terms of the Federal Acquisition Regulation (FAR) 52.232.39 Unenforceability of Unauthorized Obligations clause herein to be considered responsive to this solicitation. If any of these conditions are not included in the EULA/warranty provided by sellers/reseller in response to this solicitation, the Government shall not award until these terms have been incorporated and agreed.

INSTRUCTIONS TO OFFERORS

This is a Brand Name or Equal solicitation under FAR Parts 12 and 13.5 for a firm-fixed price contract for the purchase of Splunk Software Licenses, Software Maintenance Support, Onsite Installation Support and Training.

This solicitation will be awarded on an all-or-none basis.

BASIS OF AWARD - Vendor shall refer to FAR clause 52.212-2 herein for evaluation factors. Vendor's quote should address all salient characteristics within technical evaluation worksheet listed in 52.212-2.

Proposals shall document their responsiveness to the Section 508 requirements by either completing the Government Product Accessibility Template (GPAT) included as a part of this solicitation, submitting a Voluntary Product Accessibility Template (VPAT), or Equivalent and Supporting Documentation.

The Contracting Officer will review Past Performance Information Retrieval System (PPIRS) for responsibility determination purposes.

It is the offers’ responsibility to furnish sufficient information and detailed specifications to the government to determine acceptability of the offered item(s). Failure to provide product quotes that meet the salient characteristics may result in quote being considered non-responsive.

All responsible sources may submit a quotation which, if received in a timely manner, shall be considered by the agency.

Method of Invoicing/Payment: Wide Area Workflow (WAWF).

NO PHONE CALLS will be accepted regarding this solicitation. ALL QUESTIONS shall be sent in writing via email to tammy.crump@usmc.mil.

Any direct customer contact by Vendors is not authorized during the solicitation phase or your quote may be at risk of being eliminated from consideration for this solicitation.

TO BE CONSIDERED RESPONSIVE TO THIS SOLICIATION OFFERORS SHALL:

(1) Completely fill out this SOLICITATION AND ALL AMENDMENT documents if issued (including applicable clauses). (a) Return documents along with quote to Marine Forces Reserve Regional Contracting Office POC Only.

(2) Provide a quote on company letterhead.

(3) Provide estimated delivery time after receipt of order for supplies and period of performance for services for each line item or for entire quote (if applicable). This shall be visible on the face of the quote and not incorporated as a link or other attachment.

(4) Provide the following information for all vendors associated with the quote.

(a) Cage Code and or DUNS Number

(b) Address

(b) Point of contact (email and telephone number)

(5) Prompt payment/discount terms (if offered). This will not be used to evaluate offers.

CLAUSES INCORPORATED BY REFERENCE

CLAUSES INCORPORATED BY FULL TEXT

52.203-17 CONTRACTOR EMPLOYEE WHISTLEBLOWER RIGHTS AND REQUIREMENT TO INFORM

EMPLOYEES OF WHISTLEBLOWER RIGHTS (APR 2014)

(a) This contract and employees working on this contract will be subject to the whistleblower rights and remedies in the pilot program on Contractor employee whistleblower protections established at 41 U.S.C. 4712 by section 828 of the National Defense Authorization Act for Fiscal Year 2013 (Pub. L. 112-239) and FAR 3.908.

(b) The Contractor shall inform its employees in writing, in the predominant language of the workforce, of employee whistleblower rights and protections under 41 U.S.C. 4712, as described in section 3.908 of the Federal Acquisition Regulation.

(c) The Contractor shall insert the substance of this clause, including this paragraph (c), in all subcontracts over the simplified acquisition threshold.

(End of clause)

52.209-5 CERTIFICATION REGARDING RESPONSIBILITY MATTERS (APR 2010)

(a)(1) The Offeror certifies, to the best of its knowledge and belief, that-

(i) The Offeror and/or any of its Principals-

(A) Are ( ) are not ( ) presently debarred, suspended, proposed for debarment, or declared ineligible for the award of contracts by any Federal agency;

(B) Have ( ) have not ( ), within a three-year period preceding this offer, been convicted of or had a civil judgment rendered against them for: commission of fraud or a criminal offense in connection with obtaining, attempting to obtain, or performing a public (Federal, State, or local) contract or subcontract; violation of Federal or State antitrust statutes relating to the submission of offers; or commission of embezzlement, theft, forgery, bribery, falsification or destruction of records, making false statements, tax evasion, violating Federal criminal tax laws, or receiving stolen property (if offeror checks “have”, the offeror shall also see 52.209-7, if included in this solicitation); and

(C) Are ( ) are not ( ) presently indicted for, or otherwise criminally or civilly charged by a governmental entity with, commission of any of the offenses enumerated in paragraph (a)(1)(i)(B) of this provision.; and

(D) Have , have not , within a three-year period preceding this offer, been notified of any delinquent Federal taxes in an amount that exceeds $3,000 for which the liability remains unsatisfied.

(1) Federal taxes are considered delinquent if both of the following criteria apply:

(i) The tax liability is finally determined. The liability is finally determined if it has been assessed. A liability is not finally determined if there is a pending administrative or judicial challenge. In the case of a judicial challenge to the liability, the liability is not finally determined until all judicial appeal rights have been exhausted.

(ii) The taxpayer is delinquent in making payment. A taxpayer is delinquent if the taxpayer has failed to pay the tax liability when full payment was due and required. A taxpayer is not delinquent in cases where enforced collection action is precluded.

(2) Examples. (i) The taxpayer has received a statutory notice of deficiency, under I.R.C. Sec. 6212, which entitles the taxpayer to seek Tax Court review of a proposed tax deficiency. This is not a delinquent tax because it is not a final tax liability. Should the taxpayer seek Tax Court review, this will not be a final tax liability until the taxpayer has exercised all judicial appeal rights.

(ii) The IRS has filed a notice of Federal tax lien with respect to an assessed tax liability, and the taxpayer has been issued a notice under I.R.C. Sec. 6320 entitling the taxpayer to request a hearing with the IRS Office of Appeals contesting the lien filing, and to further appeal to the Tax Court if the IRS determines to sustain the lien filing. In the course of the hearing, the taxpayer is entitled to contest the underlying tax liability because the taxpayer has had no prior opportunity to contest the liability. This is not a delinquent tax because it is not a final tax liability. Should the taxpayer seek tax court review, this will not be a final tax liability until the taxpayer has exercised all judicial appeal rights.

(iii) The taxpayer has entered into an installment agreement pursuant to I.R.C. Sec. 6159. The taxpayer is making timely payments and is in full compliance with the agreement terms. The taxpayer is not delinquent because the taxpayer is not currently required to make full payment.

(iv) The taxpayer has filed for bankruptcy protection. The taxpayer is not delinquent because enforced collection action is stayed under 11 U.S.C. 362 (the Bankruptcy Code).

(ii) The Offeror has ( ) has not ( ), within a three-year period preceding this offer, had one or more contracts terminated for default by any Federal agency.

(2) Principal, for the purposes of this certification, means an officer, director, owner, partner, or a person having primary management or supervisory responsibilities within a business entity (e.g., general manager; plant manager; head of a division or business segment; and similar positions).

(b) The Offeror shall provide immediate written notice to the Contracting Officer if, at any time prior to contract award, the Offeror learns that its certification was erroneous when submitted or has become erroneous by reason of changed circumstances.

(c) A certification that any of the items in paragraph (a) of this provision exists will not necessarily result in withholding of an award under this solicitation. However, the certification will be considered in connection with a determination of the Offeror's responsibility. Failure of the Offeror to furnish a certification or provide such additional information as requested by the Contracting Officer may render the Offeror nonresponsible.

(d) Nothing contained in the foregoing shall be construed to require establishment of a system of records in order to render, in good faith, the certification required by paragraph (a) of this provision. The knowledge and information of an Offeror is not required to exceed that which is normally possessed by a prudent person in the ordinary course of business dealings.

(e) The certification in paragraph (a) of this provision is a material representation of fact upon which reliance was placed when making award. If it is later determined that the Offeror knowingly rendered an erroneous certification, in addition to other remedies available to the Government, the Contracting Officer may terminate the contract resulting from this solicitation for default.

(End of provision)

52.212-2 EVALUATION--COMMERCIAL ITEMS (OCT 2014)

(a) The Government will award a contract resulting from this solicitation to the responsible offeror whose offer conforming to the solicitation will be most advantageous to the Government, price and other factors considered. The following factors shall be used to evaluate offers: Lowest Price Technically Acceptable - Offers will be ranked lowest to highest according to price. The lowest price offer will be forwarded to the requiring activity for technical evaluation (offer will be deemed either technically acceptable or technically unacceptable). If the lowest price offer is found technically acceptable and its price is determined fair and reasonable by the Contracting Officer, evaluation will be deemed complete and award will be made based on the lowest price offer. If the lowest price offer is determined technically unacceptable, the next lowest price offer will be sent for technical evaluation and price analysis. This process is repeated in order of price until an offer is deemed technically acceptable and price is determined fair and reasonable.

The Government will utilize the below Evaluation Worksheet for Lowest Price Technically Acceptable Determination to evaluate proposals.

EVALUATION WORKSHEET FOR LOWEST PRICE TECHNICALLY ACCEPTABLE DETERMINATION

Solicitation #: M67861-15-T-0070

TECHNICAL ACCEPTABILITY SECTION 1:

General

The solution shall provide a lightweight agent that resides on the servers to be managed. It shall be able to consume no more than 1 GB of memory and minimum CPU cycles.

The agent based solution shall scale to support at least 100 GB of log traffic per day.

The solution shall support agents for multiple Operating Systems including Windows XP, Windows Vista, Windows 7, Windows 2003 Server, Windows 2008 Server, VMWare ESX Server, Redhat Enterprise Linux, Solaris Unix, etc.

The solution shall support the multiple files systems including NFS3 and 4, ext, UFS, NTFS, FAT32, etc.

The solution shall not be dependent on OS components such as Windows Management Interface (WMI).

The solution shall use a single configurable port for all client-server communication.

The solution shall be FIPS certified and have a Common Criteria certification of EAL Level 2.

The solution shall be accredited to run on USMC networks with an ATO for MCEN on NIPR and SIPR.

The solution shall be capable of storing up to 2 years of information or up to 24TB of data.

The solution shall be capable to scale to monitor up to 2,000 servers.

The solution shall have search capability of the logs for log monitoring.

The solution shall have a web based front end to allow multiple users. The GUI shall be supported on DoD approved application servers (WebLogic, OAS, Apache, and IIS).

The solution shall provide the capability of real-time monitoring and alerts.

The solution shall be able to monitor several variations of logs. Logs from application servers, Operating Servers, and Database’s.

The solution shall provide the ability to customize out of the box inspection content to meet USMC organizational needs.

The solution shall be able to provide training for the product

The solution shall provide security updates and patches as needed to maintain DoD STIG requirements.

Technical Objectives and Goals.

Provide the TSO’s Incident Management and Cybersecurity Incident Response capabilities by allowing system administrators and security analysts to centrally store, monitor, analyze and correlate log data; decreasing the man-hours devoted to manually reviewing log data.

Provide the TSO support in automating the implementation, assessment, and continuous monitoring of several NIST SP 800-53 security controls to include but not limited to; AC-5, Separation of Duties; AU-2, Auditable Events; AU-6, Audit Review, Analysis, and Reporting; Au-7, Audit reduction and Report Generation; CA-7, Continuous Monitoring; IR-5, Incident Monitoring; RA-3, Risk Assessment; RA-5, Vulnerability Scanning; and SI-4, Information System Monitoring.

Provide security metrics reports, dashboards, log parsing via searches for reporting monitoring and compliance effectiveness management and stakeholders.

Specific Requirements.

A tool that integrates with various operating systems, web server applications, application servers, database servers, Lightweight Directory Access Protocol (LDAP) servers, network devices, government-off-the-shelf (GOTS) web applications and COTS applications, to include but not limited to; Microsoft Windows Server 2008 and 2012; Microsoft IIS 6.0; Microsoft SQL Server 2008 and 2014, Microsoft Windows 7; RedHat Enterprise Linux 5 and 6; Oracle Linux; Oracle Fusion Middleware 11g; Oracle Database 11.2g and 12c and Database Management Servers, Oracle Real Application Clusters 112.2g and 12c and Grid Infrastructure; Oracle WebLogic 12c; Oracle Identity Management; IBM Cognos Business Intelligence 10.2 Big-IP F5 Local Traffic Manager, Access Policy Manager and Application Security Manager; IBM WebSphere; ESX VMWare ESXi; TACACS+ servers and NetApp Storage Area Network devices.

Log management automation that allows for the representation of historical log data.

Facilitates review and log data analysis for indications of unusual or malicious events or incidents.

Integrated threat intelligence feeds in support of risk based analysis, risk assessments and cybersecurity incident detection.

Automated correlation searches and engine utilizing various data sources as well as, allowing for real-time threat analysis and baseline anomaly detection.

Ability to utilize raw data in the creation of graphics, dashboards, reports, and security metrics as well as, the ability to export into .pdf or .csv formats.

User identity and asset correlation features that allow administrators to correlate specific users.

Distributed SIEM solution with centralized management of both the tool and log data.

Log retention capability allowing for compression and storage for a period of no less than two years.

Capable of LDAP or Microsoft Active Directory authentication integration.

Tamper-proof and audit quality protection measures ensuring the integrity of log data.

Detection and administrator alerting of event collection failures as well as; ability to validate original event sources are still sending events.

SIEM Suite Consultant.

The contractor shall provide a SIEM suite Consultant on a “Full-Time” basis for a term of twenty (20) days, with “Full-Time” defined as eight (8) hours per day.

Assist in the installation, configuration, and tuning of SIEM suite.

Assist in integration of SIEM suite log indexing into all TSO supported environments.

Assist TSO in establishing organization specific configurations that will allow the TSO to tune, retrieve, and correlate relevant data and alerts.

Assist TSO in creating security related correlation searches.

Assist TSO in configuring SIEM suite to meet NIST 800-53 Audit and Accountability Security controls.

Assist in creating custom reports and security metrics with the SIEM suite.

Assist in creating custom alerts and correlation searches in support of cybersecurity requirements as outlined in section 3.3 “Specific Requirements”.

Assist in integrating the SIEM suite into the TSO Cybersecurity Incident Response Procedures.

Perform additional SIEM suite related tasks as mutually agreed.

SIEM Suite Trainer.

The contractor shall provide a SIEM suite Trainer on a “Full-Time” basis for a term of ten (10) business days, no less than eight (8) hours a dayTeach the six (6) purchased SIEM Education classes to targeted administrators and information security personnel as outlined in SOW 3.3.1 Contractor Services:

Using Splunk brand or comparable - (Introduction to interface; Using pivot; Searching and saving results; Using fields; Creating reports and visualizations; Working with Dashboards).

Searching and Reporting - (Search Fundamentals; Reporting Commands; Analyzing, Calculating, and Formatting Results ; Correlating Events ; Enriching Data with Lookups).

Creating Knowledge Objects - (Fields (Field aliases, field extractions, calculated fields, source type renaming); Tags and Event Types; Workflow Actions; Alerts; Macros; Data Models).

Advanced Searching and Reporting - (Beyond Search Fundamentals; Using Sub-searches; Using Advanced Statistics; Manipulating & Filtering Data; Using Advanced Charting; Using Advanced Transactions; Using Advanced Lookups).

Splunk brand or comparable Administration - (License management; Getting data in; Managing Splunk brand or comparable apps; Splunk brand or comparable configuration files; Universal forwarder and forwarder management; Data inputs in detail; Index administration, maintenance and optimization; Users, roles, and authentication; Event Parsing with data preview; Manipulating raw data; Field extraction; Distributed search; Search performance tuning; Introduction to large-scale Splunk brand or comparable deployment; Monitoring and troubleshooting).

Architecting and Deploying - (Deployment Planning; Infrastructure planning; Data collection; Data comprehension; Search considerations; Development tools and external integration concepts; Operations and management).

(b) Options. The Government will evaluate offers for award purposes by adding the total price for all options to the total price for the basic requirement. The Government may determine that an offer is unacceptable if the option prices are significantly unbalanced. Evaluation of options shall not obligate the Government to exercise the option(s).

(c) A written notice of award or acceptance of an offer, mailed or otherwise furnished to the successful offeror within the time for acceptance specified in the offer, shall result in a binding contract without further action by either party. Before the offer's specified expiration time, the Government may accept an offer (or part of an offer), whether or not there are negotiations after its receipt, unless a written notice of withdrawal is received before award.

(End of provision)

52.212-3 OFFEROR REPRESENTATIONS AND CERTIFICATIONS--COMMERCIAL ITEMS (MAR 2015) ALTERNATE I (OCT 2014)

The offeror shall complete only paragraphs (b) of this provision if the Offeror has completed the annual representations and certification electronically via the System for Award Management (SAM) Web site accessed through http://www.acquisition.gov . If the Offeror has not completed the annual representations and certifications electronically, the Offeror shall complete only paragraphs (c) through (p) of this provision.

(a) Definitions. As used in this provision--

“Economically disadvantaged women-owned small business (EDWOSB) concern” means a small business concern that is at least 51 percent directly and unconditionally owned by, and the management and daily business operations of which are controlled by, one or more women who are citizens of the United States and who are economically disadvantaged in accordance with 13 CFR part 127. It automatically qualifies as a women-owned small business eligible under the WOSB Program.

“Forced or indentured child labor” means all work or service—

(1) Exacted from any person under the age of 18 under the menace of any penalty for its nonperformance and for which the worker does not offer himself voluntarily; or

(2) Performed by any person under the age of 18 pursuant to a contract the enforcement of which can be accomplished by process or penalties.

“Highest-level owner” means the entity that owns or controls an immediate owner of the offeror, or that owns or controls one or more entities that control an immediate owner of the offeror. No entity owns or exercises control of the highest level owner.

“Immediate owner” means an entity, other than the offeror, that has direct control of the offeror. Indicators of control include, but are not limited to, one or more of the following: Ownership or interlocking management, identity of interests among family members, shared facilities and equipment, and the common use of employees.

“Inverted domestic corporation,” means a foreign incorporated entity that meets the definition of an inverted domestic corporation under 6 U.S.C. 395(b), applied in accordance with the rules and definitions of 6 U.S.C. 395(c).

“Manufactured end product” means any end product in product and service codes (PSCs) 1000-9999, except—

(1) PSC 5510, Lumber and Related Basic Wood Materials;

(2) Product or Service Group (PSG) 87, Agricultural Supplies;

(3) PSG 88, Live Animals;

(4) PSG 89, Subsistence;

(5) PSC 9410, Crude Grades of Plant Materials;

(6) PSC 9430, Miscellaneous Crude Animal Products, Inedible;

(7) PSC 9440, Miscellaneous Crude Agricultural and Forestry Products;

(8) PSC 9610, Ores;

(9) PSC 9620, Minerals, Natural and Synthetic; and

(10) PSC 9630, Additive Metal Materials.

“Place of manufacture” means the place where an end product is assembled out of components, or otherwise made or processed from raw materials into the finished product that is to be provided to the Government. If a product is disassembled and reassembled, the place of reassembly is not the place of manufacture.

“Restricted business operations” means business operations in Sudan that include power production activities, mineral extraction activities, oil-related activities, or the production of military equipment, as those terms are defined in the Sudan Accountability and Divestment Act of 2007 (Pub. L. 110-174). Restricted business operations do not include business operations that the person (as that term is defined in Section 2 of the Sudan Accountability and Divestment Act of 2007) conducting the business can demonstrate—

(1) Are conducted under contract directly and exclusively with the regional government of southern Sudan;

(2) Are conducted pursuant to specific authorization from the Office of Foreign Assets Control in the Department of the Treasury, or are expressly exempted under Federal law from the requirement to be conducted under such authorization;

(3) Consist of providing goods or services to marginalized populations of Sudan;

(4) Consist of providing goods or services to an internationally recognized peacekeeping force or humanitarian organization;

(5) Consist of providing goods or services that are used only to promote health or education; or

(6) Have been voluntarily suspended.

Sensitive technology—

(1) Means hardware, software, telecommunications equipment, or any other technology that is to be used specifically—

(i) To restrict the free flow of unbiased information in Iran; or

(ii) To disrupt, monitor, or otherwise restrict speech of the people of Iran; and

(2) Does not include information or informational materials the export of which the President does not have the authority to regulate or prohibit pursuant to section 203(b)(3) of the International Emergency Economic Powers Act (50 U.S.C. 1702(b)(3)).

“Service-disabled veteran-owned small business concern”—

(1) Means a small business concern—

(i) Not less than 51 percent of which is owned by one or more service-disabled veterans or, in the case of any publicly owned business, not less than 51 percent of the stock of which is owned by one or more service-disabled veterans; and

(ii) The management and daily business operations of which are controlled by one or more service-disabled veterans or, in the case of a service-disabled veteran with permanent and severe disability, the spouse or permanent caregiver of such veteran.

(2) Service-disabled veteran means a veteran, as defined in 38 U.S.C. 101(2), with a disability that is service-connected, as defined in 38 U.S.C. 101(16).

“Small business concern” means a concern, including its affiliates, that is independently owned and operated, not dominant in the field of operation in which it is bidding on Government contracts, and qualified as a small business under the criteria in 13 CFR Part 121 and size standards in this solicitation.

“Small disadvantaged business concern, consistent with 13 CFR 124.1002,” means a small business concern under the size standard applicable to the acquisition, that--

(1) Is at least 51 percent unconditionally and directly owned (as defined at 13 CFR 124.105) by--

(i) One or more socially disadvantaged (as defined at 13 CFR 124.103) and economically disadvantaged (as defined at 13 CFR 124.104) individuals who are citizens of the United States; and

(ii) Each individual claiming economic disadvantage has a net worth not exceeding $750,000 after taking into account the applicable exclusions set forth at 13 CFR 124.104(c)(2); and

(2) The management and daily business operations of which are controlled (as defined at 13.CFR 124.106) by individuals, who meet the criteria in paragraphs (1)(i) and (ii) of this definition.

“Subsidiary” means an entity in which more than 50 percent of the entity is owned—

(1) Directly by a parent corporation; or

(2) Through another subsidiary of a parent corporation.

“Veteran-owned small business concern” means a small business concern—

(1) Not less than 51 percent of which is owned by one or more veterans(as defined at 38 U.S.C. 101(2)) or, in the case of any publicly owned business, not less than 51 percent of the stock of which is owned by one or more veterans; and

(2) The management and daily business operations of which are controlled by one or more veterans.

“Women-owned business concern” means a concern which is at least 51 percent owned by one or more women; or in the case of any publicly owned business, at least 51 percent of the its stock is owned by one or more women; and whose management and daily business operations are controlled by one or more women.

“Women-owned small business concern” means a small business concern --

(1) That is at least 51 percent owned by one or more women or, in the case of any publicly owned business, at least 51 percent of the stock of which is owned by one or more women; and

(2) Whose management and daily business operations are controlled by one or more women.

“Women-owned small business (WOSB) concern eligible under the WOSB Program (in accordance with 13 CFR part 127),” means a small business concern that is at least 51 percent directly and unconditionally owned by, and the management and daily business operations of which are controlled by, one or more women who are citizens of the United States.

(b)

(1) Annual Representations and…