Solicitation_M67861-17-T-0038_-_Imperva_DMZ_Enhancement.docx

M6786117T0038

Section SF 1449 - CONTINUATION SHEET

SALIENT CHARACTERISTICS

Purchase request is an upgrade to build upon our pre-existing systems. MARFORRES is expanding its DMZ capabilities and requires additional devices to properly secure it. The additional devices must also support high availability (HA) for network redundancy.

Device/Hardware:

· The device solutions will be Federal Information Processing Standard (FIPS) 140-2 compliant and have evidence of FIPS-capable running configuration per DODI 8500.2.

· The device solutions shall be Common Criteria certified (EAL 2+).

· The device solutions will support HTTP 1.0/1.1 (RFC 2616), HTTPS, SSH, SSL v2-3.1, TLS 1.0-1.2, IPv4 and IPv6.

· The device solutions will be capable of analyzing, alerting, reporting and applying policies to IPv4 and IPv6 traffic.

· The device solutions will have software/firmware that can be upgradeable as revisions are released.

· The device will be able to support high availability in active/active and active/passive configurations.

· The device solution will support role based access support.

· The device solution must support a mixture of copper and fiber ports. 1 WAF must contain 2 fiber and 4 copper ports. 1 WAF must contain 4 fiber ports.

· The device must support 2 GBps throughput for all deployment modes to include SSL/TLS inspection.

Function:

· The device solution will have the capability of inspecting traffic to include SSL in deployment modes via proxy, SPAN/TAP with TCP reset mode.

· The WAF device solution will support DoD PKI Implementation to include both server certificate and client certificate-protected traffic.

· WAF device solution needs to operate in multiple schemes, to include: transparent proxy, inline, transparent layer 2 bridge mode, and reverse proxy.

· WAF device solution needs to support URL rewriting and show customized response pages to client upon policy violations.

· WAF device will support Simple Object Access Protocol (SOAP) authentication and protection.

· WAF will maintain non-repudiation of the HTTPS connection between the web user and the web server and not terminate the connection.

· WAF solution will protect against website scraping attacks.

· WAF shall be able to identify and block all OWASP top 10 attack classes in real time.

· WAF and Database Firewalls must have an automatic learning capability; automatically construct a profile of the applications and databases they monitor.

· WAF solution must provide content protection for all learned profiles.

· WAF must have the capability to support Microsoft SharePoint Services’ file security schemes, user tracking, and Lightweight Directory Access Protocol (LDAP) authentication with Active Directory (AD).

· WAF solution must block known anonymous proxy endpoints from automatically updated list of IP addresses.

· WAF solution must allow geographic IP rules; allow/deny/audit users depending on the country of origin.

· WAF and Database firewall solutions must have the ability to identify and block SQL injection, cross-site forgery, cross-site scripting, directory traversal, remote file inclusion, and remote command execution.

· WAF and Database firewall solutions must be able to automatically learn normal traffic/request and block when traffic exceeds normal thresholds or patterns.

· The solution must provide the ability to monitor database traffic in an agent based deployment.

· The database agent solution must have the ability to permit/deny traffic based on policies provided from an Imperva MX150.

· The database agents must support the following: MS Server 2003, 2008, 2008 R2, 2012; MS-SQL 2012, 2014, 2016.

· The security solution for WAF and Database Firewalls must have the ability to correlate web request from the client to the sql request generated by the application server.

· The solutions for WAF and Database firewalls must have their policies and configuration centrally managed by a sole device.

· The database firewall/agents must have the ability to conduct user rights scanning on SQL server table structures.

Management:

· Device solutions must be able to be centrally managed by an Imperva MX150 via SSH and/or HTTPS.

· The WAF devices must be capable of producing reports including the full web application request. This includes the complete URI of GETs, POST, HEADS, and OPTIONS request as well as all other HTTP request methods.

· Device solutions must support syslog and reporting to USMC enterprise SIEM.

· Solution must support integration with virtual patching from USMC licensed vulnerability scanning tools.

Enhanced support:

· The solution must provide advance support for all hardware and subscription services.

HSM cards:

-Each web application firewall must support the ability to install high security modules. These high security modules must be able to properly store and protect private cryptographic keys.

Fiber NIC:

-The solution must support the correct network connections at MARFORRES DMZ sites. This will require one WAF with 4 FIBER interfaces and one WAF with 2 FIBER interfaces and 4 copper RJ-45 ports.

SecureSphere for Sharepoint:

-The solution must support custom tailored security capabilities for SharePoint. SharePoint differs from standard IIS web servers and requires a security solution that understands the SharePoint architecture. The solutions should have the ability to monitor 500 accounts.

Virtual Database Firewall:

The solution must provide a total of 4 virtual database firewalls. Each firewall should be able to support 50 database agents.

X4510 Web Application Firewall:

-The solutions needs to provide 2 physical web application firewalls. These devices need to support HA and be compatible with the pre-existing Imperva WAFs deployed by MARFORRES.

ThreatRadar Reputation:

Each WAF must have the ThreatRadar service. This subscription is crucial to blocking cyber actors on the internet.

Advanced support:

All of the items in the solution need to be under warranty and maintain enhanced support from the vendor.

INSTRUCTIONS TO OFFERORS

Herein are the applicable Instructions to Offerors. Any Instructions not listed that appear to be skipped are not applicable to this solicitation.

1 Synopsis: This is a Combined Synopsis/Solicitation for commercial items prepared in accordance with the format in Subpart 12.6, as supplemented with additional information included in this notice. This announcement constitutes the only solicitation; proposals are being requested and a separate written solicitation will not be issued.

2 Brand Name or Equal Product: This is a Competitive Brand Name or Equal solicitation under FAR Part 12 using FAR Part 13 procedures for a firm-fixed price contract for the purchase of Imperva DMZ Enhancement.

7 Market Research: Market research conducted via DON ESL, DON ESI, GSA Advantage and the WWW revealed that there is not a reasonable expectation of obtaining two or more offers from small business concerns. FAR Part 19.502-2 (a) Each acquisition of supplies or services that has an anticipated dollar value exceeding $3,000 but not over $150,000 is automatically reserved exclusively for small business concerns and shall be set aside for small business unless the contracting officer determines there is not a reasonable expectation of obtaining offers from two or more responsible small business concerns that are competitive in terms of market prices, quality, and delivery. Marine Forces Reserve Small Business Program Deputy Director concurs with this action.

QUOTATION INSTRUCTIONS

8Quotations/bids shall be submitted via email to Brenlie.Wilson@usmc.mil and copy Shelley.Mentzos@usmc.mil. Each email may not exceed 5MB in size due to server/network restrictions. Submit multiple emails if necessary to ensure timely receipt of your bid.

9All responsible sources may submit a quotation which, if received in a timely manner, shall be considered by the agency.

10 Award will be made to the lowest-priced technically acceptable (LPTA) offer. The Technical Evaluation Template that will be used to evaluate the LPTA bid is incorporated herein for Contractor awareness only. See FAR 52.212-2 herein for technical evaluation procedures.

11 The Government will accept Open Market offers or GSA offers.

12 The Government will consider brand name or equal bids only. Descriptive literature/brochures and proof software/hardware authorized to operate on USMC-N00027-NGEN-U Network required with all quotes bidding equal.

13 Method of Invoicing/Payment: Wide Area Workflow (WAWF) DFARS 252.232-7006 WAWF Instructions.

14 Any direct customer contact by Bidders is not authorized during the solicitation phase or your bid may be at risk of being eliminated from consideration for this solicitation.

15 NO PHONE CALLS will be accepted regarding this solicitation. ALL QUESTIONS shall be sent in writing via email to Brenlie.Wilson@usmc.mil and copy Shelley.Mentzos@usmc.mil.

16 In the event only one offer is received in response to this solicitation the Government may request a detailed cost break-out of your quote for the purposes of comparisons in determining fair and reasonability of your quoted prices in accordance with DFARS 252.215-7008 herein.

17 The Contracting Officer may review Past Performance Information Retrieval System (PPIRS) for responsibility determination purposes.

18 The Government reserves the right to make award solely on initial quotes received on an all or none or multiple award basis.

19 Offerors bear the burden of ensuring that all portions of the offer (and any authorized amendments) reach the designated office before the deadline specified in the solicitation.

INSTRUCTIONS TO BE CONSIDERED RESPONSIVE TO THIS SOLICITATION

20 Bidders should include and comply with all remaining numbered instructions to Offerors:

21 CAGE code 22 DUNS number 23 Address 24 Point of contact 25 Delivery lead time after receipt of order for supplies and period of performance for services if different than listed in the solicitation document. List by line item if the delivery lead time differs from one line item to another. This shall be visible on the face of the quote and not incorporated as a link or other attachment.

26 Prompt payment/discount terms (if offered). This will not be used to evaluate offers.

27 Contract number and expiration date shall be included if bidding under a GSA, SEWP or other contract. This shall be listed per line item unless the contract vehicle is applicable to all line items.

28 Manufacturer Part Number and Contractor Part Number (if different).

29 Supply product descriptive literature or certification statement that the proposed product or service meets all salient characteristics listed in this solicitation and the Technical Evaluation Template provided with the solicitation.

33 Brand Name or Equal Bids: All responses to this solicitation shall indicate whether the firm is offering a ‘brand name manufacturer's products’ or ‘equal products.’ Descriptive literature is required with all quotes. Firms shall submit sufficient descriptive literature to permit the contracting agency to assess whether the product proposed meets all the salient characteristics specified in the solicitation in accordance to the Lowest Priced Technically Acceptable Template included/attached to this solicitation. Firms offering "equal" items should provide the make, model, description of the items, proof software/hardware authorized to operate on USMC-N00027-NGEN-U Network, and product literature/brochures. This agency will not be responsible for locating or obtaining any information not included on the face of the offer or a hardcopy attachment to the offer in a response to this solicitation.

34 Software End User Licensing Agreements (EULA)/Warranty Support: All Government software contracts are required to include warranty provisions from authorized sellers/resellers of all commercial and non-commercial publisher software products. The Government will not accept any seller/reseller disclaimers of implied publisher standard commercial warranty or automatic renewals. As a minimum software warranties shall cover the performance of all required product capabilities, free from defects/bugs, for all intended authorized users, process for reporting/fixing defects remedied at no charge to the Government, effective after Government tests of delivered software product(s), and include the seller/reseller's return policy and procedures.

Enter the following text in solicitation for new (first time purchased) software the USG does not already own 35 Software Purchases: Bidders shall allow the Government a trial period to test new software not previously purchased by this customer prior to delivery and start of the software warranty support.

Enter the following text in solicitation for software/hardware support renewals or with varying POP dates 37 Software/Hardware Support: All bids for new software/hardware maintenance support shall be for annual 12 months of services (unless otherwise noted in this solicitation). All bids for renewal of software/hardware maintenance support shall include the manufacturer’s period of performance end dates on the face of the quote. Also, this solicitation may contain support subscriptions with varying support term dates. The offeror shall state whether co-term is authorized by the manufacturer on the face of the offer.

44 Service Contract Labor Standards - This solicitation includes contract line items (CLIN) for services therefore a wage determination is included and assumed applicable to this solicitation. Bidders shall provide self-certification in FAR 52.212-3(K)(1) or (2) for a formal determination before award for the products listed in this solicitation. If a wage determination is no longer applicable based on self-certification responses, the wage determination will be removed upon final award. If self-certification is not provided in bid response (or completed in certifications and representations at the System for Award Management at SAM.gov), or certification responses indicate the wage determination is applicable, the wage determination will remain upon final award. This full text of this FAR clause is included in this solicitation (with section K bolded for ease of completion) and can also be found at http://farsite.hill.af.mil/vffar.htm.

45 Complete the Following Clauses/Tables/Attachments/Etc Bidders shall complete the following clauses listed in this solicitation: 52.212-3(k)(2) as stated in number 44 above (required fill-in highlighted within 52.212-3(k) herein) and 252.239-7009 herein.

46 Solicitation/Contract Line Item Numbers (CLIN) Structure – Potential bidders shall submit bids in the same CLIN structure as outlined in the solicitation for bid evaluation purposes. However, an alternate line item structure can be submitted as an additional attachment consolidating like line items and pricing for award consideration.

47Assignment of Claims – Potential bidders that may need an Assignment of Claims as described in FAR 32.8 (copy/paste link into web browser: http://farsite.hill.af.mil/VFFARA.HTM) shall include a statement on bid that "Assignment of Claims is required if selected for award." Assignment of Claims will not be used as an evaluation factor for award. However, all Assignment of Claims documentation shall be submitted with bid or provided BEFORE accepting award for Contracting Officer determination. The Government reserves the right to disapprove a request for Assignment of Claims; vendor will be advised of disapproval prior to drafting of award so vendor may determine if it can still fulfill the contractual requirement without an Assignment of Claims. If request for Assignment of Claims is not included in bid or required documentation is not provided PRIOR to Contractor acceptance of award, the Contracting Officer may reject request for Assignment of Claims and award to the next qualified offeror.

48 System for Award Management (SAM.gov) – Potential bidders not currently registered at SAM.gov shall register (including completion of certifications and representations) to be considered for award. Contact SAM.gov website points of contact if you need assistance with registration.

X4510 Web Application Firewall

FFP

BRAND NAME OR EQUAL X4510 Web Application Firewall FOB: Destination

MILSTRIP: M2638117RC00290

PURCHASE REQUEST NUMBER: M2638117RC00290

NET AMT

X4510 Web Application Firewall, Annual Enhanced Support

BRAND NAME OR EQUAL X4510 Web Application Firewall, Annual Enhanced Support FOB: Destination

NET AMT

HSM Card for X2510 / X4510 / X6510 / X8510 / X10K

BRAND NAME OR EQUAL HSM Card for X2510 / X4510 / X6510 / X8510 / X10K FOB: Destination

NET AMT

HSM Card Annual Enhanced Support

BRAND NAME OR EQUAL HSM Card Annual Enhanced Support FOB: Destination

NET AMT

Quad SX Fiber Network Interface Card

BRAND NAME OR EQUAL Quad SX Fiber Network Interface Card FOB: Destination

NET AMT

Quad SX Fiber Network Interface Card, Support

BRAND NAME OR EQUAL Quad SX Fiber Network Interface Card, Support FOB: Destination

NET AMT

SecureSphere for SharePoint, Perpetual Software License

BRAND NAME OR EQUAL SecureSphere for SharePoint, Perpetual Software License FOB: Destination

NET AMT

SecureSphere for SharePoint, Annual Enhanced Support

BRAND NAME OR EQUAL - The appliances being procured provide Marine Forces Reserve G-6 with the hardware necessary to host a Demilitarized Zone (DMZ). MFR information consumers and contributors are able to access applications from outside of the Marine Corps Enterprise Network (MCEN). The additional Firewalls increase our network security posture.

FOB: Destination

NET AMT

V4500 Database Firewall Virtual Appliance

BRAND NAME OR EQUAL V4500 Database Firewall Virtual Appliance FOB: Destination

NET AMT

X4510 Web Application Firewall

BRAND NAME OR EQUAL X4510 Web Application Firewall FOB: Destination

NET AMT

V4500 Database Firewall Virtual Appliance

BRAND NAME OR EQUAL - The appliances being procured provide Marine Forces Reserve G-6 with the hardware necessary to host a Demilitarized Zone (DMZ). MFR information consumers and contributers are able to access applications from outside of the Marine Corps Enterprise Network (MCEN). The additional Firewalls increase our network security posture.

FOB: Destination

NET AMT

INSPECTION AND ACCEPTANCE TERMS

Supplies/services will be inspected/accepted at:

DELIVERY INFORMATION

SGT BAILEYMOORE, DYLAN

2000 OPELOUSAS AVE RM:3E6109

NEW ORLEANS LA 70114

504-697-8650 FOB: Destination M26381

M26381

M26381

M26381

M26381

M26381

M26381

M26381

M26381

M26381

M26381

CLAUSES INCORPORATED BY REFERENCE

CLAUSES INCORPORATED BY FULL TEXT

52.204-13 SYSTEM FOR AWARD MANAGEMENT MAINTENANCE (OCT 2016)

(a) Definitions. As used in this clause--

Electronic Funds Transfer (EFT) indicator means a four-character suffix to the unique entity identifier. The suffix is assigned at the discretion of the commercial, nonprofit, or Government entity to establish additional System for Award Management (SAM) records for identifying alternative EFT accounts (see subpart 32.11) for the same entity.

Registered in the System for Award Management (SAM) database means that--

(1) The Contractor has entered all mandatory information, including the unique entity identifier and the EFT indicator (if applicable), the Commercial and Government Entity (CAGE) code, as well as data required by the Federal Funding Accountability and Transparency Act of 2006 (see subpart 4.14), into the SAM database;

(2) The Contractor has completed the Core, Assertions, Representations and Certifications, and Points of Contact sections of the registration in the SAM database;

(3) The Government has validated all mandatory data fields, to include validation of the Taxpayer Identification Number (TIN) with the Internal Revenue Service (IRS). The Contractor will be required to provide consent for TIN validation to the Government as a part of the SAM registration process; and

(4) The Government has marked the record ``Active''.

System for Award Management (SAM) means the primary Government repository for prospective Federal awardee and Federal awardee information and the centralized Government system for certain contracting, grants, and other assistance-related processes. It includes—

(1) Data collected from prospective Federal awardees required for the conduct of business with the Government;

(2) Prospective contractor-submitted annual representations and certifications in accordance with FAR subpart 4.12; and

(3) Identification of those parties excluded from receiving Federal contracts, certain subcontracts, and certain types of Federal financial and non-financial assistance and benefits.

Unique entity identifier means a number or other identifier used to identify a specific commercial, nonprofit, or Government entity. See www.sam.gov for the designated entity for establishing unique entity identifiers.

(b) The Contractor is responsible for the accuracy and completeness of the data within the SAM database, and for any liability resulting from the Government's reliance on inaccurate or incomplete data. To remain registered in the SAM database after the initial registration, the Contractor is required to review and update on an annual basis, from the date of initial registration or subsequent updates, its information in the SAM database to ensure it is current, accurate and complete. Updating information in the SAM does not alter the terms and conditions of this contract and is not a substitute for a properly executed contractual document.

(c)(1)(i) If a Contractor has legally changed its business name, doing business as name, or division name (whichever is shown on the contract), or has transferred the assets used in performing the contract, but has not completed the necessary requirements regarding novation and change-of-name agreements in subpart 42.12, the Contractor shall provide the responsible Contracting Officer a minimum of one business day's written notification of its intention to—

(A) Change the name in the SAM database;

(B) Comply with the requirements of subpart 42.12 of the FAR; and

(C) Agree in writing to the timeline and procedures specified by the responsible Contracting Officer. The Contractor shall provide with the notification sufficient documentation to support the legally changed name.

(ii) If the Contractor fails to comply with the requirements of paragraph (c)(1)(i) of this clause, or fails to perform the agreement at paragraph (c)(1)(i)(C) of this clause, and, in the absence of a properly executed novation or change-of-name agreement, the SAM information that shows the Contractor to be other than the Contractor indicated in the contract will be considered to be incorrect information within the meaning of the ``Suspension of Payment'' paragraph of the electronic funds transfer (EFT) clause of this contract.

(2) The Contractor shall not change the name or address for EFT payments or manual payments, as appropriate, in the SAM record to reflect an assignee for the purpose of assignment of claims (see FAR subpart 32.8, Assignment of Claims). Assignees shall be separately registered in the SAM. Information provided to the Contractor's SAM record that indicates payments, including those made by EFT, to an ultimate recipient other than that Contractor will be considered to be incorrect information within the meaning of the ``Suspension of Payment'' paragraph of the EFT clause of this contract.

(3) The Contractor shall ensure that the unique entity identifier is maintained with the entity designated at www.sam.gov for establishment of the unique entity identifier throughout the life of the contract. The Contractor shall communicate any change to the unique entity identifier to the Contracting Officer within 30 days after the change, so an appropriate modification can be issued to update the data on the contract. A change in the unique entity identifier does not necessarily require a novation be accomplished.

(d) Contractors may obtain additional information on registration and annual confirmation requirements at https://www.acquisition.gov.

(End of clause)

52.204-20 Predecessor of Offeror (JUL 2016)

(a) Definitions. As used in this provision--

Commercial and Government Entity (CAGE) code means--

(1) An identifier assigned to entities located in the United States or its outlying areas by the Defense Logistics Agency (DLA) Commercial and Government Entity (CAGE) Branch to identify a commercial or government entity; or

(2) An identifier assigned by a member of the North Atlantic Treaty Organization (NATO) or by the NATO Support and Procurement Agency (NSPA) to entities located outside the United States and its outlying areas that the DLA Commercial and Government Entity (CAGE) Branch records and maintains in the CAGE master file. This type of code is known as a NATO CAGE (NCAGE) code.

Predecessor means an entity that is replaced by a successor and includes any predecessors of the predecessor.

Successor means an entity that has replaced a predecessor by acquiring the assets and carrying out the affairs of the predecessor under a new name (often through acquisition or merger). The term “successor” does not include new offices/divisions of the same company or a company that only changes its name. The extent of the responsibility of the successor for the liabilities of the predecessor may vary, depending on State law and specific circumstances.

(b) The Offeror represents that it [____] is or [____] is not a successor to a predecessor that held a Federal contract or grant within the last three years.

(c) If the Offeror has indicated “is” in paragraph (b) of this provision, enter the following information for all predecessors that held a Federal contract or grant within the last three years (if more than one predecessor, list in reverse chronological order):

Predecessor CAGE code: ____ (or mark “Unknown”).

Predecessor legal name: ____.

(Do not use a “doing business as” name).

(End of provision)

52.204-21 BASIC SAFEGUARDING OF COVERED CONTRACTOR INFORMATION SYSTEMS (JUN 2016)

(a) Definitions. As used in this clause--

Covered contractor information system means an information system that is owned or operated by a contractor that processes, stores, or transmits Federal contract information.

Federal contract information means information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government, but not including information provided by the Government to the public (such as on public Web sites) or simple transactional information, such as necessary to process payments.

Information means any communication or representation of knowledge such as facts, data, or opinions, in any medium or form, including textual, numerical, graphic, cartographic, narrative, or audiovisual (Committee on National Security Systems Instruction (CNSSI) 4009).

Information system means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information (44 U.S.C. 3502).

Safeguarding means measures or controls that are prescribed to protect information systems.

(b) Safeguarding requirements and procedures.

(1) The Contractor shall apply the following basic safeguarding requirements and procedures to protect covered contractor information systems. Requirements and procedures for basic safeguarding of covered contractor information systems shall include, at a minimum, the following security controls:

(i) Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems).

(ii) Limit information system access to the types of transactions and functions that authorized users are permitted to execute.

(iii) Verify and control/limit connections to and use of external information systems.

(iv) Control information posted or processed on publicly accessible information systems.

(v) Identify information system users, processes acting on behalf of users, or devices.

(vi) Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems.

(vii) Sanitize or destroy information system media containing Federal Contract Information before disposal or release for reuse.

(viii) Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals.

(ix) Escort visitors and monitor visitor activity; maintain audit logs of physical access; and control and manage physical access devices.

(x) Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems.

(xi) Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.

(xii) Identify, report, and correct information and information system flaws in a timely manner.

(xiii) Provide protection from malicious code at appropriate locations within organizational information systems.

(xiv) Update malicious code protection mechanisms when new releases are available.

(xv) Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed.

(2) Other requirements. This clause does not relieve the Contractor of any other specific safeguarding requirements specified by Federal agencies and departments relating to covered contractor information systems generally or other Federal safeguarding requirements for controlled unclassified information (CUI) as established by Executive Order 13556.

(c) Subcontracts. The Contractor shall include the substance of this clause, including this paragraph (c), in subcontracts under this contract (including subcontracts for the acquisition of commercial items, other than commercially available off-the-shelf items), in which the subcontractor may have Federal contract information residing in or transiting through its information system.

(End of clause)

52.209-2 PROHIBITION ON CONTRACTING WITH INVERTED DOMESTIC CORPORATIONS--REPRESENTATION (NOV 2015)

(a) Definitions. Inverted domestic corporation and subsidiary have the meaning given in the clause of this contract entitled Prohibition on Contracting with Inverted Domestic Corporations (52.209-10).

(b) Government agencies are not permitted to use appropriated (or otherwise made available) funds for contracts with either an inverted domestic corporation, or a subsidiary of an inverted domestic corporation, unless the exception at 9.108-2(b) applies or the requirement is waived in accordance with the procedures at 9.108-4.

(c) Representation. The Offeror represents that--

(1) It [ ___ ] is, [ ___ ] is not an inverted domestic corporation; and

(2) It [ ___ ] is, [ ___ ] is not a subsidiary of an inverted domestic corporation.

52.209-11 REPRESENTATION BY CORPORATIONS REGARDING DELINQUENT TAX LIABILITY OR A

FELONY CONVICTION UNDER ANY FEDERAL LAW (FEB 2016)

(a) As required by sections 744 and 745 of Division E of the Consolidated and Further Continuing Appropriations Act, 2015 (Pub. L. 113-235), and similar provisions, if contained in subsequent appropriations acts, the Government will not enter into a contract with any corporation that--

(1) Has any unpaid Federal tax liability that has been assessed, for which all judicial and administrative remedies have been exhausted or have lapsed, and that is not being paid in a timely manner pursuant to an agreement with the authority responsible for collecting the tax liability, where the awarding agency is aware of the unpaid tax liability, unless an agency has considered suspension or debarment of the corporation and made a determination that suspension or debarment is not necessary to protect the interests of the Government; or

(2) Was convicted of a felony criminal violation under any Federal law within the preceding 24 months, where the awarding agency is aware of the conviction, unless an agency has considered suspension or debarment of the corporation and made a determination that this action is not necessary to protect the interests of the Government.

(b) The Offeror represents that--

(1) It is [ ] is not [ ] a corporation that has any unpaid Federal tax liability that has been assessed, for which all judicial and administrative remedies have been exhausted or have lapsed, and that is not being paid in a timely manner pursuant to an agreement with the authority responsible for collecting the tax liability; and

(2) It is [ ] is not [ ] a corporation that was convicted of a felony criminal violation under a Federal law within the preceding 24 months.

52.212-2 EVALUATION--COMMERCIAL ITEMS (OCT 2014)

(a) The Government will award a contract resulting from this solicitation to the responsible offeror whose offer conforming to the solicitation will be most advantageous to the Government, price and other factors considered. The following factors shall be used to evaluate offers:

Basis of Single Award - Lowest Price Technically Acceptable (LPTA) - Offers will be ranked lowest to highest according to price. The lowest price offer will be forwarded to the requiring activity for technical evaluation (offer will be deemed either technically acceptable or technically unacceptable). If the lowest price offer is found technically acceptable and its price is determined fair and reasonable by the Contracting Officer, evaluation will be deemed complete and award will be made based on the lowest price offer. If the lowest price offer is determined technically unacceptable, the next lowest price offer will be sent for technical evaluation and price analysis. This process is repeated in order of price until an offer is deemed technically acceptable and price is determined fair and reasonable. The actual evaluation template is incorporated into this solicitation for reference. The actual evaluation template is incorporated into this solicitation for reference. An example of the Technical Evaluation is as follows:

TECHNICAL EVALUATION WORKSHEET FOR LOWEST PRICE TECHNICALLY ACCEPTABILITY DETERMINATION (v8.19.2015)

TECHNICAL ACCEPTABILITY SECTION 1: TBD

· The device solutions shall be Common Criteria certified (EAL 2+).

· The device solutions will support HTTP 1.0/1.1 (RFC 2616), HTTPS, SSH, SSL v2-3.1, TLS 1.0-1.2, IPv4 and IPv6.

· The device solutions will be capable of analyzing, alerting, reporting and applying policies to IPv4 and IPv6 traffic.

· The device solutions will have software/firmware that can be upgradeable as revisions are released.

· The device will be able to support high availability in active/active and active/passive configurations.

· The device solution will support role based access support.

· The device solution must support a mixture of copper and fiber ports. 1 WAF must contain 2 fiber and 4 copper ports. 1 WAF must contain 4 fiber ports.

· The device must support 2 GBps throughput for all deployment modes to include SSL/TLS inspection.

· The WAF device solution will support DoD PKI Implementation to include both server certificate and client certificate-protected traffic.

· WAF device solution needs to operate in multiple schemes, to include: transparent proxy, inline, transparent layer 2 bridge mode, and reverse proxy.

· WAF device solution needs to support URL rewriting and show customized response pages to client upon policy violations.

· WAF device will support Simple Object Access Protocol (SOAP) authentication and protection.

· WAF will maintain non-repudiation of the HTTPS connection between the web user and the web server and not terminate the connection.

· WAF solution will protect against website scraping attacks.

· WAF shall be able to identify and block all OWASP top 10 attack classes in real time.

· WAF and Database Firewalls must have an automatic learning capability; automatically construct a profile of the applications and databases they monitor.

· WAF solution must provide content protection for all learned profiles.

· WAF must have the capability to support Microsoft SharePoint Services’ file security schemes, user tracking, and Lightweight Directory Access Protocol (LDAP) authentication with Active Directory (AD).

· WAF solution must block known anonymous proxy endpoints from automatically updated list of IP addresses.

· WAF solution must allow geographic IP rules; allow/deny/audit users depending on the country of origin.

· WAF and Database firewall solutions must have the ability to identify and block SQL injection, cross-site forgery, cross-site scripting, directory traversal, remote file inclusion, and remote command execution.

· WAF and Database firewall solutions must be able to automatically learn normal traffic/request and block when traffic exceeds normal thresholds or patterns.

· The solution must provide the ability to monitor database traffic in an agent based deployment.

· The database agent solution must have the ability to permit/deny traffic based on policies provided from an Imperva MX150.

· The database agents must support the following: MS Server 2003, 2008, 2008 R2, 2012; MS-SQL 2012, 2014, 2016.

· The security solution for WAF and Database Firewalls must have the ability to correlate web request from the client to the sql request generated by the application server.

· The solutions for WAF and Database firewalls must have their policies and configuration centrally managed by a sole device.

· The database firewall/agents must have the ability to conduct user rights scanning on SQL server table structures.

· The WAF devices must be capable of producing reports including the full web application request. This includes the complete URI of GETs, POST, HEADS, and OPTIONS request as well as all other HTTP request methods.

· Device solutions must support syslog and reporting to USMC enterprise SIEM.

· Solution must support integration with virtual patching from USMC licensed vulnerability scanning tools.

(b) Options. The Government will evaluate offers for award purposes by adding the total price for all options to the total price for the basic requirement. The Government may determine that an offer is unacceptable if the option prices are significantly unbalanced. Evaluation of options shall not obligate the Government to exercise the option(s).

(c) A written notice of award or acceptance of an offer, mailed or otherwise furnished to the successful offeror within the time for acceptance specified in the offer, shall result in a binding contract without further action by either party. Before the offer's specified expiration time, the Government may accept an offer (or part of an offer), whether or not there are negotiations after its receipt, unless a written notice of withdrawal is received before award.

52.212-3 OFFEROR REPRESENTATIONS AND CERTIFICATIONS--COMMERCIAL ITEMS (JAN 2017) ALTERNATE I (OCT 2014)

The offeror shall complete only paragraphs (b) of this provision if the Offeror has completed the annual representations and certification electronically via the System for Award Management (SAM) Web site located at https://www.sam.gov/portal . If the Offeror has not completed the annual representations and certifications electronically, the Offeror shall complete only paragraphs (c) through (u) of this provision.

(a) Definitions. As used in this provision--

“Administrative merits determination” means certain notices or findings of labor law violations issued by an enforcement agency following an investigation. An administrative merits determination may be final or be subject to appeal or further review. To determine whether a particular notice or finding is covered by this definition, it is necessary to consult section II.B. in the DOL Guidance.

“Arbitral award or decision” means an arbitrator or arbitral panel determination that a labor law violation occurred, or that enjoined or restrained a violation of labor law. It includes an award or decision that is not final or is subject to being confirmed, modified, or vacated by a court, and includes an award or decision resulting from private or confidential proceedings. To determine whether a particular award or decision is covered by this definition, it is necessary to consult section II.B. in the DOL Guidance.

“Civil judgment” means--

(1) In paragraph (h) of this provision: A judgment or finding of a civil offense by any court of competent jurisdiction.

(2) In paragraph (s) of this provision: Any judgment or order entered by any Federal or State court in which the court determined that a labor law violation occurred, or enjoined or restrained a violation of labor law. It includes a judgment or order that is not final or is subject to appeal. To determine whether a particular judgment or order is covered by this definition, it is necessary to consult section II.B. in the DOL Guidance.

“DOL Guidance” means the Department of Labor (DOL) Guidance entitled: ``Guidance for Executive Order 13673, `Fair Pay and Safe Workplaces' ''. The DOL Guidance, dated August 25, 2016, can be obtained from www.dol.gov/fairpayandsafeworkplaces.

“Economically disadvantaged women-owned small business (EDWOSB) concern” means a small business concern that is at least 51 percent directly and unconditionally owned by, and the management and daily business operations of which are controlled by, one or more women who are citizens of the United States and who are economically disadvantaged in accordance with 13 CFR part 127. It automatically qualifies as a women-owned small business eligible under the WOSB Program.

“Enforcement agency” means any agency granted authority to enforce the Federal labor laws. It includes the enforcement components of DOL (Wage and Hour Division, Office of Federal Contract Compliance Programs, and Occupational Safety and Health Administration), the Equal Employment Opportunity Commission, the occupational Safety and Health Review Commission, and the National Labor Relations Board. It also means a State agency designated to administer an OSHA-approved State Plan, but only to the extent that the State agency is acting in its capacity as administrator of such plan. It does not include other Federal agencies which, in their capacity as contracting agencies, conduct investigations of potential labor law violations. The enforcement agencies associated with each labor law under E.O. 13673 are--

(1) Department of Labor Wage and Hour Division (WHD) for--

(i) The Fair Labor Standards Act;

(ii) The Migrant and Seasonal Agricultural Worker Protection Act;

(iii) 40 U.S.C. chapter 31, subchapter IV, formerly known as the Davis-Bacon Act;

(iv) 41 U.S.C. chapter 67, formerly known as the Service Contract Act;

(v) The Family and Medical Leave Act; and

(vi) E.O. 13658 of February 12, 2014 (Establishing a Minimum Wage for Contractors);

(2) Department of Labor Occupational Safety and Health Administration (OSHA) for--

(i) The Occupational Safety and Health Act of 1970; and

(ii) OSHA-approved State Plans;

(3) Department of Labor Office of Federal Contract Compliance Programs (OFCCP) for--

(i) Section 503 of the Rehabilitation Act of 1973;

(ii) The Vietnam Era Veterans' Readjustment Assistance Act of 1972 and the Vietnam Era Veterans' Readjustment Assistance Act of 1974; and

(iii) E.O. 11246 of September 24, 1965 (Equal Employment Opportunity);

(4) National Labor Relations Board (NLRB) for the National Labor Relations Act; and

(5) Equal Employment Opportunity Commission (EEOC) for--

(i) Title VII of the Civil Rights Act of 1964;

(ii) The Americans with Disabilities Act of 1990;

(iii) The Age Discrimination in Employment Act of 1967; and

(iv) Section 6(d) of the Fair Labor Standards Act (Equal Pay Act).

“Force…