Solicitation-_M67861-18-Q-0096.pdf

SEE ADDENDUM

(No Collect Calls)

M6786118Q0096 14-Sep-2018

b. TELEPHONE NUMBER

(504) 697-8348

8. OFFER DUE DATE/LOCAL TIME

01:00 PM 20 Sep 2018

5. SOLICITATION NUMBER 6. SOLICITATION ISSUE DATE

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

STANDARD FORM 1449 (REV. 2/2012)

Prescribed by GSA – FAR (48 CFR) 53.212

(TYPE OR PRINT)

(SIGNATURE OF CONTRACTING OFFICER)

ADDENDA X ARE

26. TOTAL AWARD AMOUNT (For Gov t. Use Only )

23.

CODE 10. THIS ACQUISITION IS

SUCH ADDRESS IN OFFER

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT

BELOW IS CHECKED

TELEPHONE NO.

M678619. ISSUED BY

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a. UNLESS BLOCK

7. FOR SOLICITATION

INFORMATION CALL:

a. NAME

SAMSON WODAJO

2. CONTRACT NO. 3. AWARD/EFFECTIVE DATE 4. ORDER NUMBER

(TYPE OR PRINT)

30b. NAME AND TITLE OF SIGNER 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a.UNITED STATES OF AMERICA

1 27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1. 52.212-4. FAR 52.212-3. 52.212-5 ARE ATTACHED.X

25. ACCOUNTING AND APPROPRIATION DATA

1. REQUISITION NUMBER

20.

ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED.

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, AND 30

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

M0009418RC00196

ARE NOT ATTACHED

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA ARE ARE NOT ATTACHED

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

SET FORTH HEREIN, IS ACCEPTED AS TO ITEMS:

. YOUR OFFER ON SOLICITATION

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

% FOR:SET ASIDE:UNRESTRICTED ORX

SMALL BUSINESS

17a.CONTRACTOR/ CODE FACILITY

OFFEROR CODE

MARFORRES REGIONAL CONTRACTING OFFICE

MFR RCO

2000 OPELOUSAS AVE

NEW ORLEANS LA 70114

18a. PAYMENT WILL BE MADE BY CODE

RATED ORDER UNDER

DPAS (15 CFR 700)

13a. THIS CONTRACT IS A

13b. RATING

CODE15. DELIVER TO CODE M00094 16. ADMINISTERED BY

12. DISCOUNT TERMS11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

14. METHOD OF SOLICITATION

RFQ IFB RFPX

TECHNOLOGY SERVICES ORGANIZATION

TROY BOUDREAUX

135 N. PENNSYLVANIA ST

ROOM 2209

INDIANAPOLIS IN 46204

TEL: 317-200-3467 FAX:

FAX:

TEL: 504-697-8357 SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

8(A)

HUBZONE SMALL

BUSINESS

SIZE STANDARD:

$38,500,000

NAICS:

511210

X

OFFER DATED

29. AWARD OF CONTRACT: REF.

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND

EMAIL:

TEL:

31c. DATE SIGNED

SEE SCHEDULE

SCHEDULE OF SUPPLIES/ SERVICESITEM NO. QUANTITY UNIT UNIT PRICE AMOUNT

24.22.21.19.

WOMEN-OWNED SMALL BUSINESS (WOSB)

ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

(CONTINUED)

ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED: ______________________________________________________

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED

32b. SIGNATURE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32c. DATE 32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE 32f . TELEPHONE NUMBER OF AUTHORIZED GOVERNMENT REPRESENTATIVE

37. CHECK NUMBER

FINALPARTIALCOMPLETE

36. PAYMENT35. AMOUNT VERIFIED

CORRECT FOR

34. VOUCHER NUMBER

FINAL

33. SHIP NUMBER

PARTIAL

38. S/R ACCOUNT NUMBER 39. S/R VOUCHER NUMBER 40. PAID BY

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT 41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER 41c. DATE

42a. RECEIVED BY (Print)

42b. RECEIVED AT (Location)

42c. DATE REC'D (YY/MM/DD) 42d. TOTAL CONTAINERS

STANDARD FORM 1449 (REV. 2/2012) BACK

Prescribed by GSA – FAR (48 CFR) 53.212

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

SEE SCHEDULE

20.

SCHEDULE OF SUPPLIES/ SERVICES

21.

QUANTITY UNIT

22. 23.

UNIT PRICE

24.

AMOUNT

19.

ITEM NO.

M6786118Q0096

Section SF 1449 - CONTINUATION SHEET

SALIENT CHARACTERISTICS

TSO P&R HQMC

Salient Requirements (Splunk brand or equal):

Automatic Log Management and Repository Requirements:

General

- The solution shall provide a lightweight agent that resides on the servers to be managed. It shall consume no more than 1gb of memory and cpu resource usage shall be configurable.

- The agent based solution shall scale to support at least 100 GB of log traffic per day.

- The solution shall support agents for multiple Operating Systems including Windows XP, Windows Vista, Windows 7, Windows 2003 Server, Windows 2008 Server, VMWare ESX Server, Redhat Enterprise Linux, Solaris Unix, etc.

- The solution shall support the multiple files systems including but not limited to NFS3 and 4, ext, UFS, NTFS, FAT32, etc.

- The solution shall NOT be dependent on OS compents such as Windows Management Interface (WMI).

- The solution shall use a single configurable port for all client-server communication.

- The solution shall be FIPS certified and have a Common Criteria certification of EAL Level 2.

- The solution shall be accredited to run on USMC networks with an ATO for MCEN on NIPR and SIPR.

- The solution shall be capable of storing at a minimum 24TB of data.

- The solution shall be capable to scale to monitor a maximum of 2,000 servers.

Search capabilities and log monitoring

- The solution shall have search capability of the logs for log monitoring.

- The solution shall have a web based front end to allow multiple users. The GUI must be supported on DoD approved application servers (WebLogic, OAS, Apache, IIS).

- The solution shall provide the capability of real-time monitoring and alerts.

- The solution shall be able to monitor several variations of logs. Logs from application servers, Operating

Servers, and Database’s.

- The solution shall provide the ability to customize out of the box inspection content to meet USMC organizational needs.

Support and Training

- The solution shall be able to provide training for the product.

- The solutionshall provide security updates and patches as needed to maintain DoD STIG requirements.

Splunk brand name items or equal:

Splunk enterprise is an application that performs log management to include authentication, distributed search, deployment management, scheduling of alerts and role based accesses controls. It provides the capability to scale the amount of logs the application monitors. It allows for customization of the GUI and search criteria.

Enterprise Security Module Salient Characteristics

• The solution shall be able to integrate and access logs from the ERR servers

• The solution shall support integration with current tools (Security Center, BigFix, Lansweeper) via plugins or API

• The solution shall provide dashboard gadgets with test execution progress and requirement coverage charts, easily customize views, and drill down to the raw event

• The solution shall provide real time monitoring to provide a clear visual picture of the organization’s security posture

• The solution shall have the ability to prioritize and act to gain a security-specific view of data to increase detection capabilities and optimize incident response

• The solution shall facilitate rapid investigations using ad hoc search and static, dynamic and visual correlations to determine malicious activities

• The solution shall be able to handle multi-step investigations to conduct breach and investigative analyses to trace the dynamic activities associated with advanced threats

• The solution shall be deployable as software, as a cloud service in a public or private cloud, or in a hybrid software-cloud deployment (may be good for the future of (iADTE)

• The solution shall migrate or replace the legacy SIEM

Information Technology Service Intelligence Salient Characteristics

• The solution shall support customized report capability

• The solution shall deliver a central, unified view of critical IT services for data-driven monitoring

• The solution shall map critical services with Key Performance Indicators (KPIs)

• The solution shall use machine learning to detect patterns, dynamically adapt thresholds, highlight anomalies and pinpoint areas of impact

• The solution shall provide business and service context to prioritize incident investigation and triage

• The solution shall supports drill downs to profile an entity and rapidly troubleshoot outages and service degradations

• The solution shall support integration with current tools (Security Center, BigFix, Lansweeper) via plugins or API

INSTRUCTIONS TO OFFERORS

*Only the numbered instructions listed herein are applicable to this solicitation. Any numbered instructions that appear to be missing are not applicable to this solicitation.

1 Synopsis: This is a Combined Synopsis/Solicitation for commercial items prepared in accordance with the format in Subpart 12, and 13.5 as supplemented with additional information included in this notice. This announcement constitutes the only solicitation; proposals are being requested and a separate written solicitation will not be issued.

2 Brand Name or Equal Product: This is a Competitive Brand Name or Equal solicitation under FAR Part 12 using FAR 13.5 procedures for a firm-fixed price contract for the purchase of Splunk Enterprise Log Management Software or EQUAL.

6 Small Business Set-aside: This requirement is unrestricted. The applicable NAICS is 511210 and the size standard is $38.5 Million. The non-manufacturer (NMR) rule does not apply as detailed in FAR 19.102(f).

7 Market Research: Market Research was conducted via World Wide Web (WWW), GSA Advantage and historical contractual data has revealed that there is no reasonable expectation of obtaining two or more offers from small business concerns. Specialist recommends that the government solicit on FBO as an unrestricted Solicitation under NAICS 511210 with a Size Standard of $38.5 Million. FAR Part 19.502-2 (a) Each acquisition of supplies or services that has an anticipated dollar value exceeding $3,000 but not over $150,000 is automatically reserved exclusively for small business concerns and should be set aside for small business unless the contracting officer determines there is not a reasonable expectation of obtaining offers from two or more responsible small business concerns that are competitive in terms of market prices, quality, and delivery. Marine Forces Reserve Small Business Program Deputy Director concurs with this action.

QUOTATION INSTRUCTIONS

8Quotations/bids/attachments should be submitted as a pdf document via email to samson.wodajo@usmc.mil and cc:shelley.mentzos@usmc.mil. Each email may not exceed 5MB in size due to server/network restrictions.

Submit multiple emails if necessary to ensure timely receipt of your bid. Only pdf email attachments are authorized. Any other email attachment types will be rejected by this agencies servers. All bids should include an overall total price in addition to individual pricing by contract line item (CLIN)

9All responsible sources may submit a quotation which, if received in a timely manner, should be considered by the agency.

10 Award will be made to the lowest-priced technically acceptable (LPTA) offer. The Technical Evaluation Template that will be used to evaluate the LPTA bid is incorporated herein for Contractor awareness only. See FAR 52.212-2 herein for technical evaluation procedures.

11 The Government will accept all offers. The Government will accept offers from authorized GSA, SEWP, or BPA holders and if available offers from Ability One and Federal Prison Industry (FPI) only. All applicable provisions and clauses from the MAS contract flowdown and are applicable to this solicitation and any resulting task/delivery order award.

12 The Government will consider brand name or equal bids only. Descriptive literature/brochures and proof software/hardware authorized to operate on USMC-N00027-NGEN-U Network required with all quotes bidding equal.

13 Method of Invoicing/Payment: Wide Area Workflow (WAWF) DFARS 252.232-7006 WAWF Instructions.

14 Any direct customer contact by Bidders is not authorized during the solicitation phase or your bid may be at risk of being eliminated from consideration for this solicitation.

15 NO PHONE CALLS will be accepted regarding this solicitation. ALL QUESTIONS should be sent in writing via email to samson.wodajo@usmc.mil and cc: shelley.mentzos@usmc.mil.

16 In the event only one offer is received in response to this solicitation the Government may request a detailed cost break-out of your quote for the purposes of comparisons in determining fair and reasonability of your quoted prices in accordance with DFARS 252.215-7008 herein.

17 The Contracting Officer may review Past Performance Information Retrieval System (PPIRS) for responsibility determination purposes.

18 The Government reserves the right to make award solely on initial quotes received on an all or none basis or on a multiple award basis. If a partial award will not be accepted, so state on the face of your bid.

19 Offerors bear the burden of ensuring that all portions of the offer (and any authorized amendments) reach the designated office before the deadline specified in the solicitation.

INSTRUCTIONS TO BE CONSIDERED RESPONSIVE TO THIS SOLICITATION:

20 Bidders should include and comply with all remaining numbered instructions to Offerors:

21 CAGE code mailto:samson.wodajo@usmc.mil mailto:samson.wodajo@usmc.mil mailto:shelley.mentzos@usmc.mil

22 DUNS number 23 Address 24 Point of contact 25 Delivery lead time after receipt of order for supplies and period of performance for services if different than listed in the solicitation document. List by line item if the delivery lead time differs from one line item to another. This should be visible on the face of the quote and not incorporated as a link or other attachment.

26 Prompt payment/discount terms (if offered). This will not be used to evaluate offers.

27 Contract number and expiration date should be included if bidding under a GSA, SEWP or other contract. This should be listed per line item unless the contract vehicle is applicable to all line items.

28 Manufacturer Part Number and Contractor Part Number (if different).

29 Supply product descriptive literature or certification statement that the proposed product or service meets all salient characteristics listed in this solicitation and the Technical Evaluation Template provided with the solicitation.

33 Brand Name or Equal Bids: All responses to this solicitation should indicate whether the firm is offering an ‘equal product.’ Descriptive literature is required with all quotes. Firms should submit sufficient descriptive literature to permit the contracting agency to assess whether the product proposed meets all the salient characteristics specified in the solicitation in accordance to the Lowest Priced Technically Acceptable Template included/attached to this solicitation. Firms offering "equal" items should provide the make, model, description of the items, proof software/hardware authorized to operate on USMC-N00027-NGEN-U Network, and product literature/brochures. This agency will not be responsible for locating or obtaining any information not included on the face of the offer or a hardcopy attachment to the offer in a response to this solicitation.

34 Software End User Licensing Agreements (EULA)/Warranty Support: Bidders shall submit an editable version of any software or subscription EULAs as an attachment to bid submittal email. Any edits will be sent to the LPTA bidder for reivew/concurrence. The Government will not accept any seller/reseller disclaimers of implied publisher standard commercial warranty or automatic renewals. As a minimum software warranties should cover the performance of all required product capabilities, free from defects/bugs, for all intended authorized users, process for reporting/fixing defects remedied at no charge to the Government, effective after Government tests of delivered software product(s), and include the seller/reseller's return policy and procedures.

46 Solicitation/Contract Line Item Numbers (CLIN) Structure – Potential bidders should submit bids in the same CLIN structure as outlined in the solicitation for bid evaluation purposes. However, an alternate line item structure can be submitted as an additional attachment consolidating like line items and pricing for award consideration.

47Assignment of Claims – Potential bidders that may need an Assignment of Claims as described in FAR 32.8 (copy/paste link into web browser: http://farsite.hill.af.mil/VFFARA.HTM) should include a statement on bid that "Assignment of Claims is required if selected for award." Assignment of Claims will not be used as an evaluation factor for award. However, all Assignment of Claims documentation should be submitted with bid or provided BEFORE accepting award for Contracting Officer determination. The Government reserves the right to disapprove a request for Assignment of Claims; vendor will be advised of disapproval prior to drafting of award so vendor may determine if it can still fulfill the contractual requirement without an Assignment of Claims. If request for Assignment of Claims is not included in bid or required documentation is not provided PRIOR to Contractor acceptance of award, the Contracting Officer may reject request for Assignment of Claims and award to the next qualified offeror.

48 System for Award Management (SAM.gov) – Potential bidders not currently registered at SAM.gov should register (including completion of certifications and representations) to be considered for award. Registration may take several days to be visible at SAM.gov, therefore, affected bidders should provide proof of registration/date with bid submittal. Contact SAM.gov website points of contact if you need assistance with registration.

ITEM NO SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

0001 1 Each Splunk Enterprise

FFP

Brand Name or Equal to Splunk Enterprise Perpetual License 100GB/day Mfr Part #: SE-P-LIC POP: 30 Sep 2018 to 29 Sep 2019

*200 GB/day of Splunk Enterprise ADC until 10/25/2018 and 100GB/day thereafter.* FOB: Destination

MILSTRIP: M0009418RC00196

PURCHASE REQUEST NUMBER: M0009418RC00196

NET AMT

0002 1 Each Splunk Enterprise - Global Support

FFP

Brand Name or Equal Splunk Enterprise Global Support Mfr Part #: SE-P-GSUP POP: 30 Sep 2018 to 29 Sep 2019 FOB: Destination

0003 1 Each Splunk Enterprise Security - Perpetual License-

FFP

Brand Name or Equal Splunk Enterprise Security - Perpetual License- 100GB/day

Mfr Part #: ES-P-LIC POP: 30 Sep 2018 to 29 Sep 2019

*200 GB/day of Splunk Enterprise ADC until 10/25/2018 and 100GB/day thereafter.* FOB: Destination

0004 1 Each Splunk Enterprise Security - Global Suppor

FFP

Brand Name or Equal Splunk Enterprise Security - Global Support

Mfr Part #: ES-P-GSUP POP: 30 Sep 2018 to 29 Sep 2019 FOB: Destination

0005 1 Each Splunk IT Service Intelligence - Perpetual License

FFP

Brand Name or Equal Splunk IT Service Intelligence - Perpetual License 100GB/day

Mfr Part #: IT-P-LIC POP: 30 Sep 2018 to 29 Sep 2019

*200 GB/day of Splunk Enterprise ADC until 10/25/2018 and 100GB/day thereafter.* FOB: Destination

0006 1 Each Splunk IT Service Intelligence - Global Support

FFP

Brand Name or Equal Splunk IT Service Intelligence - Global Support

Mfr Part #: IT-P-GSUP POP: 30 Sep 2018 to 29 Sep 2019 FOB: Destination

0008 1 Each KGI Splunk Subscription Services

FFP

Brand Name or Equal Splunk Subscription Services

Mfr Part #: KGI-EOD-L1 KGI POP: 30 Sep 2018 to 29 Sep 2019

*Expertise on Demand One 1/2 day availability monthly (averaged as 1 hour availability each week) over 12-month term of contract.* FOB: Destination

INSPECTION AND ACCEPTANCE TERMS

Supplies/services will be inspected/accepted at:

CLIN INSPECT AT INSPECT BY ACCEPT AT ACCEPT BY

0001 Destination Government Destination Government 0002 Destination Government Destination Government 0003 Destination Government Destination Government 0004 Destination Government Destination Government 0005 Destination Government Destination Government 0006 Destination Government Destination Government 0008 Destination Government Destination Government

DELIVERY INFORMATION

CLIN DELIVERY DATE QUANTITY SHIP TO ADDRESS DODAAC /

CAGE

0001 POP 30-SEP-2018 TO

29-SEP-2019

N/A TECHNOLOGY SERVICES

ORGANIZATION

TROY BOUDREAUX

135 N. PENNSYLVANIA ST

ROOM 2209

INDIANAPOLIS IN 46204

317-200-3467 FOB: Destination

M00094

0002 POP 30-SEP-2018 TO

N/A (SAME AS PREVIOUS LOCATION)

0003 POP 30-SEP-2018 TO

N/A (SAME AS PREVIOUS LOCATION)

0004 POP 30-SEP-2018 TO

N/A (SAME AS PREVIOUS LOCATION)

0005 POP 30-SEP-2018 TO

N/A (SAME AS PREVIOUS LOCATION)

0006 POP 30-SEP-2018 TO

N/A (SAME AS PREVIOUS LOCATION)

0008 POP 30-SEP-2018 TO

N/A (SAME AS PREVIOUS LOCATION)

CLAUSES INCORPORATED BY REFERENCE

52.203-3 Gratuities APR 1984 52.204-4 Printed or Copied Double-Sided on Postconsumer Fiber

Content Paper

MAY 2011

52.204-7 System for Award Management OCT 2016 52.204-13 System for Award Management Maintenance OCT 2016 52.204-16 Commercial and Government Entity Code Reporting JUL 2016 52.204-18 Commercial and Government Entity Code Maintenance JUL 2016 52.204-19 Incorporation by Reference of Representations and

Certifications.

DEC 2014

52.204-22 Alternative Line Item Proposal JAN 2017 52.204-23 Prohibition on Contracting for Hardware, Software, and

Services Developed or Provided by Kaspersky Lab and Other Covered Entities.

JUL 2018

52.212-1 Instructions to Offerors--Commercial Items JAN 2017 52.212-4 Contract Terms and Conditions--Commercial Items JAN 2017 52.225-25 Prohibition on Contracting with Entities Engaging in Certain

Activities or Transactions Relating to Iran-- Representation and Certifications.

AUG 2018

52.232-40 Providing Accelerated Payments to Small Business Subcontractors

DEC 2013

52.247-34 F.O.B. Destination NOV 1991 252.203-7000 Requirements Relating to Compensation of Former DoD

Officials

SEP 2011

252.203-7005 Representation Relating to Compensation of Former DoD Officials

NOV 2011

252.204-7003 Control Of Government Personnel Work Product APR 1992 252.204-7015 Notice of Authorized Disclosure of Information for Litigation

Support

MAY 2016

252.209-7004 Subcontracting With Firms That Are Owned or Controlled By The Government of a Country that is a State Sponsor of Terrorism

OCT 2015

252.213-7000 Notice to Prospective Suppliers on Use of Supplier Performance Risk System in Past Performance Evaluations

MAR 2018

252.223-7008 Prohibition of Hexavalent Chromium JUN 2013 252.225-7002 Qualifying Country Sources As Subcontractors DEC 2017 252.225-7012 Preference For Certain Domestic Commodities DEC 2017 252.225-7021 Trade Agreements--Basic DEC 2017 252.225-7048 Export-Controlled Items JUN 2013 252.232-7003 Electronic Submission of Payment Requests and Receiving

Reports

JUN 2012

252.232-7010 Levies on Contract Payments DEC 2006 252.237-7010 Prohibition on Interrogation of Detainees by Contractor

Personnel

JUN 2013

252.239-7010 Cloud Computing Services OCT 2016 252.243-7002 Requests for Equitable Adjustment DEC 2012 252.244-7000 Subcontracts for Commercial Items JUN 2013 252.247-7023 Transportation of Supplies by Sea APR 2014

CLAUSES INCORPORATED BY FULL TEXT

52.204-20 Predecessor of Offeror (JUL 2016)

(a) Definitions. As used in this provision--

Commercial and Government Entity (CAGE) code means--

(1) An identifier assigned to entities located in the United States or its outlying areas by the Defense Logistics Agency (DLA) Commercial and Government Entity (CAGE) Branch to identify a commercial or government entity;

or

(2) An identifier assigned by a member of the North Atlantic Treaty Organization (NATO) or by the NATO Support and Procurement Agency (NSPA) to entities located outside the United States and its outlying areas that the DLA Commercial and Government Entity (CAGE) Branch records and maintains in the CAGE master file. This type of code is known as a NATO CAGE (NCAGE) code.

Predecessor means an entity that is replaced by a successor and includes any predecessors of the predecessor.

Successor means an entity that has replaced a predecessor by acquiring the assets and carrying out the affairs of the predecessor under a new name (often through acquisition or merger). The term “successor” does not include new offices/divisions of the same company or a company that only changes its name. The extent of the responsibility of the successor for the liabilities of the predecessor may vary, depending on State law and specific circumstances.

(b) The Offeror represents that it [____] is or [____] is not a successor to a predecessor that held a Federal contract or grant within the last three years.

(c) If the Offeror has indicated “is” in paragraph (b) of this provision, enter the following information for all predecessors that held a Federal contract or grant within the last three years (if more than one predecessor, list in reverse chronological order):

Predecessor CAGE code: ____ (or mark “Unknown”).

Predecessor legal name: ____.

(Do not use a “doing business as” name).

(End of provision)

52.204-21 BASIC SAFEGUARDING OF COVERED CONTRACTOR INFORMATION SYSTEMS (JUN 2016)

(a) Definitions. As used in this clause--

Covered contractor information system means an information system that is owned or operated by a contractor that processes, stores, or transmits Federal contract information.

Federal contract information means information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government, but not including information provided by the Government to the public (such as on public Web sites) or simple transactional information, such as necessary to process payments.

Information means any communication or representation of knowledge such as facts, data, or opinions, in any medium or form, including textual, numerical, graphic, cartographic, narrative, or audiovisual (Committee on National Security Systems Instruction (CNSSI) 4009).

Information system means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information (44 U.S.C. 3502).

Safeguarding means measures or controls that are prescribed to protect information systems.

(b) Safeguarding requirements and procedures.

(1) The Contractor shall apply the following basic safeguarding requirements and procedures to protect covered contractor information systems. Requirements and procedures for basic safeguarding of covered contractor information systems shall include, at a minimum, the following security controls:

(i) Limit information system access to authorized users, processes acting on behalf of authorized users, or devices

(including other information systems).

(ii) Limit information system access to the types of transactions and functions that authorized users are permitted to execute.

(iii) Verify and control/limit connections to and use of external information systems.

(iv) Control information posted or processed on publicly accessible information systems.

(v) Identify information system users, processes acting on behalf of users, or devices.

(vi) Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems.

(vii) Sanitize or destroy information system media containing Federal Contract Information before disposal or release for reuse.

(viii) Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals.

(ix) Escort visitors and monitor visitor activity; maintain audit logs of physical access; and control and manage physical access devices.

(x) Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems.

(xi) Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.

(xii) Identify, report, and correct information and information system flaws in a timely manner.

(xiii) Provide protection from malicious code at appropriate locations within organizational information systems.

(xiv) Update malicious code protection mechanisms when new releases are available.

(xv) Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed.

(2) Other requirements. This clause does not relieve the Contractor of any other specific safeguarding requirements specified by Federal agencies and departments relating to covered contractor information systems generally or other Federal safeguarding requirements for controlled unclassified information (CUI) as established by Executive Order 13556.

(c) Subcontracts. The Contractor shall include the substance of this clause, including this paragraph (c), in subcontracts under this contract (including subcontracts for the acquisition of commercial items, other than commercially available off-the-shelf items), in which the subcontractor may have Federal contract information residing in or transiting through its information system.

(End of clause)

52.209-2 PROHIBITION ON CONTRACTING WITH INVERTED DOMESTIC CORPORATIONS--

REPRESENTATION (NOV 2015)

(a) Definitions. Inverted domestic corporation and subsidiary have the meaning given in the clause of this contract entitled Prohibition on Contracting with Inverted Domestic Corporations (52.209-10).

(b) Government agencies are not permitted to use appropriated (or otherwise made available) funds for contracts with either an inverted domestic corporation, or a subsidiary of an inverted domestic corporation, unless the exception at 9.108-2(b) applies or the requirement is waived in accordance with the procedures at 9.108-4.

(c) Representation. The Offeror represents that--

(1) It [ ___ ] is, [ ___ ] is not an inverted domestic corporation; and

(2) It [ ___ ] is, [ ___ ] is not a subsidiary of an inverted domestic corporation.

52.209-11 REPRESENTATION BY CORPORATIONS REGARDING DELINQUENT TAX LIABILITY OR A

FELONY CONVICTION UNDER ANY FEDERAL LAW (FEB 2016)

(a) As required by sections 744 and 745 of Division E of the Consolidated and Further Continuing Appropriations Act, 2015 (Pub. L. 113-235), and similar provisions, if contained in subsequent appropriations acts, the Government will not enter into a contract with any corporation that--

(1) Has any unpaid Federal tax liability that has been assessed, for which all judicial and administrative remedies have been exhausted or have lapsed, and that is not being paid in a timely manner pursuant to an agreement with the authority responsible for collecting the tax liability, where the awarding agency is aware of the unpaid tax liability, unless an agency has considered suspension or debarment of the corporation and made a determination that suspension or debarment is not necessary to protect the interests of the Government; or

(2) Was convicted of a felony criminal violation under any Federal law within the preceding 24 months, where the awarding agency is aware of the conviction, unless an agency has considered suspension or debarment of the corporation and made a determination that this action is not necessary to protect the interests of the Government.

(b) The Offeror represents that--

(1) It is [ ] is not [ ] a corporation that has any unpaid Federal tax liability that has been assessed, for which all judicial and administrative remedies have been exhausted or have lapsed, and that is not being paid in a timely manner pursuant to an agreement with the authority responsible for collecting the tax liability; and

(2) It is [ ] is not [ ] a corporation that was convicted of a felony criminal violation under a Federal law within the preceding 24 months.

52.212-2 EVALUATION--COMMERCIAL ITEMS (OCT 2014)

(a) The Government will award a contract resulting from this solicitation to the responsible offeror whose offer conforming to the solicitation will be most advantageous to the Government, price and other factors considered. The following factors shall be used to evaluate offers:

1. Technical Acceptability (i) will be the primary evaluating factor for this requirement followed by Price (ii) then Past Performance (iii) in order of prescedence.

(i) Technical Acceptability will be evaluated according to the table provided herein to ensure accuracy and compatability amoung all required items.

(ii) Price will be evaluated to determine offer fair and reasonable.

(iii) Past Performance will be evaluated to determine responsibility of the offeror to satisfy the requirement.

2. Offers will be ranked lowest to highest according to price. The lowest price offer will be forwarded to the requiring activity for technical evaluation (offer will be deemed either technically acceptable or technically unacceptable). If the lowest price offer is found technically acceptable and its price is determined fair and reasonable by the Contracting Officer, evaluation will be deemed complete and award will be made based on the lowest price offer. If the lowest price offer is determined technically unacceptable, the next lowest price offer will be sent for technical evaluation and price analysis. This process is repeated in order of price until an offer is deemed technically acceptable and price is determined fair and reasonable. The actual evaluation template is incorporated into this solicitation for bidder reference only and may not include or be all inclusive of items evaluated. The final completed version is for Government Official Use Only.

TECHNICAL EVALUATION WORKSHEET FOR LOWEST PRICE TECHNICALLY ACCEPTABILITY

DETERMINATION (v8.19.2015)

PR NOMENCLATURE: TSO: Splunk Enterprise Log

Management Software

PR #:

M00094-18-RC-00196

Solicitation #:

M6786118-Q-0096

TECHNICAL ACCEPTABILITY - SECTION 2:

Salient Characteristics Technically Acceptable

Not Technically Acceptable

Explain in Detail Why Does Not Meet Criteria

Automatic Log Management and Repository Requirements:

The solution shall provide a lightweight agent that resides on the servers to be managed. It shall consume no more than 1gb of memory and cpu resource usage shall be configurable.

The agent based solution shall scale to support at least 100 GB of log traffic per day.

The solution shall support agents for multiple Operating Systems including Windows XP, Windows Vista, Windows 7, Windows 2003 Server, Windows 2008 Server, VMWare ESX Server, Redhat Enterprise Linux, Solaris Unix, etc.

The solution shall support the multiple files systems including but not limited to NFS3 and 4, ext, UFS, NTFS, FAT32, etc.

The solution shall NOT be dependent on OS compents such as Windows Management Interface (WMI).

The solution shall use a single configurable port for all client-server communication.

The solution shall be FIPS certified and have a Common Criteria certification of EAL Level 2.

The solution shall be accredited to run on USMC networks with an ATO for MCEN on NIPR and SIPR.

The solution shall be capable of storing at a minimum 24TB of data.

The solution shall be capable to scale to monitor a maximum of 2,000 servers.

Search capabilities and log monitoring:

The solution shall have search capability of the logs for log monitoring.

The solution shall have a web based front end to allow multiple users. The GUI must be supported on DoD approved application servers (WebLogic, OAS, Apache, IIS).

The solution shall provide the capability of real-time monitoring and alerts.

The solution shall be able to monitor several variations of logs.

Logs from application servers, Operating Servers, and Database’s.

The solution shall provide the ability to customize out of the box inspection content to meet USMC organizational needs.

Support and Training:

The solution shall be able to provide training for the product.

The solutionshall provide security updates and patches as needed to maintain DoD STIG requirements.

Splunk brand name items or equal: Splunk enterprise is an application that performs log management to include authentication, distributed search, deployment management, scheduling of alerts and role based accesses controls. It provides the capability to scale the amount of logs the application monitors.

It allows for customization of the GUI and search criteria.

Enterprise Security Module Salient Characteristics:

The solution shall be able to integrate and access logs from the ERR servers

The solution shall support integration with current tools (Security Center, BigFix, Lansweeper) via plugins or API

The solution shall provide dashboard gadgets with test execution progress and requirement coverage charts, easily customize views, and drill down to the raw event

The solution shall provide real time monitoring to provide a clear visual picture of the organization’s security posture

The solution shall have the ability to prioritize and act to gain a security-specific view of data to increase detection capabilities and optimize incident response

The solution shall facilitate rapid investigations using ad hoc search and static, dynamic and visual correlations to determine malicious activities

The solution shall be able to handle multi-step investigations to conduct breach and investigative analyses to trace the dynamic activities associated with advanced threats

The solution shall be deployable as software, as a cloud service in a public or private cloud, or in a hybrid software-cloud deployment (may be good for the future of (iADTE)

The solution shall migrate or replace the legacy SIEM

Information Technology Service Intelligence Salient Characteristics:

The solution shall support customized report capability The solution shall deliver a central, unified view of critical IT services for data-driven monitoring

The solution shall map critical services with Key Performance Indicators (KPIs)

The solution shall use machine learning to detect patterns, dynamically adapt thresholds, highlight anomalies and pinpoint areas of impact

The solution shall provide business and service context to prioritize incident investigation and triage

The solution shall supports drill downs to profile an entity and rapidly troubleshoot outages and service degradations

The solution shall support integration with current tools (Security Center, BigFix, Lansweeper) via plugins or API

(b) Options. The Government will evaluate offers for award purposes by adding the total price for all options to the total price for the basic requirement. The Government may determine that an offer is unacceptable if the option prices are significantly unbalanced. Evaluation of options shall not obligate the Government to exercise the option(s).

(c) A written notice of award or acceptance of an offer, mailed or otherwise furnished to the successful offeror within the time for acceptance specified in the offer, shall result in a binding contract without further action by either party. Before the offer's specified expiration time, the Government may accept an offer (or part of an offer), whether or not there are negotiations after its receipt, unless a written notice of withdrawal is received before award.

52.212-3 OFFEROR REPRESENTATIONS AND CERTIFICATIONS--COMMERCIAL ITEMS (NOV 2017)

ALTERNATE I (OCT 2014)

The offeror shall complete only paragraphs (b) of this provision if the Offeror has completed the annual representations and certification electronically via the System for Award Management (SAM) Web site located at https://www.sam.gov/portal . If the Offeror has not completed the annual representations and certifications electronically, the Offeror shall complete only paragraphs (c) through (u) of this provision.

(a) Definitions. As used in this provision--

“Economically disadvantaged women-owned small business (EDWOSB) concern” means a small business concern that is at least 51 percent directly and unconditionally owned by, and the management and daily business operations of which are controlled by, one or more women who are citizens of the United States and who are economically disadvantaged in accordance with 13 CFR part 127. It automatically qualifies as a women-owned small business eligible under the WOSB Program.

“Forced or indentured child labor” means all work or service—

(1) Exacted from any person under the age of 18 under the menace of any penalty for its nonperformance and for which the worker does not offer himself voluntarily; or

(2) Performed by any person under the age of 18 pursuant to a contract the enforcement of which can be accomplished by process or penalties.

“Highest-level owner” means the entity that owns or controls an immediate owner of the offeror, or that owns or controls one or more entities that control an immediate owner of the offeror. No entity owns or exercises control of the highest level owner.

“Immediate owner” means an entity, other than the offeror, that has direct control of the offeror. Indicators of control include, but are not limited to, one or more of the following: Ownership or interlocking management, identity of interests among family members, shared facilities and equipment, and the common use of employees.

“Inverted domestic corporation,” means a foreign incorporated entity that meets the definition of an inverted domestic corporation under 6 U.S.C. 395(b), applied in accordance with the rules and definitions of 6 U.S.C. 395(c).

“Manufactured end product” means any end product in product and service codes (PSCs) 1000-9999, except— https://www.sam.gov/portal

(1) PSC 5510, Lumber and Related Basic Wood Materials;

(2) Product or Service Group (PSG) 87, Agricultural Supplies;

(3) PSG 88, Live Animals;

(4) PSG 89, Subsistence;

(5) PSC 9410, Crude Grades of Plant Materials;

(6) PSC 9430, Miscellaneous Crude Animal Products, Inedible;

(7) PSC 9440, Miscellaneous Crude Agricultural and Forestry Products;

(8) PSC 9610, Ores;

(9) PSC 9620, Minerals, Natural and Synthetic; and

(10) PSC 9630, Additive Metal Materials.

“Place of manufacture” means the place where an end product is assembled out of components, or otherwise made or processed from raw materials into the finished product that is to be provided to the Government. If a product is disassembled and reassembled, the place of reassembly is not the place of manufacture.

“Restricted business operations” means business operations in Sudan that include power production activities, mineral extraction activities, oil-related activities, or the production of military equipment, as those terms are defined in the Sudan Accountability and Divestment Act of 2007 (Pub. L. 110-174). Restricted business operations do not include business operations that the person (as that term is defined in Section 2 of the Sudan Accountability and Divestment Act of 2007) conducting the business can demonstrate—

(1) Are conducted under contract directly and exclusively with the regional government of southern Sudan;

(2) Are conducted pursuant to specific authorization from the Office of Foreign Assets Control in the Department of the Treasury, or are expressly exempted under Federal law from the requirement to be conducted under such authorization;

(3) Consist of providing goods or services to marginalized populations of Sudan;

(4) Consist of providing goods or services to an internationally recognized peacekeeping force or humanitarian organization;

(5) Consist of providing goods or services that are used only to promote health or education; or

(6) Have been voluntarily suspended.

“Sensitive technology”—

(1) Means hardware, software, telecommunications equipment, or any other technology that is to be used specifically—

(i) To restrict the free flow of unbiased information in Iran; or

(ii) To disrupt, monitor, or otherwise restrict speech of the people of Iran; and

(2) Does not include information or informational materials the export of which the President does not have the authority to regulate or prohibit pursuant to section 203(b)(3) of the International Emergency Economic Powers Act (50 U.S.C. 1702(b)(3)).

“Service-disabled veteran-owned small business concern”—

(1) Means a small business concern—

(i) Not less than 51 percent of which is owned by one or more service-disabled veterans or, in the case of any publicly owned business, not less than 51 percent of the stock of which is owned by one or more service-disabled veterans; and

(ii) The management and daily business operations of which are controlled by one or more service-disabled veterans or, in the case of a service-disabled veteran with permanent and severe disability, the spouse or permanent caregiver of such veteran.

(2) Service-disabled veteran means a veteran, as defined in 38 U.S.C. 101(2), with a disability that is service-connected, as defined in 38 U.S.C. 101(16).

“Small business concern” means a concern, including its affiliates, that is independently owned and operated, not dominant in the field of operation in which it is bidding on Government contracts, and qualified as a small business under the criteria in 13 CFR Part 121 and size standards in this solicitation.

“Small disadvantaged business concern, consistent with 13 CFR 124.1002,” means a small business concern under the size standard applicable to the acquisition, that--

(1) Is at least 51 percent unconditionally and directly owned (as defined at 13 CFR 124.105) by--

(i) One or more socially disadvantaged (as defined at 13 CFR 124.103) and economically disadvantaged (as defined at 13 CFR 124.104) individuals who are citizens of the United States; and

(ii) Each individual claiming economic disadvantage has a net worth not exceeding $750,000 after taking into account the applicable exclusions set forth at 13 CFR 124.104(c)(2); and

(2) The management and daily business operations of which are controlled (as defined at 13.CFR 124.106) by individuals, who meet the criteria in paragraphs (1)(i) and (ii) of this definition.

“Subsidiary” means an entity in which more than 50 percent of the entity is owned—

(1) Directly by a parent corporation; or

(2) Through another subsidiary of a parent corporation.

“Veteran-owned small business concern” means a small business concern—

(1) Not less than 51 percent of which is owned by one or more veterans(as defined at 38 U.S.C. 101(2)) or, in the case of any publicly owned business, not less than 51 percent of the stock of which is owned by one or more veterans; and

(2) The management and daily business operations of which are controlled by one or more veterans.

“Women-owned business concern” means a concern which is at least 51 percent owned by one or more women; or in the case of any publicly owned business, at least 51 percent of the its stock is owned by one or more women; and whose management and daily business operations are controlled by one or more women.

“Women-owned small business concern” means a small business concern --

(1) That is at least 51 percent owned by one or more women or, in the case of any publicly owned business, at least 51 percent of the stock of which is owned by one or more women; and

(2) Whose management and daily business operations are controlled by one or more women.

“Women-owned small business (WOSB) concern eligible under the WOSB Program (in accordance with 13 CFR part 127),” means a small business concern that is at least 51 percent directly and unconditionally owned by, and the management and daily business operations of which are controlled by, one or more women who are citizens of the United States.

(b)

(1) Annual Representations and Certifications. Any changes provided by the offeror in paragraph (b)(2) of this provision do not automatically change the representations and certifications posted on the SAMwebsite.

(2) The offeror has completed the annual representations and certifications electronically via the SAM website accessed through https://www.acquisition.gov. After reviewing the SAM database information, the offeror verifies by submission of this offer that the representation and certifications currently posted electronically at FAR 52.212-3, Offeror Representations and Certifications—Commercial Items, have been entered or updated in the last 12 months, are current, accurate, complete, and applicable to this solicitation (including the business size standard applicable to the NAICS code referenced for this solicitation), as of the date of this offer and are incorporated in this offer by reference (see FAR 4.1201), except for paragraphs ___ . [Offeror to identify the applicable paragraphs at (c) through (u) of this provision that the offeror has completed for the purposes of this solicitation only, if any. These amended representation(s) and/or certification(s) are also incorporated in this offer and are current, accurate, and complete as of the date of this offer. Any changes provided by the offeror are applicable to this solicitation only, and do not result in an update to the representations and certifications posted electronically on SAM.]

(c) Offerors must complete the following representations when the resulting contract is to be performed in the United States or its outlying areas. Check all that apply.

(1) Small business concern. The offeror represents as part of its offer that it [ ___ ] is, [ ___ ] is not a small business concern.

https://www.acquisition.gov/

(2) Veteran-owned small business concern. [Complete only if the offeror represented itself as a small business concern in paragraph (c)(1) of this provision.] The offeror represents as part of its offer that it [ ___ ] is, [ ___ ] is not a veteran-owned small business concern.

(3) Service-disabled veteran-owned small business concern. [Complete only if the offeror represented itself as a veteran-owned small business concern in paragraph (c)(2) of this provision.] The offeror represents as part of its offer that it [ ___ ] is, [ ___ ] is not a service-disabled veteran-owned small business concern.

(4) Small disadvantaged business concern. [Complete only if the offeror represented itself as a small business concern in paragraph (c)(1) of this provision.]The offeror represents that it [ ___ ] is, [ ___ ] is not, a small disadvantaged business concern as defined in 13 CFR 124.1002.

(5) Women-owned small business concern. [Complete only if the offeror represented itself as a…