RFQ_M68909-24-Q-7624 A0002 Conformed.pdf

SEE ADDENDUM

(No Collect Calls)

M6890924Q7624 27-Jun-2024

b. TELEPHONE NUMBER

619-5713223

8. OFFER DUE DATE/LOCAL TIME

12:00 PM 12 Jul 2024

5. SOLICITATION NUMBER 6. SOLICITATION ISSUE DATE

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

STANDARD FORM 1449 (REV. 2/2012)

Prescribed by GSA – FAR (48 CFR) 53.212

(TYPE OR PRINT)

(SIGNATURE OF CONTRACTING OFFICER)

ADDENDA ARE

26. TOTAL AWARD AMOUNT (For Gov t. Use Only )

23.

CODE 10. THIS ACQUISITION IS

SUCH ADDRESS IN OFFER

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT

BELOW IS CHECKED

TELEPHONE NO.

M689099. ISSUED BY

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a. UNLESS BLOCK

7. FOR SOLICITATION

INFORMATION CALL:

a. NAME

JARED C. ROWE

2. CONTRACT NO. 3. AWARD/EFFECTIVE DATE 4. ORDER NUMBER

(TYPE OR PRINT)

30b. NAME AND TITLE OF SIGNER 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a.UNITED STATES OF AMERICA

0 27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1. 52.212-4. FAR 52.212-3. 52.212-5 ARE ATTACHED.

25. ACCOUNTING AND APPROPRIATION DATA

1. REQUISITION NUMBER

20.

ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED.

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, AND 30

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

ARE NOT ATTACHED

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA ARE ARE NOT ATTACHED

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

SET FORTH HEREIN, IS ACCEPTED AS TO ITEMS:

. YOUR OFFER ON SOLICITATION

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

% FOR:SET ASIDE:UNRESTRICTED OR X

SMALL BUSINESS

17a.CONTRACTOR/ CODE FACILITY

OFFEROR CODE

COMMANDING OFFICER

CONTRACTS, MCTSSA

BOX 555171

CAMP PENDLETON CA 92055-5171

18a. PAYMENT WILL BE MADE BY CODE

RATED ORDER UNDER

DPAS (15 CFR 700)

13a. THIS CONTRACT IS A

13b. RATING

CODE15. DELIVER TO CODE M68909 16. ADMINISTERED BY

12. DISCOUNT TERMS11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

14. METHOD OF SOLICITATION

RFQ IFB RFPX

COMMANDING OFFICER

MAJOR JOSEPH MEIER

MCTSSA SUPPLY

BLDG 31345

CAMP PENDLETON CA 92055-5171

TEL: 760-846-6738 FAX: (760) 725-2550

(760) 725-2514FAX:

TEL: SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

X 8(A)

HUBZONE SMALL

BUSINESS

SIZE STANDARD:

$47,000,000

NAICS:

513210

OFFER DATED

29. AWARD OF CONTRACT: REF.

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND

EMAIL:

TEL:

31c. DATE SIGNED

SEE SCHEDULE

SCHEDULE OF SUPPLIES/ SERVICESITEM NO. QUANTITY UNIT UNIT PRICE AMOUNT

24.22.21.19.

WOMEN-OWNED SMALL BUSINESS (WOSB)

ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

x

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

(CONTINUED)

ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED: ______________________________________________________

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED

32b. SIGNATURE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32c. DATE 32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE 32f . TELEPHONE NUMBER OF AUTHORIZED GOVERNMENT REPRESENTATIVE

37. CHECK NUMBER

FINALPARTIALCOMPLETE

36. PAYMENT35. AMOUNT VERIFIED

CORRECT FOR

34. VOUCHER NUMBER

FINAL

33. SHIP NUMBER

PARTIAL

38. S/R ACCOUNT NUMBER 39. S/R VOUCHER NUMBER 40. PAID BY

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT 41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER 41c. DATE

42a. RECEIVED BY (Print)

42b. RECEIVED AT (Location)

42c. DATE REC'D (YY/MM/DD) 42d. TOTAL CONTAINERS

STANDARD FORM 1449 (REV. 2/2012) BACK

Prescribed by GSA – FAR (48 CFR) 53.212

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

SEE SCHEDULE

20.

SCHEDULE OF SUPPLIES/ SERVICES

21.

QUANTITY UNIT

22. 23.

UNIT PRICE

24.

AMOUNT

19.

ITEM NO.

M6890924Q7624

Section SF 30 - BLOCK 14 CONTINUATION PAGE

AMENDMENT 001

Vendor Question: What cybersecurity platform does the Government intend to use to meet its requirements?

Government Answer: The Government does not intend to use any specific cybersecurity platform. Any platform with the capabilities detailed in the RFQ will meet the Government’s requirements for this procurement.

Vendor Question: What Tenable products must the contractor ensure compatibility with? Which version of these products must the contractor shape their solution to support?

Government Answer: Tenable Nessus (Latest Version)

Vendor Question: What specific requirements and limitations for operating in the air-gapped environment does the Government have in mind?

Government Answer: For any tool/vendor to be considered, the tool must be self-contained whether as a single Virtual Machine or multiple. There can be no reach back to vendor servers or the internet. Software updates must be delivered in a method where it can be downloaded to a disk and must be self-contained as well.

Custom scripts must be able to be imported without review, approval, and dissemination with vendor.

Vendor Question: Are there any specific hardware or software configurations offerors should be aware of?

Government Answer: Vendor solution must be able to be deployed on ESXi. Solution must also be able to ingest data from Rapid7 tools

Vendor Question: Are there any specific scripting languages or frameworks preferred for creating custom attack scripts?

Government Answer: Python (.py), Bash Script (.sh), Windows Batch (.bat) and Powershell (.ps1)

Vendor Question: Are there any specific data formats or APIs that the imported vulnerability scan data should adhere to?

Government Answer: At minimum: XML, CSV, HTML, .nessus

Vendor Question: Can the Government provide any guidelines or documentation on the required depth and complexity of the APT emulation?

Government Answer: Depth and Complexity should emulate APT campaigns from publicly available sources and follow steps from initial access to data exfiltration

Vendor Question: Can the Government provide an expected license count for nodes, users, or seats required to run this software?

Government Answer: Single instance, 15 users

Vendor Question: Are there specific pricing models or structures preferred for this procurement (milestone, subscription)?

Government Answer: Yearly Subscription

Section SF 1449 - CONTINUATION SHEET

ITEM NO SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

Cyber Assessment Tool Base

FFP

To provide penetration testing, validation, and reporting software over a 12 month base period. The relevant software must have the following capabilities:

1. Ability to operate in an air-gapped environment with no reliance on external connections.

2. Ability to create custom attack scripts without external oversight or approval.

3. Ability to import vulnerability scan data from Tenable.

4. Ability to emulate Advanced Persistent Threat (APT) groups.

FOB: Destination

PSC CD: 7A21

NET AMT

Cyber Assessment Tool Option 1

FFP

Penetration testing, validation, and reporting software for one 12-month option period. The relevant software must have the following capabilities:

1. Ability to operate in an air-gapped environment with no reliance on external connections.

2. Ability to create custom attack scripts without external oversight or approval.

3. Ability to import vulnerability scan data from Tenable.

4. Ability to emulate Advanced Persistent Threat (APT) groups.

Cyber Assessment Tool Option 2

FFP

Penetration testing, validation and reporting software for one 12-month option period. The relevant software must have the following capabilities:

1. Ability to operate in an air-gapped environment with no reliance on external connections.

2. Ability to create custom attack scripts without external oversight or approval.

3. Ability to import vulnerability scan data from Tenable.

4. Ability to emulate Advanced Persistent Threat (APT) groups.

INSPECTION AND ACCEPTANCE TERMS

Supplies/services will be inspected/accepted at:

CLIN INSPECT AT INSPECT BY ACCEPT AT ACCEPT BY

0001 Destination Government Destination Government 0002 Destination Government Destination Government 0003 Destination Government Destination Government

DELIVERY INFORMATION

CLIN DELIVERY DATE QUANTITY SHIP TO ADDRESS DODAAC /

CAGE

0001 18-AUG-2024 COMMANDING OFFICER

MAJOR JOSEPH MEIER

MCTSSA SUPPLY

BLDG 31345

CAMP PENDLETON CA 92055-5171

760-846-6738

M68909

0002 19-AUG-2025 (SAME AS PREVIOUS LOCATION)

0003 19-AUG-2026 (SAME AS PREVIOUS LOCATION)

CLAUSES INCORPORATED BY REFERENCE

52.203-19 Prohibition on Requiring Certain Internal Confidentiality

Agreements or Statements

JAN 2017

52.204-1 Approval of Contract DEC 1989 52.204-10 Reporting Executive Compensation and First-Tier

Subcontract Awards

JUN 2020

52.204-13 System for Award Management Maintenance OCT 2018 52.204-16 Commercial and Government Entity Code Reporting AUG 2020 52.204-17 Ownership or Control of Offeror AUG 2020 52.204-18 Commercial and Government Entity Code Maintenance AUG 2020 52.204-20 Predecessor of Offeror AUG 2020 52.204-23 Prohibition on Contracting for Hardware, Software, and

Services Developed or Provided by Kaspersky Lab Covered Entities

DEC 2023

52.204-24 Representation Regarding Certain Telecommunications and Video Surveillance Services or Equipment

NOV 2021

52.204-25 Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment

NOV 2021

52.204-26 Covered Telecommunications Equipment or Services-- Representation.

OCT 2020

52.204-27 Prohibition on a ByteDance Covered Application JUN 2023 52.209-6 Protecting the Government's Interest When Subcontracting

With Contractors Debarred, Suspended, or Proposed for Debarment

NOV 2021

52.209-7 Information Regarding Responsibility Matters OCT 2018 52.209-10 Prohibition on Contracting With Inverted Domestic

Corporations

NOV 2015

52.209-11 Representation by Corporations Regarding Delinquent Tax Liability or a Felony Conviction under any Federal Law

FEB 2016

52.212-1 Instructions to Offerors--Commercial Products and Commercial Services

SEP 2023

52.212-3 Offeror Representations and Certifications--Commercial Products and Commercial Services

MAY 2024

52.212-4 Contract Terms and Conditions--Commercial Products and Commercial Services

NOV 2023

52.212-5 Contract Terms and Conditions Required to Implement Statutes or Executive Orders--Commercial Products and Commercial Services

MAY 2024

52.217-5 Evaluation Of Options JUL 1990 52.217-6 Option For Increased Quantity MAR 1989 52.217-9 Option To Extend The Term Of The Contract MAR 2000 52.219-6 Notice Of Total Small Business Set-Aside NOV 2020 52.219-8 Utilization of Small Business Concerns FEB 2024

52.219-27 Notice of Set-Aside for, or Sole-Source Award to, Service- Disabled Veteran-Owned Small Business (SDVOSB) Concerns Eligible Under the SDVOSB Program

FEB 2024

52.219-28 Post-Award Small Business Program Rerepresentation FEB 2024 52.219-33 Nonmanufacturer Rule SEP 2021 52.222-3 Convict Labor JUN 2003 52.222-20 Contracts for Materials, Supplies, Articles, and Equipment JUN 2020 52.222-21 Prohibition Of Segregated Facilities APR 2015 52.222-22 Previous Contracts And Compliance Reports FEB 1999 52.222-25 Affirmative Action Compliance APR 1984 52.222-26 Equal Opportunity SEP 2016 52.222-35 Equal Opportunity for Veterans JUN 2020 52.222-36 Equal Opportunity for Workers with Disabilities JUN 2020 52.222-37 Employment Reports on Veterans JUN 2020 52.222-40 Notification of Employee Rights Under the National Labor

Relations Act

DEC 2010

52.222-50 Combating Trafficking in Persons NOV 2021 52.222-54 Employment Eligibility Verification MAY 2022 52.223-22 Public Disclosure of Greenhouse Gas Emissions and

Reduction Goals -- Representation.

DEC 2016

52.224-3 Privacy Training JAN 2017 52.225-6 Trade Agreements Certificate FEB 2021 52.225-13 Restrictions on Certain Foreign Purchases FEB 2021 52.229-11 Tax on Certain Foreign Procurements--Notice and

Representation

JUN 2020

52.232-33 Payment by Electronic Funds Transfer--System for Award Management

OCT 2018

52.232-39 Unenforceability of Unauthorized Obligations JUN 2013 52.232-40 Providing Accelerated Payments to Small Business

Subcontractors

MAR 2023

52.233-3 Protest After Award AUG 1996 52.233-4 Applicable Law for Breach of Contract Claim OCT 2004 52.239-1 Privacy or Security Safeguards AUG 1996 52.247-34 F.O.B. Destination NOV 1991 252.203-7000 Requirements Relating to Compensation of Former DoD

Officials

SEP 2011

252.203-7002 Requirement to Inform Employees of Whistleblower Rights DEC 2022 252.203-7005 Representation Relating to Compensation of Former DoD

Officials

SEP 2022

252.204-7003 Control Of Government Personnel Work Product APR 1992 252.204-7008 Compliance With Safeguarding Covered Defense Information

Controls

OCT 2016

252.204-7009 Limitations on the Use or Disclosure of Third-Party Contractor Reported Cyber Incident Information

JAN 2023

252.204-7012 Safeguarding Covered Defense Information and Cyber Incident Reporting

JAN 2023

252.204-7015 Notice of Authorized Disclosure of Information for Litigation Support

JAN 2023

252.204-7016 Covered Defense Telecommunications Equipment or Services -- Representation

DEC 2019

252.204-7017 Prohibition on the Acquisition of Covered Defense Telecommunications Equipment or Services -- Representation

MAY 2021

252.204-7018 Prohibition on the Acquisition of Covered Defense Telecommunications Equipment or Services

JAN 2023

252.204-7019 Notice of NIST SP 800-171 DoD Assessment Requirements NOV 2023

252.204-7020 NIST SP 800-171 DoD Assessment Requirements NOV 2023 252.204-7021 Contractor Compliance with the Cybersecurity Maturity

Model Certification Level Requirement

JAN 2023

252.204-7022 Expediting Contract Closeout MAY 2021 252.204-7024 Notice on the Use of the Supplier Performance Risk System MAR 2023 252.211-7003 Item Unique Identification and Valuation JAN 2023 252.215-7007 Notice of Intent to Resolicit JUN 2012 252.223-7008 Prohibition of Hexavalent Chromium JAN 2023 252.225-7000 Buy American--Balance Of Payments Program Certificate FEB 2024 252.225-7001 Buy American and Balance of Payments Program FEB 2024 252.225-7052 Restriction on the Acquisition of Certain Magnets, Tantalum, and Tungsten.

JAN 2023

252.225-7055 Representation Regarding Business Operations with the Maduro Regime

MAY 2022

252.225-7056 Prohibition Regarding Business Operations with the Maduro Regime

JAN 2023

252.225-7060 Prohibition on Certain Procurements from the Xinjiang Uyghur Autonomous Region

JUN 2023

252.226-7001 Utilization of Indian Organizations, Indian-Owned Economic Enterprises, and Native Hawaiian Small Business Concerns

JAN 2023

252.232-7003 Electronic Submission of Payment Requests and Receiving Reports

DEC 2018

252.232-7010 Levies on Contract Payments DEC 2006 252.239-7009 Representation of Use of Cloud Computing SEP 2015 252.239-7010 Cloud Computing Services JAN 2023 252.239-7017 Notice of Supply Chain Risk DEC 2022 252.239-7018 Supply Chain Risk DEC 2022 252.244-7000 Subcontracts for Commercial Products or Commercial

Services

NOV 2023

CLAUSES INCORPORATED BY FULL TEXT

52.212-2 EVALUATION--COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES (NOV 2021)

(a) The Government will award a contract resulting from this solicitation to the responsible offeror whose offer conforming to the solicitation will be most advantageous to the Government, price and other factors considered. The following factors shall be used to evaluate offers:

EVALUATION FACTORS AND RELATIVE ORDER OF IMPORTANCE

The evaluation factors and applicable sub-factors are listed below in descending order of importance:

Factor 1: Technical Approach Factor 2: Price

FACTOR 1 – TECHNICAL APPROACH

1.1 Items must meet the Government requirement/specifications in the CLIN description. If all requested information is not provided or the items proposed do not meet the requirements identified, the Government will determine the quotation to be technically unacceptable.

FACTOR 2 – PRICE

2.1 The lowest priced quotation will be evaluated for technical acceptability first. The Government will evaluate quotations for acceptability but will not rank the quotations by non-price factors. If the Government receives fewer than three (3) quotations, all quotations will be evaluated for Technical Acceptability. If the Government receives more than three (3) quotations, the Government will only select the three (3) lowest priced quotations to evaluate for Technical Acceptability. The Government reserves the right to evaluate additional quotations for technical acceptability if it is in the Government’s best interest to do so.

2.2 Price will be evaluated using the total evaluated price (TEP) on the bottom-line price for the entire effort. A price is reasonable if, in its nature and amount, it does not exceed that which would be incurred by a prudent person in the conduct of competitive business. The Government may use various price analysis techniques and procedures to ensure a fair and reasonable price. Some of those techniques are, but not limited to, comparison of quoted prices received in response to the solicitation and/or comparison of quoted prices with the Independent Government Estimate. Prices must be determined fair and reasonable.

2.3 No additional information from the offeror will be required if the price is based on adequate price competition.

In the event adequate price competition does not exist, the contracting officer will obtain information from the offeror to the extent required to determine the reasonableness of the offered prices.

(b) Options. The Government will evaluate offers for award purposes by adding the total price for all options to the total price for the basic requirement. The Government may determine that an offer is unacceptable if the option prices are significantly unbalanced. Evaluation of options shall not obligate the Government to exercise the option(s).

(c) A written notice of award or acceptance of an offer, mailed or otherwise furnished to the successful offeror within the time for acceptance specified in the offer, shall result in a binding contract without further action by either party.

Before the offer's specified expiration time, the Government may accept an offer (or part of an offer), whether or not there are negotiations after its receipt, unless a written notice of withdrawal is received before award.

(End of provision)

252.232-7006 WIDE AREA WORKFLOW PAYMENT INSTRUCTIONS (JAN 2023)

(a) Definitions. As used in this clause—

“Department of Defense Activity Address Code (DoDAAC)” is a six position code that uniquely identifies a unit, activity, or organization.

“Document type” means the type of payment request or receiving report available for creation in Wide Area WorkFlow (WAWF).

“Local processing office (LPO)” is the office responsible for payment certification when payment certification is done external to the entitlement system.

“Payment request” and “receiving report” are defined in the clause at 252.232-7003, Electronic Submission of Payment Requests and Receiving Reports.

(b) Electronic invoicing. The WAWF system provides the method to electronically process vendor payment requests and receiving reports, as authorized by Defense Federal Acquisition Regulation Supplement (DFARS) 252.232- 7003, Electronic Submission of Payment Requests and Receiving Reports.

(c) WAWF access. To access WAWF, the Contractor shall—

(1) Have a designated electronic business point of contact in the System for Award Management at https://www.sam.gov; and

(2) Be registered to use WAWF at https://wawf.eb.mil/ following the step-by-step procedures for self-registration available at this web site.

(d) WAWF training. The Contractor should follow the training instructions of the WAWF Web-Based Training Course and use the Practice Training Site before submitting payment requests through WAWF. Both can be accessed by selecting the “Web Based Training” link on the WAWF home page at https://wawf.eb.mil/.

(e) WAWF methods of document submission. Document submissions may be via web entry, Electronic Data Interchange, or File Transfer Protocol.

(f) WAWF payment instructions. The Contractor shall use the following information when submitting payment requests and receiving reports in WAWF for this contract or task or delivery order:

(1) Document type. The Contractor shall submit payment requests using the following document type(s):

(i) For cost-type line items, including labor-hour or time-and-materials, submit a cost voucher.

(ii) For fixed price line items—

(A) That require shipment of a deliverable, submit the invoice and receiving report specified by the Contracting Officer.

COMBO

(B) For services that do not require shipment of a deliverable, submit either the Invoice 2in1, which meets the requirements for the invoice and receiving report, or the applicable invoice and receiving report, as specified by the Contracting Officer.

__N/A__________________________________________________________

(iii) For customary progress payments based on costs incurred, submit a progress payment request.

(iv) For performance based payments, submit a performance based payment request.

(v) For commercial financing, submit a commercial financing request.

(2) Fast Pay requests are only permitted when Federal Acquisition Regulation (FAR) 52.213-1 is included in the contract.

(3) Document routing. The Contractor shall use the information in the Routing Data Table below only to fill in applicable fields in WAWF when creating payment requests and receiving reports in the system.

Routing Data Table*

Field Name in WAWF Data to be entered in WAWF Pay Official DoDAAC HQ0871 Issue By DoDAAC M68909 Admin DoDAAC** M68909 https://www.sam.gov/ https://wawf.eb.mil/ https://wawf.eb.mil/

Inspect By DoDAAC M92840 Ship To Code M92840 Ship From Code ____ Mark For Code ____ Service Approver (DoDAAC) ____ Service Acceptor (DoDAAC) ____ Accept at Other DoDAAC ____ LPO DoDAAC ____ DCAA Auditor DoDAAC ____ Other DoDAAC(s) ____

(4) Payment request. The Contractor shall ensure a payment request includes documentation appropriate to the type of payment request in accordance with the payment clause, contract financing clause, or Federal Acquisition Regulation 52.216-7, Allowable Cost and Payment, as applicable.

(5) Receiving report. The Contractor shall ensure a receiving report meets the requirements of DFARS Appendix F.

(g) WAWF point of contact.

(1) The Contractor may obtain clarification regarding invoicing in WAWF from the following contracting activity’s WAWF point of contact.

_ Devin Crook, devin.crook@usmc.mil

(2) Contact the WAWF helpdesk at 866-618-5988, if assistance is needed.

(End of clause)