N00014-17-S-B010.pdf

ONR BAA Announcement # N00014-17-S-B010

BROAD AGENCY ANNOUNCEMENT (BAA)

INTRODUCTION:

This publication constitutes a Broad Agency Announcement (BAA) as contemplated in Federal

Acquisition Regulation (FAR) 6.102(d)(2) and 35.016, the Department of Defense Grants and

Agreements regulations (DoDGARS) 32 CFR 22.315(a) and DoD’s Other Transaction Guide for

Prototypes Projects, USD(AT&L), OT Guide, Jan 2001. A formal Request for Proposals (RFP), solicitation, and/or additional information regarding this announcement will not be issued.

The Office of Naval Research (ONR) will not issue paper copies of this announcement. The ONR reserves the right to fund all, some, or none of the proposals received under this BAA. ONR provides no funding for direct reimbursement of proposal development costs. Technical and cost proposals (or any other material) submitted in response to this BAA will not be returned. It is the policy of ONR to treat all proposals submitted under this BAA as sensitive competitive information and to disclose their contents only for the purposes of evaluation.

For grant proposals submitted through Grants.gov, offerors should include responses to the

Representations indicated in Section VII-A iv. and v. of this BAA and located at http://www.onr.navy.mil/Contracts-Grants/submit-proposal/grants-proposal.aspx.

Hyperlinks have been embedded within this document and appear as underlined, blue-colored words. The reader may “jump” to the linked section by clicking the hyperlink.

http://www.onr.navy.mil/Contracts-Grants/submit-proposal/grants-proposal.aspx

(Add page numbers when completed.)

Table of Contents

I. GENERAL INFORMATION

A. Agency Name –

B. Research Opportunity Title –

C. Program Name –

D. Research Opportunity Number –

E. Response Date –

F. Research Opportunity Description –

G. Point(s) of Contact (POC) –

H. Instrument Type(s) –

I. Catalog of Federal Domestic Assistance (CFDA) Numbers -

J. Catalog of Federal Domestic Assistance (CFDA) Titles -

K. Other Information –

II. AWARD INFORMATION

A. Amount and Period of Performance-

B. Peer Reviews-

C. Production and Testing of Prototypes-

III. ELIGIBILITY INFORMATION

IV. APPLICATION AND SUBMISSION INFORMATION

A. Application and Submission Process -

B. Content and Format of White Papers/Full Proposals -

a. White Papers ...................................................................................................................................................N/A

b. Full Proposals

C. Significant Dates and Times –

D. Submission of Late Proposals –

E. Submission of Grant Proposals through Grants.gov

F. Submission of Full Proposals for Contracts, Cooperative Agreements, and Other Transaction

Agreements

V. EVALUATION INFORMATION

A. Evaluation Criteria –

B. Commitment to Small Business- (For Contract Awards Only)

C. Options-

D. Evaluation Panel -

E. General Information Regarding the Review and Selection Process for Grants - ……………………………..30

VI. AWARD ADMINISTRATION INFORMATION

VII. OTHER INFORMATION

A. Applies to Grant, Cooperative Agreement and Other Transaction Agreement applications only:

B. Applies to Contracts only:

C. Applies to Contracts, Grants, Cooperative Agreements and Other Transaction Agreements:

I. GENERAL INFORMATION

A. Agency Name - Office of Naval Research, Computer Mathematics and Information

Sciences Division, Code 311

Office of Naval Research, One Liberty Center

875 N. Randolph Street

Arlington, VA 22203-1995

B. Research Opportunity Title - Late-stage Software Customization and Complexity Reduction S&T for Legacy Naval Systems

C. Program Name – Total Platform Cyber Protection Innovative Naval Prototype (TPCP

INP)

D. Research Opportunity Number - N00014-17-S-B010

E. Response Date – Monday, 1 May 2017

F. Research Opportunity Description -

The Office of Naval Research (ONR) is interested in receiving proposals addressing the fundamental problem of modern systems and software insecurity. The main focus for this solicitation is late-stage software customization/specialization and complexity reduction science and technology (S&T) projects which offer potential for advancement and improvement of security and efficiency of Navy and Marine

Corps systems and software. A brief description of the science and technology thrusts, Technical Areas

(TA) 1 through 5), that ONR is pursuing is provided below.

The size and complexity of software in Naval systems has grown tremendously in recent years. As more components become digitally controlled and designed to interoperate, both the sheer amount of software and the complexity of that software have been growing and continue to grow at a frenetic pace. While in some sense this growth is necessary to meet the needs of the 21st century fleet and autonomous and automated capabilities, it introduces the unfortunate side effect of leaving software complexity and bloat unchecked, which often leads to an increase in unexpected software execution failures and vulnerable attack surface for software exploitation. Virtually all software products are affected, from applications and libraries to low-level system software and even communications protocols. The unchecked complexity and bloat issues are especially severe for commercial-off-the-shelf (COTS) software, which form an integral part of many Naval systems.

Current software development and deployment practices, which involve excessive use of indirection and abstraction, often encourage complexity and bloat. Modern architectures and practices that have evolved throughout software engineering history are the result of a series of individual decisions and approaches built upon one another all geared toward increasing a programmer’s productivity. A major contributor to that increased productivity has been to maximize software reuse, which has resulted in a software structure with layers upon layers of abstraction, libraries, and indirections. The use of layers upon layers of libraries and indirections, deeply nested APIs, and procedure calls increases complexity and makes efforts to reason about the safety or security of that software even more intractable. It also significantly reduces program execution efficiency to the point that modern software often performs an enormous amount of activity to accomplish simple tasks.

In addition to the bloat that results from attempts to increase a programmer's productivity, feature creep and over-generalization of included functionality (i.e., one size fits all) further exacerbate the situation.

Especially in COTS software, many programs contain extraneous, seldom or never used functionality. The field currently lacks the capability to effectively customize and tailor software to specific environments in an automated fashion that is transparent and practical for the user. To address unchecked complexity and bloat issues, this BAA focuses on S&T that enables late-stage software customization and complexity reduction without requiring cooperation from the original developer. By decoupling efforts from the development process, issues from a variety of sources can be addressed on both current and legacy code with a consistent and user-empowering set of tools.

Addressing customization and complexity reduction without requiring the availability of source code is critical in responding to this BAA. Military systems utilize large amounts of COTS software and, especially with legacy code, there will be instances where the source is no longer available or is difficult to obtain. For efforts that address dynamic or other non-compiled languages, tools and techniques must be applicable to the format as delivered to the end user (e.g., Java bytecode).

TA1: Functionality identification and reduction

Subcategories: Apps (including web), OS, Hypervisor, Communications Protocols

One focus area of transformation and customization is that of feature or functionality reduction. Modern commercial software is notoriously bloated due to the one-size-fits-all methodology commonly practiced by many development and deployment efforts. This practice eases the burden on developers that intend to sell and deploy code to a large and diverse user base, but has a detrimental impact on performance and security.

Many features built into a software program may not be needed by the average user, but are often included with no way for those users to disable or remove those features. Between the additional code (which may contain its own bugs and vulnerabilities) and the potentially undesirable functionality, extraneous features unnecessarily hamper performance while broadening a software product’s attack surface.

Extraneous features that broaden attack surfaces are not restricted to just software. Protocols used for communication across the stack also suffer bloat from a variety of sources such as support for legacy features or rarely used (and unnecessary) functionality. In networking environments that are tightly controlled by a single entity (e.g., a connection to back-end database), it would be desirable to automatically customize or subset the protocols to allow only necessary functionality. Subsetting protocols may require automated transformation and rewriting of protocol implementations as well as methods to automate analysis and determination of required functionality. Even for some general-purpose communications, restriction of supported features is desirable in such that it reduces attack surface without introducing additional security issues (proposed techniques must address this analysis).

This BAA seeks efforts to reverse the trend toward one-size-fits-all software and protocols by enabling and empowering end users to selectively remove features they do not use or want. Examples of software features to be removed could include elements of the user interface, or something that could potentially compromise privacy such as a callback or diagnostic reporting functions. Examples of protocol features could include support for legacy functionality or a feature that is made unnecessary by a feature in another layer. Some features may manifest themselves through externally visible interfaces (e.g., a system call) while others may be internal and thus more difficult to identify and trace back to specific regions of code.

We make no assumption that developers have tagged their software to identify features, so identification of features (units of functionality) and their corresponding code is a key challenge that must be addressed.

Due to the goal of reducing attack surface, preference will be given to approaches that operate statically to remove the feature in question and transform the software or protocol implementation so that it is permanently removed. Dynamic approaches can be used to supplement, but must not be employed alone due to the lesser benefit to attack surface reduction. Proposals must discuss what to do when an attempt is made to access a feature that has been removed. Feature reduction is of interest across application software, middleware APIs, operating systems, hypervisors, and communications protocols.

TA2: De-bloat/de-layer

Even without removing any required functionality, software can be transformed so that it is more efficient.

Extensive use of layers upon layers of abstractions, indirections, and other software development practices meant to increase productivity have the side effect of causing a great deal of bloat in modern software.

While modularization and use of shared libraries improve software reuse, they often come precompiled without source code and their clients are not known a priori so they must be kept general-purpose. The result is that very little of the code in a function or library is actually executed when loaded and executed, often wasting memory bandwidth and making code reuse attacks much easier. By reducing indirections, layers of abstraction, and bloat within a program and across all of the libraries and APIs invoked during runtime, a non-trivial amount of software execution efficiency can be reclaimed while simultaneously reducing complexity and attack surface.

While striving to improve software efficiency, it is important to retain the positive effects of current software engineering practices, e.g., software reuse. Thus, it is highly desirable to have an enhanced software architecture, development methodology, and deployment strategy that improve software efficiency while preserving the productivity benefits of current practices. Improving the actual software efficiency of the final executable while maintaining the productivity benefits of software reuse and layering at the development stage is an important goal to be addressed in this BAA.

The leanest and most efficient program customizations are likely achievable at late-stage, i.e., during installation or just-in-time for execution, when all of the platform and execution environment parameters are known. As a result, binary code understanding and transformation is a critical challenge for this topic.

When undertaken statically, specialization and transformation of programs and all the libraries that program utilizes must reduce testing complexity, improve test coverage, and improve the overall robustness and efficiency of the final product. Proposals must be directed toward research and development of automated and transparent debloating and delayering tools to be run at installation time or perform just-in-time transformations.

TA3: Addition of security constructs

Another aspect of late-stage software customization is the capability to retrofit pre-existing executable code with security constructs to improve the safety and security of that software. The software transformations performed with tools developed in TA1 and TA2 will significantly reduce the size and complexity of an executable. These transformations present an opportunity for a more complete examination for security defects and software hardening across the resulting executable chain.

TA3 performers will develop automated transformation tools for security-hardening of executables and executable chains. It is important that proposed tools developed within TA3 target software executables as opposed to source code and that they be completely automated and transparent to end users. This focus on executables is necessary for practical deployment purposes. Late stage security retrofitting tools can efficiently and effectively harden software executables and reintegrate security constructs that may have been accidently trimmed by TA1 and TA2 tools.

TA4: Verification and Validation

The steps taken by TA1 and TA2 tools to simplify and compact software executables and TA3 tools to harden and apply security constructs represent an aggressive set of transformations. After applying these sets of install-time transformations to software executables, we need to ensure that the resulting software functions as expected (functional verification).

Functional verification and validation will be required to ensure that the results of the executable transformations of TA1, TA2 and TA3 are proper and satisfy requirements. This is especially important given that the application of TA1 (functionality customization and specialization) tools may render some of the tests in the original test suite invalid. Any invalidated tests need to be automatically identified and either modified, replaced, or removed. ONR is interested in research and development for tools that automatically assemble a verification and validation test suite for the transformed code. The tools could use the original test suite, original code, and the transformed code as input to automatically produce the new test suite.

Beyond software testing, formal methods can be used to provide the highest level of assurance for certain important properties of software. However, formal methods generally suffer from key limitations that limit its practical, widespread use. One major drawback is the need for a manually generated formal model of the code. The scalability of the mathematical tools used to evaluate the model, e.g., SMT solvers, theorem provers, etc., is also an issue. As previously noted, however, the resulting software of the TA1, TA2, and

TA3 transformations will have been significantly reduced in both size and complexity. ONR is interested in

S&T approaches that explore whether the reduced size and complexity alleviates scalability problems with formal methods and allows for automated lifting or extraction of the formal model needed for evaluation. A bottom-up approach to formal methods analysis, made possible by complexity reduction efforts, would make comprehensive (all layers) formal verification of complex software become practical for widespread use. Proposals addressing this topic shall be capable of extracting formal specification from executables, since the application of late-stage program transformation tools in other technical areas makes manual formal modelling impractical.

TA5: Supportive and complementary approaches

ONR is interested in research and development approaches that are complementary to the late-stage software customization and transformation approaches discussed above, but do not necessarily fall under one of the four previous categories. Innovative and novel approaches to improve the security of software or system operation can be directed here. TA5 includes, but is not limited to, the following areas:

Robust executable or binary reverse engineering tools

Robust transformation from binary to compiler intermediate representation (IR)

Methods to improve robust IR extraction through compiler metadata generation

Autonomic computing (self-aware reactive and adaptive systems)

Other automated fundamental software transformations that improve the quality, simplicity, or reduce the attack surface of systems and software (applications, middleware, operating systems, or hypervisiors), excluding intrusion detection systems (IDS).

G. Point(s) of Contact -

Comments or questions submitted should be concise and to the point, eliminating any unnecessary verbiage. In addition, the relevant part and paragraph of the Broad Agency Announcement (BAA) be referenced.

Questions of a business nature and suggestions for improvement must be submitted to:

Point of Contact Name: Matthew Murray

Point of Contact Occupation Title: Contract Specialist

Division Title: Contract and Grant Awards Management Division

Division Code: ONR Code 25

Email Address: matthew.murray1@navy.mil

Questions of a technical nature must be submitted to:

Point of Contact Name: Mr. Ryan Gunst

Point of Contact Occupation Title: USN Cybersecurity Program Officer

Division Title: Computer, Mathematics & Information Sciences

Division Code: 311

Address: 875 N Randolph St., Suite 1425

Email Address: clifford.gunst@navy.mil

Questions of a security nature must be submitted to:

Point of Contact Name: Torri Woodfolk

Point of Contact Occupation Title: Industrial Security Specialist

Division Title: Security Division, Code 43

Address: One Liberty Center

875 N Randolph St., Suite 1425

Email Address: torri.powell@navy.mil

(Please note that the e-mail address does differ from POC’s name above)

Note: All UNCLASSIFIED communications shall be submitted via e-mail to the Technical Point of Contract (POC) with a copy to the designated Business POC.

CLASSIFIED questions shall be handled through the ONR Security POC. Specifically, any entity wanting to ask a CLASSIFIED question shall send an UNCLASSIFIED email to the ONR Security

POC with a copy to both the Technical POC and the Business POC stating that the entity would like to ask a CLASSIFIED question. DO NOT EMAIL ANY CLASSIFIED QUESTIONS. The

Security POC will contact the entity and arrange for the CLASSIFIED question to be asked through a secure method of communication.

Questions submitted within 2 weeks prior to a deadline may not be answered, and the due date for submission of the full proposal will not be extended.

mailto:torri.powell@navy.mil

Amendments to this BAA will be posted to one or more of the following web pages:

-Federal Business Opportunities (FedBizOpps) Webpage – https://www.fbo.gov/

-Grants.gov Webpage – http://www.grants.gov/

-ONR Broad Agency Announcement (BAA) -http://www.onr.navy.mil/en/Contracts- Grants/Funding-Opportunities/Broad-Agency-

Announcements.aspx

H. Instrument Type(s) -

Awards may take the form of contracts, grants, and other transaction agreements, as appropriate.

Any contract award resulting from this BAA will incorporate the most current FAR, DFARS, NMCARS and ONR clauses.

Any assistance instrument awarded under this announcement will be governed by the award terms and conditions that conform to DoD’s implementation of OMB circulars applicable to financial assistance. Terms and conditions of new awards made after December 26, 2014, may include revisions to reflect DoD implementation of new OMB guidance in 2 CFR Part 200, “Uniform

Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards.” The

DoD Terms and Conditions is located at http://www.onr.navy.mil/Contracts-Grants/submit-proposal/grants-proposal/grants-terms-conditions.aspx.

Examples of model contracts can be found on the ONR website at the following link:

http://www.onr.navy.mil/Contracts-Grants/submit-proposal/contracts-proposal/contract-model-awards.aspx. ONR Contract specific representations and certifications can be accessed on the following page of the ONR website: http://www.onr.navy.mil/en/Contracts-Grants/submit-proposal/contracts-proposal.aspx.

Examples of model grants can be found on the ONR website at the following link:

http://www.onr.navy.mil/en/Contracts-Grants/submit-proposal/grants-proposal/model-grant.aspx.

The model contracts and grants at the links above are only provided as examples. In the event of any conflict between these examples and current FAR, DFARS, NMCARS, or ONR clauses, current FAR, DFARS, NMCARS, or ONR clauses will govern.

I. Catalog of Federal Domestic Assistance (CFDA) Numbers - 12.300

J. Catalog of Federal Domestic Assistance (CFDA) Titles - Department of Defense (DOD), Department of the Navy, Office of Chief of Naval Research, Basic and Applied Scientific Research

K. Other Information -

This BAA is intended for proposals related to basic research, applied research, or advanced technology development and that part of development not related to the development of a specific system or hardware procurement. With regard to any restrictions on the conduct or https://www.fbo.gov/ http://www.grants.gov/ http://www.onr.navy.mil/en/Contracts-Grants/Funding-Opportunities/Broad-Agency-Announcements.aspx http://www.onr.navy.mil/en/Contracts-Grants/Funding-Opportunities/Broad-Agency-Announcements.aspx http://www.onr.navy.mil/en/Contracts-Grants/Funding-Opportunities/Broad-Agency-Announcements.aspx http://www.onr.navy.mil/Contracts-Grants/submit-proposal/grants-proposal/grants-terms-conditions.aspx http://www.onr.navy.mil/Contracts-Grants/submit-proposal/grants-proposal/grants-terms-conditions.aspx http://www.onr.navy.mil/Contracts-Grants/submit-proposal/contracts-proposal/contract-model-awards.aspx http://www.onr.navy.mil/Contracts-Grants/submit-proposal/contracts-proposal/contract-model-awards.aspx http://www.onr.navy.mil/en/Contracts-Grants/submit-proposal/contracts-proposal.aspx http://www.onr.navy.mil/en/Contracts-Grants/submit-proposal/contracts-proposal.aspx http://www.onr.navy.mil/en/Contracts-Grants/submit-proposal/grants-proposal/model-grant.aspx file:///D:/public/viewprog.asp%3fprogid=255 outcome of work funded under this BAA, ONR will follow the guidance on and definition of

“contracted fundamental research” as provided in the Under Secretary of Defense (Acquisition, Technology and Logistics) Memorandum of 24 May 2010.

As defined therein the definition of “contracted fundamental research,” in a DoD contractual context, includes research performed under grants and contracts that are (a) funded by

Research, Development, Test and Evaluation Budget Activity 1 (Basic Research), whether performed by universities or industry or (b) funded by Budget Activity 2 (Applied Research) and performed on campus at a university. The research shall not be considered fundamental in those rare and exceptional circumstances where the applied research effort presents a high likelihood of disclosing performance characteristics of military systems or manufacturing technologies that are unique and critical to defense, and where agreement on restrictions have been recorded in the contract or grant.

Pursuant to DoD policy, research performed under grants and contracts that are a) funded by

Budget Activity 2 (Applied Research) and NOT performed on-campus at a university or b) funded by Budget Activity 3 (Advanced Technology Development) does not meet the definition of “contracted fundamental research.” In conformance with the USD (AT&L) guidance and

National Security Decision Directive 189, ONR will place no restriction on the conduct or reporting of unclassified “contracted fundamental research,” except as otherwise required by statute, regulation or executive order. For certain research projects, it may be possible that although the research being performed by the prime contractor is restricted research, a subcontractor may be conducting “contracted fundamental research.” In those cases, it is the prime contractor’s responsibility in the proposal to identify and describe the subcontracted unclassified research and include a statement confirming that the work has been scoped, negotiated, and determined to be fundamental research according to the prime contractor and research performer.

Normally, fundamental research is awarded under grants with universities and under contracts with industry. Non-fundamental research is normally awarded under contracts and may require restrictions during the conduct of the research and DoD pre-publication review of such research results due to subject matter sensitivity. Potential offerors should consult with the appropriate

ONR Technical POCs to determine whether the proposed effort would constitute basic research, applied research or advanced research.

FAR Part 35 restricts the use of Broad Agency Announcements (BAAs), such as this, to the acquisition of basic and applied research and that portion of advanced technology development not related to the development of a specific system or hardware procurement. Contracts and grants and other assistance agreements made under BAAs are for scientific study and experimentation directed towards advancing the state of the art and increasing knowledge or understanding.

THIS ANNOUNCEMENT IS NOT FOR THE ACQUISITION OF TECHNICAL,

ENGINEERING AND OTHER TYPES OF SUPPORT SERVICES.

II. AWARD INFORMATION

A. Funded Amount and Period of Performance-

The Office of Naval Research is anticipating multiple awards ranging from $500,000-

$1,500,000/year for a period of 12-36 months base plus options (e.g. 24 months), but not to exceed five years period of performance in total. The following table provides an estimate of the anticipated funding planned for this effort. The funded amount and period of performance of each proposal selected for award may vary depending on the research area and the technical approach to be pursued by the offeror selected.

FY18 FY19 FY20 FY21

Funding ($K) 8000 10,000 10,000 10,000

B. Peer Reviews-

In the case of proposals funded as basic research, ONR may utilize peer reviewers from academia, industry, and Government agencies to assist in the periodic appraisal of performance under the awards, as outlined in ONR Instruction 3966.1. Such periodic program reviews monitor the cost, schedule and technical performance of funded basic research efforts. The reviews are used in part to determine which basic research projects will receive continued ONR funding. Peer reviewers who are not U.S. Government employees must sign nondisclosure agreements before receiving full or partial copies of proposals and reports submitted by the basic research performers. Offerors may include travel costs for the Principal Investigator (PI) to attend the peer review.

C. Production and Testing of Prototypes-

ONR may modify a contract awarded under this BAA to add a contract line item or contract option for the provision of advanced component development or for the delivery of an initial or additional prototype units. However, such a contract addition shall be subject to the limitations contained in Section 819 of the National Defense Authorization Act (NDAA) for

Fiscal Year 2010, as modified in Section 811 of the NDAA for Fiscal Year 2015.

III. ELIGIBILITY INFORMATION

A. All responsible sources from academia, industry and the research community may submit proposals under this BAA. Historically Black Colleges and Universities (HBCUs) and

Minority Institutions (MIs) are encouraged to submit proposals and join others in submitting proposals. However, no portion of this BAA will be set aside for Small Business or other socio-economic participation. All businesses both small and large are encouraged to submit proposals and compete for funding consideration.

B. Federally Funded Research & Development Centers (FFRDCs), including Department of

Energy National Laboratories, are not eligible to receive awards under this BAA. However, teaming arrangements between FFRDCs and eligible principal Offerors are allowed so long as such arrangements are permitted under the sponsoring agreement between the Government and the specific FFRDC.

C. Navy laboratories, military universities and warfare centers as well as other Department of

Defense and civilian agency laboratories are also not eligible to receive awards under this

BAA and should not directly submit full proposals in response to this BAA. If any such organization is interested in one or more of the programs described herein, the organization should contact an appropriate ONR Technical POC to discuss its area of interest. The various scientific divisions of ONR are identified at http://www.onr.navy.mil/. As with FFRDCs, these types of federal organizations may team with other eligible sources from academia and industry that are submitting proposals under this BAA.

D. University Affiliated Research Centers (UARCs) are eligible to submit proposals under this

BAA unless precluded from doing so by their Department of Defense UARC contract.

E. Teams are also encouraged and may submit proposals in any and all areas. However, Offerors must be willing to cooperate and exchange software, data and other information in an integrated program with other contractors, as well as with system integrators, selected by

ONR.

F. Offerors should be aware of recent changes in export control laws. Offerors are responsible for ensuring compliance with all U.S. export control laws and regulations, including the

International Traffic in Arms Regulation (ITAR)( 22 CFR Parts 120 - 130) and Export

Administration Regulation (EAR) (15 CFR Parts 730 – 774), as applicable. In some cases, developmental items funded by the Department of Defense are now included on the United

States Munition List (USML) (22 CFR Part 121) and are therefore subject to ITAR jurisdiction. In other cases, items that were previously included on the USML have been moved to the EAR Commerce Control List (CCL). Offerors should address in their proposals whether ITAR or EAR restrictions apply to the work they are proposing to perform for ONR.

The ITAR and EAR are available online at http://www.ecfr.gov/cgi-bin/ECFR?page=browse.

Additional information regarding the President's Export Control Reform Initiative can be found at http://export.gov/ecr/index.asp.

Offerors must comply with all U.S. export control laws and regulations, including the ITAR and EAR, in the performance of any award or agreement resulting from this BAA. Offerors shall be responsible for obtaining any required licenses or other approvals, or license exemptions or exceptions if applicable, for exports of hardware, technical data, and software

(including deemed exports), or for the provision of technical assistance.

G. Cost sharing is not expected and will not be used as a factor during the merit review of any proposal hereunder. However, the Government may consider voluntary cost sharing if proposed.

http://www.onr.navy.mil/

IV. APPLICATION AND SUBMISSION INFORMATION

A. Application and Submission Process - Preproposal Conference/Industry Day Full Proposals.

The process under this BAA shall include a Preproposal/Industry Day and Full Proposals. "White

Papers" are not desired for this solicitation.

Pre-proposal Conference/Industry Day: The ONR Total Platform Cyber Protection Program will conduct an unclassified briefing for potential Offerors during the week of 13 March 2017 in a location to be determined. Details will be provided in an Amendment to this BAA and a Special

Notice on FedBizOps. The purpose of the meeting will be to provide potential Offerors with a better understanding of the scope of the Program and objectives of this BAA. Preregistration will be required. The briefing will be held at the at 1300 Eastern Standard Time (EST) with check-in beginning at (one hour earlier). All attendees are required to pre-register by sending a notification of planned attendance to Mr. Ryan Gunst, clifford.gunst@navy.mil by 3:00 PM (EST) by 8 March

2017.

Full Proposals: The due date for receipt of Full Proposals is 3:00 PM (EDT) on Monday, 1 May

2017. It is anticipated that final selections will be made within six weeks after full proposal submission. As soon as the final full proposal evaluation process is completed, PI’s will be notified via email of their project’s selection or non-selection for FY18 funding. Full proposals received after the published due date and time will not be considered for funding.

B. Content and Format of Full Proposals -

Full Proposals submitted under this BAA are expected to be unclassified; however, classified proposals are permitted. If a classified proposal is submitted and selected for award, the resultant contract will be unclassified. An ‘unclassified’ Statement of Work (SOW) must accompany any classified proposal.

For both classified and unclassified proposals, a non-proprietary version of the Statement of

Work must also be submitted. Do not put proprietary data or markings in or on the Statement of Work. For proposals containing data that the offeror does not want disclosed to the public for any purpose, or used by the Government except for evaluation purposes, the contractor shall mark the title page with the following legend:

“This proposal includes data that shall not be disclosed outside the Government and shall not be duplicated, used, or disclosed--in whole or in part--for any purpose other than to evaluate the proposal. If, however, a contract is awarded to this offeror as a result of--or in connection with-- the submission of this data, the Government shall have the right to duplicate, use, or disclose the data to the extent provided in the resulting contract. This restriction does not limit the Government’s right to use information contained in this data if is obtained from another source without restriction. The data subject to this restriction are contained in (insert numbers or other identification of sheets).”

Also, mark each sheet of data that the offeror wishes to restrict with the following legend:

“Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this proposal.”

Titles given to the Full Proposals should be descriptive of the work they cover and should not be merely a copy of the title of this solicitation.

1. Unclassified Proposal Instructions:

Unclassified proposals shall be submitted in accordance with this Section.

2. Special Instructions for Classified Proposal:

Classified proposals shall be submitted directly to the attention of ONR’s Document

Control Unit at the following address and marked in the following manner:

OUTSIDE ENVELOPE

(no classification marking):

“Office of Naval Research

Attn: Document Control Unit

ONR Code 43

875 North Randolph Street

Arlington, VA 22203-1995”

The inner wrapper of the classified Full Proposal should be addressed to the attention of the cognizant TPOC, ONR Code XX and marked in the following manner:

INNER ENVELOPE

(stamped with the overall classification of the material)

“Program Name:

Office of Naval Research

Attn: Gary Toth

ONR Department Code: 311

875 North Randolph Street, Suite 1425

All proposal submissions will be protected from unauthorized disclosure in accordance with

FAR Subpart 15.207, applicable law, and DoD/DoN regulations. Offerors are expected to appropriately mark each page of their submission that contains proprietary information.

STATEMENT OF WORK (SOW)

An ‘unclassified’ SOW must accompany any classified proposal.

For both classified and unclassified proposals, a non-proprietary version of the SOW must also be submitted.

IMPORTANT NOTE: Titles given to the Full Proposals shall be descriptive of the work they cover and not be merely a copy of the title of this solicitation.

a. WHITE PAPERS: Not Applicable

b. FULL PROPOSALS

i. INSTRUCTIONS FOR CONTRACT, COOPERATIVE AGREEMENTS AND

OTHER TRANSACTION AGREEMENTS (Does not include Grants)

Proposal Package:

The following five documents with attachments comprise a complete proposal package:

(1) Proposal Checklist (.pdf)

(2) Technical Proposal Template (.pdf) (Not to exceed 20 pages, excluding bibliography, table of contents, and resumes)

(3) Cost Proposal Spreadsheet (Excel)

(4) Adequacy Checklist for Pre Award Audit (SF 1408) (as applicable)

(5) Stand-alone non-proprietary Statement of Work (SOW) in Word

NOTE: The electronic file name for all documents submitted under this BAA must not exceed 68 characters in length, including the file name extension.

Items 1 – 5 above are located at: http://www.onr.navy.mil/Contracts-Grants/submit-proposal/contracts-proposal/. All have instructions imbedded into them that will assist in completing the documents. Also, both the Proposal Checklist and the Cost Proposal

Spreadsheet require completion of cost-related information. Please note that attachments can be incorporated into the Proposal Checklist.

The format requirements for attachments are as follows:

• Paper Size- 8.5 x 11 inch paper

• Margins – 1 inch

• Spacing- single or double spaced

• Font- Times New Roman, 12 point

Offerors responding to this BAA must submit a separate list of all technical data or computer software that will be furnished to the Government with other than unlimited rights. The

Government will assume unlimited rights if offerors fail to identify any intellectual property restrictions in their proposals. Include all proprietary claims to results, prototypes, and/or deliverables. If no restrictions are intended, then the offeror should state “NONE.”

For proposals below the simplified acquisition threshold (less than or equal to $150K), the http://www.onr.navy.mil/Contracts-Grants/submit-proposal/contracts-proposal/cost-proposal.aspx

Technical Proposal Template and Proposal Checklist documents, and the Cost Proposal

Spreadsheet are required. Purchase orders can also contain options, as long as the total amount of the base and all options does not exceed $150K.

For proposed subcontracts or interorganizational transfers over $150,000, Offerors must provide a separate fully completed Cost Proposal Spreadsheet in support of the proposed costs. This spreadsheet, along with supporting documentation, must be provided either in a sealed envelope with the prime’s proposal or via e-mail directly to both the Program Officer and the Business

Point of Contact at the same time the prime proposal is submitted. The e-mail should identify the proposal title, the prime Offeror and that the attached proposal is a subcontract, and should include a description of the effort to be performed by the subcontractor.

Offerors should submit FIVE hard copies.

The electronic copy must be submitted in a secure, pdf-compatible format, except for the electronic file of the Cost Proposal Spreadsheet which must be submitted in a Microsoft Excel

2010 compatible format and the Statement of Work Template which must be submitted in

Microsoft Word format. All attachments to any required proposal documents should be submitted in a secure, pdf-compatible format.

The secure pdf-compatible format is intended to prevent unauthorized editing of the proposal prior to any award. A password should not be required for opening the proposal document, but the Government must have the ability to print and copy text, images, and other content. Should an Offeror amend its proposal, the amended proposal should be submitted following the same hard and electronic copy guidance applicable to the original proposal.

Any proposed options that are identified in the Technical Proposal Template or Proposal

Checklist documents, but are not fully priced out in the Cost Proposal Spreadsheet, will not be included in any resulting contract, cooperative agreement, or other transaction. If proposing options, they must be separately priced and separate spreadsheets should be provided for the base period and each option. In addition to providing summary by period of performance (base and any options), the Contractor is also responsible for providing a breakdown of cost for each task identified in the Statement of Work. The sum of all costs by task worksheets MUST equal the total cost summary.

The electronic submission of the Excel spreadsheet should be in a “useable condition” to aid the

Government with its evaluation. The term “useable condition” indicates that the spreadsheet should visibly include and separately identify within each appropriate cell any and all inputs, formulas, calculations, etc. The Offeror should not provide “value only spreadsheets” similar to a hard copy.

Fixed Fees on ONR Contracts: The Government Objective is set in accordance with the DFARS

215.404-71. See the below table for range and normal values:

Contract Risk Factor

Contract Type Assigned Value

(Normal range)

Normal Value

Technical (1) 3% - 7% (2) 5%

Management/Cost Control (1) 3% - 7% (2) 5% Contract Type Risk Firm Fixed Price 2% - 6% (3) 3% - 5% (4) Contract Type Risk Cost Plus Fixed Fee 0% - 1% (2) 0.5%

(1) Assign a weight (percentage) to each element according to its input to the total performance risk. The total of the two weights equal 100%

(2) Assign a weighting score relative to the Risk Factor.

(3) Depends on the specific Contract Type (With/without financing, performance-based payments, and/or progress payments).

(4) Depends on the specific Contract Type.

Technology Incentive (TI) is rarely utilized at ONR, because the contracts issued by ONR typically are not eligible for TI (See DFARS 215.404-71-2(c) (2)). Any consideration of TI requires strong and convincing justification in the proposal, which are then subject to negotiation and determination of a fair and reasonable fee, within the context of the specific award.

Typically the range of fee is 5% to 7.5% on an ONR awarded contract.

For submission instructions, see Part IV, Section F. Submission of Full Proposals for

Contracts, Cooperative Agreements, and Other Transaction Agreements.

ii. INSTRUCTIONS FOR GRANTS (Does not include contracts, cooperative agreements and other transaction agreements)

Content and Form of Application:

Prospective offerors must complete the mandatory forms in accordance with the instructions provided on the forms and the additional instructions below. Files that are attached to the forms must be in Adobe Portable Document Format (.PDF) unless otherwise specified in this announcement.

Form: SF 424 (RESEARCH & RELATED)

Complete all the required fields in accordance with the pop-up instructions on the form. To activate the instructions, turn on the “Help Mode” (icon with the pointer and question mark at the top of the form). The following information must be completed in the SF 424 located on Grants.gov to ensure that the application is directed to the correct individual for review and to be considered for award, Offerors must fill out Block 4 of the SF 424 R&R as follows:

Block 4a, Federal Identifier - If the application is not a renewal or expansion of an existing award, enter the previous ONR award number, or

N00014.

Block 4b, Agency Routing Number - Enter the three (3) digit Program

Office Code and the Program Officer’s name, last name first, in brackets

(e.g., 331 [Smith, John]).

o Where the Program Office Code only has two digits, add a “0” directly after the Code (e.g., Code 30 would be entered as 300) o Use Code 600 for ONRG).

Applicants who fail to provide a Program Officer Code identifier may receive a notice that their proposal is rejected.

Block 4c, Previous Grants.gov Tracking ID – If this submission is for a

Changed/Corrected Application, enter the Grants.gov tracking number of the previous proposal submission; otherwise, leave blank.

Form: Project Abstract

Abstracts of all funded research projects will be posted on a DTIC website, https://dodgrantawards.dtic.mil/grants/index.html#/home. Do not include proprietary or confidential information. Use only characters available on a standard

QWERTY keyboard. Spell out all Greek letters, other non-English letters and symbols. Graphics are not allowed and there is a 4,000 character limit.

Form: RESEARCH & RELATED Other Project Information

Attach the Technical Proposal as follows:

• Download the application package;

• Click on "Research and Related Other Project Information";

• Click on "Move form to Submission List";

• Click on "Open Form";

• A new PDF entitled "Research & Related Other Project Information" will appear;

• Locate Field 8 entitled, “Project Narrative;”

• Click on “Add Attachment;” and

• Attach the technical proposal.

Field 7of the SF-424 Other Project Information entitled, “Project Summary/Abstract” may be left blank if the Project Abstract is already attached.

NOTE: Ensure the attachment is a single PDF file with File name: “Volume I-

Technical Proposal.”

Full Proposal Format – Volume 1 - Technical Proposal, and Volume 2 - Cost

Proposal

• Paper Size – 8.5 x 11 inch paper

• Margins – 1 inch

• Spacing – single spaced

• Font – Times New Roman, 12 point

• Discuss the limit on the number of pages for Volume I with the cognizant Program https://dodgrantawards.dtic.mil/grants/index.html#/home

Officer. There are no page limitations to the Cost Proposal, Volume 2.

• The full proposal should be submitted electronically at http://www.grants.gov/ as delineated in paragraph E below.

NOTE: The electronic file name for all documents submitted under this BAA must not exceed 68 characters in length, including the file name extension.

Technical Proposal

• Cover Page: This should include the words “Technical Proposal” and the following:

1) BAA Number: N00014-17-S-B010;

2) Title of Proposal;

3) Identity of prime Offeror and complete list of subawards, if applicable;

4) Technical contact (name, address, phone/fax, electronic mail address)

5) Administrative/business contact (name, address, phone/fax, electronic mail address) and;

6) Proposed period of performance (identify both the base period and any options, if included).

• Table of Contents: An alphabetical/numerical listing of the sections within the proposal, including corresponding page numbers.

• Technical Approach and Justification: The major portion of the proposal should consist of a clear description of the technical approach being proposed. This discussion should provide the technical foundation/justification for pursuing this particular approach/direction and why one would expect it to enable the objectives of the proposal to be met.

Include for Basic Research, if it applies.

• Future Naval Relevance (where applicable): A description of potential Naval relevance and contributions of the effort to the agency’s specific mission.

For Applied Research and Advanced Technology Development, if it applies.

• Operational Naval Concept (where applicable): A description of the project objectives, the concept of operation for the new capabilities to be delivered, and the expected operational performance improvements.

• Operational Utility Assessment Plan (where applicable): A plan for demonstrating and evaluating the operational effectiveness of the Offeror’s proposed products or processes in field experiments and/or tests in a simulated environment.

• Project Schedule and Milestones: A summary of the schedule of events and milestones:

• Reports:

http://www.grants.gov/

The following are sample reports that are typically required under a research effort:

− Technical and Financial Progress Reports

− Final Report

Grants do not include the delivery of software, prototypes, and other hardware deliverables.

• Management Approach: Identify which personnel and subcontractors/subrecipients (if any) will be involved. Include a description of the facilities that are required for the proposed effort, along with a description of any Government Furnished Equipment/Hardware/

Software/Information required, by version and/or configuration.

• Current and Pending Project and Proposal Submissions: Offerors are required to provide information on all current and pending support for ongoing projects and proposals, including subsequent funding in the case of continuing contracts, grants, and other assistance agreements.

Offerors shall provide the following information of any related or complementary proposal submissions from whatever sources (e.g., ONR, Federal, State, local or foreign government agencies, public or private foundations, industrial or other commercial organizations).

Concurrent submission of a proposal to other organizations will not prejudice its review by

ONR:

1) Title of Proposal and Summary;

2) Source and amount of funding (annual direct costs; provide contract and/or grant numbers for current contracts/grants);

3) Percentage effort devoted to each project;

4) Identity of prime Offeror and complete list of subwards, if applicable;

5) Technical contact (name, address, phone/fax, electronic mail address)

6) Administrative/business contact (name, address, phone/fax, electronic mail address);

7) Period of performance (differentiate basic effort);

8) The proposed project and all other projects or…