S7. A1_RFP.pdf

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER (Type or print)

30-105-04EXCEPTION TO SF 30

APPROVED BY OIRM 11-84

STANDARD FORM 30 (Rev. 10-83) Prescribed by GSA

FAR (48 CFR) 53.243

The purpose of this amendment is to:

1) Correct and extend the proposal due date,

2) Revise CLIN 0001 description,

3) Revise Section C,

4) Revise L-3.2.1,

5) Revise Attachment 1 - PWS, and

6) Revise Attachment 2 - DD254

1. CONTRACT ID CODE PAGE OF PAGES

J 1 15

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

16C. DATE SIGNED

BY 30-Oct-2019

16B. UNITED STATES OF AMERICA15C. DATE SIGNED15B. CONTRACTOR/OFFEROR

(Signature of Contracting Officer)(Signature of person authorized to sign)

8. NAME AND ADDRESS OF CONTRACTOR (No., Street, County, State and Zip Code) X N0003920R0012

X 9B. DATED (SEE ITEM 11)

24-Oct-2019

10B. DATED (SEE ITEM 13)

9A. AMENDMENT OF SOLICITATION NO.

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

X The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offer X is extended, is not extended.

Offer must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended by one of the following methods:

(a) By completing Items 8 and 15, and returning 1 copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted;

or (c) By separate letter or telegram which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN

REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by telegram or letter, provided each telegram or letter makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

12. ACCOUNTING AND APPROPRIATION DATA (If required)

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS.

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE

CONTRACT ORDER NO. IN ITEM 10A.

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation date, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(B).

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority)

E. IMPORTANT: Contractor is not, is required to sign this document and return copies to the issuing office.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

10A. MOD. OF CONTRACT/ORDER NO.

2. AMENDMENT/MODIFICATION NO. 5. PROJECT NO.(If applicable)

6. ISSUED BY

3. EFFECTIVE DATE

30-Oct-2019

CODE

COMMANDER, NAVAL INFORMATION WARFARE

SYSTEMS COMMAND

02 CONTRACTS

4301 PACIFIC HIGHWAY

SAN DIEGO CA 92110-3127

N00039 7. ADMINISTERED BY (If other than item 6)

4. REQUISITION/PURCHASE REQ. NO.

CODE

See Item 6

FACILITY CODECODE

EMAIL:TEL:

N0003920R0012

SECTION SF 30 BLOCK 14 CONTINUATION PAGE

SUMMARY OF CHANGES

SECTION A - SOLICITATION/CONTRACT FORM

The required response date/time has changed from 13-Sep-2019 03:00 PM to 15-Nov-2019 03:00 PM.

SECTION B - SUPPLIES OR SERVICES AND PRICES

CLIN 0001

The CLIN extended description has changed from:

User and Entity Behavioral Analytics (UEBA) and data visualization software in accordance with the Salient Software Characteristics in Section C. One each is defined as: 1. One year of software licensing for development, testing, and Risk Management Framework (RMF) authorization purposes only (no operational network endpoints or users or entities).- The Government may use simulated endpoints, users or entities; or real endpoints, users or entities that are connected exclusively for testing and evaluation purposes. If a contractor’s licensing model requires charging for simulated or non-operational endpoints or users or entities, then the specification of the Optional Laboratory Hardware is appropriate (5,000 network endpoints and 10,000 users or entities).2. Licensing terms of proposed software shall permit the Navy to install unlimited instances of the ITS for non-production purposes including development, testing, and baseline management and up to three production implementations in the event the Navy decides to deploy separate implementations for the NIPRNet, SIPRNet, and JWICS networks, subject to the limitation of the cumulative number of networks or entities in the monitored population.3. Software license agreement shall not limit volume of data ingested by the UEBA suite.4. Software shall be capable of, and license terms shall allow for, use of the software suite in Amazon Web Services (AWS) environments and on hardware specified in Optional Production Hardware. AWS environments includes AWS Secret Region, AWS Top Secret Region, and unclassified environments through the Intelligence Community (IC) Commercial Cloud Services (C2S).5. Software shall comply with applicable Defense Information Systems Agency (DISA) Security Requirements Guides (SRGs) and Security Technical Implementation Guides (STIGs) with Committee on National Security Systems Instruction (CNSSI) 1253 overlays for privacy and classified information. The Contractor shall assist the Government to make necessary configuration changes to comply with the above and shall resolve all non-compliant items identified in the Assessment and Authorization process. Information and tools on security requirements can be found at:- https://public.cyber.mil/-https://www.dss.mil/Portals/69/documents/io/rmf/CNSSI_No1253.pdf6. Requirements for software licenses covered under the DEPARTMENT OF THE NAVY ORACLE ENTERPRISE LICENSE AGREEMENT Core Products List (https://www.doncio.navy.mil/ContentView.aspx?id=5412) or the DEPARTMENT OF THE NAVY ENTERPRISE SOFTWARE LICENSING AGREEMENT for RED HAT Core Products List (https://www.public.navy.mil/spawar/PEOEIS/technology/Documents/ESL_AwardedContract_Red%20Hat_Dec_20 17.pdf) shall be identified in proposals but shall NOT be priced as part of this contract.7. System documentation (Contract Data Requirements List (CDRL) A005) shall include:- Steps to verify proper operation of the system and to perform configuration changes, administration, maintenance, and diagnostics.- Initial system configuration and installation prerequisites including hardware requirements, operating system requirements (including recommended patch levels), and additional third-party software requirements.- Written troubleshooting guidance for common issues with the operation, administration, and maintenance of the system.

To:

User and Entity Behavioral Analytics (UEBA) and data visualization software in accordance with the Salient Software Characteristics in Section C. One each is defined as: 1. One year of software licensing for development, testing, and Risk Management Framework (RMF) authorization purposes only (no operational network endpoints or users or entities).- The Government may use simulated endpoints, users or entities; or real endpoints, users or entities that are connected exclusively for testing and evaluation purposes. If a contractor’s licensing model requires charging for simulated or non-operational endpoints or users or entities, then the specification of the Optional Laboratory Hardware is appropriate (5,000 network endpoints and 10,000 users or entities).2. Licensing terms of proposed software shall permit the Navy to install unlimited instances of the ITS for non-production purposes including development, testing, and baseline management and up to three production implementations in the event the Navy decides to deploy separate implementations for the NIPRNet, SIPRNet, and JWICS networks, subject to the limitation of the cumulative number of networks or entities in the monitored population.3. Software license agreement shall not limit volume of data ingested by the UEBA suite.4. Software shall be capable of, and license terms shall allow for, use of the software suite in Amazon Web Services (AWS) environments and on hardware specified in Optional Production Hardware. AWS environments includes AWS Secret Region, AWS Top Secret Region, and unclassified environments through the Intelligence Community (IC) Commercial Cloud Services (C2S).5. Software shall comply with applicable Defense Information Systems Agency (DISA) Security Requirements Guides (SRGs) and Security Technical Implementation Guides (STIGs) with Committee on National Security Systems Instruction (CNSSI) 1253 overlays for privacy and classified information and shall hold a Risk Management Framework authority to operate (ATO) on at least one classified (SECRET or higher) Government network. The Contractor shall assist the Government to make necessary configuration changes to comply with the above and shall resolve all non-compliant items identified in the Assessment and Authorization process. This service may require access up to TOP SECRET information. Contractor shall have and maintain technical services for proposed software at the TOP SECRET level. Top Secret cleared personnel shall have at least two years of experience with the proposed software. Information and tools on security requirements can be found at:-https://public.cyber.mil/- https://www.dss.mil/Portals/69/documents/io/rmf/CNSSI_No1253.pdf6. Requirements for software licenses covered under the DEPARTMENT OF THE NAVY ORACLE ENTERPRISE LICENSE AGREEMENT Core Products List (https://www.doncio.navy.mil/ContentView.aspx?id=5412) or the DEPARTMENT OF THE NAVY ENTERPRISE SOFTWARE LICENSING AGREEMENT for RED HAT Core Products List (https://www.public.navy.mil/spawar/PEOEIS/technology/Documents/ESL_AwardedContract_Red%20Hat_Dec_20 17.pdf) shall be identified in proposals but shall NOT be priced as part of this contract.7. System documentation (Contract Data Requirements List (CDRL) A005) shall include:- Steps to verify proper operation of the system and to perform configuration changes, administration, maintenance, and diagnostics.- Initial system configuration and installation prerequisites including hardware requirements, operating system requirements (including recommended patch levels), and additional third-party software requirements.- Written troubleshooting guidance for common issues with the operation, administration, and maintenance of the system.

SECTION C - DESCRIPTIONS AND SPECIFICATIONS

The following have been modified:

PERFORMANCE WORK STATEMENT

The work under this contract shall be performed in accordance with Attachment 1, Performance Work Statement.

(End of text)

Salient Software Characteristics Integration

1. Software solutions may consist of a suite of Commercial-off-the-shelf (COTS) software components or a hybrid of COTS and Government-off-the-shelf (GOTS) components. Solutions that include multiple software applications or components shall be provided by the Contractor as an integrated software suite. Proposals shall include a description of how software components interact to include a simple use case that demonstrates how an analyst would interact with the multiple applications.

Data Acquisition and Storage

2. Software shall automatically ingest data from Forcepoint-brand User Activity Monitoring products at a maximum data ingestion rate of at least 1 MB per hour per endpoint.

3. Software shall provide the capability to ingest data from multiple data sources of various structured and unstructured data formats, via manual import and automatically using application programming interfaces (APIs).

4. Software shall support storage at scales of up to at least 10 petabytes Data Analysis

5. Software shall include out of the box a suite of pre-built analytics to detect insider use cases such as data exfiltration, compromised user credentials, malicious user, illicit behavior, etc.; proposals shall include a full list of included analytics to enable the Government to determine technical acceptability of the proposed software.

6. Software shall allow for user customization of analytics, risk models, and visualizations that can be performed by general analysts without platform-specific expertise or contractor support.

7. Software shall generate customizable alerts based on single events, patterns, and sequences of events.

8. Software shall provide customizable risk scoring models for assigning risks to entities.

9. Software shall perform automated fusion of all data sources to correlate collected information to a specific user or entity.

Data Export

10. Software shall provide the ability for operators to develop, print, and save custom reports.

11. Software shall provide the capability to export reports; acceptable formats include CSV, XML, HTML, PDF, RTF, or text.

12. Software shall provide API or web interface to export data.

13. Software shall support exporting of all system logs to a remote Internet Protocol (IP)-connected device.

Installation, Maintenance, Configuration, and Documentation

14. Software shall provide an administration interface and documentation of the functions that can be performed in the interface (CDRL A005).

15. Software shall provide a password recovery option and a system configuration, user database, and policy backup option in the event system restoration is necessary.

Licensing and Support

16. Major version releases shall be supported for a minimum of three years. Alternatively, the Contractor may provide updated software to the Government, in which case the Contractor shall support the current version and one version prior.

17. Expiration of the licensing shall not prevent access to any data acquired or created by the system prior to expiration of licenses.

18. Data shall not be stored in proprietary formats or otherwise rendered inaccessible to third-party tools.

Security

19. Software shall provide individual accountability with respect to authorized user activity and include a mechanism to track, log, and report operator actions.

20. Software shall support group-based, role-based, or attribute-based access controls to simplify granting privileges to user accounts and scaling user account management.

Hardware Specifications The Contractor shall provision hardware that meets all requirements specified by the software vendor and shall ensure the hardware is adequate to support efficient and responsive operation of the software with the maximum number of specified endpoints and users.

1. Proposals shall include resource requirements (memory, Central Processing Unit, etc.) of proposed software and specifications of the proposed hardware including a full bill of materials.

2. Hardware shall support maximum data ingestion rate of 1 MB per hour per endpoint and shall facilitate streaming analytics results to be returned within one minute and batch analytics within two hours on average.

3. Hardware shall be provisioned to accommodate fast storage (Input and output Operations per section as recommended by software vendor), at least 50 TB, expandable to 100 TB.

Equipment shall include:

4. At least four USB ports

5. DVD and CD ROM drive

6. Ethernet adaptors shall support 1 GBPS speed or higher

7. One C13 PDU power adaptor per power supply,

8. VGA or HDMI port and KVM kit with HP AP 628 cable

9. Smart un-interruptible power supply (UPS) that conducts graceful shutdown of the equipment

10. 250 TB Storage Area Network (SAN) for backups, expandable to at least 500 TB for production system

11. 50 TB Storage Area Network (SAN) for backups for laboratory systems

12. Proposals shall include an equipment list or bill of materials

Warranty shall include five years of hardware support including defective media retention (DMR) and comprehensive defective material retention (CDMR) service; in the event of a hard drive failure, the failed drive or memory capable component shall not be required to be sent back to the hardware vendor for replacement or to allow for proper handling and disposal of sensitive data.

13. Proposals shall include terms of warranties.

All equipment shall be rack-mountable and production and laboratory systems shall each occupy 35 rack units

(35U) or less.

14. Proposals shall document power consumption, heat generation, size and weight, of the provisioned equipment.

SECTION J - LIST OF DOCUMENTS, EXHIBITS AND OTHER ATTACHMENTS

The Table of Contents has changed from:

Exhibit/Attachment Table of Contents

DOCUMENT TYPE DESCRIPTION PAGES DATE

Exhibit A Exhibit A - Contract Data

Requirements List

(CDRL)

9 11-JUL-2019

Attachment 1 Attachment 1 - Performance Work Statement

9 01-OCT-2019

Attachment 2 Attachment 2 - Draft

DD254

4 05-AUG-2019

Attachment 3 Attachment 3 - Draft DD254 Attachment

13 05-AUG-2019

Attachment 4 Attachment 4 - EULA Addendum

2 22-OCT-2019

Attachment 5 Attachment 5 - Reference Information Sheet

1 18-OCT-2019

Attachment 6 Attachment 6 - Past Performance Questionnaire

4 18-OCT-2019

to:

Exhibit/Attachment Table of Contents

DOCUMENT TYPE DESCRIPTION PAGES DATE

Exhibit A Exhibit A - Contract Data

Requirements List

(CDRL)

9 11-JUL-2019

Attachment 1 Attachment 1 - Performance Work Statement

9 29-OCT-2019

Attachment 2 Attachment 2 - Draft

DD254

4 28-OCT-2019

Attachment 3 Attachment 3 - Draft DD254 Attachment

13 05-AUG-2019

Attachment 4 Attachment 4 - EULA Addendum

2 22-OCT-2019

Attachment 5 Attachment 5 - Reference Information Sheet

1 18-OCT-2019

Attachment 6 Attachment 6 - Past Performance Questionnaire

4 18-OCT-2019

SECTION L - INSTRUCTIONS, CONDITIONS AND NOTICES TO BIDDERS

L-1 GENERAL INFORMATION

L1.1 Eligibility Classification This firm fixed price commercial procurement is being solicited as a Full and Open competition. The North American Industry Classification System (NAICS) code applicable to this procurement is 541511. The size standard in number of employees for NAICS 541511 is $27,500,000.

L1.2 Source Selection Process The Government will evaluate the Offeror’s technical ability against the stated requirements starting with the lowest priced offer. If the lowest priced offer is technically acceptable and has acceptable past performance, then the Government will make the award to that Offeror and will not evaluate any further offers. If the lowest priced offer does not meet the stated requirements, then the Government will evaluated the next lowest priced offer in the same manner and so on. However, Offerors are hereby on notice that the Government reserves the right to view an Offeror with “Acceptable” past performance based on positive provided past performance information more favorably than an offeror with “Acceptable” past performance based on neutral past performance information, where little or no information is provided. In other words, the Government reserves the right to bypass the lowest priced Offeror with “Neutral” past performance and select the next lowest priced Offeror with “Acceptable” past performance based on acceptable provided information.

L1.3 Questions It is the Offeror’s responsibility to bring questions to the attention of the Contracting Officer at the earliest possible time, but prior to the closing date, regarding any ambiguities, discrepancies, inconsistencies, or conflicts between the requirement and other solicitation documents attached hereto or incorporated by reference. All questions shall be submitted to the Contract Specialist at megan.ashley@navy.mil and the Contracting Officer at cindy.ledesma@navy.mil and must be received by 1000 AM Pacific Time, Monday 28 October 2019.

L-2 PROPOSAL REQUIREMENTS

L-2.1 PROPOSAL ORGANIZATION: Proposals submitted in response to this requirement shall be unclassified and shall consist of two separate volumes identified as follows:

a. Volume I: Contract Documents and Cost/Price Proposal Volume

b. Volume II: Technical Proposal Volume

L-2.2 PROPOSAL FORMAT: In addition to all other requirements to this solicitation, each Offeror shall demonstrate its capability by means of a written proposal in each of the areas indicated in Section M – Evaluation Factors. Proposals submitted for consideration for award shall address the full scope of the solicitation.

The Offeror’s proposal volumes shall include the following:

Table 1 Volume Item Page Limit I Section 1: Cover Letter / Executive Summary No Limit I Section 2: Exceptions to the RFP No Limit I Section 3: Signed SF33 with completed Sections B through K No Limit

I Section 4: Contractor Responsibility Information No Limit II Section 1: Technical Requirements (Factor 1) 20 Pages* II Section 2: Past Performance (Factor 2) 4 Pages

* Hardware specs do not count against page limits.

Information submitted in excess of the established page limits will not be read or evaluated. Page limits do not include cover sheets, tables of contents, requirements compliance matrices, lists of figures, lists of drawings, lists of proprietary data, glossaries, tabs, dividers, or blank pages.

Do not include cost/pricing information in any volume other than the Volume I. If cost/pricing information is found in Volume II, the pricing information will be redacted from that volume prior to evaluation and therefore, the redacted information will not be evaluated.

Format: The proposal shall be on 8½" x 11" paper with single-spaced typed lines, including figures, glossaries, tables of contents, and cover sheets. Type and size shall be Times New Roman and no smaller than 12 point in the text, 10 point in spreadsheets, and 6 point on drawings, figures, and tables. Foldouts may be used, but shall be no larger than 11″ by 17 ″, and shall count as two pages. Standard margins shall be a minimum of one inch, excluding header and footer. The volumes shall contain a glossary of abbreviations and acronyms used and an explanation of each.

Numbering: Pages shall be numbered consecutively within each section to indicate the volume, section, and page.

For example, page 19 of Volume I, Section 3 would be numbered I-3-19.

L-3 PROPOSAL VOLUMES

The Offeror shall provide sufficient detail to substantiate the validity of all stated claims. An Offeror’s proposal is presumed to represent their best efforts to respond to the solicitation. Proposals should be clear, concise, and complete. Organization, clarity, accuracy of information, relevance, and completeness are important. Sufficient supporting information shall be provided to allow the Government to evaluate the Offeror’s approach. Stating that the Offeror understands and complies with this effort or paraphrasing the statements of the RFP is considered inadequate and unacceptable. Phrases such as “standard procedures will be employed” and “well known techniques will be used” are also considered inadequate. Elaborate brochures or other presentation aids are not necessary and if such material is included in the proposal it will be included in the volume page count.

Proposals shall correlate directly and sequentially with the following specific proposal preparation instructions.

Non-conformance to the instructions may cause rejection of the proposal. Proposals shall be complete and self-sufficient, relate exactly to what is requested, and strictly adhere to the requirements of this solicitation. Use of documentation by reference that is not incorporated into the proposal will not be allowed. Where cross-referencing is used, the volume, attachment, exhibit and paragraph numbers, as appropriate, shall be referenced. Tables of contents, blank pages, requirements compliance matrices, lists of tables, list of drawings, list of figures, glossaries, and lists of proprietary data do not count against the page limitations.

The required content for each volume section is described below:

L-3.1 VOLUME I: CONTRACT DOCUMENTS AND COST/PRICE PROPOSAL. The completion and submission to the Government of the items in Volume I will constitute the offer. The Government’s acceptance of the offer will create a binding contract between the Government and Offeror. The Offeror’s proposal shall be signed by a company official having actual authority to bind the contractor contractually. The Offeror’s failure or refusal to assent to any of the terms and conditions of this RFP or its imposition of additional conditions or any material omission in its offer may constitute a deficiency, which may make the offer unacceptable to the Government.

L-3.1.1 Section 1: Cover Letter/Executive Summary. The Offeror’s proposal shall include a cover letter on company letterhead and signed by an individual who has the authority to contractually bind the Offeror. The cover letter shall acknowledge receipt of all amendments (if any are issued) to the RFP. The cover letter shall identify all enclosures being transmitted as part of the response to the RFP. The Cover Letter shall provide a statement specifying the extent of agreement with all terms, conditions, and provisions included in the solicitation and a point of contact including name, telephone number and email for correspondence regarding the proposal. It shall state: (1) Commercial and Government Entity (CAGE) number, (2) Data Universal Numbering System (DUNS) number, (3) Taxpayer Identification Number (TIN), (4) address(es) of the location(s) at which the Offeror intends to perform the proposed effort, (5) name, address and telephone number of the cognizant Defense Contract Audit Agency (DCAA) audit office, (6) the name, address and telephone number of the cognizant Defense Contract Management Agency (DCMA) office, and (7) a statement that the proposal is valid for no less than 90 days from the solicitation closing date. The above listed information (items 1-7) shall also be provided for all proposed subcontractors.

L-3.1.2 Section 2: Exceptions to the RFP. The Offeror’s proposal shall include any exceptions to the provisions of the solicitation. The Offeror shall clearly state the exceptions and provide references to the applicable solicitation page, paragraph, or exhibit line item number. The Offeror shall provide a full explanation for all exceptions taken to the solicitation. Any material exceptions to the solicitation may render the proposal unacceptable and ineligible. If the Offeror takes no exceptions to the provisions of the solicitation, the Offeror shall state their unconditional assent to all terms, conditions, and provisions included in the RFP within Volume I: Contract Documents.

L-3.1.3 Section 3: Signed SF33 with completed Sections B through K. The Offeror shall agree to the Government’s Software Amendment by completing and signing Attachment No. 4, shall complete Sections B through K of the RFP and provide a signed SF33 acknowledging all amendments. Signature by the Offeror on the SF33 constitutes an offer, which the Government may accept.

L-3.1.3.1 Completion of annual representations and certifications via the System for Award Management (SAM) is a requirement of solicitation provision 52.204-8, but it is not a sufficient response to Section K of the solicitation.

All representations and certifications included in Section K must be completed.

L-3.1.4 Section 4: Contractor Responsibility Information. To aid in the determination of contractor responsibility, the following information is required:

a. Information regarding the general financial condition of your firm and specific plans for financing the proposed contract, including the latest available financial statements. If you are currently being audited, or have been audited by DCAA, provide the address, current telephone number, and current point of contact for the cognizant DCAA and the cognizant DCMA Office. This shall include the latest approval date of your Disclosure Statement (not applicable to Small Businesses) and most recent audit status, i.e., when was the last one performed, what were the findings, etc.

b. A listing of previous and/or ongoing experience in related areas. Include the contracting activity, program or item produced, contract number, current point of contact, current telephone number, duration of contract, type of contract, and total dollar amount of contract. Please ensure information provided is current. If the Offeror believes that information provided under Volume II Section 3: Past Performance Information (Factor 2) adequately addresses the requirements of this provision, please state here. Repetition of the same information is not necessary.

c. A summary of your:

1. Accounting procedures and controls;

2. Organization;

3. Production control procedures;

4. Property control system;

5. Quality assurance programs; and

6. Equipment and facilities relative to this effort.

d. If there will be any subcontracting, provide the following information:

1. Methodology for the selection of proposed subcontractors, if any, and the benefit they would bring to the arrangement; and

2. Analysis performed on the subcontractor’s cost/price proposal to determine a fair and reasonable price.

e. A list of credit references, including suppliers. Provide company name, point of contact, and telephone number.

f. Any other additional information that will assist in a better or complete understanding of your firm and its capabilities.

L-3.2 VOLUME II: TECHNICAL PROPOSAL. Each Offeror shall submit a written proposal in accordance with Sections 1 and 2 below to enable the Government to evaluate the extent to which the proposal meets the Government’s requirements. Wherever relevant, the Offeror is encouraged to use cross-references to the applicable sections of the proposal, rather than repeating that information in the several sections of this volume. No pricing information shall be included in the technical volume.

L-3.2.1 Section 1: Technical Requirements (Factor 1).

Background: The Department of the Navy requires an Integrated Tool Suite (ITS) consisting of off-the-shelf User and Entity Behavioral Analytics (UEBA) and data visualization software designed to streamline and enhance the analysis of network User Activity Monitoring (UAM) data. The ITS shall ingest the UAM data from an existing UAM system and enrich it with additional Government-provided structured and unstructured data sources such as human resources, travel, law enforcement, and other records to provide a comprehensive risk analysis of individuals in the monitored population. The Government envisions an annual license agreement in which licenses are metered either by the number of users or entities tracked by the UEBA software, or by the number of network endpoints monitored by the UAM system, which will be the primary data source for the UEBA software. The initial year of the agreement will have no operational endpoints or users or entities; the software will be used for development, testing, and accreditation purposes only. The subsequent years will have incremental increases in number of operational endpoints or users or entities covered by the UEBA suite. Options years may be exercised early if testing and accreditation can be accelerated or if the Navy’s monitored population of endpoints or users grows more rapidly than anticipated.

The Contractor shall:

CLIN 0001: Provide User and Entity Behavioral Analytics (UEBA) and data visualization software based on the salient characteristics specified in the Salient Software Characteristics section of this document.

Proposals shall describe how the proposed solution meets each of the Salient Software Characteristics.

1. Licensing for base year shall be for one year of software use for development, testing, and Risk Management Framework (RMF) authorization purposes only (no operational network endpoints or users or entities).

The Government may use simulated endpoints, users or entities; or real endpoints, users or entities that are connected exclusively for testing and evaluation purposes. If a contractor’s licensing model requires charging for simulated or non-operational endpoints or users or entities, then the specification of the Optional Laboratory Hardware is appropriate (5,000 network endpoints and 10,000 users or entities).

2. Licensing terms of proposed software shall permit the Navy to install unlimited instances of the ITS for non-production purposes including development, testing, and baseline management and up to three production implementations in the event the Navy decides to deploy separate implementations for the NIPRNet, SIPRNet, and JWICS networks, subject to the limitation of the cumulative number of networks or entities in the monitored population.

3. Software license agreement shall not limit volume of data ingested by the UEBA suite.

4. Software shall be capable of, and license terms shall allow for, use of the software suite in

Amazon Web Services (AWS) environments and on hardware specified in Optional Production Hardware. AWS environments includes AWS Secret Region, AWS Top Secret Region, and unclassified environments through the Intelligence Community (IC) Commercial Cloud Services (C2S).

5. Software shall comply with applicable Defense Information Systems Agency (DISA) Security Requirements Guides (SRGs) and Security Technical Implementation Guides (STIGs) with Committee on National Security Systems Instruction (CNSSI) 1253 overlays for privacy and classified information and shall hold a Risk Management Framework authority to operate (ATO) on at least one classified (SECRET or higher) Government network. The Contractor shall assist the Government to make necessary configuration changes to comply with the above and shall resolve all non-compliant items identified in the Assessment and Authorization process. This service may require access up to TOP SECRET information. Contractor shall have and maintain the ability to provide technical servcies for proposed software at the TOP SECRET level. Top Secret cleared personnel shall have at least two years of experience with the proposed software.

Proposals shall include the Contractor’s plan to provide qualified Top Secret personnel, including a summary of personnel qualifications, and assert that the proposed software has been authroized to operate on at least one classified network (specify the organization if it is unclassified).

Information and tools on security requirements can be found at:

https://public.cyber.mil/ https://www.dss.mil/Portals/69/documents/io/rmf/CNSSI_No1253.pdf

6. Requirements for software licenses covered under the DEPARTMENT OF THE NAVY ORACLE ENTERPRISE LICENSE AGREEMENT Core Products List (https://www.doncio.navy.mil/ContentView.aspx?id=5412) or the DEPARTMENT OF THE NAVY ENTERPRISE SOFTWARE LICENSING AGREEMENT for RED HAT Core Products List (https://www.public.navy.mil/spawar/PEOEIS/technology/Documents/ESL_AwardedContract_Re d%20Hat_Dec_2017.pdf) shall be identified in proposals but shall NOT be priced as part of this contract.

7. System documentation (Contract Data Requirements List (CDRL) A005) shall include:

Steps to verify proper operation of the system and to perform configuration changes, administration, maintenance, and diagnostics.

Initial system configuration and installation prerequisites including hardware requirements, operating system requirements (including recommended patch levels), and additional third-party software requirements.

Written troubleshooting guidance for common issues with the operation, administration, and maintenance of the system.

CLIN 0002: Provide the following training services and documentation (CDRL A004):

1. In accordance with Section 4.1 of the Performance Work Statement.

CLIN 0003: Provide one production User and Entity Behavioral Analytics (UEBA) appliance (software installed on hardware) sized to accommodate user activity monitoring of 75,000 network endpoints and 150,000 users or entities.

1. System shall be delivered or shipped to Naval Information Warfare Center Pacific (NIWC PAC) in San Diego, CA with the Base Year software pre-installed within 90 days.

2. Instructions for connecting hardware and all Original Equipment Manufacturer (OEM) hardware documentation shall be included. (CDRL A005)

3. Hardware shall conform to Hardware Specifications identified in Hardware Specifications section of this document.

CLIN 0004: Provide one laboratory UEBA appliance that mirrors the production system in all respects, except the hardware shall be scaled down to accommodate 5,000 network endpoints and 10,000 users or entities.

1. System shall be delivered or shipped to NIWC PAC in San Diego, CA with the Base Year software pre-installed within 90 days.

2. Instructions for connecting hardware and all OEM hardware documentation shall be included.

(CDRL A005)

3. Hardware shall conform to Hardware Specifications identified in Hardware Specifications section of this document.

CLIN 0005: Provide one additional laboratory UEBA appliance identical to system described in CLIN 0004.

1. System shall be delivered or shipped to NIWC PAC in San Diego, CA with the Base Year software pre-installed within 90 days.

2. Instructions for connecting hardware and all OEM hardware documentation shall be included.

(CDRL A005)

3. Hardware shall conform to Hardware Specifications identified in Hardware Specifications section of this document.

CLIN 0006: Provide Help Desk support for at least eight hours per day, Monday through Friday, by phone and email. Help desk support shall be able to provide support up to SECRET classification via SIPRNet email.

Option Year 1: Provide annual licensing for UEBA software suite for cumulative 10,000 network endpoints and 20,000 users or entities.

1. CLIN 0007 (O&M,N): Extend licenses procured in the Base Year for one additional year.

2. CLIN 0008 (OPN): Provide licensing for additional 10,000 network endpoints and 20,000 users or entities.

3. CLIN 0009: Provide help desk support for at least eight hours per day, Monday through Friday, by phone and email. Help desk support shall be able to provide support up to SECRET classification via SIPRNet email.

Option Year 2: Provide annual licensing for UEBA software suite for cumulative 50,000 network endpoints and 100,000 users or entities.

1. CLIN 0010 (O&M,N): Extend licenses procured in previous years for one additional year.

2. CLIN 0011 (OPN): Provide licensing for additional 40,000 network endpoints and 80,000 users or entities.

3. CLIN 0012: Provide help desk support for at least eight hours per day, Monday through Friday, by phone and email. Help desk support shall be able to provide support up to SECRET classification via SIPRNet email.

Option Year 3: Provide annual licensing for UEBA software suite for cumulative 75,000 network endpoints and 150,000 users or entities

1. CLIN 0013 (O&M,N): Extend licenses procured in previous years for one additional year.

2. CLIN 0014 (OPN): Provide licensing for additional 25,000 network endpoints and 50,000 users or entities.

3. CLIN 0015: Provide help desk support for at least eight hours per day, Monday through Friday, by phone and email. Help desk support shall be able to provide support up to SECRET classification via SIPRNet email.

Option Year 4: Provide annual licensing for UEBA software suite for cumulative 75,000 network endpoints and 150,000 users or entities

1. CLIN 0016: O&M,N: Extend licenses procured in previous years for one additional year.

2. CLIN 0017: Provide help desk support for at least eight hours per day, Monday through Friday, by phone and email. Help desk support shall be able to provide support up to SECRET classification via SIPRNet email.

Salient Software Characteristics Integration

1. Software solutions may consist of a suite of Commercial-off-the-shelf (COTS) software components or a hybrid of COTS and Government-off-the-shelf (GOTS) components. Solutions that include multiple software applications or components shall be provided by the Contractor as an integrated software suite. Proposals shall include a description of how software components interact to include a simple use case that demonstrates how an analyst would interact with the multiple applications.

Data Acquisition and Storage

21. Software shall automatically ingest data from Forcepoint-brand User Activity Monitoring products at a maximum data ingestion rate of at least 1 MB per hour per endpoint.

22. Software shall provide the capability to ingest data from multiple data sources of various structured and unstructured data formats, via manual import and automatically using application programming interfaces (APIs).

23. Software shall support storage at scales of up to at least 10 petabytes.

Data Analysis

24. Software shall include out of the box a suite of pre-built analytics to detect insider use cases such as data exfiltration, compromised user credentials, malicious user, illicit behavior, etc.; proposals shall include a full list of included analytics to enable the Government to determine technical acceptability of the proposed software.

25. Software shall allow for user customization of analytics, risk models, and visualizations that can be performed by general analysts without platform-specific expertise or contractor support.

26. Software shall generate customizable alerts based on single events, patterns, and sequences of events.

27. Software shall provide customizable risk scoring models for assigning risks to entities.

28. Software shall perform automated fusion of all data sources to correlate collected information to a specific user or entity.

Data Export

29. Software shall provide the ability for operators to develop, print, and save custom reports.

30. Software shall provide the capability to export reports; acceptable formats include CSV, XML, HTML, PDF, RTF, or text.

31. Software shall provide API or web interface to export data.

32. Software shall support exporting of all system logs to a remote Internet Protocol (IP)-connected device.

Installation, Maintenance, Configuration, and Documentation

33. Software shall provide an administration interface and documentation of the functions that can be performed in the interface (CDRL A005).

34. Software shall provide a password recovery option and a system configuration, user database, and policy backup option in the event system restoration is necessary.

Licensing and Support

35. Major version releases shall be supported for a minimum of three years. Alternatively, the Contractor may provide updated software to the Government, in which case the Contractor shall support the current version and one version prior.

36. Expiration of the licensing shall not prevent access to any data acquired or created by the system prior to expiration of licenses.

37. Data shall not be stored in proprietary formats or otherwise rendered inaccessible to third-party tools.

Security

38. Software shall provide individual accountability with respect to authorized user activity and include a mechanism to track, log, and report operator actions.

39. Software shall support group-based, role-based, or attribute-based access controls to simplify granting privileges to user accounts and scaling user account management.

Hardware Specifications The Contractor shall provision hardware that meets all requirements specified by the software vendor and shall ensure the hardware is adequate to support efficient and responsive operation of the software with the maximum number of specified endpoints and users.

1. Proposals shall include resource requirements (memory, Central Processing Unit, etc.) of proposed software and specifications of the proposed hardware including a full bill of materials.

2. Hardware shall support maximum data ingestion rate of 1 MB per hour per endpoint and shall facilitate streaming analytics results to be returned within one minute and batch analytics within two hours on average.

3. Hardware shall be provisioned to accommodate fast storage (Input and output Operations per section as recommended by software vendor), at least 50 TB, expandable to 100 TB.

Equipment shall include:

4. At least four (4) USB ports

5. DVD and CD ROM drive

6. Ethernet adaptors shall support one GBPS speed or higher

7. One C13 PDU power adaptor per power supply,

8. VGA or HDMI port and KVM kit with HP AP 628 cable

9. Smart un-interruptible power supply (UPS) that conducts graceful shutdown of the equipment

10. 250 TB Storage Area Network (SAN) for backups, expandable to at least 500 TB for production system

11. 50 TB Storage Area Network (SAN) for backups for laboratory systems

12. Proposals shall include an equipment list or bill of materials

Warranty shall include five years of hardware support including defective media retention (DMR) and comprehensive defective material retention (CDMR) service; in the event of a hard drive failure, the failed drive or memory capable component shall not be required to be sent back to the hardware vendor for replacement or to allow for proper handling and disposal of sensitive data.

14. Proposals shall include terms of warranties.

All equipment shall be rack-mountable and production and laboratory systems shall each occupy 35 rack units

(35U) or less.

15. Proposals shall document power consumption, heat generation, size and weight, of the provisioned equipment.

L-3.2.2 Section 2: Past Performance (Factor 2). (Two Reference Information Sheets (Attachment No. 5), two pages per reference maximum; total of four pages maximum) (Excludes CPARS and Past Performance Questionnaire (PPQ) (Attachment No.6 )):

Offerors shall complete and submit two Reference Information Sheets (RIS) (Attachment No. 5) in accordance with the instructions contained therein. Part 15 of the RIS requires Offerors to provide a summary description of contract work, not to exceed one page in length, for each cited reference. Past performance references should be recent, that is performed since September 2016, and relevant. Relevant work is defined as work of similar nature, scope, magnitude, and difficulty to that required by this solicitation.

Offerors shall submit recent CPARS evaluations for the references cited, if available. If CPARS evaluations are unavailable, offerors shall ensure that the references cited in Blocks 9a & 9b of the RIS (Attachment No. 5) are current and accurate and forward the PPQ (Attachment No. 6) directly to the Technical Point of Contact (TPOC) listed in Block 9a. The offeror shall request the TPOC return the Past Performance Questionnaire forms prior to the solicitation closing date directly to NAVWAR Contracts via e-mail to Megan Ashley at megan.ashley@navy.mil and Cindy Ledesma at cindy.ledesma@navy.mil.

SECTION M - EVALUATION FACTORS FOR AWARD

M-1 GENERAL INFORMATION

M1.1 Source Selection Process The Government will evaluate the Offeror’s technical ability against the stated requirements starting with the lowest priced offer. If the lowest priced offer is technically acceptable and has acceptable past performance, then the

Government will make the award to that Offeror and will not evaluate any further offers. If the lowest priced offer does not meet the stated requirements, then the Government will evaluated the next lowest priced offer in the same manner and so on. However, Offerors are hereby on notice that the Government reserves the right to view an Offeror with “Acceptable” past performance based on positive provided past performance information more favorably than an offeror with “Acceptable” past performance based on neutral past performance information, where little or no information is provided. In other words, the Government reserves the right to bypass the lowest priced Offeror with “Neutral” past performance and select the next lowest priced Offeror with “Acceptable” past performance based on acceptable provided information.

M1.2 Evaluation Notice

As specified in the FAR 52.215-1 “Instructions to Offerors--Competitive Acquisition” provision, the Government intends to evaluate proposals and award without discussions. An offer must be acceptable for the Offeror to be eligible for award. OFFERS THAT DO NOT CONFORM TO THE REQUIREMENTS STATED HEREIN

MAY BE DETERMINED UNACCEPTABLE AND MAY BE REJECTED WITHOUT FURTHER

EVALUATION.

M-2 TECHNICAL EVALUATION

Offerors will be evaluated on the ability to meet the Government’s requirements in accordance with the Performance Work Statement and the following factors:

Cost/Price Technical Requirements Past Performance

The Government will evaluate the Offeror’s technical ability against the stated requirements starting with the lowest priced offer. If the lowest priced offer is technically acceptable and has acceptable past performance, then the Government will make the award to that Offeror and will not evaluate any further offers. If the lowest priced offer does not meet the stated requirements, then the Government will evaluated the next lowest priced offer in the same manner and so on. However, Offerors are hereby on notice that the Government reserves the right to view an Offeror with “Acceptable” past performance based on positive provided past performance information more favorably than an offeror with “Acceptable” past performance based on neutral past performance information, where little or no information is provided. In other words, the Government reserves the right to bypass the lowest priced Offeror with “Neutral” past performance and select the next lowest priced Offeror with “Acceptable” past performance based on acceptable provided information.

M-2.1 Factor 1: Technical Requirements

The Government will evaluate the Offeror’s technical ability against the stated requirements in L-3.2.1 starting with the lowest priced offer.

The Government will evaluate this factor on an Acceptable or Unacceptable basis.

Technical Ratings Rating Description Acceptable Proposal meets the requirements of the solicitation.

Unacceptable Proposal does not meet the requirements of the solicitation.

M-2.2 Factor 2: Past Performance The past performance information submitted will be reviewed to determine the past performance acceptable/unacceptable rating.