N3220520R4130 - SF30 A13 -SAM.docx

N3220520R4130

SECTION SF 30 BLOCK 14 CONTINUATION PAGE

SUMMARY OF CHANGES

SECTION SF 1449 - CONTINUATION SHEET

SOLICITATION/CONTRACT FORM

The required response date/time has changed from 08-Jul-2022 03:00 PM to 16-Sep-2022 03:00 PM.

The following have been added by full text:

252.204-7020 NIST SP 800-171 DOD ASSESSMENT REQUIREMENTS (MAR 2022)

(a) Definitions.

Basic Assessment means a contractor's self-assessment of the contractor's implementation of NIST SP 800-171 that-

(1) Is based on the Contractor's review of their system security plan(s) associated with covered contractor information system(s);

(2) Is conducted in accordance with the NIST SP 800-171 DoD Assessment Methodology; and

(3) Results in a confidence level of "Low" in the resulting score, because it is a self-generated score.

Covered contractor information system has the meaning given in the clause 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting, of this contract.

High Assessment means an assessment that is conducted by Government personnel using NIST SP 800-171A, Assessing Security Requirements for Controlled Unclassified Information that--

(1) Consists of--

(i) A review of a contractor's Basic Assessment;

(ii) A thorough document review;

(iii) Verification, examination, and demonstration of a Contractor's system security plan to validate that NIST SP 800-171 security requirements have been implemented as described in the contractor's system security plan; and

(iv) Discussions with the contractor to obtain additional information or clarification, as needed; and

(2) Results in a confidence level of "High" in the resulting score.

Medium Assessment means an assessment conducted by the Government that--

(1) Consists of--

(i) A review of a contractor's Basic Assessment;

(ii) A thorough document review; and

(iii) Discussions with the contractor to obtain additional information or clarification, as needed; and

(2) Results in a confidence level of "Medium" in the resulting score.

(b) Applicability. This clause applies to covered contractor information systems that are required to comply with the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171, in accordance with Defense Federal Acquisition Regulation System (DFARS) clause at 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting, of this contract.

(c) Requirements. The Contractor shall provide access to its facilities, systems, and personnel necessary for the Government to conduct a Medium or High NIST SP 800-171 DoD Assessment, as described in NIST SP 800-171 DoD Assessment Methodology at https://www.acq.osd.mil/asda/dpc/cp/cyber/safeguarding.html#nistSP800171, if necessary.

(d) Procedures. Summary level scores for all assessments will be posted in the Supplier Performance Risk System (SPRS) (https://www.sprs.csd.disa.mil/) to provide DoD Components visibility into the summary level scores of strategic assessments.

(1) Basic Assessments. A contractor may submit, via encrypted email, summary level scores of Basic Assessments conducted in accordance with the NIST SP 800-171 DoD Assessment Methodology to webptsmh@navy.mil for posting to SPRS.

(i) The email shall include the following information:

(A) Version of NIST SP 800-171 against which the assessment was conducted.

(B) Organization conducting the assessment (e.g., Contractor self-assessment).

(C) For each system security plan (security requirement 3.12.4) supporting the performance of a DoD contract--

(1) All industry Commercial and Government Entity (CAGE) code(s) associated with the information system(s) addressed by the system security plan; and

(2) A brief description of the system security plan architecture, if more than one plan exists.

(D) Date the assessment was completed.

(E) Summary level score (e.g., 95 out of 110, NOT the individual value for each requirement).

(F) Date that all requirements are expected to be implemented (i.e., a score of 110 is expected to be achieved) based on information gathered from associated plan(s) of action developed in accordance with NIST SP 800-171.

(ii) If multiple system security plans are addressed in the email described at paragraph (b)(1)(i) of this section, the Contractor shall use the following format for the report:

Brief CAGE codes description of Date of Total Date score of System security plan supported by this the plan assessment score 110 will plan architecture achieved

(2) Medium and High Assessments. DoD will post the following Medium and/or High Assessment summary level scores to SPRS for each system security plan assessed:

(i) The standard assessed (e.g., NIST SP 800-171 Rev 1).

(ii) Organization conducting the assessment, e.g., DCMA, or a specific organization (identified by Department of Defense Activity Address Code (DoDAAC)).

(iii) All industry CAGE code(s) associated with the information system(s) addressed by the system security plan.

(iv) A brief description of the system security plan architecture, if more than one system security plan exists.

(v) Date and level of the assessment, i.e., medium or high.

(vi) Summary level score (e.g., 105 out of 110, not the individual value assigned for each requirement).

(vii) Date that all requirements are expected to be implemented (i.e., a score of 110 is expected to be achieved) based on information gathered from associated plan(s) of action developed in accordance with NIST SP 800-171.

(e) Rebuttals. (1) DoD will provide Medium and High Assessment summary level scores to the Contractor and offer the opportunity for rebuttal and adjudication of assessment summary level scores prior to posting the summary level scores to SPRS (see SPRS User's Guide https://www.sprs.csd.disa.mil/pdf/SPRS_Awardee.pdf).

(2) Upon completion of each assessment, the contractor has 14 business days to provide additional information to demonstrate that they meet any security requirements not observed by the assessment team or to rebut the findings that may be of question.

(f) Accessibility.

(1) Assessment summary level scores posted in SPRS are available to DoD personnel, and are protected, in accordance with the standards set forth in DoD Instruction 5000.79, Defense-wide Sharing and Use of Supplier and Product Performance Information (PI).

(2) Authorized representatives of the Contractor for which the assessment was conducted may access SPRS to view their own summary level scores, in accordance with the SPRS Software User's Guide for Awardees/Contractors available at https://www.sprs.csd.disa.mil/pdf/SPRS_Awardee.pdf.

(3) A High NIST SP 800-171 DoD Assessment may result in documentation in addition to that listed in this clause. DoD will retain and protect any such documentation as "Controlled Unclassified Information (CUI)" and intended for internal DoD use only. The information will be protected against unauthorized use and release, including through the exercise of applicable exemptions under the Freedom of Information Act (e.g., Exemption 4 covers trade secrets and commercial or financial information obtained from a contractor that is privileged or confidential).

(g) Subcontracts.

(1) The Contractor shall insert the substance of this clause, including this paragraph (g), in all subcontracts and other contractual instruments, including subcontracts for the acquisition of commercial items (excluding COTS items).

(2) The Contractor shall not award a subcontract or other contractual instrument, that is subject to the implementation of NIST SP 800-171 security requirements, in accordance with DFARS clause 252.204-7012 of this contract, unless the subcontractor has completed, within the last 3 years, at least a Basic NIST SP 800-171 DoD Assessment, as described in https://www.acq.osd.mil/asda/dpc/cp/cyber/safeguarding.html#nistSP800171, for all covered contractor information systems relevant to its offer that are not part of an information technology service or system operated on behalf of the Government.

(3) If a subcontractor does not have summary level scores of a current NIST SP 800-171 DoD Assessment (i.e., not more than 3 years old unless a lesser time is specified in the solicitation) posted in SPRS, the subcontractor may conduct and submit a Basic Assessment, in accordance with the NIST SP 800-171 DoD Assessment Methodology, to webptsmh@navy.mil for posting to SPRS along with the information required by paragraph (d) of this clause.

(End of clause)

The following have been modified:

ADDENDUM TO FAR 52.212-1

In addition to FAR 52.212-1, “Instructions to Offerors – Commercial Items” and any other instructions contained elsewhere in this solicitation, the following instructions are provided. Any inconsistency between FAR 52.252-1 and this addendum to FAR 52.212-1 shall be solved by giving precedence to the addendum to FAR 52.212-1.

INSTRUCTIONS FOR SUBMISSION OF PROPOSALS:

(1) Proposals and any modifications thereto shall be emailed directly to Alexandra Hiser at alexandra.p.hiser.civ@us.navy.mil and Kasie Samaniego at kasie.h.samaniego.civ@us.navy.mil no later than the due date and time cited in this solicitation. No other electronic means of submissions, used in whole or in combination with email, is permitted. Hand-carried proposals are not authorized.

(2) Offerors are advised that the Government may be unable to receive other types of electronic files (e.g., .zip files) or files in excess of 20 megabytes. To be timely, an E-mail proposal must be received in its entirety in the designated E-mail inbox by the due date and time cited in this solicitation. An E-mail proposal that resides on a Government server, but has not appeared in the designated E-mail inbox by the due date and time for proposal submission will be considered late unless the exception at FAR 52.212-1(f)(2)(i)(A) applies. The exception at FAR 52.212-1(f)(2)(i)(B) shall not apply to E-mail proposals.

(3) The price proposal must be submitted in excel format using the provided Exhibit A - Rate Table with the exception of the Small Business Subcontracting Plan, Master Subcontracting Plan or Commercial Plan, SF 1449 and associated amendments, and any other required documents.

(4) Questions: Offerors may submit questions to alexandra.p.hiser.civ@us.navy.mil and kasie.h.samaniego.civ@us.navy.mil. To ensure that all questions submitted by potential offerors are answered prior to the solicitation’s closing date, questions should be submitted no later than 1200, Eastern Time 10 calendar days prior to the solicitation closing. Accordingly, Offerors are encouraged to carefully review all solicitation requirements and submit questions to the Government as early as possible.

(5) Each page shall be affixed with the following legend:

Source Selection Information - See FAR 2.101 and 3.104

IMPORTANT NOTES:

(1) Offerors shall respond to all requirements of the solicitation. Offerors are cautioned not to alter the solicitation.

(2) Proposals shall not contain any classified information. Any portion of an offer, which the Offeror considers business sensitive, should be clearly marked as such.

(3) Offerors shall comply with the instructions for the format and content of the proposals contained herein; proposals that do not comply may be considered unacceptable and may be determined to be ineligible for award.

(4) In accordance with COMSCINST 4490.1C, Qualification Requirements for Items Critical to Safety on Vessels Assigned to Military Sealift Command, for ship critical safety items, MSC shall enter into contracts only with sources qualified to produce and/or service such items. Requests for qualification or offers received from an unapproved source are referred to visit https://www.msc.usff.navy.mil/Business-Opportunities/Contracts/Qualification-for-Items-Critical-to-Shipboard-Safety-on-MSC-Vessels/ where the offeror or vendor can submit a request for qualification to the Design Control Activity (DCA). If an offeror or vendor is unable to obtain qualification standards before the date specified for award of the contract, then the offeror or vendor will not have met a term and condition under this proposed contract. It is a term and condition under this solicitation and resultant contract that offerors and future contractors are either an Original Equipment Manufacturer (OEM), OEM authorized vendor, or MSC DCA qualified non-OEM offeror/vendor.

PROPOSAL CONTENT:

The proposal should contain the following items in addition to other information required by this solicitation. The cover page should indicate the following:

· Request for Proposal (RFP) Number

· Name and Address of Offeror, Cage Code, DUNS, and applicable TAX I.D Number (TIN)

· Point of Contact name, telephone number, and email address

· Proposal validity of 120 days following the solicitation closing date

· A statement specifying the extent of agreement with all terms, conditions, and provisions included in the solicitation and agreement to furnish any or all services upon which prices are offered The proposal shall consist of the following volumes:

Volume I: Factor 1 – Price Volume II: Small Business Subcontracting Plan

Proposal Page Limitations:

Volume I: Factor 1 – Price

The price proposal shall include the completed solicitation documents. The price proposal shall include all elements of price and such other information considered appropriate to support the Offeror’s proposal.

The pricing information shall be completed in accordance with the following:

(a) A complete and signed Standard Form 1449, “Solicitation/Contract/Order for Commercial Items” and executed copy of any amendments, if applicable.

(b) Unless completed in the System for Award Management (SAM), the Offeror shall complete the representations and certifications contained in the solicitation. If the Offeror has completed all of the representations and certifications required by this solicitation in the System for Award Management (SAM), then the Offeror need not submit the hardcopy representations and certifications.

(c) For the purpose of preparing a price proposal, the Offeror shall assume that the period of performance consists of a five-year ordering period. Offerors shall use the periods established in the Schedule.

(d) This volume shall also include a completed Exhibit A - Rate Table, submitted in accordance with the following instructions. The price for the services shown in this spreadsheet shall include all fully burdened labor required to provide the services. The firm-fixed-price annual rates proposed in the pricing spreadsheet will be incorporated into the resultant contract.

(e) Exhibit A - Rate Table represents the Government’s estimate of labor hours, labor categories, and parts required for the subject requirement. This is not a labor hour or level of effort type contract and this estimate is provided to help the Offeror price their proposal. The Offeror may propose different labor categories, parts, and/or quantities of either; however, the Offeror shall clearly indicate its proposed differences and provide supporting written rationale.

(f) Travel is anticipated; however, travel will be priced at the task order level.

(g) If applicable, the Offeror shall clearly detail any exceptions taken and the rationale for the exceptions taken to the RFP or its amendments. Please note that exceptions taken to the RFP may render the Offeror’s proposal unacceptable to the Government.

The price section is not page-limited, but is strictly limited to the requested information and supporting documentation only. No price information shall be contained in any other part of the proposal.

Volume II: Small Business Subcontracting Plan

(a) Large business offerors shall submit a Small Business Subcontracting Plan in accordance with FAR 19.704, Subcontracting plan requirements. Offerors are permitted to submit a master subcontracting plan or commercial plan so long as it is created in accordance with FAR 19.701 and FAR 19.704(b) or FAR 19.704(d). Subcontracting Plans are not required from small business offerors. It is the goal of this solicitation that prime contractors subcontract with small businesses to the maximum extent practicable. For large prime contractors, the Small Business Subcontracting Plan goals shall be expressed in terms of whole dollars and percentages based on total planned subcontracting dollars. Of the total planned subcontracting dollars, the Small Business Subcontracting Plan shall include goals for Small Businesses, Small Disadvantaged Businesses, Woman-Owned Small Businesses, HUBZone Small Businesses, Veteran-Owned Small Businesses and Service-Disabled Veteran-Owned Small Business.

(b) In the event that the offeror has determined that there are no subcontracting possibilities, the offeror shall describe in detail why this determination has been presented to the Contracting Officer.

(End of Summary of Changes) image1.wmf