RMF_Solicitation_N6449819R4078_Amendment_0001.pdf

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER (Type or print)

30-105-04EXCEPTION TO SF 30

APPROVED BY OIRM 11-84

STANDARD FORM 30 (Rev. 10-83) Prescribed by GSA

FAR (48 CFR) 53.243

(1) The purpose of this amendment is to revise the solicitation based on questions submitted by vendors.

(2) This amendment also extends the proposal due date as stated in Section A.

1. CONTRACT ID CODE PAGE OF PAGES

J 1 21

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

16C. DATE SIGNED

BY 19-Sep-2019

16B. UNITED STATES OF AMERICA15C. DATE SIGNED15B. CONTRACTOR/OFFEROR

(Signature of Contracting Officer)(Signature of person authorized to sign)

8. NAME AND ADDRESS OF CONTRACTOR (No., Street, County, State and Zip Code) X N6449819R4078

X 9B. DATED (SEE ITEM 11)

12-Sep-2019

10B. DATED (SEE ITEM 13)

9A. AMENDMENT OF SOLICITATION NO.

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

X The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offer X is extended, is not extended.

Offer must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended by one of the following methods:

(a) By completing Items 8 and 15, and returning 1 copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted;

or (c) By separate letter or telegram which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN

REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by telegram or letter, provided each telegram or letter makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

12. ACCOUNTING AND APPROPRIATION DATA (If required)

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS.

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE

CONTRACT ORDER NO. IN ITEM 10A.

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation date, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(B).

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority)

E. IMPORTANT: Contractor is not, is required to sign this document and return copies to the issuing office.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

10A. MOD. OF CONTRACT/ORDER NO.

2. AMENDMENT/MODIFICATION NO. 5. PROJECT NO.(If applicable)

6. ISSUED BY

3. EFFECTIVE DATE

19-Sep-2019

CODE

NAVAL SURFACE WARFARE CENTER PHILA

CODE 0232, MEGAN MCMULLEN

215-897-2876, MEGAN.MCMULLEN@NAVY.MIL

5001 SOUTH BROAD STREET

PHILADELPHIA PA 19112

N64498 7. ADMINISTERED BY (If other than item 6)

4. REQUISITION/PURCHASE REQ. NO.

CODE

See Item 6

FACILITY CODECODE

EMAIL:TEL:

N6449819R4078

SECTION SF 30 BLOCK 14 CONTINUATION PAGE

SUMMARY OF CHANGES

SECTION A - SOLICITATION/CONTRACT FORM

The required response date/time has changed from 19-Sep-2019 05:00 PM to 24-Sep-2019 05:00 PM.

The following have been modified:

NOTES TO OFFERORS

1) This acquisition is being issued as a Service-Disabled Veteran-Owned Small Business Set Aside, Competitve requirement.

2) Award of a Firm Fixed Price (FP) contract is anticipated.

3) The POCs for this action are:

Megan McMullen Contract Specialist Megan.McMullen@navy.mil 215-897-2876

Gregory Kaiser Contracting Officer gregory.kaiser@navy.mil 215-897-7215

SECTION C - DESCRIPTIONS AND SPECIFICATIONS

PERFORMANCE WORK STATEMENT

Statement of Work (SOW) for

Risk Management Framework (RMF) Support to Code 104

1.0 INTRODUCTION

1.0.1 The Naval Surface Warfare Center Philadelphia Division (NSWCPD) is a Department of Defense entity responsible for research and development, test and evaluation, engineering and fleet support organization for the Navy’s ships, submarines, military watercraft and unmanned vehicles. This requirement is for NSWCPD’s Information Technology Operations Division Code 104.

1.0.2 This purchase order is for non-personal services. It does not create employment rights with the U.S. Government whether actual, inherent, or implied.

1.0.3 Government / Contractor Relationship

(a) The services to be delivered under this purchase order are non-personal services and the parties recognize and agree that no employer-employee relationship exists or will exist under the purchase order between the Government and the Contractor's personnel. Therefore, it is in the best interest of the Government to provide both parties a full understanding of their respective obligations.

(b) The Contractor employees shall identify themselves as Contractor personnel by introducing themselves or being introduced as Contractor personnel and displaying distinguishable badges or other visible identification for meetings with Government personnel. In addition, Contractor personnel shall appropriately identify themselves as Contractor employees in telephone conversations and in formal and informal written correspondence.

(c) Contractor personnel under this purchase order shall not engage in any of the inherently Governmental functions listed at FAR Subpart 7.5 or DFARS Subpart 207.5.

(d) Employee Relationship:

1) The services to be performed under this purchase order do not require the Contractor or its personnel to exercise personal judgment and discretion on behalf of the Government. Rather the Contractor's personnel will act and exercise personal judgment and discretion on behalf of the Contractor.

2) Rules, regulations, directives, and requirements that are issued by the U. S. Navy and NSWCPD under its responsibility for good order, administration, and security are applicable to all personnel who enter a Government installation or who travel on Government transportation.

This is not to be construed or interpreted to establish any degree of Government control that is inconsistent with a non-personal services contract.

(e) Inapplicability of Employee Benefits: This purchase order does not create an employer-employee relationship. Accordingly, entitlements and benefits applicable to such relationships do not apply.

(f) Notice. It is the Contractor's, as well as the Government's, responsibility to monitor purchase order activities and notify the Contracting Officer if the Contractor believes that the intent of this Section has been or may be violated.

1) The Contractor shall notify the Contracting Officer in writing via letter or email within three (3) calendar days from the date of any incident that the Contractor considers to constitute a violation of this Section. The notice should include the date, nature, and circumstances of the conduct; the name, function, and activity of each Government employee or Contractor official or employee involved or knowledgeable about such conduct; identify any documents or substance of any oral communication involved in the conduct; and the Contractor's estimated date when, absent a response, cost, schedule or performance will be impacted.

2) The Contracting Officer will, within five (5) calendar days after receipt of notice, respond to the notice in writing. In responding, the Contracting Officer will either:

(i) Confirm the conduct is in violation and when necessary direct the mode of further performance,

(ii) Countermand any communication regarded as a violation,

(iii) Deny that the conduct constitutes a violation and when necessary direct the mode of further performance, or

(iv) In the event the notice is inadequate to make a decision, advise the Contractor what additional information is required, and establish the date by which it should be furnished by the Contractor.

1.1 BACKGROUND

The purpose of this Purchase Order is to provide Cybersecurity support to NSWCPD’s Code 104 for the creation of Risk Management Framework (RMF) packages to obtain RMF/DoD Information Assurance Certification & Accreditation Process (DIACAP) Authorization To Operate (ATO). Cybersecurity support consists of creating and maintaining A&A packages and artifacts; creation and maintenance of the package record in the RMF system of record (currently eMASS), recommendation of security posture improvements, remediation or mitigation of Category I and Category II vulnerabilities (as directed by the system representatives), and Subject Matter Expertise in RMF life cycle management. The contractor shall coordinate with system representatives via all avenues necessary to facilitate and acquire the required data to support this action. ATO is obtained through validated test results, security controls assessor review, and authorization official endorsement.

1.2 SCOPE OF WORK

1.2.1 This requirement is for obtaining an ATO for four medium-sized information systems (IS), defined as consisting of up to five operating systems, up to ten servers, and up to 200 workstations. Contractor shall fulfill assignments in accordance with the framework of RMF to certify and accredit new ISs, and re-accredit existing system packages for the ISs as follows; the ISs included will not have a requirement for any external penetration testing.

Two (2) RDT&E Zone D Information System, processing Classified and Naval Nuclear Propulsion Information (NNPI). All assets are located within the NSWCPD campus.

Two (2) Unclassified, Internet-facing Information Systems located in DoD or the Amazon Web Services FEDCLOUD data center operating under expired authorizations.

1.2.2 The Contractor will be provided accounts to access and utilize the Navy Enterprise Mission Assurance Support Service (eMASS) and fulfill the ISO and ISSE roles in eMASS throughout the package creation, validation, and ATO maintenance support processes. Instructions on how to access eMASS will be provided to the Contractor selected to perform this TO.

1.2.3 The Government will provide separate qualified Navy Validators outside of this contract to perform the A&A package validation.

2.0 APPLICABLE DOCUMENTS

2.1 DoD Instruction 8510.01, Subj: Risk Management Framework (RMF) for DoD Information Technology (IT)

2.2 Certification and Accreditation (C&A) Requirements for DoD-wide Managed

Enterprise Services Procurements, DoD Chief Information Officer memorandum

2.3 DON CIO Memo 01-09, Information Assurance Policy for Platform Information

Technology

2.4 NAVSEAINST 9400.2, Implementation of Naval Sea Systems Command (NAVSEA)

Afloat Information Assurance (IA) Governance and Guidance

2.5 DoDI 8500.01, Cybersecurity

2.6 NAVSEAINST 5230.2B, NAVSEA Cybersecurity Program

2.7 NIST 800-37, Guide for the Security Certification and Accreditation of Federal

Information Systems

2.8 NIST Special Publication 800-53, Security and Privacy Controls for Federal

Information Systems and Organizations

2.9 Navy Certification Agent Qualification Standards and Registration Guidebook

2.10 DoDD 8140.01, Cyberspace Workforce Management, 11 Aug 2015

2.11 DoD 8570.01-M Change 4, Information Assurance Workforce Improvement Program, 10 Nov 2015

2.12 United States Navy Risk Management Framework Process Guide (RPG)

The Contractor shall reference and utilize the latest version available when performing tasks within this purchase order.

3.0. REQUIREMENTS – NSWCPD requires RMF package creation and RMF/DIACAP ATO maintenance support; Contractor shall re-accredit Information Systems (IS) that have expired authorizations, and accredit new ISs, as indicated at Section 1.2. The ISs included will not have a requirement for any external penetration testing. The Contractor shall perform all requirements to achieve an ATO for the specified systems. All performance shall be in accordance with all NIST, DoD, DoN, NAVSEA, and NSWCPD policies, processes, and procedures, and all applicable commercial standards and regulations. In the event RMF is replaced by a new cybersecurity standard, the scope of required services in this SOW shall continue in accordance with the requirements identified in the new standard. To support this requirement, Contractor shall:

3.1 Adhere to the Navy-specific processes to identify and properly manage the risk of Navy

Information Technology (IT) in accordance with the DoD Instruction (DoDI) 8510.01, Risk Management Framework (RMF) for DoD Information Technology (IT), taking into consideration Navy–unique operational and environmental demands detailed in the Department of Navy Risk Management Process Guide (RPG) and all superseding updates to the document; Contractor shall follow the published NAVSEA Business Rules, should any conflict between these rules exist they will be resolved by the Government Information System Security Manager (ISSM).

3.2 Collaborate with the designated Authorizing Official (AO) and/or their representatives for the packages throughout all steps of the RMF process.

3.3 Develop and maintain documents as required by DoD, DON, NAVSEA, NSWCPD, and Navy Enterprise Mission Assurance Support Service (eMASS). The Contractor shall provide artifacts to complete authorization and re-authorization based on each package’s unique requirements.

3.4 Scan for and apply remediation in accordance with the Defense Information Security Agency

(DISA) Security Technical Implementation Guides (STIGs), Security Requirements Guide (SRG), Security Readiness Review (SRR), and generate DISA checklists and/or artifacts;

Contractor shall notify the Government prior to implementation of the tools and scripts (and their capabilities and functionality) to be utilized in remediation or maintenance performed on the system, and document changes and updates applied to System and Network-documentation.

3.5 Analyze, remediate or mitigate, and document vulnerabilities in eMASS by:

3.5.1 Performing vulnerability analysis;

3.5.2 Remediating vulnerabilities posing a corresponding risk to operations (e.g., remove or quarantine); and

3.5.3 Documenting residual risks into Plan of Action and Milestones (POA&Ms), Risk

Assessment Reports (RARs), and other applicable documents.

3.6 Conduct vulnerability scanning of ISs utilizing Assured Compliance Assessment Solution (ACAS) and Security Content Automation Protocol (SCAP) and remediate system assets to acceptable levels designated by the ISSM. The Contractor shall create all documentation to prove compliance with requirements utilizing eMASS. The Contractor is not expected to provide any scanning tools or software licenses for this contract. The Contractor scans shall either include full authorization boundaries or sampling of authorization boundaries, as directed by the Government.

3.7 Register new systems in the Vulnerability Remediation Asset Manager (VRAM) database.

Import ACAS scans and maintain the VRAM database for all required ISs in accordance with DoD, DON, and NAVSEA requirements.

3.8 Update the relevant authorization process security documents and artifacts including, but not limited to: system categorization, Security Assessment Plan (SAP), Security Assessment Report (SAR), Privacy Impact Assessment (PIA), System Level Continuous Monitoring (SLCM), hardware/software lists, network diagrams, and POA&M updates based on the results of the continuous monitoring process for all assigned ISs.

3.9 Perform recurring real-time reviews of system artifacts for the ISs in conjunction with maintenance and change management activities.

3.10 Report the security status of the ISs (including the effectiveness of security controls employed within and inherited by the system) to the Authorizing Official – through the Command ISSM – and other appropriate organizational officials in accordance with the monitoring strategy, including, but not limited to, monthly status updates.

3.11 Review the reported security status of the ISs (including the effectiveness of security controls employed within and inherited by the ISs) on an ongoing basis, in accordance with the monitoring strategy, to determine whether the risk to operations, organizational assets, individuals, or other organizations remains acceptable.

3.12 Provide hardware and software data gathered during the ATO package creation to the

RDT&E Inventory Manager.

3.13 Validate each IS’s applicable security control (SC) families alongside Government provided independent validators with all applicable SCs for an assigned DoN IS, including developing the appropriate test procedures, as directed; executing the test procedures; and accurately documenting the test results. The Contractor shall not validate any packages that they have created in order to prevent a conflict of interest. The Contractor shall update the package documents for the assigned ISs. (The registration of NSWCPD ISs in the DoD Information Technology Portfolio Repository – Department of the Navy (DITPR-DON) and Department of the Navy Applications Database Management System (DADMS) is outside the scope of this TO).

3.14 Evaluate all vulnerabilities identified during the A&A processes and recommend mitigation measures for reducing or eliminating identified risk items.

3.15 Ensure that all CS requirements have been addressed in the A&A test and validation procedures.

3.16 Coordinate with the ISSE and the ISO equivalents to NSWCPD’s Information System

Security Officer (ISSO) to determine fixes or mitigation for weaknesses and to determine the level of revalidation testing that is necessary if immediate fixes are not applied.

3.17 Create POAMs and RARs documenting vulnerability test results and submit the POAMs and RARs for accreditation via eMASS.

3.17.1 Perform POAM reconciliation of the eMASS POAM as defined by system categorization or by specific ATO requirements.

3.18 Prepare ISs for the authorization and re-authorization process by making them compliant;

to include implementation of DISA’s STIG. The Contractor shall patch system assets to current acceptable levels; provide additional artifacts to complete accreditation and re-accreditation packages based on each package’s unique requirement; this may include System Security Plan (SSP), Risk Assessment (RA), Incident Response Plan (IRP), Continuity of Operations Plan (COOP), Configuration Management Plan (CMP), and Security Assessment Report (SAR), to complete the package.

3.19 Assist the Government with determining the security impact of proposed or actual changes to the ISs and their environment of operation.

3.20 Assess, document, and report the technical, management, and operational security controls employed within, and inherited by, the ISs in accordance with NSWCPD’s monitoring strategy.

3.21 Perform monthly remediation actions, to include patching and implementing STIG requirements.

3.22 Perform all DISA STIG requirements, manual security checklist items, and Security

Content Automation Protocol (SCAP) scans as required by the DISA release schedule for all assigned IS assets and make corresponding updates to the POAM.

3.23 Address all conditions in ATO letters.

3.24 Update the relevant DIACAP security documents and artifacts (or, as applicable, RMF security documents and artifacts) including, but not limited to, the RDT&E Certification & Accreditation Plan (CAP), PIT Enclosure 1, RMF security plan, security assessment report, and POAM based on the results of the continuous monitoring process for all assigned ISs.

3.25 Report the security status of the ISs (including the effectiveness of security controls employed within and inherited by the system) to the authorizing official and other appropriate organizational officials in accordance with the monitoring strategy, including, but not limited to, monthly status updates.

3.26 Upon receipt of ATO, provide the applicable NAVSEA/Navy Certification Letter evidencing successful execution.

4. DATA REQUIREMENTS - CDRLs shall be delivered electronically, unless otherwise stated.

4.1 Contract Status Report (CDRL A001)

4.1.1 This report shall reflect both prime and Subcontractor data if applicable at the same level of detail.

4.1.2 This requirement applies to all tasks within Section 3.0.

4.2 Contractor’s Personnel Roster (CDRL A002)

4.2.1 The Contractor’s format is acceptable, the Government’s approval is required from the COR. This report shall reflect both prime and subcontractor data if applicable at the same level of detail.

5. SECURITY REQUIREMENTS

The Contractor is responsible for completing all required Government mandated training to maintain security and network access to government sites and IT systems to include but not limited to: Antiterrorism Level 1 Awareness; DoD Cyber Awareness Challenge; Combatting Human Trafficking; Records Management in the DON: Everyone's Responsibility; Training and Readiness: The Active Shooter; Constitution Day; NAVSEA Introduction to Controlled Unclassified Information; Operations Security (OPSEC); NAVSEA Counterintelligence Training; Privacy and Personally Identifiable Information (PII) Awareness Training; and NAVSEA Physical Security training. Certificates of successful completion shall be sent to the COR and as otherwise specified in the contract.

In accordance with SECNAV M-5510.30 Chapters 5 and 6, all Contractor personnel that require access to Department of Navy (DON) information systems and/or work on-site are designated Non-Critical Sensitive/IT-II positions, which require an open investigation or favorable adjudicated National Agency Check (NACLC) by the Industrial Security Clearance Office (DISCO). Investigations should be completed using the SF-86 Form and the SF-87 finger print card. An interim clearance can be granted by the company Security Officer and recorded in the Joint Personnel Adjudication System (JPAS). An open or closed investigation with a favorable adjudication is required prior to issuance of a badge providing access to NSWCPD sites and buildings. If an unfavorable adjudication is determined by DISCO all access will terminated. For Common Access Card (CAC) card you must have a completed investigation that has been favorably adjudicated or a final security clearance. A CAC Card may be issued to contractors who have an interim security clearance.

Contractor personnel that require a badge to work on-site at one of the NSWCPD sites must provide an I-9 form to verify proof of citizenship. The I-9 form should be signed by the company Facility Security Officer or the company Human Resource Department. In addition to the I-9 form, Contractors shall also bring their birth certificate, current United States Passport or naturalization certificate and state issued ID to the NSWCPD Security Officer at the time of badge request to verify citizenship. Finally, contractors shall supply a copy of their OPSEC Training Certificate or other proof that the training has been completed.

A Facility Access Determination (FAD) will be completed on any contractor that does not have a favorable adjudicated investigation in JPAS and is requesting swipe/non-swipe access to our buildings in excess of 120 days. Any contractor that has unfavorable information that has not been favorably adjudicated by Department of Defense Central Adjudication Facility (DOD CAF) will not be issued a badge.

This effort may require access to classified information up to the _SECRET_ level. No classified data will be generated or stored by the Contractor. The Contractor is required to have and maintain a _SECRET_ clearance. The requirements of the attached DD Form 254 apply.

The Contractor shall appoint a Facility Security Officer (FSO), who shall (1) be responsible for all security aspects of the work performed under this contract, (2) assure compliance with the National Industrial Security Program Operating Manual (NISPOM) (DOD 5220.22-M), and (3) assure compliance with any written instructions from the NSWCPD, Security Office Code 105.

The Prime Contractor shall:

(1) Forward signed copies of DD254s provided to subcontractors to the Naval Surface Warfare Center Philadelphia Division (NSWCPD), ATTN: Security.

(2) Direct the subcontractor to obtain approval, through the prime Contractor, for the public release of information received or generated by the sub through the prime Contractor.

(3) Submit the subcontractor request for public release through the technical point of contact identified on the DD 254.

All contractor personnel performing work on this effort shall be U.S. citizens.

Additional information related to the facility clearance process can be obtained by visiting www.dss.mil or http://www.dss.mil/isec/pcl_index.htm.

6. PLACE OF PERFORMANCE

6.1 Performance will primarily occur at the following government sites: NSWCPD, Philadelphia, PA 19112. Contractor-personnel may also work at the Contractor’s location.

6.1.1 Government will provide space for contractor-personnel under this purchase order.

6.1.2 The specific location(s) will be provided at time of award of the purchase order. The Contractor shall provide a list of employees who require access to these areas, including standard security clearance information for each person, to the Contracting Officer and Robert (BJ) Wyatt, Jr., Robert.wyatt@navy.mil no later than three business days after the date of award. The work space provided to the Contractor personnel shall be identified by the Awardee, with appropriate signage listing the company name and individual Contractor employee name.

6.1.3 Access to Government buildings at Naval Surface Warfare Center Philadelphia Division is from 0600 to 1800 Monday through Friday, except Federal holidays. Normal work hours are from 0600 to 1800, Monday through Friday. Contractor employees shall be under Government oversight at all times. Government oversight requires that a Government employee be present in the same building/facility whenever Contractor employee(s) are performing work under this purchase order. Contractor-personnel are not allowed to access any Government buildings at NSWCPD outside the hours of 0600 to 1800 without the express approval of the Procuring Contracting Officer (PCO).

6.1.4 Early Dismissal and Closure of Government Facilities

When a Government facility is closed and/or early dismissal of Federal employees is directed due to severe weather, security threat, or a facility related problem that prevents personnel from working, onsite Contractor personnel regularly assigned to work at that facility should follow the same reporting and/or departure directions given to Government personnel. The Contractor shall not direct charge to the contract for time off, but shall follow its own company policies regarding leave. Non-essential Contractor personnel, who are not required to remain at or report to the facility, shall follow their parent company policy regarding whether they should go/stay home or report to another company facility. Subsequent to an early dismissal and during periods of inclement weather, onsite Contractors should monitor radio and television announcements before departing for work to determine if the facility is closed or operating on a delayed arrival basis.

When Federal employees are excused from work due to a holiday or a special event (that is unrelated to severe weather, a security threat, or a facility related problem), on site Contractors will continue working established work hours or take leave in accordance with parent company policy. Those Contractors who take leave shall not direct charge the non-working hours to the purchase order. Contractors are responsible for predetermining and disclosing their charging practices for early dismissal, delayed openings, and closings in accordance with the FAR, applicable cost accounting standards, and company policy. Contractors shall follow their disclosed charging practices during the purchase order period of performance, and shall not follow any verbal directions to the contrary. The PCO will make the determination of cost allowability for time lost due to facility closure in accordance with FAR, applicable Cost Accounting Standards, and the Contractor's established accounting policy.

7.0 SPECIAL REQUIREMENTS

Cyber Security Workforce (CSWF) Program Requirements

In accordance with DoD 8570.01-M Change 4, Information Assurance Workforce Improvement Program. Contractor personnel performing CS functions must be designated as a member of the CSWF and meet qualification requirements for their duties, which may include both an CS baseline certification and operating system (OS)/Computing Environment (CE) certification requirement per below instructions:

a. Contractor personnel performing CS functions must meet the minimum CS baseline certification prior to performing services under this purchase order.

b. Upon commencement of performance of this purchase order, all Contractor personnel assigned to an IAM/IAT Level I-III position shall sign the Information System Privileged Access Agreement and Acknowledgement of Responsibilities statement.

7.1 Baseline Certification – The baseline certification is a security certification and is required for all CSWF members (all Information Assurance Technician (IAT) and Information Assurance Manager (IAM) levels) of the CSWF.

7.2 Continuing Professional Education (CPE) Requirements – As technology continuously advances, nearly all certifications expire or have continuing professional education (CPE) requirements. Both the baseline certifications and CE certifications may require continuous education. CPE requirements are not a direct Contractor cost to the Government. The Contractor is responsible for ensuring its personnel meet the qualification requirements for each personnel’s position on the contract and shall not invoice the Government for training, certification tests, or CPE requirements.

7.3 Contractor shall submit the roster of personnel who will work on this requirement, with evidence of compliance with CSWF qualification requirements, in accordance with CDRL A002.

SECTION G - CONTRACT ADMINISTRATION DATA

The following have been added by full text:

PAYMENT INSTRUCTIONS

The Contractor will be paid upon receipt of an ATO approval by the cognizant Authoring Official.

SECTION L - INSTRUCTIONS, CONDITIONS AND NOTICES TO BIDDERS

INSTRUCTIONS

L.1 GENERAL INSTRUCTIONS

The Offeror shall submit all information required by this RFP and in the same format as outlined herein. Failure to comply with the requirements of the RFP may result in the Offeror being removed from consideration for award.

The Government does not assume the duty to search for data to cure problems it finds in proposals. Proposals shall be sufficiently detailed to enable Government evaluation board members to make a thorough evaluation and to arrive at a sound determination as to whether or not the prospective Offeror has a thorough understanding of the requirements and associated risks and is able, willing, and competent to devote the resources necessary to meet the requirements.

Pricing information should only be present in the Price Volume (and the Small Business Commitment Participation Document(SBPCD) if applicable).

No classified information shall be provided in any volume.

A “subcontractor” includes any person or entity other than the prime contractor (e.g., consultants, temporary purchased labor, or firms) who will furnish or furnishes any effort in connection with this prospective contract award.

A “major subcontractor” is considered to be any entity proposed to perform 30% or more of the total proposed contract value for the purposes of this solicitation.

L.1.2. SUBMISSION OF QUESTIONS AND COMMENTS

Offerors may submit questions, concerns, or request clarification of any aspect of this solicitation electronically as follows:

TO: Megan.McMullen@navy.mil CC: Gregory.Kaiser@navy.mil;

SUBJECT LINE: RMF Questions #N6449819R4078

The questions should include the page number and paragraph number or identifier which pertains to the Offeror’s question. Questions received without this information may not be answered. The deadline for receipt of questions is four (4) calendar days after date of solicitation issuance. Although every effort will be made, the Government makes no guarantee that questions received after this deadline will be answered. Acknowledgement of receipt of questions will not be made.

L.1.3. SOLICITATION CHANGES

Any changes or additional information (responses to questions, amendments, etc.) related to the solicitation will be made available only through the following website: http://www.fbo.gov. If this solicitation is amended, all terms and conditions that are not amended remain unchanged. Offerors shall provide proposals in response to any and all amendments to this solicitation by the date and time specified in the amendment(s). The cover letter /transmittal letter shall acknowledge receipt /response to the amendment version).

L.2. PROPOSAL FORMAT

Proposals shall be prepared on standard 8-1/2” by 11’ paper, set at single-spaced with 1” width spacing, 0” left and right indent and a single blank line before and after each paragraph. The font shall be Times New Roman with a font size of 12 throughout the document.

The Offeror’s company name, the solicitation number and the date of the proposal shall appear at the top of each page. Each page shall contain a footer that includes, at a minimum, the volume number, page number and, if applicable, restrictive legend (see FAR 52.215-1(e) (2)).

The Non Price Volumes of a Proposal shall not contain any reference to price. They should be written so that government personnel evaluating the proposal can arrive at a sound determination as to whether the proposal meets the requirements of this solicitation. To this end, the proposal shall be specific, detailed and complete as to clearly and fully demonstrate that the prospective Contractor has a clear understanding of the technical requirements contained in Section C of this solicitation. Statements such as "the Offeror understands", "will comply with the Statement of Work” "standard procedures will be employed"; "well known techniques will be used" and general paraphrasing of the Statement of Work are considered inadequate.

L.2.1. PAGE NUMBERS AND LIMITS

A page is defined as one sheet of paper with typing on one side. When information is contained on both sides of a single sheet of paper it will be counted as two pages and shall be numbered accordingly. Partial pages count as a full page. Foldouts may be used for diagrams, charts, or graphic material only that could not be depicted otherwise on standard 8-1/2” by 11” paper. Foldouts shall fold from left to right (sideways), shall not exceed 11” by 17” and shall count as two pages.

Specific page limitations are provided below in Table L.3. Pages that exceed the page count limit will not be evaluated by the Government. If the proposal exceeds the identified page limit, the Government will remove all pages exceeding the specified page count. Blank pages must contain only material pertinent to the page heading and marked "Intentionally Left Blank." All pages within a page limited volume shall be consecutively numbered, starting at page one, and shall not exceed the page limitation.

The following are not included in the page limitations:

a. Title/Cover pages

b. Tables of Contents

c. Glossaries of abbreviations and acronyms

d. Section J Attachments

L.2. INSTRUCTIONS FOR SOFT COPY PROPOSALS

Only Emailed proposals will be accepted.

Proposals shall be submitted to the following POC’s:

To: Contract Specialist: Megan.McMullen@navy.mil

CC: Contracting Officer: Gregory.Kaiser@navy.mil

L.3. PROPOSAL CONTENT AND ORGANIZATION

The proposal shall contain four (4) separate volumes with page limits identified as follows:

Volume Contents Electronic/Soft

Copies Page

Limits I. PROPOSAL DOCUMENTS 1 None

II. FACTOR 1 TECHNICAL 1 10

Subfactor A – Successful Authorization To Operate 1 5

Subfactor B – Cloud Systems Cybersecurity 1 5

III. FACTOR 2 PAST PERFORMANCE 1 5

IV. FACTOR 3 TOTAL EVALUATED COST/PRICE 1 None

L.3.1. VOLUME I: PROPOSAL DOCUMENTS

This volume is the Offeror’s contractual commitment, complete in every respect and ready for acceptance by the Government.

L.3.1.1 TRANSMITTAL/COVER LETTER

The Offeror’s proposal shall include a transmittal letter on the Offeror’s letterhead signed by an executive of the company who possesses authority to contractually bind the Offeror. The letter shall provide the name, title, phone number and e-mail address of the Offeror’s principal point of contact for the solicitation and identify those individuals authorized to negotiate with the Government and contractually bind the Offeror. The letter shall include the following information:

1. Reference the RFP number and acknowledge that it transmits an offer in response to the requirements as stated in the solicitation,

2. Identify all attachments and enclosures being transmitted as part of the response to the RFP,

3. List all subcontractors identified in the Offeror’s proposal

4. Shall state that the proposal is made without qualification or exception to any terms and conditions appearing in the solicitation; or if the Offeror takes any exceptions to solicitation, provide a full explanation. Each exception shall be referenced to the applicable paragraph or contract line item number.

Any exceptions made, and not clearly delineated here will not be considered or accepted. Any material exceptions to the RFP may render the proposal unacceptable and ineligible for award.

5. Statement that the proposal is valid for at least 180 calendar days after the date established for receipt of offers.

6. Provide the following information pertaining to the Offeror:

a. Commercial and Government Entity (CAGE) number,

b. Data Universal Numbering System (DUNs) Number,

c. Taxpayer Identification Number (TIN),

d. Address(es) of the location(s) at which the Offeror intends to perform the proposed effort,

e. Name, address and telephone number of the cognizant Defense Contract Audit Agency (DCAA), audit office,

f. Name, address and telephone number of the cognizant Defense Contract Management Agency

(DCMA) office,

g. If no Organizational Conflict of Interest exists, then the Offeror shall clearly state this in its cover letter

h. Names, titles, phone numbers and electronic addresses of persons authorized to negotiate on the

Offeror’s behalf with the Government in connection with this solicitation.

7. If the proposal contains a “contractor team arrangement” as defined in FAR 9.601, provide information that describes the contractor team arrangement to include any information that will help the Government understand the contractor team arrangement purpose and benefit.

L.3.2 VOLUME II: FACTOR 1 – TECHNICAL

1. Describe how the Offeror will provide qualified technical support for this solicitation in accordance with Section C, Statement of Work. The Offeror shall describe its approach towards executing its proposed solution, provide information on resources used, and give rationale for its proposed solution.

L.3.2.1 SUBFACTOR A –

Successful Authorization To Operation (ATO) for Department of Defense/Department of Navy Information Systems

- Offeror shall submit evidence of receiving successful Authorization To Operate for Department of Defense/Department of Navy information systems within the past two (2) years by submitting copies of the certification letters received for those systems.

L.3.2.2 SUBFACTOR B –

Cloud Systems Cybersecurity Offeror shall describe its working knowledge of, and experience with, Defense Information Security Agency Secure Technical Information Guides (STIG) and the ability to apply and demonstrate compliance with the STIGs for Information Systems for all Department of Navy-approved Operating Systems. Offeror shall describe its process to evaluate the potential/probability for making the computer unusable if a particular cyber hardening action is implemented. Offeror shall describe its process to recover from a catastrophic computer failure due to the application of a STIG or other cyber hardening action.

L.3.3 VOLUME III: FACTOR 2 – PAST PERFORMANCE

The Government will evaluate the Past Performance of the Prime Offeror and major subcontractors proposed. The past performance evaluation factor assesses the degree of confidence the Government has in an Offeror’s ability to supply products and services that meet users’ needs, based on a demonstrated record of performance.

List all relevant contracts performed within the last three (3) years, whether completed or not, including Federal, State and Local Government and private sector contracts.

For evaluation of Past Performance, the Government may use information from any sources available to it including, but not limited to, the Past Performance Information Retrieval System (PPIRS), Federal Awardee Performance and Integrity Information System (FAPIIS), and Electronic Subcontract Reporting System (eSRS). The Government may review relevant past performance information from other sources. Offerors should provide relevant past performance information for similar or related work that has taken place during the last three years. Each Offeror has the opportunity to provide in its proposal any information regarding its past performance of contracts similar to the Government's requirement that it would like the Government to consider. This includes information that the Offeror considers essential to the Government's evaluation or explanatory information of poor performance.

Offerors should provide the following information:

1. Contract Number

2. Customer/Agency

3. Contracting Officer /Technical Point of Contact/POC (names and telephone numbers)

4. Brief description of the scope of work

5. Contract type

6. Award Price

7. Total Labor-Hours of Effort

8. Delivery Dates

9. Contract Deliverables

To obtain information, the Government may contact the points of contact listed, however, the Government is not required to do so. The Government may contact references other than those provided by the Offeror to evaluate past performance.

L.3.4 VOLUME IV- FACTOR 3 - PRICE PROPOSAL

L.3.4.1 COMPLETED STANDARD FORM (SF) 33 SOLICITATION OFFER AND AWARD DOCUMENT

Offerors shall submit the Standard Form 33, “Solicitation, Offer and Award,” for the solicitation and each amendment, as applicable with blocks 12 through 18 completed/signed by the Offeror and signed by or an authorized party in Block 17. Any signatures required under this section shall be pen and ink.

L.3.4.2 COMPLETED RFP

This document shall be fully executed. The document shall not be embellished with any cover or binding. If the Offeror makes any qualifications to any provisions in the RFP, all such qualifications shall be listed in the transmittal letter to the proposal.

Offerors must fill in all areas of the RFP listed as Offeror fill-ins, including proposed price including unit price and each CLIN/SLIN in Section B. (Note - This information is exempt from the font and spacing requirements identified under Paragraph L.2.1).

Offerors shall submit signed Section K signed Representations, Certifications and Acknowledgements and System for Award Management (SAM). Offerors shall ensure that Representations and Certifications in SAM are current in the Online Representations and Certifications (ORCA) database at www.SAM.gov.

Each Offeror is required to submit a Price Volume for all priced CLINs.

L.3.4.3 PRICE VOLUME

The Cost Volume shall contain the following Sections:

• SECTION I TOTAL PRICE SUMMARY

• ANY SECTION II SUPPORTING PRICE DATA

SECTION I TOTAL COST SUMMARY

The total contract amount is included in Section B. CLINs 0001 and 0002 are established as firm-fixed price.

CLINs 0001 and 0002 (FFP), 0003 and 0004 (NSP-Technical Data): No cost information required.

The proposed price shall be provided in the format included as Section B. If only one offer is received, the Contrating Officer reserves the right to require other than certified cost and pricing data.

SECTION M - EVALUATION FACTORS FOR AWARD

EVALUATION

EVALUATION OF PROPOSALS

M.1. BASIS FOR AWARD

The Government will utilize the subjective Tradeoff source selection process. This process allows for a tradeoff between non-price factors and cost/price, and allows the Government to accept other than the lowest priced proposal or other than the highest technically rated proposal to achieve a best value contract award. The basis for award of a contract as a result of this solicitation will be an integrated assessment by the Contracting Officer of the results of the evaluation based on the evaluation factors and their importance as indicated below. The integrated assessment will include consideration of the strengths and weaknesses of the proposals. Ultimately, the source selection decision will take into account the Offeror's capability to meet the requirements of this solicitation on a timely and cost effective basis. The Government reserves such right of flexibility in conducting the evaluation as is necessary to assure placement of a contract is in the Government's best interest. Accordingly, the Government may award to other than the lowest priced Offeror, or other than the Offeror with the highest evaluation rating.

The contract resulting from this solicitation will be awarded to that responsible Offeror whose offer, conforming to the solicitation, in the Government’s estimation, provides the greatest overall benefit in response to the requirement.

M.2 RELATIVE IMPORTANCE OF EVALUATION FACTORS

Factor (1) Technical, Factor (2) Past performance, and Factor (3) Total Evaluated Cost (TEC)/price are listed in descending order of importance. Within the Technical Factor, the “Successful Authorization To Operate” and “Cloud Systems Cybersecurity” Sub-Factors are in descending order of importance. The Subfactor of “Successful Authorization To Operate” will be rated on an acceptable/unacceptable basis. All evaluation factors other than Total Evaluated Price (TEP), when combined, are significantly more important than total evaluated cost or price. However, when the non-cost/price factors are rated more equally between Offerors, Total Evaluated Price (TEP) becomes more of a deciding factor in making the best value determination.

M.3 EVALUATION APPROACH

FACTOR 1 – TECHNICAL

The Government will evaluate the effectiveness of each Offeror's technical approach to perform the requirements in the solicitation. Offerors who demonstrate mature and effective technical processes may receive a higher rating.

SUBFACTOR A. Successful Authorization To Operate

Offeror will be evaluated on its evidence of successful Authorization To Operate for Department of Defense/Department of Navy information systems. Offeror must demonstrate that it has successfully obtained Authorization To Operate for two (2) DoD/DoN information systems within the past two (2) years.

SUBFACTOR B. Cloud Systems Cybersecurity

Offeror will be evaluated on its understanding and knowledge of the RMF Process, and how detailed and useful its proposed actions will be towards completing RMF accreditation packages for Cloud Systems.

Factor 1 & Subfactor B, Rating Table Table - Combined Technical/Risk Ratings

Rating Description Outstanding Proposal indicates an exceptional approach and understanding of the requirements and contains multiple strengths, and risk of unsuccessful performance is low.

Good Proposal indicates a thorough approach and understanding of the requirements and contains at least one strength, and risk of unsuccessful performance is low to moderate.

Acceptable Proposal meets requirements and indicates an adequate approach and understanding of the requirements, and risk of unsuccessful performance is no worse than moderate.

Marginal Proposal has not demonstrated an adequate approach and understanding of the requirements, and/or risk of unsuccessful performance is high.

Unacceptable Proposal does not meet requirements of the solicitation, and thus, contains one or more deficiencies, and/or risk of unsuccessful performance is unacceptable. Proposal is unawardable.

Subfactor A, Rating Table

Rating Description

Acceptable Proposal meets requirements of the solicitation.

Unacceptable Proposal does not meet requirements of the solicitation.

FACTOR 2 – PAST PERFORMANCE

The Past Performance Evaluation is an assessment of the Offeror’s probability of meeting the solicitation requirements.

There are (3) three aspects to the past performance evaluation: Recency, relevancy (including context of data), and quality (including general trends in Contractor performance and source of information). The first is to evaluate the recency of the Offeror’s past performance. Recency is considered work performed within the past (3) three years.

The second is to determine how relevant a recent effort accomplished by the Offeror is to the effort to be acquired through the source selection. Common aspects of relevancy include, but are not limited to, the following: similarity of product/service/support, complexity, dollar value, contract type, use of key personnel (for services), and extent of subcontracting/teaming. With respect to relevancy, past performance of greater relevancy will typically be a stronger predictor of future success and have more influence on the past performance confidence assessment than past performance of lesser relevance. The third aspect of the past performance evaluation is to establish the overall quality of the Offeror’s past performance (see FAR 15.304(c)(2)) these are combined to establish one performance confidence assessment rating for each Offeror. The past performance evaluation conducted in support of a current source selection does not establish, create, or change the existing record and history of the Offeror’s past performance on past contracts; rather, the past performance evaluation process gathers information from customers on how well the Offeror performed those past contracts.

Past Performance…