Combined_Synopsis_-_VAPT_MAINTNCE.pdf

Solicitation OS240944 Metasploit Professional Subscription model and Metasploit Professional Certified Training

(i) This is a combined synopsis/solicitation for commercial items prepared in accordance with the format in Subpart 12.6, as supplemented with additional information included in this notice.

This announcement constitutes the only solicitation; proposals are being requested and a written solicitation will not be issued.

(ii) The solicitation number is OS240944

(iii) This solicitation and incorporated provisions and clauses are those in effect through Federal Acquisition Circular 2005-99

(iv) The corresponding NAICS code is 541519

(v) List of contract line item number(s) and items, quantities and units of measure

(vi) Description of Requirement –

The U.S Department of Health and Human Services (HHS), OCIO’s office has a requirement to procure Metasploit Professional Subscription model and Metasploit Professional Certified Specialist training to be delivered remotely.This is a brand Name only requirement.

(vii) Period of Performance is from Date of Award to 12 months

(viii) The provision at FAR 52.212-1, Instructions to Offerors -Commercial Items (Oct 2018), applies to this acquisition.

(ix) The provision at FAR 52.212-2, Evaluation – Commercial Items (OCT 2014), applies to this acquisition. The Government will award a contract resulting from this synopsis/solicitation to the responsible offeror who provides the lowest price and is technically acceptable (LPTA).

(x) Offerors are to include a completed copy of the provision at FAR 52.212-3, Offeror Representations and Certifications – Commercial Items (AUG 2018), with its offer or acknowledge its listing in the System for Award Management (SAM) website.

Part# Description QTY Unit Price

Total Price

License Cobalt Strike License: 12 months from Date of Award

RMSPROSUB5U Metasploit Pro Subscription License 5 Users

RMSPPROSUB2U Metasploit Pro Subscription License 2 Users

Total

(xi) The clause at FAR 52.212-4, Contract Terms and Conditions - Commercial Items (Oct 2018) applies to this acquisition.

(xii) The clause at FAR 52.212-5, Contract Terms and Conditions Required to Implement Statutes or Executive Orders -- Commercial Items (Aug 2019), applies to this acquisition. The Contracting Officer has indicated the following clauses listed in paragraph (b) as applicable and are hereby incorporated by reference: (2) 52.203-13, Contractor Code of Business Ethics and Conduct (Oct 2015) (41 U.S.C. 3509); (3) 52.203-15, Whistleblower Protections under the American Recovery and Reinvestment Act of 2009 (Jun 2010) (Section 1553 of Pub L. 111-5) (Applies to contracts funded by the American Recovery and Reinvestment Act of 2009; (4) 52.204-10, Reporting Executive compensation and First-Tier Subcontract Awards (Oct 2016) (Pub. L. 109-282) (31 U.S.C. 6101 note); (8) 52.209-6, Protecting the Government’s Interest When Subcontracting with Contractors Debarred, Suspended, or Proposed for Debarment (Oct 2015) (31 U.S.C. 6101 note); (22) 52.219-28, Post Award Small Business Program Rerepresentation (Jul 2013) (15 U.S.C. 632(a)(2)); (25) 52.222-3, Convict Labor (JUN 2003);

(26) 52.222-19, Child Labor—Cooperation with Authorities and Remedies (Jan 2018) (E.O.

13126); (27) 52.222-21, Prohibition of Segregated Facilities (APR 2015); (28) (i) 52.222-26, Equal Opportunity (Sep 2016) (E.O. 11246); 30) (i) 52.222-36, Equal Opportunity for Workers with Disabilities (Jul 2014) (29 U.S.C. 793); (32) 52.222-40, Notification of Employee Rights Under the National Labor Relations Act (Dec 2010) (E.O. 13496); (42) 52.223-18, Encouraging Contractor Policies to Ban Text Messaging while Driving (Aug 2011) (E.O. 13513); (49) 52.225- 13, Restrictions on Certain Foreign Purchases (June 2008) (E.O.’s, proclamations, and statutes administered by the Office of Foreign Assets Control of the Department of the Treasury); (33)

(i) 52.222-50, Combating Trafficking in Persons (Mar 2015) (22 U.S.C. chapter 78 and E.O.

13627); (55) 52.232-33, Payment by Electronic Funds Transfer— System for Award Management (Jul 2013) (31 U.S.C. 3332); (59) 52.242-5, Payments to Small Business Subcontractors (Jan 2017) (15 U.S.C. 637(d)(12)).

(xiii) The following additional clauses are applicable to this acquisition: FAR 52.203-19 – Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements (Jan 2017);

FAR Prohibition on Contracting with Inverted Domestic Corporations (Nov 2015); FAR 52.232- 40, Providing Accelerated Payments to Small Business Subcontractors (Dec 2013).

The following Health and Human Services Acquisition Regulations (HHSAR) clauses apply to this acquisition: HHSAR 352.222–70, Contractor Cooperation in Equal Employment Opportunity Investigations; HHSAR 352.239–74, Electronic and Information Technology Accessibility. The following additional provisions are applicable to this acquisition: FAR 52.203-18 – Prohibition on Contracting with Entities that Require Certain Internal Confidentiality Agreements or Statements—Representation and HHSAR 352.239–73, Electronic and Information Technology Accessibility.

(xiv) Brand Name Justification

The Department of Health and Human Services (HHS), Office of the Chief Information Officer (OCIO) requires Cobalt Strike License. Metasploit gives HHS VAPT the ability to safely https://www.acquisition.gov/far/current/html/52_222.html#wp1147479 https://www.acquisition.gov/far/current/html/52_222.html#wp1147656 conduct real world attacks and train security teams how to spot and thwart threats targeting HHS cyber domains. Metasploit mimics real-world hacking techniques and provides deep insight into HHS diverse architecture. The time taken to complete the testing manually would be at a great cost to HSS and an even more tremendous loss of insight of HHS security posture. Metasploit enables HHS to conduct and analyze HHS systems within hours and test numerous vulnerabilities. Metasploit has the distinct capability to scan in multiple security domains simultaneously all while gathering the information in one location to provide trend analysis capabilities, dynamic reporting and deliver a full view of the web application security architecture.

This is a brand name justification for Metasploit Professional subscription model and Metasploit Professional Certified Specialist Training. An exhaustive product comparison was performed during the initial product acquisition phase. During that time it was found that the Metasploit solution demonstrated the best value.

(xv) DPAS – N/A

(xvi) Quotes are due on September 27, 2019 at 12:00 PM ET, electronically to the attention of LaShawn Haggins at lashawn.haggins@psc.hhs.gov

(xvii) Contact LaShawn Haggins, Contract Specialist at lashawn.haggins@psc.hhs.gov regarding the solicitation. Any inquiries must be emailed to the Contract Specialist, with “OS240944– Inquiries” in the subject line no later than September 25, 2019 at 4 PM ET.