QMAA-FK-160009-D_Amendment_002_SF30_08_19_2016.pdf

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT 1. CONTRACT ID CODE PAGE OF PAGES

1 6

2. AMENDMENT/MODIFICATION NO.

AMENDMENT #002

3. EFFECTIVE DATE

08/19/2016

4. REQUISITION/PURCHASE REQ. NO.

5. PROJECT NO. (IF APPLICABLE)

6. Issued By Code 7. ADMINISTERED BY (If other than Item 6) Code

LIGHT VEHICLES ACQUISITION

GSA/FAS/QMAAA

1800 F STREET NW; HUB 3400

WASHINGTON, DC 20405

8. Name and Address of Contractor (No., street, county, State and ZIP Code (x) 9A. AMENDMENT OF SOLICITATION NO.

QMAA-FK-160009-D

X 9B. DATED (SEE ITEM 11)

AUGUST 11, 2016

10A. MODIFICATION OF CONTRACT/ORDER NO.

10B. DATED (SEE ITEM 13)

CODE FACILITY CODE

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

X The above numbered solicitation is amended as set forth in item 14. The hour and date specified for receipt of Offers is extended X is not extended.

Offer's must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended, by one of the following methods:

(a) By completing Items 8 and 15, and returning __ONE___copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted;

or (c) By separate letter or telegram which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGEMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by telegram or letter, provided each telegram or letter makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

12. ACCOUNTING AND APPROPRIATION DATA (If required)

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS,

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

[ ] A. THIS CHANGE ORDER IS ISSUED PURSUANT TO : (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE CONTRACT ORDER

NO. IN ITEM 10A.

[ ] B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation date, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF :

[ ] C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF :

[ ] D. OTHER (Specify type of modification and authority)

E. IMPORTANT: Contractor is not, X is required to sign this document and return _ONE_ copies to the issuing office.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

Program: Wheelchair Accessible Light Vehicles Ordering Program

The above referenced solicitation QMAA-FK-160009-D is amended as follows:

1) Offerors should NOT propose option TLM on any line items. All offerors should input N/A in AutoBid for this optional equipment code on all applicable line items; AND

2) Delete the requirements from Section C.20 : CYBERSECURITY LANGUAGE FOR OBD DONGLE AND TELEMATICS PROTECTION FOR FACTORY AND AFTER-MARKET INSTALLED HARDWARE from the RFP; AND

3) Provide revised Attachment G7 – Schedule of Items - Item 888E; AND

4) Provide answers to questions received in response to the solicitation.

The POC for this amendment is Bryan Davis Keith at bryan.keith@gsa.gov or (703) 605-9283.

The solicitation citations are amended in accordance with the attached pages. All other terms and conditions remain unchanged.

Except as provided herein, all terms and conditions of the document referenced in item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER (Type or print) 16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

CONTRACTING OFFICER

15B. CONTRACTOR/OFFEROR 15C. DATE SIGNED 16B. UNITED STATES OF AMERICA 16C. DATE SIGNED

________________________________________ BY ______________________________________________

(Signature of person authorized to sign) (Signature of Contracting Officer)

NSN 7540-01-152-8070 30-105 STANDARD FORM 30 (REV. 10-83)

PREVIOUS EDITION UNUSABLE Prescribed by GSA, FAR (48 CFR) 53.243 mailto:bryan.keith@gsa.gov

Solicitation QMAA-FK-160009-D

Amendment 002– Continuation of Standard Form 30

1) OFFERORS SHOULD NOT PROPOSE OPTION TLM ON ANY LINE ITEMS. ALL

OFFERORS SHOULD INPUT N/A IN AUTOBID FOR THIS OPTIONAL EQUIPMENT CODE

ON ALL APPLICABLE LINE ITEMS.

2) DELETE THE REQUIREMENTS FROM SECTION C.20 : CYBERSECURITY LANGUAGE

FOR OBD DONGLE AND TELEMATICS PROTECTION FOR FACTORY AND AFTER-

MARKET INSTALLED HARDWARE FROM THE RFP AS FOLLOWS:

FROM:

C.20 CYBERSECURITY LANGUAGE FOR OBD DONGLE AND TELEMATICS PROTECTION

FOR FACTORY AND AFTER-MARKET INSTALLED HARDWARE

A. BACKGROUND

Vehicle telematics and fleet management devices have the potential to introduce serious safety and security risks to an automobile. For devices using the OBD port, the design means that any such device has unlimited access to some or all of a car’s internal networks. These OBD devices also have external interface that is accessible from outside of the car—typically Wi-Fi, Bluetooth, or cellular. For built-in telematics devices, there are also serious concerns about the level of connectivity the telematics system provides to the internals of the vehicle.

Although there are no federal standards and/or directives that address the protection or Information Assurance

(IA) of vehicle telematics systems, there is increasing white-hat and adversarial interest in exploiting vehicles.

Information assurance (IA) is the practice of assuring information and managing risks related to the use, processing, storage, and transmission of information or data and the systems and processes used for those purposes. Information Assurance includes protection of the integrity, availability, authenticity, non-repudiation and confidentiality of user data. IA uses physical, technical and administrative controls to accomplish these tasks and the source for the IA controls is NIST 800-53: Security and Privacy Controls for Federal Information

Systems and Organizations, April 2013, http://csrc.nist.gov/publications/drafts/800-53-rev4/sp800-53-rev4-ipd.pdf. To help mitigate this risk, GSA believes that the OEMs and vendors of automotive products/services alike should be diligent in ensuring the IA posture of all systems inherent in or incorporated into vehicles and products/services.

B. CYBERSECURITY GUIDANCE

GSA’s Office of Fleet Management recognizes that many vehicle manufacturers and Tier 1 suppliers of vehicle components are currently involved and/or participating in groups and initiatives to address and resolve vulnerabilities in the security posture of vehicle systems. GSA recommends vendors familiarize themselves with the following resources to increase the awareness of activities being undertaken:

• Society of Automotive Engineers (SAE) J3061, “Cybersecurity Guidebook for Cyber-Physical Vehicle

Systems”, https://global.ihs.com/doc_detail.cfm?document_name=SAE%20J3061&item_s_key=00668496

• SAE J2945, “Dedicated Short Range Communication (DSRC) Minimum Performance Requirements”

• Car Hacker’s Handbook, http://opengarages.org/handbook/

• Five Star Automotive Cyber Safety Program, https://www.iamthecavalry.org/domains/automotive/

• Volvo’s HEAVENS (HEAling Vulnerabilities to ENhance Software Security and Safety (HEAVENS)

Security Model, http://www.sp.se/en/index/research/dependable_systems/heavens/Sidor/default.aspx

• On Board Diagnostics: Risks and Vulnerabilities of the Connected Vehicle, CERT Coordination Center

(CERT/CC) Whitepaper, http://resources.sei.cmu.edu/library/

GSA believes it to be in the best interest of OEMs, Tier 1 suppliers, and vendors of automotive products/services to familiarize themselves with the policies and directives required for IS/IT components within the federal government as the probability is very high that these or very similar policies and guidelines will be leveraged for vehicle systems in the very near future:

Cybersecurity Technical Implementation Standards/Guidelines:

• NIST SP 800-52 Rev1, “Guidelines for the Selection, Configuration, and Use of Transport Layer

Security (TLS) Implementations”

• FIPS 140-2, “Security Requirements for Cryptographic Modules”

• NIST SP 800-121 Revision 1, “Guide to Bluetooth Security”

Cybersecurity Process Guidelines

• Federal Information Security Management Act of 2002 (FISMA), 44 U.S.C. § 3541, https://www.law.cornell.edu/uscode/text/44/3541

• Federal Information Processing Standards (FIPS) 199, “Standards for Security Categorization of Federal

Information and Information Systems”

• FIPS 200, “Minimum Security Requirements for Federal Information and Information Systems”

• National Institute of Standards and Technology (NIST) Special Publication (SP) 800-37 Rev1, “Guide for Applying the Risk Management Framework to Federal Information Systems”

• NIST SP 800-53 Rev4, “Security and Privacy Controls for Federal Information Systems and

Organizations”

• NIST SP 800-137, “Information Security Continuous Monitoring for Federal Information Systems and

Organizations”

• NIST SP 800-82 Rev2, “Guide to Industrial Control System (ICS) Security”

• The Committee on National Security Systems (CNSS) Instruction No. 1253, “Security. Categorization and Control Selection for National Security Systems”

C. SECURITY CONTROLS GUIDANCE

As implementation of Executive Order 13693, “Planning for Federal Sustainability in the Next Decade” dated

June 10, 2015 begins to be implemented , government fleet managers will be acquiring vehicle OEM and third-party vendor telematics solutions. For vendors offering these solutions GSA recommends that at a minimum the following security measures are configured within their devices/service offerings:

• Encrypt all external communications by following NIST 800-52 rev. 1 guidelines for communicating with backend services external to the telematics device. (Reference:

http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-52r1.pdf )

• Sign and encrypt firmware updates through the use of cryptographically signing and encrypting to prevent firmware modification by an attacker. Specifically OBD and telematics device vendors should consider using The Update Framework (TUF) or another open, well-supported standard for doing software updates, https://theupdateframework.github.io/.

Follow NIST SP800-53 rev. 4 Control “System Integrity (SI-7 )” and enhancements 1, 2, 6, 9, 10, 15

NIST SP 800-53r4 Control SI-7 — SOFTWARE, FIRMWARE, AND INFORMATION INTEGRITY

Control: The organization employs integrity verification tools to detect unauthorized changes.

Supplemental Guidance: Unauthorized changes to software, firmware, and information can occur due to errors or malicious activity (e.g., tampering). Software includes, for example, operating systems (with key internal components such as kernels, drivers), middleware, and applications. Firmware includes, for example, the Basic

Input Output System (BIOS). Information includes metadata such as security attributes associated with information. State-of-the-practice integrity-checking mechanisms (e.g., parity checks, cyclical redundancy checks, cryptographic hashes) and associated tools can automatically monitor the integrity of information systems and hosted applications. Related controls: SA-12, SC-8, SC-13, SI-3.

Control Enhancements:

(1) SOFTWARE, FIRMWARE, AND INFORMATION INTEGRITY | INTEGRITY CHECKS

Supplemental Guidance: Security-relevant events include, for example, the identification of a new threat to which organizational information systems are susceptible, and the installation of new hardware, software, or firmware. Transitional states include, for example, system startup, restart, shutdown, and abort.

(2) SOFTWARE, FIRMWARE, AND INFORMATION INTEGRITY | AUTOMATED NOTIFICATIONS

OF INTEGRITY VIOLATIONS

The organization employs automated tools that provide notification upon discovering discrepancies during integrity verification.

Supplemental Guidance: The use of automated tools to report integrity violations and to notify organizational personnel in a timely matter is an essential precursor to effective risk response. Personnel having an interest in integrity violations include, for example, mission/business owners, information system owners, systems administrators, software developers, systems integrators, and information security officers.

(6) SOFTWARE, FIRMWARE, AND INFORMATION INTEGRITY | CRYPTOGRAPHIC PROTECTION

The information system implements cryptographic mechanisms to detect unauthorized changes to software, firmware, and information.

Supplemental Guidance: Cryptographic mechanisms used for the protection of integrity include, for example, digital signatures and the computation and application of signed hashes using asymmetric cryptography, protecting the confidentiality of the key used to generate the hash, and using the public key to verify the hash information. Related control: SC-13.

(9) SOFTWARE, FIRMWARE, AND INFORMATION INTEGRITY | VERIFY BOOT PROCESS

The information system verifies the integrity of the boot process.

Supplemental Guidance: Ensuring the integrity of boot processes is critical to starting devices in known/trustworthy states. Integrity verification mechanisms provide organizational personnel with assurance that only trusted code is executed during boot processes.

(10) SOFTWARE, FIRMWARE, AND INFORMATION INTEGRITY | PROTECTION OF BOOT

FIRMWARE

The information system implements to protect the integrity of boot firmware.

Supplemental Guidance: Unauthorized modifications to boot firmware may be indicative of a sophisticated, targeted cyber attack. These types of cyber attacks can result in a permanent denial of service (e.g., if the firmware is corrupted) or a persistent malicious code presence (e.g., if code is embedded within the firmware).

Devices can protect the integrity of the boot firmware in organizational information systems by: (i) verifying the integrity and authenticity of all updates to the boot firmware prior to applying changes to the boot devices; and

(ii) preventing unauthorized processes from modifying the boot firmware.

(15) SOFTWARE, FIRMWARE, AND INFORMATION INTEGRITY | CODE AUTHENTICATION

The information system implements cryptographic mechanisms to authenticate prior to installation.

Supplemental Guidance: Cryptographic authentication includes, for example, verifying that software or firmware components have been digitally signed using certificates recognized and approved by organizations.

Code signing is an effective method to protect against malicious code.

Reference: https://theupdateframework.github.io/ ;

http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf

• Obey the principle of least privilege by ensuring devices should provide only enough connectivity to enable it to operate for its desired function. For example, if the device does not need access to manufacturer networks (i.e., General Motors LAN), then the physical connector itself should be removed. Additional features introduce additional risk.

Follow NIST SP800-53 rev. 4 Control “Configuration Management (CM-7)” and enhancements 1 NIST

800-53 r4 Control CM-7: LEAST FUNCTIONALITY

Control: The organization:

a. Configures the information system to provide only essential capabilities.

Supplemental Guidance: Information systems can provide a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations

(e.g., key missions, functions). Additionally, it is sometimes convenient to provide multiple services from single information system components, but doing so increases risk over limiting the services provided by any one component. Where feasible, organizations limit component functionality to a single function per device (e.g., email servers or web servers, but not both). Organizations review functions and services provided by information systems or individual components of information systems, to determine which functions and services are candidates for elimination (e.g., Voice Over Internet Protocol, Instant Messaging, auto-execute, and file sharing). Organizations consider disabling unused or unnecessary physical and logical ports/protocols (e.g., Universal Serial Bus, File Transfer Protocol, and Hyper Text Transfer Protocol) on information systems to prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling.

Organizations can utilize network scanning tools, intrusion detection and prevention systems, and end-point protections such as firewalls and host-based intrusion detection systems to identify and prevent the use of prohibited functions, ports, protocols, and services. Related controls: AC-6, CM-2, RA-5, SA-5, SC-7.

Control Enhancements:

(1) LEAST FUNCTIONALITY | PERIODIC REVIEW

The organization:

(a) Reviews the information system to identify unnecessary and/or nonsecure functions, ports, protocols, and services.

Supplemental Guidance: The organization can either make a determination of the relative security of the function, port, protocol, and/or service or base the security decision on the assessment of other entities.

Bluetooth, FTP, and peer-to-peer networking are examples of less than secure protocols. Related controls: AC-

18, CM-7, IA-2.

• Institute a Vulnerability Response Program for receiving, implementing, and addressing vulnerabilities discovered or reported in their own OBD and Telematics products. Vendors should maintain a vulnerability response and disclosure program in accordance with established standards.

Follow ISO/IEC 29147 (Information Technology -- Security Techniques -- Vulnerability Disclosure), http://www.iso.org/iso/catalogue_detail.htm?csnumber=45170

TO:

C.20 RESERVED

3) PROVIDE REVISED ATTACHMENT G7 – SCHEDULE OF ITEMS – ITEM 888E.

4) PROVIDE ANSWERS TO QUESTIONS RECEIVED IN RESPONSE TO THE

SOLICITATION:

Q1: Can you give me a list of steps to ensure I get include [sic] in the procurement process. Do I need to get set up with GSA before I even start?

A1: Please refer to section F.1 of the solicitation for proposal contents and instructions for submissions.

All other terms and conditions remain unchanged.