REQ-601-19-0014_PROPOSAL_INSTRUCTIONS.pdf

INSTRUCTIONS TO VENDORS

RFQ# REQ-601-19-0014

The Overseas Private Investment Corporation (OPIC) is issuing this competitive Request for

Quote via FedBizOpps. OPIC will conduct this acquisition using Subpart 13.1 under the Federal

Acquisition Regulation. The NAICS code is 541618, the PSC is R799. If you are interested in this acquisition, you may participate by submitting your response in accordance with the following instructions.

Vendors are required to submit Volume 1 Technical Approach and Volume 2 Price Proposal to

Government officials for the purposes of assuring that the prospective contractor is fully cognizant of the scope of this effort and has the capability to complete all requirements listed in the attached

Statement of Objectives (SOO).

SUBMISSION REQUIREMENTS AND QUOTE DUE DATE

Volumes 1 and 2 of the quotes must be submitted electronically no later than July 15, 2019 at

10:00 am Eastern Time. Submit via email to the Contract Specialist (CS) Veronica Gaines-Turner at Veronica.Gaines-Turner@opic.gov and copy Contracting Officer (CO) Anthony Terrell at

Anthony.Terrell@opic.gov.

QUESTIONS

If you have questions regarding this requirement, please submit your inquiries via email no later than Monday, July 1, 2019 at 5:00PM Eastern Daylight Time. Questions along with the

Government’s responses will be posted to FedBizOpps. Questions will not be accepted or answered via telephone. Before submitting questions, vendors must check the Q&A file already posted to determine whether their question has already been addressed.

EVALUATION

The evaluation will be done using the tradeoff method to arrive at the best value for the

Government. Technical Approach (Factor I) is the most important evaluation factor. Past

Performance (Factor II) is the second most important evaluation factor. Price (Factor III) is the least important evaluation factor.

PERIOD OF PERFORMANCE

One base year with 4 option years.

CONTRACT TYPE

Firm Fixed-Price mailto:Veronica.Gaines-Turner@opic.gov mailto:Anthony.Terrell@opic.gov

AWARD

The award shall be made to the responsible vendor whose offer, in conforming to this RFQ, provides an overall best value to the Government.

CLAUSES:

The following FAR clauses will be included in the awarded task order:

By reference:

FAR 52.204-2 Security Requirements

FAR 52.204-9 Personal Identity Verification of Contractor Personnel

FAR 52.239-1 Privacy or Security Safeguards

In full text:

52.217-8 OPTION TO EXTEND SERVICES (NOV 1999)

The Government may require continued performance of any services within the limits and at the rates specified in the contract. These rates may be adjusted only as a result of revisions to prevailing labor rates provided by the Secretary of Labor. The option provision may be exercised more than once, but the total extension of performance hereunder shall not exceed 6 months. The Contracting Officer may exercise the option by written notice to the Contractor within 30 days

(End of Clause)

The following local clauses will be included in the awarded task order:

E.1 TERMS OF ACCEPTANCE

All deliverables or capabilities specified in task plans for engineering tasks charged to the T&M

CLIN in accordance with PWS Section 3.4 must be accepted by the Government as satisfactory prior to release of payment in accordance with the task plan price.

G. 1 CONTRACTING OFFICER'S AUTHORITY

The Contracting Officer (CO) will perform all contract administration. The CO is the only person with the authority to act as an agent of the U.S. Government under this contract and is the only person authorized to make or approve any changes in any of the requirements of this contract. Notwithstanding any provisions contained elsewhere in this task order contract, the said authority remains solely in the Contracting Officer. In the event the Contractor makes any changes at the direction of any person other than the CO, the change will be considered to have been made without authority and no adjustment will be made in the contract price to cover any increase in costs incurred as a result thereof. Only the CO has the authority to: (1) direct or negotiate any changes in the SOW or PWS; (2) modify or extend the period of performance; (3) change the delivery schedule, (4) authorize reimbursement to the Contractor for any costs incurred during the performance of this contract; or (5) otherwise change any terms and conditions of this contract.

Communications pertaining to contract administration matters shall be addressed to the CO. No changes in or deviation from the scope of the work shall be effected without a Supplemental

Agreement (contract modification) executed by the CO authorizing such changes.

G.2 CONTRACTING OFFICER'S REPRESENTATIVE (COR)

The Government may change the COR at any time without prior notice to the Contractor by a unilateral modification to the Contract. The responsibilities and limitations of the COR are as follows:

(1) The COR is responsible for the technical aspects of the project and serves as technical liaison with the Contractor. The COR is also responsible for the final inspection and acceptance of all reports, and such other responsibilities as may be specified in the task order contract.

(2) The COR is not authorized to make any commitments or otherwise obligate the

Government or authorize any changes, which affect the Contract price, terms or conditions. Any

Contractor request for changes shall be referred to the Contracting Officer directly or through the

COR. No such changes shall be made without the expressed prior authorization of the

Contracting Officer. The COR may designate assistant COR(s) to act for the COR by naming such assistant(s) in writing and transmitting a copy of such designation through the Contracting

Officer to the Contractor.

G.3 CONTRACTOR PERSONNEL ISSUES

Should the contractor become aware of contractor personnel issues, including poor performance, misconduct, or any other event in which employee impending resignation or termination becomes known, the contractor shall notify OPIC immediately or 48 hours in advance, whichever comes first. Notification shall be sent via email to the COR and

ContractorPersonnel@opic.gov. In the event of termination, the contractor will notify OPIC before notifying the employee and conduct the termination off-site whenever possible. If requested, the contractor will provide OPIC with an incident report detailing the events which led to the employee’s departure or termination.

H.1 RESTRICTIONS AGAINST DISCLOSURE

The Contractor agrees, in the performance of this contract, to keep in strict confidence the information furnished by the Government and designated by the CO or COR as non-public OPIC materials and information. The Contractor also agrees not to publish or otherwise divulge such information in whole or in part, in any manner or form, nor to authorize or permit others to do so, taking such reasonable measures as are necessary to restrict access to such information while in the Contractor's possession, to those employees needing such information to perform the work provided herein on a need to know basis. The Contractor agrees to immediately notify the CO in writing in the event that the Contractor determines or has reason to suspect a breach of this requirement. The Contractor may divulge the information to other OPIC employees or OPIC contractors on a need-to-know basis if it is necessary to do so in order to successfully perform the requirements of this contract.

The Contractor agrees that it will not disclose any information described in paragraph 1 of this section to any persons or individual unless prior written approval is obtained from the CO. For the purposes of this clause, the CO has determined that all information or materials received by the Contractor from OPIC or generated by the Contractor during the course of contract performance is non-public and subject to disclosure restrictions. The Contractor agrees to insert the substance of this clause in any consultant agreement or subcontract hereunder.

H. 2 SECURITY

The contractor shall comply will all contractual and Federal information security, privacy and confidentiality requirements applicable to the operation, maintenance or support of a Federal information system. The contractor shall be required to prevent and remedy data breaches and to provide the OPIC with all necessary information and cooperation, and to take all other reasonable and necessary steps and precautions, to enable the OPIC to satisfy its data breach reporting duties under applicable law, regulation, or policy in the event, if any, that a breach occurs.

A. Contractor information systems subject to the Federal Information Security Management

Act of 2002 (FISMA). All agency information systems, see 44 U.S.C. 3505(c), operated by or on behalf of the Government by a Contractor or subcontractor containing Federal data shall be subject to the requirements of the FISMA, including routine testing without advance notice to or approval of the Contractor or its subcontractors. See 44 U.S.C

3544(b).

1. For all services acquisitions (including cloud services):

PROTECTION OF INFORMATION

The contractor shall be responsible for properly protecting all information used, gathered, or developed as a result of work under this contract. The contractor shall also protect all

Government data, equipment, etc. by treating the information as sensitive. All information about the systems gathered or created under this contract should be considered as SBU information. It is anticipated that this information will be gathered, created, and stored within the primary work location. If contractor personnel must remove any information from the primary work area they should protect it to the same extent they would their proprietary data and/or company trade secrets. The use of any information that is subject to the Privacy Act will be utilized in full accordance with all rules of conduct as applicable to Privacy Act Information.

The government will retain unrestricted rights to government data. The ordering activity retains ownership of any user created/loaded data and applications hosted on vendor’s infrastructure, as well as maintains the right to request full copies of these at any time.

The data that is processed and stored by the various applications within the network infrastructure contains financial data as well as personally identifiable information (PII).

This data and PII shall be protected against unauthorized access, disclosure or modification, theft, or destruction. The contractor shall ensure that the facilities that house the network infrastructure are physically secure.

The data must be available to the Government upon request within one business day or within the timeframe otherwise specified, and shall not be used for any other purpose.

The contractor shall provide requested data at no additional cost to the government.

No data shall be released by the Contractor without the consent of the Government in writing. All requests for release must be submitted in writing to the COR/CO.

SECURITY CLASSIFICATION

The preparation of the deliverables in this contract will be completed at a Sensitive but

Unclassified level.

SECURITY DOCUMENTATION

The contractor shall provide documentation describing the functional properties of the security controls employed within the information system, its components, or services.

2. For Cloud-based systems:

Contractor shall be responsible for the following privacy and security safeguards:

a. To the extent required to carry out the FedRAMP assessment and authorization process and FedRAMP continuous monitoring, to safeguard against threats and hazards to the security, integrity, and confidentiality of any non-public Government data collected and stored by the Contractor, the Contractor shall afford the

Government access to the Contractor’s facilities, installations, technical capabilities, operations, documentation, records, and databases.

b. If new or unanticipated threats or hazards are discovered by either the Government or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party.

c. The contractor shall also comply with any additional FedRAMP privacy requirements.

d. The Government has the right to perform manual or automated audits, scans, reviews, or other inspections of the vendor’s IT environment being used to provide or facilitate services for the Government. In accordance with the Federal Acquisitions

Regulations (FAR) clause 52.239-1, contractor shall be responsible for the following privacy and security safeguards:

i. The Contractor shall not publish or disclose in any manner, without the

Contracting Officer’s written consent, the details of any safeguards either designed or developed by the Contractor under this contract or otherwise provided by the Government. Exception - Disclosure to a Consumer Agency for purposes of A&A verification.

ii. To the extent required to carry out a program of inspection to safeguard against threats and hazards to the security, integrity, and confidentiality of Government data, the Contractor shall afford the Government access to the Contractor’s facilities, installations, technical capabilities, operations, documentation, records, and databases within XX hours. (FedRAMP recommends 72 hours) The program of inspection shall include, but is not limited to:

• Authenticated and unauthenticated operating system/network vulnerability scans

• Authenticated and unauthenticated web application vulnerability scans

• Authenticated and unauthenticated database application vulnerability scans

• Automated scans can be performed by Government personnel, or agents acting on behalf of the Government, using Government operated equipment, and Government specified tools.

iii. If new or unanticipated threats or hazards are discovered by either the

Government or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party. If the vendor chooses to run its own automated scans or audits, results from these scans may, at the Government’s discretion, be accepted in lieu of

Government performed vulnerability scans. In these cases, scanning tools and their configuration shall be approved by the Government. In addition, the results of vendor-conducted scans shall be provided, in full, to the Government.

FedRAMP Security Compliance Requirements:

The contractor shall implement the controls contained within the FedRAMP Cloud

Computing Security Requirements Baseline and FedRAMP Continuous Monitoring

Requirements for low and moderate impact system (as defined in FIPS 199). These documents define requirements for compliance to meet minimum Federal information security and privacy requirements for both low and moderate impact systems. While the

FedRAMP baseline controls are based on NIST Special Publication 800-53, Revision 4.

The contractor shall generally, substantially, and in good faith follow FedRAMP guidelines and Security guidance. In situations where there are no procedural guides, the contractor shall use generally accepted industry best practices for IT security.

Assessment and Authorization:

OPIC may choose to cancel the Contract and terminate any outstanding orders if the contractor has its provisional authorization revoked and the deficiencies are greater than agency risk tolerance thresholds.

Authorization of System:

The contractor shall provide access to the Federal Government, or their designee acting as their agent, when requested, in order to verify compliance with the requirements for an

Information Technology security program. The Government reserves the right to conduct on-site inspections. The contractor shall make appropriate personnel available for interviews and provide all necessary documentation during this review.

3. For not cloud-based contractor-owned systems and services:

REQUIRED POLICIES AND REGULATIONS FOR OPIC CONTRACTS:

Contractors entering into an agreement for services to OPIC and/or its Federal customers shall be contractually subject to all OPIC and Federal IT Security standards, policies, and reporting requirements. The contractor shall meet and comply with all OPIC IT Security

Policies and all applicable OPIC and NIST standards and guidelines, other Government-wide laws and regulations for protection and security of Information Technology.

Contractors are also required to comply with Federal Information Processing Standards

(FIPS), the “Special Publications 800 series” guidelines published by NIST, and the requirements of FISMA.

OPIC SECURITY COMPLIANCE REQUIREMENTS

FIPS 200, “Minimum Security Requirements for Federal Information and Information

Systems”, is a mandatory federal standard that defines the minimum security requirements for federal information and information systems in seventeen security-related areas. Contractor systems supporting OPIC must meet the minimum security requirements through the use of the security controls in accordance with NIST Special

Publication 800-53, Revision 4 (hereafter described as NIST 800-53), and

“Recommended Security Controls for Federal Information Systems.

NIST 800-53 controls requiring organization-defined parameters (i.e., password change frequency) shall be consistent with OPIC specifications. The OPIC-specified control parameters and supplemental guidance defining more specifically the requirements per

FIPS 199 impact level are provided in Appendix A, of this document.

SYSTEM ASSESSMENT DOCUMENTATION

1. At the Moderate impact level and higher, the contractor or Government (as determined in the contract) will be responsible for providing an independent Security

Assessment/Risk Assessment.

2. Identified gaps between required 800-53 controls and the contractor’s implementation as documented in the Security Assessment/Risk Assessment report shall be tracked for mitigation in a Plan of Action and Milestones (POA&M) document.

3. The Contractor is responsible for mitigating all security risks found during C&A and continuous monitoring activities. All high-risk vulnerabilities must be mitigated within 30 days and all moderate risk vulnerabilities must be mitigated within 90 days from the date vulnerabilities are formally identified. The Government will determine the risk rating of vulnerabilities.

B. Handling of third-party requests for access to records. In the event that the Contractor receives any subpoena or other voluntary or mandatory request for access to data first produced under this Contract, the Contractor shall immediately notify the COR and the

CO, so that the Government may intervene or take any other steps it deems necessary to protect its interests.

C. Data Breaches. As part of the requirement explained elsewhere in this document for the contractor to comply with all contractual and Federal information security, privacy and confidentiality requirements applicable to the operation, maintenance or support of a

Federal information system, the contractor shall be required to prevent and remedy data breaches and to provide the OPIC with all necessary information and cooperation, and to take all other reasonable and necessary steps and precautions, to enable the OPIC to satisfy its data breach reporting duties under applicable law, regulation, or policy in the event, if any, that a breach occurs. Special attention should be paid to OMB

Memorandum 06-19 (July 12, 2006), particularly the extremely urgent reporting time frames included therein for certain breaches, as well as to any other subsequent laws, regulations, or policy governing data breaches that may arise during the performance of the contract. The Information System Security Plan required elsewhere in this document shall include policies and procedures necessary to ensure the timely detection of and reporting to the OPIC of data breaches, as well as safeguards to prevent and mitigate the risk of, as well as to remedy, such breaches, if any.

D. Use of OPIC computer equipment by contractors is limited to what is necessary to accomplish the work identified under the contract. All contractors or his/her employees or subcontractors are subject to Internet access monitoring and auditing, and discoveries of inappropriate internet access or activity not directly related to the contract, will be reported to the COR and CO, and the contractor shall be held in default of the contract.

Contractors or his/her employees or subcontractors found accessing inappropriate web sites while using an OPIC computer, may be grounds for initiating disbarment procedures.

THIS RFQ IN NO WAY OBLIGATES THE GOVERNMENT TO AWARD A TASK ORDER,

NOR TO PAY ANY COSTS INCURRED BY THE VENDOR IN PREPARING AND

SUBMITTING ITS QUOTE.