Revised_RFQ.._REQ-601-19-0014_Rev_002.pdf

1 of

INSTRUCTIONS TO VENDORS

RFQ#

REQ-601-19-0014-

Revision 002

The Overseas Private Investment Corporation (OPIC) is issuing this competitive Request for Quote via FedBizOpps. OPIC will conduct this acquisition using Subpart 13.1 under the Federal Acquisition Regulation. The NAICS code is 541618, the PSC is R799. If you are interested in this acquisition, you may participate by submitting your response in accordance with the following instructions.

Vendors are required to submit Volume 1 Technical Approach and Volume 2 Price Proposal to Government officials for the purposes of assuring that the prospective contractor is fully cognizant of the scope of this effort and has the capability to complete all requirements listed in the attached Statement of Objectives (SOO).

Volume 1 Technical Approach

FACTOR 1-TECHNICAL APPROACH

The Vendor will be evaluated on their ability to demonstrate understanding of the requirement as stated in the SOO by providing a narrative as to how each service will be structured and executed.

The Vendor shall submit a technical approach that will be used in providing OPIC with two development impact surveys and the means by which the data would be collected and analyzed.

FACTOR 2-QUALIFICATIONS OF KEY PERSONNEL

The Vendor will be evaluated on their ability to provide qualified, competent personnel for the project. Resumes shall be provided for individuals designated as Key Personnel.

Vendors shall demonstrate they have qualified personnel who can perform the duties outlined in the SOO.

FACTOR 3-CORPORATE CAPABILITY AND RELEVANT EXPERIENCE

The Vendor will be evaluated based on their ability to provide a minimum of three projects to establish previous relevant experiences in performance for technical projects similar in scale, scope, and complexity to the requirement being competed. The Vendor shall reference all projects performed as a Prime Contractor within the last three (3) years. The Vendor shall also specifically address its resilience in the face of trouble, resourcefulness, and management determination to see that the organization lived up to project commitments or standards. The Vendor shall provide examples of accomplishments to indicate an ability to implement the proposed methods and techniques for solving problems (examples should cite specific situations which occurred and how resolution was reached).

Volume 2 Price Proposal

2 of

The Government will evaluate price, which should include every element which constitutes your total price (direct labor, material, overhead, general and administrative expenses, fixed fees, and any discounts). The Government will evaluate price, an unrated evaluation factor, based upon the use of any one or several price evaluation techniques as may be deemed necessary to determine that the proposed price is fair and reasonable, such as:

a. Adequate Price Competition; and

b. Comparison of the proposed price with prices obtained through market research for the same or similar services, and

c. Other techniques in accordance with FAR 12 and 13.

BASIS FOR AWARD

All evaluation factors other than cost/price, when combined, are significantly more important than cost or price. As technical differences narrow, cost/price will become more important. If there are no significant technical differences, cost/price may be the determining factors for source selection.

This is a trade-off source selection. The Government may or may not award to the lowest priced Vendor or highest technically rated Vendor.

SUBMISSION REQUIREMENTS AND QUOTE DUE DATE

Volumes 1 and 2 of the quotes must be submitted electronically no later than Wednesday August 14, 2019 at 5:00 pm Eastern Standard Time. Submit via email to the Contract Specialist (CS) Veronica Gaines-Turner at Veronica.Gaines-Turner@opic.gov and copy Arlette Tongue Contracting Officer (CO) at Arlette.Tongue@opic.gov

QUESTIONS

If you have questions pertaining to the updated changes to this requirement, please submit your inquiries via email no later than Friday July 26, 2019 at 12:00 Noon Eastern Standard Time(EST). Questions will only be answered if they are pertaining to the updated information in the RFQ. Questions along with the Government’s responses will be posted to FedBizOpps. Questions will not be accepted or answered via telephone. Before submitting questions, vendors must check the Q&A file already posted to determine whether their question has already been addressed.

3 of

The quote shall be prepared in two parts: Volume 1 Technical Proposal and Volume 2 Price Proposal. Each part shall be evaluated independently. The following instructions establish the acceptable minimum requirements for the format and content for the Technical and Business Proposal.

Each Volume must contain a Table of Contents providing sufficient detail to allow evaluators to easily locate all important Volume elements. All pages, tables, figures, and charts must be clearly numbered using a consistent numbering system.

General Formatting. The specified format for the Technical Volume and Cost/Price Volume is:

(1) Pages must be standard 8 ½” by 11” size and the font must be 12 point Times New Roman. The font size for tables, figures, and graphics must be 8 point or larger and must be Times New Roman or Arial font.

(2) Margins must be one-inch at top/bottom and left/right of each page. Pages must not be reduced form. Headers and footers may be included in the margins.

(3) Paragraph line spacing must be single spaced.

(4) Pages must be printed single-sided.

(5) Foldouts are limited to 11” x 17” size paper and will count as two pages toward the page limit.

Each Volume must include a signed and dated cover letter that states the following:

(1) RFQ number and name

(2) RFQ issuance date

(3) OPIC issuing office and contact person

(4) Name and address of contractor submitting the quotation

(5) Acknowledgement of applicable amendments issued to the RFQ

(6) Quotation acceptance period of no less than 120 days

Each Volume’s cover letter must include no pricing or technical information.

TECHNICAL PROPOSAL VOLUME 1 - NTE 15 PAGES (EXCLUDING RESUMES)

The proposal shall be specific and complete in every detail. The proposal shall be practical, straightforward with concise delineation of what it is the Vendor will do to satisfy the requirements of the Statement of Objectives.

The proposal shall not merely offer to perform work in accordance with the scope of the work. It shall outline the actual work proposed as specifically as practical. The Statement of Objectives reflects the objectives of the program, therefore merely stating or affirming that the Vendor will execute the performance requirements without sufficient elaboration will not be acceptable.

The Vendors shall further organize their Technical Proposal with the following subdivisions:

Technical Proposal (Volume I)

4 of

Factor 1-Technical Approach Factor 2-Qualifications of Key Personnel Factor 3-Corporate Capabilities/Relevant Experience

Note: Detailed resumes for all Key Personnel must be included with the proposal. Resumes must address the Education, Experience and Certification requirements for the appropriate position.

Resumes shall include a complete work history.

PRICE PROPOSAL VOLUME 2 – NTE 15 pages Contractor price quote shall be a separate file from the technical volume. List all other direct prices necessary for the performance of this contract.

Contractors must submit all (if any) assumptions, conditions, or exceptions upon which the price quote is based.

Your quote MUST affirmatively acknowledge all RFQ amendments and included:

Request-for-Quotation Number Name and address of Vendor Name and Point-of-Contact telephone number Name of contract administration office Date of submission Amendment Acknowledgement (If applicable) Name, title, and signature of authorized representative DUNS Number

This is an open-market combined synopsis/solicitation for services as defined herein.

The government intends to award a contract as a result of this combined synopsis/solicitation that will include the terms and conditions set forth herein. To facilitate the award process, all quotes must include a statement regarding the terms and conditions herein as follows:

"The terms and conditions in the solicitation are acceptable to be included in the award document without modification, deletion, or addition."

OR

"The terms and conditions in the solicitation are acceptable to be included in the award document with the exception, deletion, or addition of the following:"

Vendor shall list exception(s) and rationale for the exception(s).

PERIOD OF PERFORMANCE

One base year with 4 option years.

5 of

CONTRACT TYPE

Firm Fixed-Price

AWARD

The award shall be made to the responsible vendor whose offer, in conforming to this RFQ, provides an overall best value to the Government.

CLAUSES:

The following FAR clauses will be included in the award By reference:

FAR 52.204-2 Security Requirements FAR 52.204-9 Personal Identity Verification of Contractor Personnel FAR 52.239-1 Privacy or Security Safeguards

In full text:

52.217-8 OPTION TO EXTEND SERVICES (NOV 1999)

The Government may require continued performance of any services within the limits and at the rates specified in the contract. These rates may be adjusted only as a result of revisions to prevailing labor rates provided by the Secretary of Labor. The option provision may be exercised more than once, but the total extension of performance hereunder shall not exceed 6 months. The Contracting Officer may exercise the option by written notice to the Contractor within 30 days

(End of Clause)

The following local clauses will be included in the award:

G. 1 CONTRACTING OFFICER'S AUTHORITY

The Contracting Officer (CO) will perform all contract administration. The CO is the only person with the authority to act as an agent of the U.S. Government under this contract and is the only person authorized to make or approve any changes in any of the requirements of this contract. Notwithstanding any provisions contained elsewhere in this task order contract, the said authority remains solely in the Contracting Officer. In the event the Contractor makes any changes at the direction of any person other than the CO, the change will be considered to have been made without authority and no adjustment will be made in the contract price to cover any increase in costs incurred as a result thereof. Only the CO has the authority to: (1) direct or negotiate any changes in the SOW or PWS; (2) modify or extend the period of performance; (3) change the delivery schedule, (4) authorize reimbursement to the Contractor for any costs incurred during the performance of this contract; or (5) otherwise change any terms and conditions of this contract.

6 of

Communications pertaining to contract administration matters shall be addressed to the CO. No changes in or deviation from the scope of the work shall be effected without a Supplemental Agreement (contract modification) executed by the CO authorizing such changes.

G.2 CONTRACTING OFFICER'S REPRESENTATIVE (COR)

The Government may change the COR at any time without prior notice to the Contractor by a unilateral modification to the Contract. The responsibilities and limitations of the COR are as follows:

(1) The COR is responsible for the technical aspects of the project and serves as technical liaison with the Contractor. The COR is also responsible for the final inspection and acceptance of all reports, and such other responsibilities as may be specified in the task order contract.

(2) The COR is not authorized to make any commitments or otherwise obligate the Government or authorize any changes, which affect the Contract price, terms or conditions. Any Contractor request for changes shall be referred to the Contracting Officer directly or through the COR. No such changes shall be made without the expressed prior authorization of the Contracting Officer. The COR may designate assistant COR(s) to act for the COR by naming such assistant(s) in writing and transmitting a copy of such designation through the Contracting Officer to the Contractor.

G.3 CONTRACTOR PERSONNEL ISSUES

Should the contractor become aware of contractor personnel issues, including poor performance, misconduct, or any other event in which employee impending resignation or termination becomes known, the contractor shall notify OPIC immediately or 48 hours in advance, whichever comes first. Notification shall be sent via email to the COR and ContractorPersonnel@opic.gov. In the event of termination, the contractor will notify OPIC before notifying the employee and conduct the termination off-site whenever possible. If requested, the contractor will provide OPIC with an incident report detailing the events which led to the employee’s departure or termination.

H.1 RESTRICTIONS AGAINST DISCLOSURE

The Contractor agrees, in the performance of this contract, to keep in strict confidence the information furnished by the Government and designated by the CO or COR as non-public OPIC materials and information. The Contractor also agrees not to publish or otherwise divulge such information in whole or in part, in any manner or form, nor to authorize or permit others to do so, taking such reasonable measures as are necessary to restrict access to such information while in the Contractor's possession, to those employees needing such information to perform the work provided herein on a need to know basis. The Contractor agrees to immediately notify the CO in writing in the event that the Contractor determines or has reason to suspect a breach of this requirement. The Contractor may divulge the information to other OPIC employees or OPIC contractors on a need-to-know basis if it is necessary to do so in order to successfully perform the requirements of this contract.

The Contractor agrees that it will not disclose any information described in paragraph 1 of this section to any persons or individual unless prior written approval is obtained from the CO. For

7 of the purposes of this clause, the CO has determined that all information or materials received by the Contractor from OPIC or generated by the Contractor during the course of contract performance is non-public and subject to disclosure restrictions. The Contractor agrees to insert the substance of this clause in any consultant agreement or subcontract hereunder.

H. 2 SECURITY

The contractor shall comply will all contractual and Federal information security, privacy and confidentiality requirements applicable to the operation, maintenance or support of a Federal information system. The contractor shall be required to prevent and remedy data breaches and to provide the OPIC with all necessary information and cooperation, and to take all other reasonable and necessary steps and precautions, to enable the OPIC to satisfy its data breach reporting duties under applicable law, regulation, or policy in the event, if any, that a breach occurs.

A. Contractor information systems subject to the Federal Information Security Management

Act of 2002 (FISMA). All agency information systems, see 44 U.S.C. 3505(c), operated by or on behalf of the Government by a Contractor or subcontractor containing Federal data shall be subject to the requirements of the FISMA, including routine testing without advance notice to or approval of the Contractor or its subcontractors. See 44 U.S.C 3544(b).

1. For all services acquisitions (including cloud services):

PROTECTION OF INFORMATION

The contractor shall be responsible for properly protecting all information used, gathered, or developed as a result of work under this contract. The contractor shall also protect all Government data, equipment, etc. by treating the information as sensitive. All information about the systems gathered or created under this contract should be considered as SBU information. It is anticipated that this information will be gathered, created, and stored within the primary work location. If contractor personnel must remove any information from the primary work area they should protect it to the same extent they would their proprietary data and/or company trade secrets. The use of any information that is subject to the Privacy Act will be utilized in full accordance with all rules of conduct as applicable to Privacy Act Information.

The government will retain unrestricted rights to government data. The ordering activity retains ownership of any user created/loaded data and applications hosted on vendor’s infrastructure, as well as maintains the right to request full copies of these at any time.

The data that is processed and stored by the various applications within the network infrastructure contains financial data as well as personally identifiable information (PII).

This data and PII shall be protected against unauthorized access, disclosure or modification, theft, or destruction. The contractor shall ensure that the facilities that house the network infrastructure are physically secure.

The data must be available to the Government upon request within one business day or within the timeframe otherwise specified, and shall not be used for any other purpose.

The contractor shall provide requested data at no additional cost to the government.

8 of

No data shall be released by the Contractor without the consent of the Government in writing. All requests for release must be submitted in writing to the COR/CO.

SECURITY CLASSIFICATION

The preparation of the deliverables in this contract will be completed at a Sensitive but Unclassified level.

SECURITY DOCUMENTATION

The contractor shall provide documentation describing the functional properties of the security controls employed within the information system, its components, or services.

2. For Cloud-based systems:

Contractor shall be responsible for the following privacy and security safeguards:

a. To the extent required to carry out the FedRAMP assessment and authorization process and FedRAMP continuous monitoring, to safeguard against threats and hazards to the security, integrity, and confidentiality of any non-public Government data collected and stored by the Contractor, the Contractor shall afford the Government access to the Contractor’s facilities, installations, technical capabilities, operations, documentation, records, and databases.

b. If new or unanticipated threats or hazards are discovered by either the Government or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party.

c. The contractor shall also comply with any additional FedRAMP privacy requirements.

d. The Government has the right to perform manual or automated audits, scans, reviews, or other inspections of the vendor’s IT environment being used to provide or facilitate services for the Government. In accordance with the Federal Acquisitions Regulations (FAR) clause 52.239-1, contractor shall be responsible for the following privacy and security safeguards:

i. The Contractor shall not publish or disclose in any manner, without the

Contracting Officer’s written consent, the details of any safeguards either designed or developed by the Contractor under this contract or otherwise provided by the Government. Exception - Disclosure to a Consumer Agency for purposes of A&A verification.

ii. To the extent required to carry out a program of inspection to safeguard against threats and hazards to the security, integrity, and confidentiality of Government data, the Contractor shall afford the Government access to the Contractor’s facilities, installations, technical capabilities, operations, documentation, records, and databases within XX hours. (FedRAMP recommends 72 hours) The program of inspection shall include, but is not limited to:

Authenticated and unauthenticated operating system/network vulnerability scans Authenticated and unauthenticated web application vulnerability scans Authenticated and unauthenticated database application vulnerability scans Automated scans can be performed by Government personnel, or agents acting on behalf of the Government, using Government operated equipment, 9 of and Government specified tools.

iii. If new or unanticipated threats or hazards are discovered by either the

Government or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party. If the vendor chooses to run its own automated scans or audits, results from these scans may, at the Government’s discretion, be accepted in lieu of Government performed vulnerability scans. In these cases, scanning tools and their configuration shall be approved by the Government. In addition, the results of vendor-conducted scans shall be provided, in full, to the Government.

FedRAMP Security Compliance Requirements:

The contractor shall implement the controls contained within the FedRAMP Cloud Computing Security Requirements Baseline and FedRAMP Continuous Monitoring Requirements for low and moderate impact system (as defined in FIPS 199). These documents define requirements for compliance to meet minimum Federal information security and privacy requirements for both low and moderate impact systems. While the FedRAMP baseline controls are based on NIST Special Publication 800-53, Revision 4.

The contractor shall generally, substantially, and in good faith follow FedRAMP guidelines and Security guidance. In situations where there are no procedural guides, the contractor shall use generally accepted industry best practices for IT security.

Assessment and Authorization:

OPIC may choose to cancel the Contract and terminate any outstanding orders if the contractor has its provisional authorization revoked and the deficiencies are greater than agency risk tolerance thresholds.

Authorization of System:

The contractor shall provide access to the Federal Government, or their designee acting as their agent, when requested, in order to verify compliance with the requirements for an Information Technology security program. The Government reserves the right to conduct on-site inspections. The contractor shall make appropriate personnel available for interviews and provide all necessary documentation during this review.

3. For not cloud-based contractor-owned systems and services:

REQUIRED POLICIES AND REGULATIONS FOR OPIC CONTRACTS:

Contractors entering into an agreement for services to OPIC and/or its Federal customers shall be contractually subject to all OPIC and Federal IT Security standards, policies, and reporting requirements. The contractor shall meet and comply with all OPIC IT Security Policies and all applicable OPIC and NIST standards and guidelines, other Government-wide laws and regulations for protection and security of Information Technology.

Contractors are also required to comply with Federal Information Processing Standards (FIPS), the “Special Publications 800 series” guidelines published by NIST, and the requirements of FISMA.

10 of

OPIC SECURITY COMPLIANCE REQUIREMENTS

FIPS 200, “Minimum Security Requirements for Federal Information and Information Systems”, is a mandatory federal standard that defines the minimum security requirements for federal information and information systems in seventeen security-related areas. Contractor systems supporting OPIC must meet the minimum security requirements through the use of the security controls in accordance with NIST Special Publication 800-53, Revision 4 (hereafter described as NIST 800-53), and “Recommended Security Controls for Federal Information Systems.

NIST 800-53 controls requiring organization-defined parameters (i.e., password change frequency) shall be consistent with OPIC specifications. The OPIC-specified control parameters and supplemental guidance defining more specifically the requirements per FIPS 199 impact level are provided in Appendix A, of this document.

SYSTEM ASSESSMENT DOCUMENTATION

1. At the Moderate impact level and higher, the contractor or Government (as determined in the contract) will be responsible for providing an independent Security Assessment/Risk Assessment.

2. Identified gaps between required 800-53 controls and the contractor’s implementation as documented in the Security Assessment/Risk Assessment report shall be tracked for mitigation in a Plan of Action and Milestones (POA&M) document.

3. The Contractor is responsible for mitigating all security risks found during C&A and continuous monitoring activities. All high-risk vulnerabilities must be mitigated within 30 days and all moderate risk vulnerabilities must be mitigated within 90 days from the date vulnerabilities are formally identified. The Government will determine the risk rating of vulnerabilities.

B. Handling of third-party requests for access to records. In the event that the Contractor receives any subpoena or other voluntary or mandatory request for access to data first produced under this Contract, the Contractor shall immediately notify the COR and the CO, so that the Government may intervene or take any other steps it deems necessary to protect its interests.

C. Data Breaches. As part of the requirement explained elsewhere in this document for the contractor to comply with all contractual and Federal information security, privacy and confidentiality requirements applicable to the operation, maintenance or support of a Federal information system, the contractor shall be required to prevent and remedy data breaches and to provide the OPIC with all necessary information and cooperation, and to take all other reasonable and necessary steps and precautions, to enable the OPIC to satisfy its data breach reporting duties under applicable law, regulation, or policy in the event, if any, that a breach occurs. Special attention should be paid to OMB Memorandum 06-19 (July 12, 2006), particularly the extremely urgent reporting time frames included therein for certain breaches, as well as to any other subsequent laws, regulations, or policy governing data breaches that may arise during the performance of the contract. The Information System Security Plan required elsewhere in this document shall include policies and procedures necessary to ensure the timely detection of and reporting to the OPIC of data breaches, as well as safeguards to prevent and mitigate the risk of, as well as to remedy, such breaches, if any.

11 of

D. Use of OPIC computer equipment by contractors is limited to what is necessary to accomplish the work identified under the contract. All contractors or his/her employees or subcontractors are subject to Internet access monitoring and auditing, and discoveries of inappropriate internet access or activity not directly related to the contract, will be reported to the COR and CO, and the contractor shall be held in default of the contract.

Contractors or his/her employees or subcontractors found accessing inappropriate web sites while using an OPIC computer, may be grounds for initiating disbarment procedures.

THIS RFQ IN NO WAY OBLIGATES THE GOVERNMENT TO MAKE AN AWARD, NOR

TO PAY ANY COSTS INCURRED BY THE VENDOR IN PREPARING AND SUBMITTING

ITS QUOTE.