RFP 70RTAC22R00000010 J.7 - Pricing Template.xlsx
XLSX spreadsheet 38 KB Posted
- Attached to
- Solicitation for Hack DHS: Crowdsourced Vulnerability Assessment Services (CVAS) Federal contract opportunity
- Solicitation number
- 70RTAC22R00000010
About this file
This solicitation requests proposals for crowdsourced vulnerability assessment services to identify security issues within six Department of Homeland Security systems over a four-month period. Offerors must demonstrate an active researcher community, comply with DHS data requirements and security standards, and provide a hacker-powered security platform. Pricing consists of fixed bounty payouts for discovered vulnerabilities as well as administrative fees calculated as a percentage of payout funds. The percentage rates offered for public and private assets will be evaluated. A sample task order scenario is provided to assess pricing, involving two systems per month with defined in-scope vulnerabilities and bug severities tied to specific payout amounts totaling $125,000. Proposals are due within 30 calendar days and the Department of Homeland Security aims to award a blanket purchase agreement for these crowdsourced security services.
View the file
Other files for this federal contract opportunity
| File | Type | Posted |
|---|---|---|
| Amendment 0001_RFP 70RTAC22R00000010_Responses to Vendor Questions on Final RFP.pdf | ||
| Amendment 0001_RFP 70RTAC22R00000010.pdf | ||
| Amendment 0001_RFP 70RTAC22R00000010_J.2 - PWS.pdf | ||
| Amendment 0001_RFP 70RTAC22R00000010_SF30.pdf | ||
| RFP 70RTAC22R00000010.pdf | ||
| RFP 70RTAC22R00000010 J.1 - SF1449.pdf | ||
| RFP 70RTAC22R00000010 J.2 - PWS.pdf | ||
| RFP 70RTAC22R00000010 J.6 - Past Performance Questionnaire.pdf | ||
| RFP 70RTAC22R00000010 J.4 - Cert of Active Researcher Community.pdf | ||
| RFP 70RTAC22R00000010 J.3 - Cert of IDIQ VDDP Platform Compliance.pdf | ||
| RFP 70RTAC22R00000010 J.5 - Cert of HSAR 3052.204-70 and Data Req.pdf | ||
| Responses to Vendor Questions on DRAFT RFP.pdf |
Show all 12
On GovTribe
Work with this file on GovTribe
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
IDIQ Pricing
| Request for Proposal for 70RTAC22R00000010 | |||
| Attachment J.7: Pricing Template | |||
| Tab 1 of 3: IDIQ Pricing | |||
| Offeror Name: | |||
| Instructions: | Please fill in the yellow-highlighted cells. Offerors do not need to provide pricing for CLINs 0001, 1001, 2001, 3001, and 4001. The Government has already established a not-to-exceed amount of these CLINs. The amount of these CLINs is the ceiling amount of all bounty payouts under all task orders that will be awarded for each ordering period. At the task order level, the Government will provide the total bounty payout amount for the task order. For all sub-CLINs under CLINs 0002, 0003, 1002, 1003, 2002, 2003, 3002, 3003, 4002, and 4003, Offerors are instructed to enter a maximum percentage (%) of the Administrative Services compared to the total bounty payout amount establihsed in CLINs 0001, 1001, 2001, 3001, and 4001. For example, if the Offeror inserted "30%" for CLIN 0002AA, and the Government identifies $1M for the bounty payout for the order, then the Offeror's proposed price for the Aministrative Services would be $300,000. The total amount of the order would equate to $1,300,000 for the purposes of this example. The rates established for these CLINs will apply to task orders. However, Offerors are encouraged to offer additional discounts at the task order level. | ||
| Base Period | |||
| CLIN Number | Description | Quantity | Price/Percentage |
| 0001 | Bounty Payouts (Fixed-Unit-Price or Firm-Fixed-Price) | 1 Lot | $5,691,140.00 |
| 0002 | Administrative Services – Public Asset (Firm-Fixed-Price) | ||
| 0002AA | Fixed-Duration Bounty Challenge | 1 Lot | |
| 0002AB | Continuous Bounty Challenge | 1 Lot | |
| 0002AC | Live Events | 1 Lot | |
| 0003 | Administrative Services – Private Asset (Firm-Fixed-Price) | ||
| 0003AA | Fixed-Duration Bounty Challenge | 1 Lot | |
| 0003AB | Continuous Bounty Challenge | 1 Lot | |
| 0003AC | Live Events | 1 Lot | |
| Option Period 1 | |||
| CLIN Number | Description | Quantity | Price/Percentage |
| 1001 | Bounty Payouts (Fixed-Unit-Price or Firm-Fixed-Price) | 1 Lot | $5,861,874.20 |
| 1002 | Administrative Services – Public Asset (Firm-Fixed-Price) | ||
| 1002AA | Fixed-Duration Bounty Challenge | 1 Lot | |
| 1002AB | Continuous Bounty Challenge | 1 Lot | |
| 1002AC | Live Events | 1 Lot | |
| 1003 | Administrative Services – Private Asset (Firm-Fixed-Price) | ||
| 1003AA | Fixed-Duration Bounty Challenge | 1 Lot | |
| 1003AB | Continuous Bounty Challenge | 1 Lot | |
| 1003AC | Live Events | 1 Lot | |
| Option Period 2 | |||
| CLIN Number | Description | Quantity | Price/Percentage |
| 2001 | Bounty Payouts (Fixed-Unit-Price or Firm-Fixed-Price) | 1 Lot | $ 6,037,730.43 |
| 2002 | Administrative Services – Public Asset (Firm-Fixed-Price) | ||
| 2002AA | Fixed-Duration Bounty Challenge | 1 Lot | |
| 2002AB | Continuous Bounty Challenge | 1 Lot | |
| 2002AC | Live Events | 1 Lot | |
| 2003 | Administrative Services – Private Asset (Firm-Fixed-Price) | ||
| 2003AA | Fixed-Duration Bounty Challenge | 1 Lot | |
| 2003AB | Continuous Bounty Challenge | 1 Lot | |
| 2003AC | Live Events | 1 Lot | |
| Option Period 3 | |||
| CLIN Number | Description | Quantity | Price/Percentage |
| 3001 | Bounty Payouts (Fixed-Unit-Price or Firm-Fixed-Price) | 1 Lot | $ 6,218,862.34 |
| 3002 | Administrative Services – Public Asset (Firm-Fixed-Price) | ||
| 3002AA | Fixed-Duration Bounty Challenge | 1 Lot | |
| 3002AB | Continuous Bounty Challenge | 1 Lot | |
| 3002AC | Live Events | 1 Lot | |
| 3003 | Administrative Services – Private Asset (Firm-Fixed-Price) | ||
| 3003AA | Fixed-Duration Bounty Challenge | 1 Lot | |
| 3003AB | Continuous Bounty Challenge | 1 Lot | |
| 3003AC | Live Events | 1 Lot | |
| Option Period 4 | |||
| CLIN Number | Description | Quantity | Price/Percentage |
| 4001 | Bounty Payouts (Fixed-Unit-Price or Firm-Fixed-Price) | 1 Lot | $ 6,405,428.21 |
| 4002 | Administrative Services – Public Asset (Firm-Fixed-Price) | ||
| 4002AA | Fixed-Duration Bounty Challenge | 1 Lot | |
| 4002AB | Continuous Bounty Challenge | 1 Lot | |
| 4002AC | Live Events | 1 Lot | |
| 4003 | Administrative Services – Private Asset (Firm-Fixed-Price) | ||
| 4003AA | Fixed-Duration Bounty Challenge | 1 Lot | |
| 4003AB | Continuous Bounty Challenge | 1 Lot | |
| 4003AC | Live Events | 1 Lot |
&G
Sample Order Pricing
| Request for Proposal for 70RTAC22R00000010 |
| Attachment J.7: Pricing Template |
| Tab 2 of 3: Sample Order Pricing |
| Offeror Name: |
| Instructions: The sample order pricing tab will be based on the Scenario provided in the Scenario tab. The sample order total price will be used for price evaluation purposes. The price for CLIN 0001 is provided for evaluation purposes. Offerors do not need to provide additional price for CLIN 0001. Column D, Row 15 (Price for CLIN 0002) will be automatically populated based on the percentage in Column D, Row 16. Column D, Row 16 (IDIQ Percentage (%) of Administrative Services Compared to the Total Funding for Bounty Payout) will be automatically generated once the Offeror completes the IDIQ Pricing Tab, IDIQ CLIN 0003AA. Column D, Row 17 (Sample Order Total) will be automatically updated once the Offeror inserts pricing for CLIN 0002 in the Sample Order Pricing tab. |
| Task Order CLIN | Description | Quantity | Price/Rate |
| 0001 | Bounty Payouts (Fixed Unit Price) (IDIQ CLIN 0001) | TBD | $ 125,000.00 |
| Critical Severity Bug: $5000 | |||
| High Severity Bug: $3500 | |||
| Medium Severity Bug: $2000 | |||
| Low Severity Bug: $750 | |||
| Informational Bug: No payout | |||
| 0002 | Administrative Services for Private Assets (All other price elements (e.g. Platform cost, overhead costs, background checks, etc.)) (Firm-Fixed-Price) (IDIQ CLIN 0003AA) | 1 Lot | $ - 0 |
| IDIQ Percentage (%) of Administrative Services Compared to the Total Funding for Bounty Payouts | 0% | ||
| Sample Order Total: | $ 125,000.00 |
&G
Scenario
| Request for Proposal for 70RTAC22R00000010 |
| Attachment J.7: Pricing Template |
| Tab 3 of 3: Scenario |
| Period of Performance (PoP): 4 months (including pre- and post- event coordination and a three (3)-month bug bounty event) |
Scenario: The Department of Homeland Security (DHS) wishes to conduct a private, invite only remote bug bounty event which includes six (6) DHS systems. The systems will only be in scope for one (1) month each during the PoP. There will be two (2) systems in scope the first month which are replaced by two (2) different systems in the second month, and then those are replaced by the final two (2) systems in the final month of the PoP.
System 1 is an on-premises environment consisting of a web server with an application which takes user input from various forms and stores/retrieves them from a database for further processing and presentation to users or individuals processing records. Researchers will be provided credentials to the application.
System 2 is a Infrastructure as a Service (IaaS) system consisting of three (3) web portals, an email server, and a virtual appliance that performs email scanning.
System 3 is a cloud-based environment which supplies desktops as a service to end users after authentication through Department single sign-on. Researchers will be provided credentials.
System 4 is a collaboration platform that allows for text chat, presentation, file sharing, and video/voice chat. The system is heavily reliant on Commercial off the Shelf (COTS), but configuration and maintenance as well as identify/access control is performed by the Department with a mix of single-sign on accounts for the Department and single-factor login/password accounts for partners. No credentials will be provided, however if a researcher discovers credentials that allow access for testing by that researcher may be allowed with DHS permission.
System 5 is a set of iOS and Android mobile applications which upload photos tagged with geolocation from multiple devices across the United States to a data center for machine learning based image classification and categorization.
System 6 is a Department coded cloud application which parses documents for Personally Identifiable Information (PII), Personal Health Information (PHI), and financial information before placing them into a publicly searchable archive. No credentials will be given.
&G image1.png
File details come from the government source that posted it. Updated .