RFP - HQ0001-20-R-0016 .pdf

FOR OFFICIAL USE ONLY

UNITED STATES CYBERCOMMAND

9800 Savage Road

Ft. Meade, Maryland 20755

Date: 25 August 2020

Request for Quote (RFQ) – SPLINTERNET

Table of Contents

1. Statement of Need/ Required Contract Line Items

2. Type of Contract

3. Important Dates

4. Inspection and Acceptance

5. Limitation of Authority

6. Basis of Award

7. Special Instructions

8. Contract Clauses

9. USCYBERCOM Points of Contact

1. Statement of Need/ Required Contract Line Items

The Department of Defense United States Cyber Command (USCYBERCOM) requests

SplinterNet software with Attack Chains as an Adversary Simulator and Red Team Operations

Software System. The software system will provide an assessment platform that benefits security operations and incident. The software shall provide a post exploitation agent and covert channels to emulate a quiet long-term embedded actor in customer’s network. The vendor shall have the capability to respond within 48 hours to alter the tool set and offer onsite support during exercises.

This requirement is for a brand name or equal product. This is a total small Business Set

Aside.

The Contractor shall provide all products in according with the specification and Contract Line

Item Numbers (CLINs) listed below on page 2.

USCYBERCOM will evaluate products and services on the basis of information furnished by the vendor. USCYBERCOM is not responsible for locating or obtaining any information not identified in the quote. Each CLIN must specify both a unit price and total price.

The Contractors shall agree to the Quality Assurance Surveillance Plan, which will set forth the

Contractor’s staffing and procedures for self-inspecting the quality, timeliness, responsiveness and customer satisfaction of all deliverables and tasks.

Request for Proposal (RFP)

HB0001-20-R-0016

CLIN Structure

Description Qty Cost EA Total

12 Month SplinterNet

License

Maintenance – Tier I 13

Training

Attack Chains

Installation Services

(configure Attack

Chains)

Total

2. Type of Contract

This will be a firm fixed price (FFP) contract using NAICS code 541511 – “Custom Computer

Programming Services.” This requirement is set aside for small business.

3. Important Dates

RFQ Closing Date: 28 August 2020 at 11:00 A.M EST is the quote submission cut-off. ANY

PRICE QUOTES/PROPOSALS RECEIVED AFTER THIS TIME WILL NOT BE ACCEPTED.

Anticipated Award Date: No later than 31 Aug 2020.

4. Inspection and Acceptance:

Inspection and acceptance of the products and deliverables to be furnished shall be performed by a designated Government official. The Contracting Officer or designated Government official may inspect all received items to ensure the deliverables meet the USCYBERCOM specification requirement and any aspect of performance under this contract at any time. Government inspection and acceptance for all contractual items listed herein will be at destination.

5. Limitation of Authority

No person in the Government, other than a Contracting Officer, has the authority to provide direction to the Contractor, which alters the Contractor’s obligations or changes this contract in any way. If any person representing the Government, other than the Contracting Officer, attempts to alter contract obligations, change the contract specifications/statement of work or tells the

Contractor to perform some effort which the Contractor believes to be outside the scope of this contract, the Contractor shall immediately notify the Contracting Officer and receive direction from the Contracting Officer.

Basis of Award:

The Government intends to award one (1) Firm-Fixed Price (FFP) contract resulting from this solicitation to the responsible vendor whose quote conforming to the solicitation while meeting all the technical requirements of the solicitation. All items listed above will be awarded as “all or nothing”. Quotes will be evaluated pursuant to FAR PART 13 procedures.

Technical Acceptability: For a quote to be determined technically acceptable, the quoted supplies must meet or exceed the minimum specifications and requirements set forth in the specifications listed in Section 1 of this document.

BASIS OF AWARD: LOWEST PRICE TECHNICALLY ACCEPTABLE (MAR 1998)

Award will be made to the responsible offeror whose proposal represents the best value to the

Government on the basis of the lowest evaluated price of proposals meeting or exceeding the acceptability standards for non-cost factors. The Government intends to make an award based on initial offers without discussions. Accordingly, it is contemplated that proposal revisions will not be requested. Each initial offer should be submitted on the most favorable terms

Instructions to Vendor: All vendors must submit electronic quotes to the POC listed in section

(a) Administrative Cover Letter that includes the following:

Complete Business Mailing Address

Tax identification number (TIN)

Dun & Bradstreet Number (DUNS)

Cage Code/NAICS Code

Contact Name, Phone, Fax, and email address

(b) Technical Acceptability: For a quote to be determined technically acceptable, the quoted supplies must meet or exceed the minimum specifications and requirements set forth in the specifications listed in Section 6.

Submit proposals to the following:

CYBERCOM Points of Contact

Contracting Officer:

Kerry Guy

USCYBERCOM

9800 Savage Road

Ft Meade, MD 20755-6940

Telephone: 410-854-3914 ktguy@cybercom.mil

Contracting Specialist:

Marilyn Mazza

USCYBERCOM

9800 Savage Road

Ft Meade, MD 20755-6940

Telephone: 443-654-2566 mgmazza@radium.ncsc.mil

6. Special Instructions/Additional Information

(a) The USCYBERCOM POC is not authorized to make any commitments or changes that will affect price, quality, quantity, delivery or any other terms and conditions of the contract.

(b) Tax Exemption Status: USCYBERCOM is an activity of the Federal Government. As such, state agencies are precluded from taxing them by reason of the Supreme Court decision in McCullough

v. Maryland, 17 US 313 (1817). In addition, the various states have codified this immunity by appropriate statutes.

(c) Invoice Submission: Invoices shall be submitted electronically through Wide Area Work Flow

(WAWF) in accordance with instructions found in DFARS Clause 252.232-7006 (see section d below).

(d) Contract Clauses: The following additional Federal Acquisition Regulation (FAR) and Defense

FAR Supplement (DFARS) clauses apply to this acquisition.

7. Contract Clauses

CLAUSES INCORPORATED BY REFERENCE

52.202-1 Definitions NOV 2013

52.203-3 Gratuities APR 1984

52.203-5 Covenant Against Contingent Fees MAY 2014

52.203-8 Cancellation, Rescission, and Recovery of Funds for

Illegal or Improper Activity

MAY 2014

52.203-12 Limitation On Payments To Influence Certain Federal

Transactions

OCT 2010

52.203-17 Contractor Employee Whistleblower Rights and

Requirement To Inform Employees of Whistleblower

Rights

APR 2014

52.204-2 Security Requirements AUG 1996

52.204-4 Printed or Copied Double-Sided on Postconsumer Fiber

Content Paper

MAY 2011

52.204-13 System for Award Management Maintenance OCT 2016

52.204-18 Commercial and Government Entity Code Maintenance JUL 2016

52.204-19 Incorporation by Reference of Representations and

Certifications.

DEC 2014

52.209-10 Prohibition on Contracting With Inverted Domestic

Corporations

NOV 2015

52.212-4 Contract Terms and Conditions--Commercial Items JAN 2017

52.215-17 Waiver of Facilities Capital Cost of Money OCT 1997

52.215-23 Limitations on Pass-Through Charges OCT 2009

52.217-8 Option To Extend Services NOV 1999

52.222-36 Equal Opportunity for Workers with Disabilities JUL 2014

52.223-6 Drug-Free Workplace MAY 2001

52.224-3 Privacy Training JAN 2017

52.227-1 Authorization and Consent DEC 2007

52.227-2 Notice And Assistance Regarding Patent And Copyright

Infringement

DEC 2007

52.229-4 Federal, State, And Local Taxes (State and Local

Adjustments)

FEB 2013

52.232-1 Payments APR 1984

52.232-9 Limitation On Withholding Of Payments APR 1984

52.232-39 Unenforceability of Unauthorized Obligations JUN 2013

52.232-40 Providing Accelerated Payments to Small Business

Subcontractors

DEC 2013

52.233-1 Disputes MAY 2014

52.242-13 Bankruptcy JUL 1995

52.245-1 Government Property JAN 2017

52.246-4 Inspection Of Services--Fixed Price AUG 1996

52.247-34 F.O.B. Destination NOV 1991

52.249-2 Termination For Convenience Of The Government

(Fixed-Price)

APR 2012

252.201-7000 Contracting Officer's Representative DEC 1991

252.203-7000 Requirements Relating to Compensation of Former DoD Officials SEP 2011

252.203-7001 Prohibition On Persons Convicted of Fraud or Other Defense-

Contract-Related Felonies

DEC 2008

252.203-7002 Requirement to Inform Employees of Whistleblower Rights SEP 2013

252.203-7003 Agency Office of the Inspector General DEC 2012

252.203-7004 Display of Hotline Posters OCT 2013

252.204-7000 Disclosure Of Information OCT 2013

252.204-7002 Payment For Subline Items Not Separately Priced DEC 1991

252.204-7003 Control Of Government Personnel Work Product APR 1992

252.204-7005 Oral Attestation of Security Responsibilities NOV 2001

252.204-7009 Limitations on the Use or Disclosure of Third-Party Contractor

Reported Cyber Incident Information

OCT 2013

252.204-7012 Safeguarding Covered Defense Information and Cyber Incident

Reporting

OCT 2013

252.204-7015 Notice of Authorized Disclosure of Information for Litigation

Support

MAY 2013

252.205-7000 Provision Of Information To Cooperative Agreement Holders DEC 1991

252.209-7004 Subcontracting With Firms That Are Owned or Controlled By The

Government of a Country that is a State Sponsor of Terrorism

OCT 2015

252.223-7004 Drug Free Work Force SEP 1988

252.223-7006 Prohibition On Storage, Treatment, and Disposal of Toxic or

Hazardous Materials

SEP 2014

252.225-7048 Export-Controlled Items JUN 2013

252.226-7001 Utilization of Indian Organizations and Indian-Owned Economic

Enterprises, and Native Hawaiian Small Business Concerns

SEP 2004

252.227-7013 Rights in Technical Data--Noncommercial Items FEB 2014

252.227-7014 Rights in Noncommercial Computer Software and Noncommercial

Computer Software Documentation

FEB 2014

252.227-7013 Rights in Bid or Proposal Information JAN 2011

252.227-7025 Limitations on the Use or Disclosure of Government-Furnished

Information Marked with Restrictive Legends

MAY 2013

252.227-7030 Technical Data--Withholding Of Payment MAR 2000

252.227-7037 Validation of Restrictive Markings on Technical Data SEP 2013

252.227-7039 Patents--Reporting Of Subject Inventions APR 1990

252.232-7000 Advanced Payment Pool DEC 1991

252.232-7003 Electronic Submission of Payment Requests and Receiving Reports JUN 2012

252.232-7010 Levies on Contract Payments DEC 2006

252.237-7010 Prohibition on Interrogation of Detainees by Contractor Personnel JUN 2013

252.239-7000 Protection Against Compromising Emanations JUN 2004

252.239-7001 Information Assurance Contractor Training and Certification JAN 2008

252.239-7018 Supply Chain Risk OCT 2015

252.242-7006 Accounting System Administration FEB 2012

252.243-7002 Requests for Equitable Adjustment DEC 2012

252.244-7000 Subcontracts for Commercial Items JUN 2013

252.244-7001 Contractor Purchasing System Administration MAY 2014

252.247-7023 Transportation of Supplies by Sea APR 2014

CLAUSES INCORPORATED BY FULL TEXT

52.219-28 POST-AWARD SMALL BUSINESS PROGRAM REREPRESENTATION (JULY 2013)

(a) Definitions. As used in this clause--

Long-term contract means a contract of more than five years in duration, including options. However, the term does not include contracts that exceed five years in duration because the period of performance has been extended for a cumulative period not to exceed six months under the clause at 52.217-8, Option to

Extend Services, or other appropriate authority.

Small business concern means a concern, including its affiliates that is independently owned and operated, not dominant in the field of operation in which it is bidding on Government contracts, and qualified as a small business under the criteria in 13 CFR part 121 and the size standard in paragraph (c) of this clause.

Such a concern is ``not dominant in its field of operation'' when it does not exercise a controlling or major influence on a national basis in a kind of business activity in which a number of business concerns are primarily engaged. In determining whether dominance exists, consideration shall be given to all appropriate factors, including volume of business, number of employees, financial resources, competitive status or position, ownership or control of materials, processes, patents, license agreements, facilities, sales territory, and nature of business activity.

(b) If the Contractor represented that it was a small business concern prior to award of this contract, the

Contractor shall represent its size status according to paragraph (e) of this clause or, if applicable, paragraph (g) of this clause, upon the occurrence of any of the following:

(1) Within 30 days after execution of a novation agreement or within 30 days after modification of the contract to include this clause, if the novation agreement was executed prior to inclusion of this clause in the contract.

(2) Within 30 days after a merger or acquisition that does not require a novation or within 30 days after modification of the contract to include this clause, if the merger or acquisition occurred prior to inclusion of this clause in the contract.

(3) For long-term contracts--

(i) Within 60 to 120 days prior to the end of the fifth year of the contract; and

(ii) Within 60 to 120 days prior to the date specified in the contract for exercising any option thereafter.

(c) The Contractor shall represent its size status in accordance with the size standard in effect at the time of this representation that corresponds to the North American Industry Classification System (NAICS) code assigned to this contract. The small business size standard corresponding to this NAICS code can be found at http://www.sba.gov/content/table-small-business-size-standards.

(d) The small business size standard for a Contractor providing a product which it does not manufacture itself, for a contract other than a construction or service contract, is 500 employees.

(e) Except as provided in paragraph (g) of this clause, the Contractor shall make the representation required by paragraph (b) of this clause by validating or updating all its representations in the Representations and

Certifications section of the System for Award Management (SAM) and its other data in SAM, as necessary, to ensure that they reflect the Contractor's current status. The

Contractor shall notify the contracting office in writing within the timeframes specified in paragraph (b) of this clause that the data have been validated or updated, and provide the date of the validation or update.

(f) If the Contractor represented that it was other than a small business concern prior to award of this contract, the Contractor may, but is not required to, take the actions required by paragraphs (e) or (g) of this clause.

(g) If the Contractor does not have representations and certifications in SAM, or does not have a representation in SAM for the NAICS code applicable to this contract, the Contractor is required to complete the following representation and submit it to the contracting office, along with the contract number and the date on which the representation was completed:

The Contractor represents that it ( ) is, ( ) is not a small business concern under NAICS Code 541519-assigned to contract number HB0001-20-R-0007.

(Contractor to sign and date and insert authorized signer's name and title).

(End of clause)

252.232-7006 WIDE AREA WORKFLOW PAYMENT INSTRUCTIONS (MAY 2013)

(a) Definitions. As used in this clause--

Department of Defense Activity Address Code (DoDAAC) is a six position code that uniquely identifies a unit, activity, or organization.

Document type means the type of payment request or receiving report available for creation in Wide Area

WorkFlow (WAWF).

Local processing office (LPO) is the office responsible for payment certification when payment certification is done external to the entitlement system.

(b) Electronic invoicing. The WAWF system is the method to electronically process vendor payment requests and receiving reports, as authorized by DFARS 252.232-7003, Electronic Submission of Payment Requests and Receiving Reports.

(c) WAWF access. To access WAWF, the Contractor shall--

(1) Have a designated electronic business point of contact in the System for Award Management at https://www.acquisition.gov; and

(2) Be registered to use WAWF at https://wawf.eb.mil/ following the step-by-step procedures for self-registration available at this Web site.

(d) WAWF training. The Contractor should follow the training instructions of the WAWF Web-Based

Training Course and use the Practice Training Site before submitting payment requests through

WAWF. Both can be accessed by selecting the “Web Based Training” link on the WAWF home page at https://wawf.eb.mil/.

(e) WAWF methods of document submission. Document submissions may be via Web entry, Electronic

Data Interchange, or File Transfer Protocol.

(f) WAWF payment instructions. The Contractor must use the following information when submitting payment requests and receiving reports in WAWF for this contract/order:

(1) Document type. The Contractor shall use the following document type(s).

COMBO

(Contracting Officer: Insert applicable document type(s). Note: If a “Combo” document type is identified but not supportable by the Contractor's business systems, an “Invoice” (stand-alone) and

“Receiving Report” (stand-alone) document type may be used instead.)

(2) Inspection/acceptance location. The Contractor shall select the following inspection/acceptance location(s) in WAWF, as specified by the contracting officer.

HB0001

(Contracting Officer: Insert inspection and acceptance locations or “Not applicable”.)

(3) Document routing. The Contractor shall use the information in the Routing Data Table below only to fill in applicable fields in WAWF when creating payment requests and receiving reports in the system.

Routing Data Table*

Field Name in WAWF Data to be entered in WAWF

Pay Official DoDAAC F87700

Issue By DoDAAC HB0001

Admin DoDAAC HB0001

Inspect By DoDAAC HB0001

Ship To Code HB0001

(*Contracting Officer: Insert applicable DoDAAC information or “See schedule” if multiple ship to/acceptance locations apply, or “Not applicable.”)

(4) Payment request and supporting documentation. The Contractor shall ensure a payment request includes appropriate contract line item and subline item descriptions of the work performed or supplies delivered, unit price/cost per unit, fee (if applicable), and all relevant back-up documentation, as defined in DFARS Appendix F, (e.g. timesheets) in support of each payment request.

(5) WAWF email notifications. The Contractor shall enter the email address identified below in the “Send

Additional Email Notifications” field of WAWF once a document is submitted in the system.

N/A

(Contracting Officer: Insert applicable email addresses or “Not applicable.”)

(g) WAWF point of contact. (1) The Contractor may obtain clarification regarding invoicing in WAWF from the following contracting activity's WAWF point of contact.

N/A

(Contracting Officer: Insert applicable information or “Not applicable.”)

(2) For technical WAWF help, contact the WAWF helpdesk at 866-618-5988.

(End of clause)

Signed_______________________________