RFP No. 106952 - Network Penetration Testing.pdf

University of Maryland

College Park

Request for Proposal (RFP) No. 106952

For Network Penetration Testing

Issue Date: May 14, 2021

Pre-Proposal Conference: Not Applicable

Deadline for Questions: May 24, 2021at 5:00 PM EDT*

Proposal Due Date: May 31,2021 at 3:00 PM EDT*

Notice of Intent to Award: Tentatively, June 10, 2021

Estimated Date for Contract Award: Tentatively, June 18, 2021

* All times listed are Local Time, College Park, MD

WARNING: Offerors who have received this document from a source other than the Issuing

Office should immediately contact the Issuing Office and provide their name and mailing address in order that amendments to the RFP or other communications can be sent to them.

Offerors who fail to notify the Issuing Office with this information assume complete responsibility in the event that they do not receive communications from the Issuing Office prior to the closing date.

Offerors are cautioned not to make changes to any of the terms and conditions in this solicitation. Doing so may render a Offeror’s proposal unacceptable and subject to rejection. Questions and comments must be addressed to the point of contact identified in

Section A-1, Item 9 of this document.

TABLE OF CONTENTS

PART I – THE SCHEDULE

SECTION A-1 – SOLICITATION / CONTRACT FORM

Section A-2 - Instructions, Conditions and Notices to Offerors

A. ISSUING OFFICE

B. PRE-PROPOSAL CONFERENCE

C. QUESTIONS

D. SUBMISSION OF PROPOSALS

E. CLOSING DATE

F. LATE PROPOSALS

G. DURATION OF PROPOSAL OFFER

H. AMENDMENTS TO THE RFP

I. ALTERNATE PROPOSALS

J. ECONOMY OF PREPARATION

K. UNABLE TO PROPOSE

L. PUBLIC INFORMATION ACT NOTICE

M. TWO VOLUME PROPOSAL

N. CANCELLATION OF THE RFP

O. ORAL PRESENTATIONS/DEMONSTRATIONS

P. SOLICITATION, PROPOSAL ACCEPTANCE, AWARD AND DISCUSSIONS

Q. EVIDENCE OF RESPONSIBILITY

R. ELECTRONIC FUNDS TRANSFER (EFT)

S. FORMATION OF AGREEMENT/CONTRACT WITH SUCCESSFUL CONTRACTOR

T. DEBRIEFING OF UNSUCCESSFUL PROPOSORS

U. CONTRACT IMPLEMENTATION MEETING

Y. CONTRACTOR REPORTING OF SUSPECTED CHILD ABUSE AND NEGLECT

Z. FIRM FIXED PRICED (FFP) CONTRACT

AA. SERVICES ORDERED AND DELIVERED

AB. COMMERCIAL NONDISCRIMINATION CLAUSE

AC. PROTECTION OF UNIVERSITY DATA

Section B – Pricing

1. FINANCIAL PROPOSAL REQUIREMENTS

Section C – Description/Specifications/Scope of Work

1. BACKGROUND

2. SCOPE OF WORK

3. OBJECTIVES

Functional Requirements and Features

Project Deliverables

Section D - Packaging and Marking

Section E - Inspection and Acceptance

Section F – Delivery and Performance

Section G - Contract Administration Data

Section H - Special Contract Requirements

PART II - CONTRACT CLAUSES

Section I - Contract Clauses

PART III - LIST OF DOCUMENTS, EXHIBITS, AND OTHER ATTACHMENTS

Section J - List of Attachments

PART IV - REPRESENTATIONS AND INSTRUCTIONS

Section K – Representations, Certifications and other Statements

BID/PROPOSAL AFFIDAVIT

CONTRACT AFFIDAVIT

CONFLICT OF INTEREST INFORMATION

CONFLICT OF INTEREST AFFIDAVIT AND DISCLOSURE

PRINCIPLES OF SOCIAL RESPONSIBILITY

and

SOCIAL RESPONSIBILITY AFFIDAVIT INFORMATION

SOCIAL RESPONSIBILITY AFFIDAVIT AND DISCLOSURE

CERTIFICATION REGARDING INVESTMENT ACTIVITIES IN IRAN

Section L - Evaluation Factors for Award

University of Maryland RFP No. 106952 for Network Penetration Testing

Version Jan 2004

PART I – THE SCHEDULE

SECTION A-1 – SOLICITATION / CONTRACT FORM

1. CONTRACT NUMBER

2. SOLICITATION NUMBER

106952

3. TYPE OF SOLICITATION

NEGOTIATED (RFP)

4. DATE ISSUED

5/14/2021

5. REQUISITION NUMBER

106952

6. ISSUED BY

UNIVERSITY OF MARYLAND COLLEGE PARK

DEPARTMENT OF PROCUREMENT AND STRATEGIC

SOURCING

2113-R CHESAPEAKE BUILDING

COLLEGE PARK, MARYLAND 20742

7. ADDRESS PROPOSAL TO

University of Maryland Department of Procurement and Strategic Sourcing

Attn.: RFP Number 106952

2113-R Chesapeake Building College Park, Maryland 20742-3111 (www.purchase.umd.edu)

SOLICITATION

8. Sealed proposals in original plus number of copies specified in Section A-2, Subsection D for furnishing the supplies or services in the Schedule will be received at the location specified in Item 7 (if no location is specified in Item 7, then the location specified in Item 6) until the date and time specified in Section A-2, Subsection E.

CAUTION – LATE Submissions, Modifications, and Withdrawals; see Section A-2, Subsection F entitled "Late Proposals". All offers are subject to all terms and conditions contained in this solicitation.

9. FOR

INFORMATION

CALL

A. NAME

Antwan Davis

B. TELEPHONE (NO COLLECT

CALLS)

C. E-MAIL ADDRESS

addavis@umd.edu

D. FAX NUMBER

301-405-9565

AREA CODE

NUMBER

405-3853

OFFER (Must be fully completed by Contractor)

10. In compliance with the above, the undersigned agrees, if this offer is accepted within the time period specified in Section A-2, Subsection G, to furnish any or all items upon which prices are offered at the price set opposite each item, delivered at the designated point(s), within the time specified in the Schedule.

11. ACKNOWLEDGEMENT OF AMENDMENTS

The Contractor acknowledges receipt of all amendments to the SOLICITATION.

This contract incorporates the Solicitation/Request for Proposal and any amendments thereto, as well as Contractor's proposal and amendments thereto. In the event of a discrepancy between the terms of this contract, including amendments and modifications made thereto, and Contractor's proposal and amendments thereto, the discrepancy shall be resolved by giving precedence in the following order:

a) This Contract, including the Solicitation/Request for Proposal and amendments and modifications made thereto

b) Contractor's proposal, including amendments and modifications made to the proposal.

This contract, including the documents incorporated by reference and any negotiated changes prior to contract award, contains the entire agreement of the parties and supersedes all prior agreements and understandings, oral or otherwise, between the parties.

12. NAME, ADDRESS AND FEI NUMBER OF

CONTRACTOR

13. CONTRACTOR REMIT-TO ADDRESS

14. NAME TITLE AND E-MAIL OF PERSON

AUTHORIZED TO SIGN OFFER (Print or Type)

15. TELEPHONE NUMBER 16. SIGNATURE 17. OFFER DATE

AREA CODE

NUMBER

EXT.

AWARD (To be completed by University)

18. ACCEPTED AS TO ITEMS LABELED

19. AMOUNT 20. KFS ACCOUNT NUMBER

21. ADMINISTERED BY (If other than Item 6)

22. NAME OF PROCUREMENT OFFICER

(Type or Print)

23. UNIVERSITY OF MARYLAND

(Signature of Procurement Officer)

24. AWARD DATE

IMPORTANT – Award will be made on this Form or by other authorized official written notice.

http://www.purchase.umd.edu/ mailto:addavis@umd.edu

RFP for Network Penetration Testing 2

Section A-2 - Instructions, Conditions and Notices to Offerors

A. ISSUING OFFICE

The sole point of contact at the University of Maryland, College Park (hereinafter “University” or “University of Maryland”) for purposes of this Request for Proposal (RFP) is the Issuing

Office. The location of the Issuing Office is contained in Part I, Section A-1, Item 6 of this document. Point of contact information is listed in Part I, Section A-1, Items 9(a) through 9(d) of this document.

B. PRE-PROPOSAL CONFERENCE

There will be no pre-proposal conference for this solicitation.

C. QUESTIONS

Each Offeror is responsible for reading carefully and understanding fully the terms and conditions of this RFP. All contact between Offerors and the University will be formally made at scheduled meetings or in writing through the Issuing Office. Requests for clarification or additional information must be made in writing to the Procurement Officer and received at the

Issuing Office no later than May 24, 2021 at 5:00 PM EDT (Local Time, College Park, MD).

Such requests should contain the following: QUESTIONS: RFP # 106952. Only written communications relative to the procurement shall be considered. Hard copy, facsimile and electronic mail are acceptable methods for submission of questions. It is incumbent upon the

Offeror to verify University receipt of their questions.

All questions will be answered in writing. Both questions and answers will be distributed, without identification of the inquirer(s), to all Offerors who are on record with the Procurement

Officer as having received this RFP. No oral communications can be relied upon for proposal purposes.

To the extent that a question causes a change to any part of this RFP, an amendment shall be issued addressing such.

D. SUBMISSION OF PROPOSALS

Proposals must be:

(1) submitted in the format set forth herein,

(2) made in the official name of the firm or individual under which Offeror's business is conducted (including the official business address),

(3) signed by a person duly authorized to commit Offeror to the proposal,

(4) submitted in envelopes clearly marked with the assigned RFP number,

(5) separated into Technical and Financial volumes, and

(6) addressed to the Procurement Officer identified in Section A-1, Item 9 and sent to the address shown in Section A-1, Item 7.

RFP for Network Penetration Testing 3

The Offeror must submit one (1) electronic copy of the Proposal via eMM and/or email (1) copy to addavis@umd.edu.

NOTE: ELECTRONIC SUBMISSIONS OF PROPOSALS ARE PERMITTED. UMD

WILL RECEIVED ELECTRONIC SUBMISSIONS OF PROPOSALS IN

ACCORDANCE WITH THE FOLLOWING REQUIREMENTS:

(1) Electronic submissions will be accepted through eMaryland Marketplace. In order to submit a proposal electronically you must register as a Vendor through eMaryland Marketplace http://news.maryland.gov/dgs/emarylandmarketplace/

(2) Refer to the eMaryland Marketplace (eMM) Instruction Guide titled “Submitting a

Bid” found on the following website:

http://dgs.maryland.gov/Pages/Procurement/eMMLinks.aspx Follow these specific instructions for submitting a proposal in response to this RFP:

a. Items Tab – eMM requires vendors to enter pricing, however UMD does

NOT require pricing to be entered into eMM. The vendor should enter the pricing as $0 in eMM. UMD will rely solely on the hard copy Financial

Volume submission in response to the RFP for pricing. Below is an example of how to complete the Items Tab to submit in eMM:

b. DO NOT USE the Questions, Subcontractor, Notes and Terms & Conditions

Tabs. UMD does NOT use any of these tabs in eMMA.

c. Use the Attachments Tabs to submit the proposal electronically in accordance with the submission requirements outlined above.

(3) LATE PROPOSALS WILL NOT BE ACCEPTED UNDER ANY

CIRCUMSTANCES.

(4) THE ORIGINAL TECHNICAL VOLUME AND THE ORIGINAL FINANCIAL

VOLUME MUST BE RECEIVED BY THE DEPARTMENT OF PROCUREMENT

AND STRATEGIC SOURCING WITHIN THREE WORKING DAYS OF THE

PROPOSAL DUE DATE AND TIME. THE ORIGINAL COPIES SHOULD BE

SUBMITTED IN ACCORDANCE WITH SECTION A-2 OF THE RFP.

(5) PROPOSALS CONVEYED BY EMAIL WILL BE ACCEPTED

E. CLOSING DATE

http://dgs.maryland.gov/Pages/Procurement/eMMLinks.aspx

RFP for Network Penetration Testing 4

Proposals must be submitted as referenced in Section A, Item 7 of this document on or before the closing date of May 31, 2021 at 3:00 PM EDT (Local Time, College Park, MD), in the format set forth herein.

Proposals, amendments to proposals, or requests for withdrawal of proposals arriving after the closing time and date shall not be considered. There shall be no public opening of the proposals.

The names of Offerors will not be released until after award.

F. LATE PROPOSALS

Any proposal, request for withdrawal, or modification of a proposal including a Best and Final

Offer (BAFO) that is not received at the designated location, time and date set forth herein will be considered late and shall not be considered. Delivery of the proposal to the specified location by the prescribed time and date is the sole responsibility of the Offeror. Exceptions may be authorized, at the sole discretion of the Procurement Officer, when the reason for the late proposal, late request for withdrawal, late modification of a proposal or BAFO is due to the action or inaction of the University. A record of the late proposal, request for withdrawal, modification of a proposal or BAFO shall be made in the appropriate procurement file.

G. DURATION OF PROPOSAL OFFER

Proposals shall be valid for a minimum of 120 days following the closing date of this RFP. If an award is not made during that period, the proposal shall automatically extend for another 120 days, unless the Offeror gives specific written notice to the Procurement Officer at least 15 days before the expiration of the then current 120-day period. Proposals shall automatically renew for an additional 120 days until such time as an award is made or proper written notice is given to the University of Offeror's intent to withdraw its proposal. By submission of a proposal, Offeror guarantees that its offer shall be firm for the period specified above.

H. AMENDMENTS TO THE RFP

If it becomes necessary to revise any part of this RFP, notice of the revision will be given in the form of an amendment to Offerors who are on record with the Procurement Officer as having received this RFP. All amendments shall become a part of this RFP. Each offeror must acknowledge receipt of amendments, and the failure of an offeror to acknowledge any amendment shall not relieve the offeror of the responsibility for complying with the terms thereof.

RFP for Network Penetration Testing 5

I. ALTERNATE PROPOSALS

In the mutual interest of receiving the best proposal, the University will consider alternate price and technical proposals. In order to submit an alternate proposal, however, a Contractor must submit additional proposals in the exact format required herein.

J. ECONOMY OF PREPARATION

Each proposal should be prepared simply and economically, providing a straightforward, concise description of the offer and capabilities to satisfy the requirements of this RFP. Emphasis should be on completeness and clarity of content.

K. UNABLE TO PROPOSE

If offeror is unable or unwilling to submit a proposal in response to the requirements, offeror must indicate such in writing to the Procurement Officer on or before the proposal due date.

Hard copy, facsimile and electronic mail are acceptable. Please include a brief explanation of the rationale for non-submission of a proposal.

L. PUBLIC INFORMATION ACT NOTICE

Offerors shall specifically identify those portions of their proposals that they deem to contain confidential, proprietary information or trade secrets and shall provide specific justification, with respect to each separate portion identified, why such materials, upon request, should not be disclosed by the State under the Access to Public Records Act, State Government Article, Title

10, Subtitle 6, Annotated Code of Maryland.

In order for such claims of confidentiality to be considered, Offerors must clearly identify and provide individual justification for each and every section that is claimed to contain confidential, proprietary information or trade secrets. It is NOT sufficient to preface your proposal with a proprietary statement, or to use a page header or footer that arbitrarily marks some or all pages as confidential. General claims of confidentiality or similar blanket designations shall not be effective.

M. TWO VOLUME PROPOSAL

The selection procedure for this procurement requires an independent evaluation of the technical and financial proposals. This separation allows for evaluation of technical proposals on their technical merit only. Consequently, offeror shall submit its proposal in two separately sealed volumes as indicated below. No pricing information is to be included in the technical proposal.

See Part IV, Section N for additional details pertaining to the evaluation process.

1. VOLUME I - TECHNICAL

This volume should be prepared in a clear and concise manner with pages numbered.

The technical volume shall not contain any price information. If such is included in the

RFP for Network Penetration Testing 6 technical volume, it may not be evaluated by the financial evaluation committee.

Volume I must contain the following sections:

a. CONTENTS AND FORMAT

i. Failure to include any of the items listed below may result in a determination by the Procurement Officer that the Proposer in not reasonably susceptible of being selected for award.

ii. Order of proposal: Compile the Technical Proposal in the order shown below, with tabs or equivalent to indicate different sections of the proposal.

• Section A-1 – Solicitation/Contract Form

• Table of Contents

• Functional Requirements Matrix (see Section C), the electronic copy of the Section C Matrix responses must be submitted in a

Microsoft Word format.

• Additional Support Documentation (Any additional support documentation, required or otherwise provided)

• Acknowledgements of any Amendments issued

• Affidavits (see Section M):

• Bid/Proposal Affidavit

• Contract Affidavit

• Conflict of Interest Information, Affidavit and

Disclosure

• Social Responsibility Information, Affidavit and

Disclosure

• Certification Regarding Investment Activities in Iran

i. The University may make a final determination regarding a proposal’s acceptability solely on the basis of the proposal as submitted.

b. SPECIFICATIONS

Offerors are urged to read the specifications very carefully and to submit their questions, in writing, by the due date for questions. Misinterpretation of specifications by the offeror shall not relieve the offeror of responsibility to accurately address the requirements of this RFP or to perform the contract, if awarded.

The information/items specified herein must be addressed in the technical proposal. The proposal must expressly indicate that it satisfies each point of the

RFP requirements and specifications, reference Section C. Simple YES or NO responses to stated requirements are insufficient. Rather, the offeror must describe in detail how the proposed products and/or services meet or exceed the stated requirements. Additionally, the offeror must explain any exception or deviation from the requirements.

Proposals must be:

1. submitted in the format set forth herein, RFP for Network Penetration Testing 7

2. made in the official name of the firm or individual under which Offeror's business is conducted (including the official business address),

3. signed by a person duly authorized to commit Offeror to the bid,

4. submitted in envelopes clearly marked with the assigned RFP number,

5. separated into independent Technical and Financial Proposal Volumes

6. addressed to the Procurement Officer identified in Section A-1, Item 9 and sent to the address shown in Section A-1, Item 7.

7. The Offeror must submit one (1) original (marked "original") and one (1) electronic copy of the technical volume.

▪ The volume which contain original documents, should be clearly identified as the ORIGINAL Technical Volume

▪ Technical Proposal must contain:

• Offerors must complete all Items the Solicitation / Contract

Form (Section A-1) of this document and include TWO signed originals as part of Offeror's Technical proposal, in the original

Technical Volume. Failure to submit these signed documents may cause the Offeror’s proposal to be rejected, at the sole discretion of the University.

2. VOLUME II - FINANCIAL

This volume consists of and must contain the following items. Offerors shall not include any technical information or specifications in the financial volume. If such are included in the financial volume, they may not be evaluated by the technical evaluation committee.

a. PRICING SECTION

This volume shall be in accordance with Section B – Pricing.

b. FINANCIAL VIABILITY

The University reserves the right to require, during proposal evaluation, that the

Offeror provide a copy of its most current Annual Report or audited Statement of

Financial Condition to include a Balance Sheet, Income Statement and Cash Flow

Statement or other acceptable financial information. These documents may be relied on in any determination regarding Offeror financial responsibility.

c. NOTICES INFORMATION

Offerors must complete Section I.6 and submit this information as part of their financial proposal.

RFP for Network Penetration Testing 8

N. CANCELLATION OF THE RFP

The University may cancel this RFP, in whole or in part, or reject all proposals submitted in response to the RFP when such action is determined to be fiscally advantageous to the University and/or the State or otherwise in the best interest of the University and/or the State.

O. ORAL PRESENTATIONS/DEMONSTRATIONS

At the sole discretion of the Procurement Officer, short-listed Proposers may be invited to provide an oral presentation and product demonstration. Information provided during this phase will be used to supplement the prior evaluation of the written technical proposal and the final evaluation of technical capabilities will take into account both the written technical proposal and the oral presentation/product demonstrations.

1. The University reserves the right to waive the Oral Presentation/Product

Demonstration, in which case the technical evaluation will be based on the written technical proposal submittal alone. Proposers are therefore encouraged to submit the best possible proposal at each opportunity for submittal

2. The due date and time of the oral presentation/product demonstration will be determined by the University upon evaluation completion of Technical Proposals. The actual date will be verified with the applicable Proposers at the time the presentation is requested. Refer to the Solicitation Schedule for tentative dates. Proposers are advised to set these dates aside so as to avoid a conflict

3. The oral presentation will be informal, as the University is not interested in a marketing presentation, rather, it will be a casual and informal format in which to view the Proposers presentations, etc.

4. The purpose of the oral presentation/product demonstration will be determined by the

University.

5. Formal written instructions will be sent to each Proposer invited to provide an Oral

Presentation. The criteria and format of the demonstration will be provided with the written request to conduct an oral presentation.

P. SOLICITATION, PROPOSAL ACCEPTANCE, AWARD AND DISCUSSIONS

This RFP creates no obligation on the part of the University to award a contract or to compensate

Offerors for proposal preparation expenses. The University reserves the unilateral right to cancel this solicitation at any time and to accept or reject any and all proposals, in whole or in part, received in response to this RFP; the unilateral right to award a contract in whole or in part; to award a contract to one Contractor or multiple Contractors; to waive or permit cure of minor irregularities; and to conduct discussions with Offerors in any manner necessary to serve the best interest of the University.

Discussions may be conducted with those Offerors who submit proposals initially judged by the

Procurement Officer to be reasonably susceptible of being selected for award. However, the

University reserves the right to award a contract based upon the proposals received without further discussions.

RFP for Network Penetration Testing 9

Q. EVIDENCE OF RESPONSIBILITY

Prior to the award of a contract pursuant to this RFP, the Procurement Officer may require

Offeror to submit such additional information bearing upon Offeror's ability to perform the contract as the Procurement Officer deems appropriate. The Procurement Officer may also consider any information otherwise available concerning the financial, technical, and other qualifications or abilities of the Offeror.

R. ELECTRONIC FUNDS TRANSFER (EFT)

By submitting a response to this solicitation, the Offeror agrees to accept payments by electronic funds transfer (EFT) unless the State Comptroller’s Office grants an exemption. The selected

Offeror shall register using the COT/GAD X-10 Vendor Electronic Funds Registration Request

Form, which may be found on the following website:

https://comptroller.marylandtaxes.gov/Vendor_Services/Accounting_Information/Electronic_Funds_Tran sfer/

Any request for exemption must be submitted to the State Comptroller’s Office for approval at the address specified on the COT/GAD X-10 form and must include the business identification information as stated on the form and include the reason for the exemption.

See Payment of University Obligations clause in PART II, Contract Clauses, Section I for additional information.

S. FORMATION OF AGREEMENT/CONTRACT WITH SUCCESSFUL

CONTRACTOR

This Contract shall also include any other forms or documents deemed necessary by the

Procurement Officer.

This RFP and any resulting contract shall be governed by the University System of Maryland

Procurement Policies and Procedures, and University of Maryland Procurement Policies and

Procedures. These policies and procedures may be viewed at the following web site:

www.purchase.umd.edu From the main menu, select the category "Policies and Procedures".

T. DEBRIEFING OF UNSUCCESSFUL PROPOSORS

A debriefing of an unsuccessful proposer shall be conducted upon written request submitted to the Procurement Officer within ten (10) days of the date on which the proposer knew, or should have known, its proposal was unsuccessful. The debriefing shall be limited to a discussion of the proposer’s unsuccessful proposal. The debriefing will be oral and shall provide information on areas in which the proposal was deemed weak or insufficient. The debriefing may NOT include discussion of a competing offeror’s proposal or discussion, thoughts, notes or ranking from an individual evaluation committee member. A summarization of the procurement officer’s rationale for the selection may be given. Debriefings shall be conducted at the earliest feasible time.

https://comptroller.marylandtaxes.gov/Vendor_Services/Accounting_Information/Electronic_Funds_Transfer/ https://comptroller.marylandtaxes.gov/Vendor_Services/Accounting_Information/Electronic_Funds_Transfer/ http://www.purchase.umd.edu/

RFP for Network Penetration Testing 10

U. CONTRACT IMPLEMENTATION MEETING

Contractor receiving an award under this solicitation may be required to attend a Contract

Implementation Meeting to be held after contract award, as scheduled by the Procurement

Officer. The location and agenda for this meeting will be communicated to the Contractor by the

Procurement Officer.

V. NOTICE TO OFFERORS - SMALL BUSINESS RESERVE PROCUREMENT

W. LIVING WAGE REQUIREMENTS - Not Applicable to this Procurement

X. ECONOMIC BENEFITS TO THE STATE OF MARYLAND - Not Applicable to this

Procurement

Y. CONTRACTOR REPORTING OF SUSPECTED CHILD ABUSE AND NEGLECT

1. Maryland Law requires persons who suspect child abuse or neglect to report it.

Contractors must comply with the University System of Maryland Board of Regents VI.1.50

Policy on the Reporting of Suspected Child Abuse and Neglect. This Policy, available at http://president.umd.edu/policies/vi-150.html, is incorporated into the contract.

2. The University reserves the right to terminate the Contract if the Contractor fails to comply with this policy or, if the University judges Contract Termination to be necessary to protect a child’s safety or welfare.

Z. FIRM FIXED PRICED (FFP) CONTRACT

Under award of a resulting FFP contract, Contractor shall be paid only for any services contracted, and/or approved task order actual hours worked at the fully loaded firm fixed hourly labor rates contained herein. The labor rates contained in the pricing sheet shall apply to all hours worked, including overtime hours. Estimates in the pricing sheet are provided for evaluation purposes only.

AA. SERVICES ORDERED AND DELIVERED

The Contractor is authorized to provide only those Services covered by the contract and specifically identified via orders placed by authorized individuals. If a review of orders placed by the Contractor reveals that Services other than that covered by the contract has been ordered and delivered, such delivery shall be a violation of the terms of the contract and may be considered by the Procurement Officer as a basis to terminate the contract and/or as a basis not to award the Contractor a subsequent contract/renewal. The Procurement Officer may take such steps as are necessary to have the items returned by the University, regardless of the time between the date of delivery and discovery of the violation. In such event, the Contractor shall reimburse the University the full purchase price.

AB. COMMERCIAL NONDISCRIMINATION CLAUSE

A. “As a condition of entering into this Agreement, Contractor represents and warrants that it will comply with the State's Commercial Nondiscrimination Policy, as described under State

Finance and Procurement Article, Title 19, Annotated Code of Maryland. As part of this compliance, Contractor may not discriminate on the basis of race, color, religion, ancestry or http://president.umd.edu/policies/vi-150.html

RFP for Network Penetration Testing 11 national origin, sex, age, marital status, sexual orientation, or disability or other unlawful forms of discrimination in the solicitation, selection, hiring, or commercial treatment of subcontractors, vendors, suppliers, or commercial customers, nor shall Contractor retaliate against any person for reporting instances of such discrimination. Contractor shall provide equal opportunity for subcontractors, vendors, and suppliers to participate in all of its public sector and private sector subcontracting and supply opportunities, provided that this clause does not prohibit or limit lawful efforts to remedy the effects of marketplace discrimination that have occurred or are occurring in the marketplace. Contractor understands that a material violation of this clause shall be considered a material breach of this Agreement and may result in termination of this

Agreement, disqualification of Contractor from participating in State contracts, or other sanctions. This clause is not enforceable by or for the benefit of, and creates no obligation to, any third party.

B. The Contractor shall include the provision in §A of this regulation in all subcontracts to the State contract.

C. The following provision is mandatory for all State contracts: As a condition of entering into this Agreement, upon the request of the Maryland Commission on Human Relations, and only after the filing of a complaint against Contractor under State Finance and Procurement

Article, Title 19, Annotated Code of Maryland, as amended from time to time, Contractor agrees to provide within 60 days after the request a complete list of the names of all subcontractors, vendors, and suppliers that Con tractor has used in the past 4 years on any of its contracts that were undertaken within the State of Maryland, including the total dollar amount paid by

Contractor on each subcontract or supply contract. Contractor further agrees to cooperate in any investigation conducted by the State pursuant to the State's Commercial Nondiscrimination

Policy as set forth under State Finance and Procurement Article, Title 19, Annotated Code of

Maryland, and to provide any documents relevant to any investigation that is requested by the

State. Contractor understands that violation of this clause is a material breach of this Agreement and may result in contract termination, disqualification by the State from participating in State contracts, and other sanctions."

AC. PROTESTION OF UNIVERSITY DATA

UNIVERSITY DATA: All data residing on or flowing through servers used by or in the conduct of, the effort described in the Scope of Work shall remain the property of University and shall be considered confidential or proprietary, as defined in section 2.0 below.

1. University Data: University will provide Contractor access to University Data subject to the following terms and conditions:

1.1 University grants Contractor a nonexclusive, nontransferable right and license to access and use University Data solely to fulfill its obligations with respect to implementation and conduct of the statement of work herein defined.

1.2 The license granted to Contractor does not grant Contractor any rights to copy, distribute, transfer, license, or sell University Data to any third parties or to use

University Data for any purpose not directly related to this Contract.

1.3 Contractor agrees to limit access to University Data to those of its officers, agents and/or employees who are assigned to work on this Contract and who require access to

University Data in order to fulfill Contractor’s obligations hereunder.

RFP for Network Penetration Testing 12

1.4 Under no circumstances will Contractor disclose University Data, in whole or in part, to any person or entity except as authorized under this Contract.

1.5 Contractor acknowledges receipt of and agrees to comply with the Policy On

Confidentiality And Disclosure Of Student Records (III-6.30: Approved by the Board of

Regents, January 11, 1990) and University of Maryland Policy and Procedures on the

Disclosure of Student Educational Records (III-6.30(A): Pres. 1991, 1996, 1997, III-

6.30A), as amended from time to time, and available on line respectively at http://www.usmh.usmd.edu/regents/bylaws/SectionIII/III630.html and http://www.president.umd.edu/administration/policies/section-iii-academic-affairs/iii-

630a. These policies are hereby incorporated as part of this agreement.

1.6 Contractor shall fully and promptly comply with regulations that may be promulgated by the State or Federal governments concerning the privacy of University

Data that Contractor uses and accesses pursuant to this Contract.

1.7 Contractor shall notify University of any breach in the security of University Data immediately upon becoming aware of such breach. Notice shall be issued simultaneously to the University Enterprise CRM Owner and University Procurement Officer, in writing, and shall describe the date, nature and scope of the breach, the causes of the breach, and all steps Contractor has taken as of the date of the notice to remedy the breach.

Contractor will use its best efforts and cooperate fully with University to respond to any such breach.

1.8 University Data is deemed to be Confidential and Proprietary Information for purposes of Section 1.0.

2. Confidential Information

2.1 Definition. Confidential Information means University Data and other information, whether in written, oral, graphic, electronic or physical form, including but not limited to scientific knowledge, know-how, processes, inventions, techniques, formulae, data, plans, and business practices, that are not generally known to the public and that, if tangible, is clearly marked by the disclosing party as Confidential Information at the time of disclosure and which, if oral, is summarized and identified in a writing as

Confidential Information that is submitted to the receiving party within ten (10) days of initial disclosure.

2.2 Exclusions. Confidential Information does not include information that:

2.2.1 is developed by a receiving party independently and without the benefit of

Confidential Information disclosed by the disclosing party;

2.2.2 a receiving party lawfully obtains from a third party without restriction;

2.2.3 is or becomes publicly available through no wrongful act of a receiving party;

2.2.4 is known to the receiving party prior to receipt from the disclosing party;

2.2.5 a receiving party is obligated to produce to comply with applicable laws or regulations, including the Maryland Public Information Act, or pursuant to an order of a court of competent jurisdiction or a valid administrative or congressional subpoena, provided the party receiving such order notifies the disclosing party prior to such disclosure so it may take appropriate action.

2.3 Obligations. In addition to the obligations of Contractor with respect to

University Data under section 1 above, a receiving party shall use reasonable efforts to protect the confidentiality of Confidential Information it receives under this Contract, http://www.usmh.usmd.edu/regents/bylaws/SectionIII/III630.html http://www.president.umd.edu/administration/policies/section-iii-academic-affairs/iii-630a http://www.president.umd.edu/administration/policies/section-iii-academic-affairs/iii-630a

RFP for Network Penetration Testing 13 specifically, a receiving party will disclose Confidential Information it receives to only to those of its officers, agents and employees who are working on this Contract and have a need to know. A receiving party shall obtain the agreement of those to whom

Confidential Information is disclosed to abide by the obligations set forth in this section.

The receiving party will not disclose Confidential Information to any third parties without the prior written approval of the disclosing party. The obligations of confidentiality with respect to Product Deliverables and University Data shall remain in effect until they lose their status as Confidential Information. The obligations of confidentiality with respect to all other Confidential Information received under this Contract shall expire three (3) years after the expiration of the Term.

RFP for Network Penetration Testing 14

Section B – Pricing

Offerors are required to submit a Financial Proposal that provides detailed costs and cost justifications that correspond to the information submitted by the Offeror in the Technical

Proposal.

No pricing information is to be included in the Technical Proposal. The Statement of Work is described in Section C of this document.

1. FINANCIAL PROPOSAL REQUIREMENTS

All Offerors must submit list of proposed prices for all services to be used during the term of the contract. The list of proposed prices should be structured, for each phase, to allow for the calculation of unit cost analyses. The prices included herein are to be firm through the contract term, unless noted otherwise by the Offeror. UMD has the ability to award phases to multiple vendors, if deemed necessary.

Item

Number

Description Quantity Commercial

List

Unit Price

University

Unit Price

University

Total Price

1. Network Penetration Testing 5-20

The University price includes a discount of $______________. Indicate if this discount is:

-standard academic discount _____, -special discount____ . Please explain _______________________________, or

-other ____. Please explain ____________________________.

RFP for Network Penetration Testing 15

Section C – Description/Specifications/Scope of Work

1. BACKGROUND

The University of Maryland, College Park comprises several academic colleges, schools, research institutes, and supporting administrative and business units for the university and its residents. The university employs 14,000 faculty and staff, and has an enrollment of more than

41,000 students (combined undergraduate and graduate).

2. SCOPE OF WORK

The University of Maryland, College Park Division of Information Technology (UMD DivIT) is interested in contracting for a number of penetration test assessments across the academic colleges, schools, research institutes, and supporting administrative and business units that will allow them to address the following high-level goals:

• Gain a better understanding of potential network vulnerabilities that may be exploitable on Internet-facing application services in the absence of authorized credentials.

• Gain a better understanding of potential risks to internal and external campus services and resources in the event of exploitation or compromise of Internet-facing or internal services.

• Evaluate the security associated with application services available to a credentialed user from their institutions’ internal network and an external network.

We anticipate an arrangement that would cover penetration tests with a minimum of 5 tasks and up to 20 tasks across the different campus organizational units, as selected by UMD DivIT with cooperation from involved organizational units. The contract will be for one (1) year, with an option to extend it for up to four (4) additional one (1) year renewals to perform additional 5-20 tasks per year. In addition, the option of requesting additional tests involving one or more organizational units is desirable.

These activities are part of the University of Maryland’s ongoing risk management program and are focused on identifying the risk level the university and its organizational units are currently exposed to so that an appropriate set of responses to those threats and vulnerabilities can be developed.

The University of Maryland, College Park Division of Information Technology is seeking to identify and select an outside independent organization to perform the penetration testing assessment activities. The remainder of this document provides additional information that will allow a service provider to understand the scope of the effort and develop a proposal in the format desired by the University of Maryland, College Park Division of Information Technology.

RFP for Network Penetration Testing 16

3. OBJECTIVES

The objectives of the penetration testing engagements would include:

• Identifying network and host system vulnerabilities that could lead to the compromise of the unit’s (or university’s) network infrastructure.

• This examines specific risks to threats and specific functions for each unit.

• Prioritizing the discovered vulnerabilities according to risk to ensure that each unit’s and the university’s resources are spent on the highest-risk issues with the biggest potential impact on the business. This is a risk reduction and mitigation process.

• Recommending approaches based on industry best practices for addressing all discovered vulnerabilities with an action plan that considers not only the technology, but also, more importantly, the business objectives of each unit and the university. Recommended solutions should be practical, manageable, and cost-effective.

• Minimizing the impact on unit and university personnel resources while conducting the engagements.

Designated unit and university personnel will be notified prior to beginning any testing activity.

The activities will be conducted in close coordination with the university Project Manager, who will be notified prior to beginning any activity in order to coordinate with the proper unit/university personnel and/or to ensure that appropriate unit/university personnel at your facilities observe tests.

RFP for Network Penetration Testing 17

Functional Requirements & Features

To be considered for selection, interested outside organizations should at a minimum be able to:

• Demonstrate experience working with higher educational institutions of similar size and composition. If previous experience working with higher educational institutions is not available, please demonstrate experience with working with organizations similar in size to the University of Maryland, College Park. This should include at least three (3) references of organizations that are similar in size and structure the university.

• Demonstrate experience and ability to test in non-corporate and non-centralized IT environments.

• Demonstrate experience and ability to do internal and external network testing.

• Demonstrate experience and ability to do web application security testing.

• Demonstrate experience and ability to engage in "purple-teaming" testing and training.

This may include performing aspects of the testing with defending personnel present and stepping through some of the tests as well as providing some real-time demonstrations of attacks along with effective defensive and preventative measures.

• Provide a portfolio of experience of actual personnel who will be involved in primary and secondary roles of any testing tasks and engagements. Such experience could include the writing, presentation, and dissemination of industry standards for security testing and defensive practices.

• Demonstrate experience and ability to conduct phishing and other types of user-awareness related assessment tasks and training.

• Describe approach and methodologies to common testing tasks within the described environments.

• Demonstrate experience and familiarity with testing environments where HIPAA and PCI regulations or requirements apply.

RFP for Network Penetration Testing 18

Project Deliverables

Include descriptions of the types of reports and/or other communication methods used to summarize and provide detailed information on security risk, vulnerabilities, and the necessary countermeasures and recommended corrective actions as result of each test.

Include sample reports as attachments to the proposal to illustrate the types of reports that will be provided at the conclusion of each discrete test.

At the conclusion of each assessment, the University requires written documentation of the approach, findings, and recommendations associated with their set of “projects”. A presentation of the findings and recommendations to senior management may also be required. The documentation for each institution should consist of the following:

A. Detailed Technical Report

A document developed for the use of the University’s technical staff which discusses: the methodology employed, positive security aspects identified, detailed technical vulnerability findings, an assignment of a risk rating for each vulnerability, supporting detailed exhibits for vulnerabilities when appropriate, and detailed technical mitigation steps.

B. Executive Summary Report

A document developed to summarize the scope, approach, findings and recommendations for each institution, in a manner suitable for its senior management.

Project Management Approach

Include the method and approach used to manage the overall project, each discrete penetration test, and the client communications and correspondence. Briefly describe your vision of how the engagement proceeds from beginning to end.

Project Team Staffing

Describe the qualifications and relevant experience of the management and key staff assigned to this engagement by providing biographies, relevant experience, and credentials for those personnel. Describe your bonding process and coverage levels for employees. Affirm that employees working on the engagement have not been convicted of a felony.

Key personnel on the engagement may not be replaced without prior approval from the

University. Any replacements would need to be of similar skill level and experience of those key personnel.

Does your organization use outside staff or subcontractors for engagements? If so, what contract for confidentiality is in place to protect penetration test results from disclosure?

Describe any personnel requirements from the University. What are the desired roles, skill sets and experience levels?

RFP for Network Penetration Testing 19

Section D - Packaging and Marking

Not Applicable to this Procurement

Section E - Inspection and Acceptance

The following inspection, testing and acceptance requirements are incorporated herein:

• Delivery shall be made in accordance with the scope of services. All services rendered/deliveries shall confirm and affirm the requirements defined in Section C/Scope of Work.

• Any services that fail to meet the quality and specifications shall be rejected. At the

University’s discretion, the contractor may be requested to re-work any services/deliverables, at no additional cost to the University, until such services/deliverables prove acceptable.

• In the event the Contractor is not able to produce acceptable services/deliverables, the

University reserves the right to purchase replacement services in the open market and charge the Contractor for any excess price paid for the replacement, plus applicable expenses, if any.

• The University, in its sole discretion, may extend the time of performance for excusable delays due to unforeseeable causes beyond the Contractor’s control. The University unilaterally may order in writing the suspension, delay, or interruption of performance hereunder.

• The services listed in the scope of services shall be delivered to the point or points specified prior to, or on the date specified in this Contract.

RFP for Network Penetration Testing 20

Section F – Delivery and Performance

The following delivery or performance requirements are incorporated herein:

1. Prices quoted shall include all transportation and delivery charges fully prepaid by the

Contractor, Free On Board (FOB) Destination to the University of Maryland.

2. When installation is required as part of this contract, the Contractor shall be responsible for removal of all packing materials.

RFP for Network Penetration Testing 21

Section G - Contract Administration Data

1.0 Roles of the University of Maryland Program Manager and Procurement

Officer

The Procurement Officer is the University of Maryland’s authorized representative for all contractual matters related to a resulting agreement. Throughout the duration of the contract, the Procurement Officer shall be the only individual with authority to modify any provisions of this contract including, without limitation, the statement of work, pricing or any other sections of a resulting agreement.

The University of Maryland Program Manager is Kevin Shivers at (301) 405-8836 and designated staff shall be the principal interface on behalf of the University of Maryland for post-award technical matters, and shall have the authority to explain and provide further details regarding the University of Maryland’s expectations concerning the work to be performed hereunder and/or the items to be provided herein. The Program Manager and designated staff shall have no authority to modify any provisions of this contract.

2.0 Invoicing

The Contractor shall provide the following invoicing services. Invoices shall reflect the price structure spelled out in Section B.

Throughout the duration of any resultant contract, the Contractor shall provide one electronic invoice. That must contain the following minimum information:

a. Invoice Number

b. Invoice Date

c. The word ORIGINAL printed on the original copy of the document

d. The full company or corporate name and address; payment address if it differs from corporate address.

e. The full nine (9) digit Federal Tax Identification number (for U.S.

Contractors only) or Social Security Number.

f. Purchase order number and/or contract number.

All invoices issued for services using hourly labor rates must also contain the following elements:

a. An itemized summary showing the time billed, including each staff’s hours, labor category, hourly rate and cost, and the total hours and cost.

D…