RFQ 47HAA020R0001_Postguard 25SEPT2020.pdf

REQUEST FOR QUOTE (RFQ)

Number: 47HAA020R0001

STATEMENT OF WORK (SOW)

For: PORTALGUARD 2 FACTOR AUTHENTICATION

SYSTEM FOR LISTSERV.GSA.GOV

IN SUPPORT OF:

General Services Administration (GSA)

Office of Information Technology (IT)

Corporate IT Services, Applications

Operations and Maintenance Branch

CONDUCTED UNDER:

FAR 6.302-1 (See attached J&A)

With intent to sole source to: PortalGuard by PistolStar, Inc.

ISSUED BY:

GENERAL SERVICES ADMINISTRATION (GSA)

Office of Internal Acquisition (OIA)

1800 F Street, NW

Washington, DC 20405

ISSUED DATE: September 25, 2020

STATEMENT OF WORK (SOW)

Multi-Factor Authentication System for listserv.gsa.gov

Page | 2

1.0 INTRODUCTION

The U.S. General Services Administration (GSA), Office of Internal Acquisition, hereby issues this solicitation as a Request for Quotation (RFQ) and its associated attachments, in support of GSAIT in accordance with FAR Part 6.3 procedures for “PortalGuard 2 Factor authentication” system for listserv.gsa.gov.

GSA-IT Corporate IT Services, Applications Operations and Maintenance Branch has a “Brand Name” requirement for the purchase of “PortalGuard 2 Factor authentication” system for listserv.gsa.gov. GSA-IT offers a publicly available Listserv system which requires multi-factor authentication that supports users web interface.

GSA intends to issue a single award to Pistolstar, Inc. to provide “PortalGuard 2 Factor authentication” system.

1.1 North American Industry Classification System Codes (NAICS)

The NAICS Code: 541519, Other Computer Related Services

1.2 PRODUCT SERVICE CODE (PSC)

D319 IT and Telecom Annual Maintenance Service

2.0 CONTRACT TYPE

Firm-Fixed Price (FFP) Task Order

3.0 BACKGROUND

GSA-IT has a requirement to integrate the PortalGuard authentication system with the listserv.gsa.gov site. GSA-IT offers a publicly available Listserv system and has a requirement to enforce multi-factor authentication for users that log into the web interface and requires changing the authentication process from listserv.gsa.gov to a LDAP, a based system that supports multi-factor authentication.

GSA-IT requires to enforce 2FA multi-factor authentication for users that login to the listserv.gsa.gov web site. Listserv.gsa.gov currently stores usernames and passwords and offers the option of supporting an LDAP directory.

PistolStar shall deliver PortalGuard authentication server and associated services and components to configure the listerv.gsa.gov site for 2-factor authentication.

Page | 3

4.0 OBJECTIVES

The GSA-IT objective is to integrate the existing listserv.gsa.gov site with the PortalGuard authentication system and with open LDAP to add multi-factor authentication to the listserv.gsa.gov site.

4.1 Project Scope:

The Office of GSA Information Technology (GSA-IT) administers a publicly accessible email list server from commercial software vendor LSoft. The email list server is called Listserv.gsa.gov. GSA-IT has a requirement to enforce 2FA authentication for users that login to the listserv.gsa.gov web site.

Listserv.gsa.gov currently stores usernames and passwords in proprietary, encrypted files, and there is an option to support an LDAP directory.

GSA-IT has a requirement to change the authentication process for listserv.gsa.gov to an LDAP based system that supports multi-factor authentication. GSA-IT understands that all users will have to re-enroll into a new back-end directory.

• The Listserv web interface runs on Win2016/IIS 10.

• Public lists are visible to anyone: https://listserv.gsa.gov/cgi-bin/wa.exe

• The system has been running for 20+ years.

• 300 immediate admins that need 2FA, but the total users is undetermined because anyone can go in and create an account.

• GSA-IT does not want to be responsible for administration of another LDAP server so a successful offeror shall remotely install & configure it for GSA-IT and also schedule upgrades. All upgrades that require system downtime shall be performed after-hours in a pre-scheduled maintenance window. GSA typically schedules maintenance windows within the time periods from Friday 9:00 PM to Sunday 9:00PM.

4.2 Design Requirements:

1. The 2FA enrollment and prompting shall be performed by PortalGuard.

2. A new .net HTTP module shall be written. It will gate access to the main "wa.exe" module until the user has authenticated through PortalGuard (e.g. via 2FA).

3. A new OpenLDAP server shall be deployed so that both Listserv and PortalGuard can reference the same user accounts/credentials.

4. The PortalGuard and OpenLDAP servers shall be installed on a server separate from theListserv server. GSA-IT shall provision a server for the OpenLDAP and

PortalGuard software.

5. The operation of the wa.exe module will not be modified. It shall still verify usernames and passwords in real-time and its session management shall still be utilized.

6. Successful offeror shall provide front end branding and alterations so that users shall

Page | 4 be provided on-screen instructions and prompts to create new accounts in OpenLDAP using PortalGuard's self-registration feature and instructions on how to log into the

Listserv.gsa.gov website using their new credentials.

7. The .net HTTP module configuration parameters will include the URL to the

PortalGuard server and the public certificate matching the keypair it will use to sign outbound responses.

8. Successful offeror shall also install and configure the OpenLDAP server in the GSA environment as well as provide scheduled maintenance/upgrades to OpenLDAP two times annually, plus at any time that GSA-IT security detects an application vulnerability with a CVE rating of high or critical.

4.3 Services the vendor shall provide:

1. PortalGuard Authentication Server

2. PortalGuard Identity Provider

3. Multi-Factor Self-Service Password/PIN Reset

4. Multi-factor authentication

5. Renewable 1-year Technical Support and Maintenance Contract

6. Professional Single Sign On configuration Services

7. Professional Deployment Services

8. Provide front-end Branding/Customization Services

9. Enable 2-factor Enrollment and authentication for listserv.gsa.gov site.

4.4 Detailed Authentication Flow

1. The user accesses server as usual (e.g. via bookmark or link).

2. The .net HTTP module will detect access to wa.exe's login form and automatically redirect the user to PortalGuard.

3. User must login through PortalGuard (using OpenLDAP credentials for 1st factor).

4. If the user has not enrolled any 2FA methods, PortalGuard will force them to do so.

5. Once the user has satisfied the PortalGuard logon requirements (including 2FA), the user's browser will be redirected back to the Listserv web server using an auto-submitting form.

6. The HTTP module will ensure the user has passed through the trusted PortalGuard server by verifying a digital signature in the request.

7. The HTTP module will update the session for this request to ensure a new authentication cookie is set down in the response.

8. The HTTP module will let the request continue for normal processing by wa.exe.

a. NOTE: This login should always succeed since Listserv and the

PortalGuard server are both authenticating against the same OpenLDAP server.

9. Before the response created by wa.exe is returned to the user, the HTTP module will add a secure HTTP cookie for authentication purposes.

Page | 5

10. In all future requests, the HTTP module will look for and validate this cookie. If the cookie is missing, invalid or has "expired", the user will be redirected to PortalGuard to re-authenticate with 2FA.

5.0 PRODUCT REQUIREMENT/DESCRIPTION

GSAIT requires the product listed in the table below:

Table 1:

CLIN(s) Manufacturer Part Number Description QTY

Base Year

0001 PortalGuard Authentication

Extension

Subscription Server Software License - Up to 10,000 concurrent users Licensing includes On-Premises (1)

Production, (1) Disaster Recovery and (2) Test server licenses.

0002 PortalGuard Identity provider

(IdP)

Features single sign-on, includes identity federation or Form based configurations for up to 6 applications (included)

0003 Multi-Factor Self-Service

Password/PIN Reset

Password Reset options - Moblie Pin Reset via HMAC, Challenge Questions (CQ/A) & Answers, SMS OTP delivery, CQ/A & OTP (included)

0004 Multi-Factor Authentication OTP Delivery options - SMS text, RSA, HMAC, YubiKey, Voice call, Google Authenticator, Email, Help Desk, PassiveKey, Printed (included)

0005 First Year – Renewable

Technical Support &

Maintenance Contract

(renewable)

Includes 2 Scheduled Maintenance/Upgrades to OpenLDAP

Server Environment and 12 support incidents

0006 PistolStar Professional

Deployment Services

Dedicated Premium Support for Production Cutover (Not to

Exceed 8 Hours)

0007 PistolStar Front-End

Branding/Customization

Services

Detailed Front-End alterations to match the look and feel of

GSA’s choosing.

0008 Tailor Authentication: Enable

2FA Enrollment and

Authentication to Listserv

Enable 2FA Enrollment and Authentication to Listserv 1

OPTION YEAR 1

1005 Renewable Technical Support

& Maintenance Contract

(renewable)

Includes 2 Scheduled Maintenance/Upgrades to OpenLDAP

Server Environment and 12 support incidents

OPTION YEAR 2

2005 Renewable Technical Support

& Maintenance Contract

(renewable)

Includes 2 Scheduled Maintenance/Upgrades to OpenLDAP

Server Environment and 12 support incidents

Page | 6

OPTION YEAR 3

3005 Renewable Technical Support

& Maintenance Contract

(renewable)

Includes 2 Scheduled Maintenance/Upgrades to OpenLDAP

Server Environment and 12 support incidents

OPTION YEAR 4

4005 Renewable Technical Support

& Maintenance Contract

(renewable)

Includes 2 Scheduled Maintenance/Upgrades to OpenLDAP

Server Environment and 12 support incidents

NOTE: Based on the GSA-IT’s desire to not have to maintain an LDAP server, the offeror shall also install and configure the OpenLDAP server in the GSA environment as well as provide scheduled maintenance/upgrades to OpenLDAP two times annually, plus at any time that GSA- IT security detects application vulnerability with a CVE rating of high or critical.

6.0 PLACE OF PERFORMANCE/HOURS OF OPERATION

General Service Administration (GSA) Office of the Chief Information Officer (GSA-IT) Applications Operations and Maintenance Branch 1800 F Street N.W.

Washington, DC 20405

Services will be delivered remotely by the contractor by working directly with the GSA Project Manager using Webex during mutually scheduled maintenance windows.

6.1 Place of Performance

The primary Place of Performance for this requirement is anticipated to be at the Contractor site.

7.0 PERIOD OF PERFORMANCE

The Period of Performance (POP) will consist of Base Period and four (4) 1-Year Options as follows:

Base Year 09/30/2020 through 09/29/2021 Option Year (OY1) – 9/30/2021 to 09/29/2022 Option Year (OY2) – 9/30/2022 to 09/29/2023 Option Year (OY3) – 9/30/2023 to 09/29/2024 Option Year (OY4) – 9/30/2024 to 09/29/2025

8.0 DELIVERY ADDRESS

ATTN: Lisa Stokes General Services Administration (GSA)

Page | 7

Office of the Chief Information Officer (GSA-IT) Corporate IT Services, Applications Operations and Maintenance Branch 1800 F Street N.W.

Washington, DC 20405 Telephone: 202-501-2886

9.0 CONTRACT ADMINISTRATION

The Contracting Officer will appoint a COR in writing for this Purchase Order. The Contracting Officer Representative (COR) will receive, for the Government; all work called for by the Purchase Order and will represent the CO in the technical phases of the work. The COR will provide no supervisory or instructional assistance to contractor personnel. The COR is not authorized to change any of the terms and conditions, scope and price of the contract or the Purchase Order. Changes in the scope of work will be made only by the CO with modifications to the Purchase Order.

CONTRACTING OFFICER (CO)

ATTN: Bonnie Impastato General Services Administration (GSA) Office of Internal Acquisition (OIA) 1800 F Street N.W.

Washington, DC 20405 Telephone: 202-510-3328 Email: bonnie.impastato@gsa.gov

CONTRACT SPECIALIST (CS)

ATTN: Monica Golibart General Services Administration (GSA) Office of Internal Acquisition (OIA) 1800 F Street N.W.

Washington, DC 20405 Telephone: 202-258-2631 Email: monica.golibart@gsa.gov

CONTRACTING OFFICER’S REPRESENTATIVE (COR)

ATTN: Lisa Stokes General Services Administration (GSA) Office of the Chief Information Officer (GSA-IT) Corporate IT Services, Applications Operations and Maintenance Branch 1800 F Street N.W.

Washington, DC 20405 Telephone: 312-886-2635 Email: lisa.stokes@gsa.gov

Page | 8

10.0 FUNDING/PAYMENT PROCEDURES FOR PAYMENT

Prompt Payment Requirements: Payments will be processed in accordance with FAR Clause

52.212-4(i) Payments as supplemented and deviated from in GSAM Clause 552.212-4.

INVOICES: The Contractor shall submit billings per deliverable in accordance with the

Government’s requirements in the SOW.

Submission of Original Invoices:

Invoices shall be submitted no later than fifteen calendar days following performance and/or delivery. The invoice must be accompanied by any applicable monthly status reports submitted during that period. The COR and CO shall receive a copy of the invoice and all supporting documentation. This can be done before, but no later than, the same time as invoice submission to the GSA Financial Operations and Disbursement Center.

Invoices are authorized for payment upon the Government’s receipt and acceptance of deliverables specified in the contract and the receipt of a valid invoice. Invoices, to be proper and payable, must include the following information:

1. Name and address of the Contractor, and

2. Invoice date and number, and

3. Contract/Order Number (as listed in Block 4 on Form SF1449) and Pegasys Document

Number (PDN) (GD followed by [PIID Number as listed in Block 4 on Form SF1449]), any Contract Line Item Numbers (CLINs), and the Program/Project Title (PortalGuard

2 Factor authentication system for listserv.gsa.gov) and

4. Description of the services/products provided including CLIN number and description, quantity, unit of measure, unit price and extended price of the item(s) delivered; period of service and/or dates that services were provided, etc., and;

5. Name and address of the contractor’s authorized representative to whom payment is to be sent, and;

6. Name, title, and phone number of the contractor’s PoC to be notified in the event of defective invoice; and

7. Taxpayer Identification Number (TIN). The Contractor shall include its TIN on the invoice and ensure the SAM.gov profile for the contractor is complete including the payment remittance address and bank details.

The Contractor shall submit an original invoice for payment to GSA Financial Operations and

Disbursement Center.

P.O. Box 419279

Kansas City, MO

Page | 9

Copies of invoices shall be emailed to the designated Contracting Officer Representative (COR) that will be appointed following award of this task order.

Copies of invoices shall be emailed to the designated Contract Specialist and Contracting

Officer.

Please Note: Failure to send both copies could delay your payment.

When invoicing GSA, ensure all data listed in Items 1-7 above are present on the invoice. All invoices shall be submitted electronically. Password and electronic invoice access is obtained through VCSS, https://vcss.ocfo.gsa.gov.

For assistance with how to setup electronic invoicing or payment related information, please contact GSA Finance Customer Support (800) 676-3690 or kc-acctspayable.vcss@gsa.gov.

A copy of the invoice must be sent to the COR/Program Office POC, Kyle Steffensmeier at kyle.steffensmeier@gsa.gov for approval. A courtesy copy of the invoice must also be sent to the Contract Specialist, Monica Golibart at monica.golibart@gmail.com and Contracting Officer

Bonnie Impastato at bonnie.impastato@gsa.gov for the official contract file.

FINAL INVOICE: The Contractor shall submit with a GSA Form 1142- Release of Claims with submission of the final invoice at the end of the period of performance. A copy of the form should be sent via email to the Contracting Officer and to the Contract Specialist and COR identified as the Government POCs in the SOW.

11.0 IT SECURITY REQUIREMENTS AND POLICIES

The following GSA policies must be followed. These policies can be found at http://www.gsa.gov/directives or https://insite.gsa.gov/directives.

Security Clauses:

1. Attachment A - CIO 09 -48, IT Security Procedural Guide:

Security and Privacy IT Acquisition Requirements.

2. Attachment B - CIO 12-2018, IT Policy Requirements Guide

The contractor’s personnel involved with this task order are required to review above-cited contract clauses and policies and ensure compliance throughout the life of this task order.

Page | 10

12.0 GENERAL COMPLIANCE REQUIREMENTS.

Section 508: Where appropriate, the Contractor(s) shall provide accessibility based on FAR subpart 39.2 Electronic and Information Technology and Section 508 of the Rehabilitation Act of 1973 (29 U.S.C794d). All electronic and information technology (EIT) procured through this Contract must meet the applicable accessibility standards at 36 CFR1194, unless an agency exception to this requirement exists. The 36 CFR 1194 implements Section 508 of the Rehabilitation Act of 1973, as amended. All deliverables will be Section 508 compliant, and will be reviewed for compliance by the government which reserves the right to reject the deliverable(s) until remediation of deficiencies has been successfully completed by the Contractor. Complete technical descriptions are provided on the following website:

https://www.section508.gov.

Where appropriate, the Contractor(s) shall indicate whether each product or service is compliant or non- compliant with the accessibility standards at 36 CFR 1194.

Note: Further, the quote must indicate where full details of compliance can be found (e.g., vendor’s website or other exact location).

12.1 Privacy Act: Where appropriate, the Contractor shall be responsible for adhering to all aspects of the Privacy Act and is prohibited from removing from the worksite any programs, documentation, or data without the knowledge and written approval of the COR or PM. All deliverables and work products covered under this task order become the property of the U.S. Government. The use of any information that is subject to the Privacy Act shall be used in complete accordance with all rules of conduct as applicable to Privacy Act Information.

Where appropriate, work on this contract may require personnel to have access to Privacy Information. Personnel shall adhere to the Privacy Act, Title 5 of the U.S. Code, Section 552a and applicable agency rules and regulations.

12.2 Data Rights and Ownership of Deliverables

Government data rights of software deliverable shall be in accordance with FAR 52.227-19-- Commercial Computer Software License, and/or FAR 52.227-14- Rights in Data - General.

Ownership of data entered into any and all systems, system documentation, all deliverables produced in the performance of this contract, and other related system information shall reside with the Government. The contractor shall place the following copyright notice on all materials, documents, deliverables, etc. developed during the performance of this contract. COPYRIGHT NOTICE: This work, authored by [contractor name] employees, was funded in whole or in part by federal funds under U.S. Government contract [number] and is, therefore, subject to the following license: The Government is granted for itself and others acting on its behalf a paid-up, nonexclusive, irrevocable, worldwide license in this work to use, reproduce, modify, prepare derivative works, disclose, distribute copies to the public, and perform publicly and display publicly, by or on behalf of the Government. All other rights are reserved by copyright owner.

Page | 11

For the purpose of clarity, the intent of the Government is for intellectual property to be vested in the Federal Government for work paid by the Federal Government. All documents, graphics, and code created under this contract are the intellectual property of the Federal Government including, but not limited to, plans, reports, schedules, software code, software designs, graphics, etc. In the event that the Federal Government implements under this contract open-source software and pays for the cost of the implementation of open-source software, the final changes and edits to the code and configuration (such as work to integrate plug-ins) are the intellectual property of the Federal Government.

13.0 FEDERAL ACQUISITION REGULATION (FAR) PROVISIONS AND CLAUSES

INCORPORATED BY REFERENCE

This TO incorporates one or more clauses by reference with the same force and effect as if they were given in full text. Upon request the CO will make their full text available. Also, the full text of a provision may be accessed electronically at: FAR website:

https://www.acquisition.gov/far/

All solicitation provisions will be removed at Task Order Award (TOA)

Clause No. Clause Title Date

52.203-19 Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements.

(JAN 2017)

52.204-7 System for Award Management. (OCT 2016)

52.204-24 Representation Regarding Certain Telecommunications and Video Surveillance Services or Equipment (provision).

(AUG 2019)

52.204-26 Covered Telecommunications Equipment or Services- Representation. (Provision)

(AUG 2019)

52.212-1 Instructions to Offerors— Commercial Items. (JAN 2017)

52.212-2 Evaluation—Commercial Items, in solicitations for commercial items (see 12.602)

(OCT 2014)

52.212-3 Offeror Representations and Certifications— Commercial Items. (NOV 2017)

52.212-4 Contract Terms and Conditions --Commercial Items. (JAN 2017)

52.212-5 Contract Terms and Conditions Required To Implement Statutes or Executive Orders— Commercial Items.

(NOV 2017)

52.225-25 Prohibition on Contracting with Entities Engaging in Certain Activities or Transactions Relating to Iran-Representation and Certifications. (Provision)

(AUG 2018)

52.223-18 Encouraging Contractor Policies to Ban Text Messaging While Driving.

(AUG 2011)

Page | 12

52.232-38 Submission of Electronic Funds Transfer Information with Offer. (JUL 2013)

52.232-39 Unenforceability of Unauthorized Obligation (JUN 2013)

13.1 GENERAL SERVICES ADMINISTRATION MANUAL (GSAM) PROVISIONS

AND CLAUSES

The tables below incorporate clauses by reference, with the same force and effect as if they were given in full text. The full text may be accessed electronically at https://www.acquisition.gov/far

All provisions will be removed at the Task Order Award (TOA).

The full text of a provision may be accessed electronically at: GSAM website:

https://www.acquisition.gov/gsam/gsam.html

Clause No. Clause Title Date

552.212-4 Contract Terms and Conditions-Commercial Items (FAR

DEVIATION)

(Sep 1999)

552.212-71 Contract Terms and Conditions Applicable to GSA Acquisition of Commercial Items.

(Sep 2019)

552.212-72 Contract Terms and Conditions Required to Implement Statutes or Executive Orders Applicable to GSA Acquisition of Commercial Items.

(Sep 2019)

13.2 Task Order Level Clauses Incorporated in Full Text

FAR 52.217-5 Evaluation of Options (Jul 1990)

(Provision)

Except when it is determined in accordance with FAR 17.206(b) not to be in the Government’s best interests, the Government will evaluate quotes for award purposes by adding the total price for all options to the total price for the basic requirement. Evaluation of options will not obligate the Government to exercise the option(s).

(End of Provision)

52.217-8 Option to Extend Services.

As prescribed in 17.208(f), insert a clause substantially the same as the following:

Option to Extend Services (Nov 1999)

Page | 13

The Government may require continued performance of any services within the limits and at the rates specified in the contract. These rates may be adjusted only as a result of revisions to prevailing labor rates provided by the Secretary of Labor. The option provision may be exercised more than once, but the total extension of performance hereunder shall not exceed 6 months. The Contracting Officer may exercise the option by written notice to the Contractor within 30 days.

(End of clause)

52.217-9 Option to Extend the Term of the Contract.

Option to Extend the Term of the Contract (Mar 2000)

(a) The Government may extend the term of this contract by written notice to the Contractor within 10 days of the contract expiration; provided that the Government gives the Contractor a preliminary written notice of its intent to extend at least 30 days before the contract expires. The preliminary notice does not commit the Government to an extension.

(b) If the Government exercises this option, the extended contract shall be considered to include this option clause.

(c) The total duration of this contract, including the exercise of any options under this clause, shall not exceed four years.

(End of clause)

52.232-40 PROVIDING ACCELERATED PAYMENT TO SMALL BUSINESS

SUBCONTRACTORS (DEC 2013)

(a) Upon receipt of accelerated payments from the Government, the Contractor shall make accelerated payments to its small business subcontractors under this contract, to the maximum extent practicable and prior to when such payment is otherwise required under the applicable contract or subcontract, after receipt of a proper invoice and all other required documentation from the small business subcontractor.

(b) The acceleration of payments under this clause does not provide any new rights under the Prompt Payment Act.

(c) Include the substance of this clause, including this paragraph (c), in all subcontracts with small business concerns, including subcontracts with small business concerns for the acquisition of commercial items.

(End of clause)

Page | 14

EVALUATION METHODOLOGY/BASIS OF AWARD

14.0 LOWEST PRICE TECHNICALLY ACCEPTABLE (LPTA)

LPTA will Be The Best Value Methodology Used For This Effort. The government anticipates awarding a Firm Fixed-Price single-award task order with the contractor that can provide the products/services on the basis of a Lowest Price Technically Acceptable (LPTA), resulting from selection of the technically acceptable quote with the lowest evaluated price. Prices will be assessed for fairness and reasonableness and all proposed pricing must be based upon comparison with commercial price list, competition and the independent government cost estimate (IGCE).

QUOTE SUBMISSION INSTRUCTIONS

15.0 SUBMISSION OF QUESTIONS

The due date for submittal of questions is Monday, September 28, 2020, 10:00 AM

Eastern Standard Time.

All questions must be submitted in writing via email to the Contracting Officer, Bonnie Impastato at bonnie.impastato@gsa.gov and the Contract Specialist, Monica Golibart at monica.golibart@gsa.gov. No questions will be accepted by telephone or after the specified time and due date to submit quotes. Each question submitted must cite the Statement of Work Section number/title for which the question pertains, unless the question is general in nature and not specific to a particular portion(s) of the RFQ/Statement of Work.

15.1 QUESTIONS AND ANSWERS (Q&As)

GSA intends to provide answers to questions (Q&As) via the Beta SAM portal at https://beta.sam.gov/ on or about: Tuesday, September 29, 2020, 10:00 AM Eastern Standard Time). All questions will be addressed in writing only.

15.2 SUBMISSION OF QUOTES

The Offeror shall provide the following products/services as specified on a Firm-Fixed-Price basis in accordance with the SOW/RFQ.

15.3 FORMAT OF QUOTES

The price quote shall be submitted based on your current commercial price list, utilizing any and all discounts. Please provide the name of the company, DUNs number, company POC and date on your price quote. Please include a copy of your applicable Commercial Price List with your quote.

Page | 15

15.4 Format for Attachment C: Section 889(a)(1)(A) of the John S. McCain National

Defense.

The quoter must fill-out the last page of this GSAM representation in its entirety and return a copy with the quote submission.

15.5 Format for Attachment D: FAR 52.204-24 Representation Regarding Certain Telecommunications and Video Surveillance Services or Equipment (AUG 2020) The quoter must fill-out the representation as per the instructions in this FAR representation in its entirety and return a copy with the quote submission.

15.6 DUE DATE FOR SUBMISSION OF THE PRICE QUOTE

The due date for submittal of questions is Wednesday, September 30, 2020, 10:00 AM

Eastern Standard Time.

All questions must be submitted in writing via email to the Contracting Officer, Bonnie Impastato at bonnie.impastato@gsa.gov and the Contract Specialist, Monica Golibart at monica.golibart@gsa.gov.

This includes: Attachment C: Section 889(a)(1)(A) of the John S. McCain National Defense. Attachment D: FAR 52.204-24 Representation Regarding Certain Telecommunications and Video Surveillance Services or Equipment (AUG 2020)

Discounts: Offerors are encouraged to offer discounts off of their existing GSA price List.

16.0 ATTACHMENTS:

Attachments A and B are Security Clauses which are incorporated by reference (IBR) only!

1. Pricing Template

2. *Attachment A - CIO 09 -48, IT Security Procedural Guide: Security and Privacy

IT Acquisition Requirements. (IBR)

3. *Attachment B - CIO 12-2018, IT Policy Requirements Guide (IBR)

4. Attachment C: Section 889(a)(1)(A) of the John S. McCain National Defense

a. Authorization Act for Fiscal Year 2019 (the NDAA).

5. Attachment D: FAR 52.204-24 Representation Regarding Certain Telecommunications and Video Surveillance Services or Equipment (AUG 2020).

6. Justification and Approval (J&A)

Page | 16

ATTACHMENT C:

Part A: GSAR 552.204-70, REPRESENTATION REGARDING CERTAIN

TELECOMMUNICATIONS AND VIDEO SURVEILLANCE SERVICES OR EQUIPMENT

(DEVIATION I)(AUG 2019)

(a) Definitions. As used in this clause-

“Covered telecommunications equipment or services”, “Critical technology”, and “Substantial or essential component” have the meanings provided in FAR 52.204-25, Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment.

(b) Prohibition. Section 889(a)(1)(A) of the John S. McCain National Defense Authorization

Act for Fiscal Year 2019 (Pub. L. 115-232) prohibits the head of an executive agency on or after

August 13, 2019, from procuring or obtaining, or extending or renewing a contract to procure or obtain, any equipment, system, or service that uses covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system. Contractors are not prohibited from providing-

(1) A service that connects to the facilities of a third-party, such as backhaul, roaming, or interconnection arrangements; or

(2) Telecommunications equipment that cannot route or redirect user data traffic or permit visibility into any user data or packets that such equipment transmits or otherwise handles.

(c) Representation. [Contractor to complete and submit to the Contracting Officer] The Offeror or

Contractor represents that it [ ] will or [ ] will not provide covered telecommunications equipment or services to the Government in the performance of any contract, subcontract, order, or other contractual instrument resulting from this contract. This representation shall be provided as part of the proposal and resubmitted on an annual basis from the date of award.

(d) Disclosures. If the Offeror or Contractor has responded affirmatively to the representation in paragraph (c) of this clause, the Offeror or Contractor shall provide the following additional information to the Contracting Officer--

(1) All covered telecommunications equipment and services offered or provided (include brand;

model number, such as original equipment manufacturer (OEM) number, manufacturer part number, or wholesaler number; and item description, as applicable);

(2) Explanation of the proposed use of covered telecommunications equipment and services and any factors relevant to determining if such use would be permissible under the prohibition in paragraph (b) of this provision;

(3) For services, the entity providing the covered telecommunications services (include entity name, unique entity identifier, and Commercial and Government Entity (CAGE) code, if known);

and

(4) For equipment, the entity that produced the covered telecommunications equipment (include entity name, unique entity identifier, CAGE code, and whether the entity was the OEM or a distributor, if known).

(End of clause)

Page | 17

ATTACHMENT C:

Part A: GSAM 552.204-70(C) REPRESENTATION

THE BELOW GSAM 552.204-70(C) IS A FILLABLE REPRESENTATION; THE VENDOR

WILL BE REQUIRED TO PROVIDE A RESPONSE TO THE FILL-IN ITEMS WITHIN THE

PROVISION WITH THEIR QUOTATION RESPONSE NO LATER THAN THE DUE DATE

LISTED IN RESPONSE TO THIS RFQ/SUBMITTED WITH QUOTE.

Note: Please complete the representation directly below to comply with GSAR 552.204-70(c).

Please provide contact information for an authorized point of contact from your organization.

First Name:

Last Name:

Email Address:

Please select the statement that applies to you:

❑ In accordance with GSAR 552.204-70(c), the Offeror or Contractor represents that it will provide covered telecommunications equipment or services to the Government in the performance of any contract, subcontract, order, or other contractual instrument resulting from this contract. This representation shall be provided as part of the proposal and resubmitted on an annual basis from the date of award.

❑ In accordance with GSAR 552.204-70(c), the Offeror or Contractor represents that it will not provide covered telecommunications equipment or services to the Government in the performance of any contract, subcontract, order, or other contractual instrument resulting from this contract. This representation shall be provided as part of the proposal and resubmitted on an annual basis from the date of award.

If the offeror or contractor has responded affirmatively to the representation above, disclosures required at

GSAR 552.204-70(d) must be provided to the Contracting Officer.

I certify that the information I provided is true and correct and that this survey has been completed by an authorized representative of the contractor.

❑ Yes

❑ No

(End of Provision)

Page | 18

ATTACHMENT D:

Part B: 52.204-25 Prohibition on Contracting for Certain Telecommunications and Video

Surveillance Services or Equipment (AUG 2020)

(a) * * * Backhaul means intermediate links between the core network, or backbone network, and the small subnetworks at the edge of the network (e.g., connecting cell phones/towers to the core telephone network). Backhaul can be wireless (e.g., microwave) or wired (e.g., fiber optic, coaxial cable, Ethernet).

Interconnection arrangements means arrangements governing the physical connection of two or more networks to allow the use of another's network to hand off traffic where it is ultimately delivered (e.g., connection of a customer of telephone provider A to a customer of telephone company B) or sharing data and other information resources.

Reasonable inquiry means an inquiry designed to uncover any information in the entity's possession about the identity of the producer or provider of covered telecommunications equipment or services used by the entity that excludes the need to include an internal or third-party audit.

Roaming means cellular communications services (e.g., voice, video, data) received from a visited network when unable to connect to the facilities of the home network either because signal coverage is too weak or because traffic is too high.

(b) Prohibition. (1) Section 889(a)(1)(A) of the John S. McCain National Defense Authorization Act for

Fiscal Year 2019 (Pub. L. 115-232) prohibits the head of an executive agency on or after August 13, 2019, from procuring or obtaining, or extending or renewing a contract to procure or obtain, any equipment, system, or service that uses covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system. The

Contractor is prohibited from providing to the Government any equipment, system, or service that uses covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system, unless an exception at paragraph (c) of this clause applies or the covered telecommunication equipment or services are covered by a waiver described in FAR

4.2104.

(2) Section 889(a)(1)(B) of the John S. McCain National Defense Authorization Act for Fiscal Year 2019

(Pub. L. 115-232) prohibits the head of an executive agency on or after August 13, 2020, from entering into a contract, or extending or renewing a contract, with an entity that uses any equipment, system, or service that uses covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system, unless an exception at paragraph (c) of this clause applies or the covered telecommunication equipment or services are covered by a waiver described in FAR 4.2104. This prohibition applies to the use of covered telecommunications equipment or services, regardless of whether that use is in performance of work under a Federal contract.

(End of Clause)

Page | 19

ATTACHMENT D:

Part B: FAR 52.204-24 Representation Regarding Certain Telecommunications and Video

Surveillance Services or Equipment (AUG 2020)

The Offeror shall not complete the representation at paragraph (d)(1) of this provision if the Offeror has represented that it “does not provide covered telecommunications equipment or services as a part of its offered products or services to the Government in the performance of any contract, subcontract, or other contractual instrument” in the provision at 52.204-26, Covered Telecommunications Equipment or

Services—Representation, or in paragraph (v) of the provision at 52.212-3, Offeror Representations and

Certifications-Commercial Items.

(a) Definitions. As used in this provision-

Backhaul, covered telecommunications equipment or services, critical technology, interconnection arrangements, reasonable inquiry, roaming, and substantial or essential component have the meanings provided in the clause 52.204-25, Prohibition on Contracting for Certain Telecommunications and Video

Surveillance Services or Equipment.

(b) Prohibition. (1) Section 889(a)(1)(A) of the John S. McCain National Defense Authorization Act for

Fiscal Year 2019 (Pub. L. 115-232) prohibits the head of an executive agency on or after August 13, 2019, from procuring or obtaining, or extending or renewing a contract to procure or obtain, any equipment, system, or service that uses covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system. Nothing in the prohibition shall be construed to—

(i) Prohibit the head of an executive agency from procuring with an entity to provide a service that connects to the facilities of a third-party, such as backhaul, roaming, or interconnection arrangements; or

(ii) Cover telecommunications equipment that cannot route or redirect user data traffic or cannot permit visibility into any user data or packets that such equipment transmits or otherwise handles.

(2) Section 889(a)(1)(B) of the John S. McCain National Defense Authorization Act for Fiscal Year 2019

(Pub. L. 115-232) prohibits the head of an executive agency on or after August 13, 2020, from entering into a contract or extending or renewing a contract with an entity that uses any equipment, system, or service that uses covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system. This prohibition applies to the use of covered telecommunications equipment or services, regardless of whether that use is in performance of work under a Federal contract. Nothing in the prohibition shall be construed to—

(i) Prohibit the head of an executive agency from procuring with an entity to provide a service that connects to the facilities of a third-party, such as backhaul, roaming, or interconnection arrangements; or

(ii) Cover telecommunications equipment that cannot route or redirect user data traffic or cannot permit visibility into any user data or packets that such equipment transmits or otherwise handles.

(c) Procedures. The Offeror shall review the list of excluded parties in the System for Award

Management (SAM) (https://www.sam.gov) for entities excluded from receiving federal awards for

“covered telecommunications equipment or services.”

Page | 20

(d) Representations. The Offeror represents that—

(1) It [ ] will, [ ] will not provide covered telecommunications equipment or services to the Government in the performance of any contract, subcontract or other contractual instrument resulting from this solicitation. The Offeror shall provide the additional disclosure information required at paragraph (e)(1) of this section if the Offeror responds “will” in paragraph (d)(1) of this section; and

(2) After conducting a reasonable inquiry, for purposes of this representation, the Offeror represents that—

It [ ] does, [ ] does not use covered telecommunications equipment or services, or use any equipment, system, or service that uses covered telecommunications equipment or services. The Offeror shall provide the additional disclosure information required at paragraph (e)(2) of this section if the Offeror responds

“does” in paragraph (d)(2) of this section.

(e) Disclosures. (1) Disclosure for the representation in paragraph (d)(1) of this provision. If the Offeror has responded “will” in the representation in paragraph (d)(1) of this provision, the Offeror shall provide the following information as part of the offer:

(i) For covered equipment—

(A) The entity that produced the covered telecommunications equipment (include entity name, unique entity identifier, CAGE code, and whether the entity was the original equipment manufacturer (OEM) or a distributor, if known);

(B) A description of all covered telecommunications equipment offered (include brand; model number, such as OEM number, manufacturer part number, or wholesaler number; and item description, as applicable); and

(C) Explanation of the proposed use of covered telecommunications equipment and any factors relevant to determining if such use would be permissible under the prohibition in paragraph (b)(1) of this provision.

(ii) For covered services—

(A) If the service is related to item maintenance: A description of all covered Start Printed Page

42679telecommunications services offered (include on the item being maintained: Brand; model number, such as OEM number, manufacturer part number, or wholesaler number; and item description, as applicable); or

(B) If not associated with maintenance, the Product Service Code (PSC) of the service being provided; an explanation of the proposed use of covered telecommunications services and any factors relevant to determining if such use would be permissible under the prohibition in paragraph (b)(1) of this provision.

(2) Disclosure for the representation in paragraph (d)(2) of this provision. If the Offeror has responded

“does” in the representation in paragraph (d)(2) of this provision, the Offeror shall provide the following information as part of the offer:

Page | 21

(i) For covered equipment—

(A) The entity that produced the covered telecommunications equipment (include entity name, unique entity identifier, CAGE code, and whether the entity was the OEM or a distributor, if known);

(B) A description of all covered telecommunications equipment offered (include brand; model number, such as OEM number, manufacturer part number, or wholesaler number; and item description, as applicable); and

(C) Explanation of the proposed use of covered telecommunications equipment and any factors relevant to determining if such use would be permissible under the prohibition in paragraph (b)(2) of this provision.

(ii) For covered services—

(A) If the service is related to item maintenance: A description of all covered telecommunications services offered (include on the item being maintained: Brand; model number, such as OEM number, manufacturer part number, or wholesaler number; and item description, as applicable); or

(B) If not associated with maintenance, the PSC of the service being provided; an explanation of the proposed use of covered telecommunications services and any factors relevant to determining if such use would be permissible under the prohibition in paragraph (b)(2) of this provision.

(End of provision)

GENERAL SERVICES ADMINISTRATION (GSA)

JUSTIFICATION FOR OTHER THAN FULL AND OPEN COMPETITION

41 U.S.C. 253(c), 10 U.S.C. 2304(c) and FAR 6.302

BRAND NAME JUSTIFICATION

For: PistolStar PortalGuard 2 Factor Authentication System Maintenance Services for listserv.gsa.gov.

1. IDENTIFICATION OF AGENCY AND CONTRACTING ACTIVITY

This requirement is in support of GSA the Office of GSA-IT, Corporate IT Services, Applications Operations and Maintenance Branch, 1800 F Street NW, Washington, DC 20405. The contracting activity is the Office of Internal Acquisition (OIA), 1800 F Street NW, Washington, DC 20405.

2. NATURE AND DESCRIPTION OF ACTION BEING APPROVED

The statutory authority permitting Other Than Full and Open Competition is implemented by FAR 6.302-1 – Only One Responsible Source and No Other Supplies or Services Will Satisfy Agency Requirements. Approval is sought herein to purchase a Brand Name, “PistolStar 2 Factor Authentication Software” on behalf of the Office of GSA-IT, Corporate IT Services, Applications Operations and Maintenance Branch.

This document is hereby identified as a "Brand Name Justification” in accordance with FAR 6.302-1 which pertains to only one responsible source and no other supplies or services will satisfy the agency’s requirements. GSA has determined that PortalGuard Authentication Software, by PistolStar Inc., a Small Business, is the only software that can satisfy the agency’s requirements.

Contemplated Contract Type: Firm Fixed-Price Purchase Order

Proposed Approach under Consideration: GSA intends to make a sole source award to PistolStar, Inc. Thus far, we were able to determine PortalGuard by PistolStar as the only known source that can meet the government’s minimum needs. No other capable sources were found during market Research. However, GSA intends to solicit quotes by posting an RFQ on beta.sam.gov to afford other capable vendors an opportunity to compete for this acquisition opportunity.

Period of Performance: Date of Award (DOA) – 12 months

3. DESCRIPTION OF SUPPLIES OR SERVICES REQUIRED TO

MEET THE AGENCY'SNEEDS

GSA-IT administers a publicly accessible email list server from commercial software vendor LSoft. The email list server is called Listserv.gsa.gov. GSA-IT has a requirement to enforce 2 Factor authentications for users that login to the listserv.gsa.gov web site. Listserv.gsa.gov currently stores usernames and passwords in proprietary, encrypted files, and there is an option to support an LDAP directory. GSA- IT has a requirement to change the authentication process for listserv.gsa.gov to an LDAP based system that supports multi-factor authentication.

The GSA-IT objective is to integrate the existing listserv.gsa.gov site with the PortalGuard authentication system and with open LDAP to add multi-factor authentication to the listserv.gsa.gov site.

Design Requirements:

1. The 2FA enrollment and prompting will be performed by PortalGuard.

2. A new .NET HTTP module must be written. It will gate access to the main

"wa.exe" module until the user has authenticated through PortalGuard (e.g. via

2FA).

3. A new OpenLDAP server will be utilized so both Listserv and PortalGuard can reference the same user accounts/credentials.

4. The PortalGuard and OpenLDAP servers could be installed on the Listserv server or on separate server(s) depending on OGIT's security requirements (the Listserv credentials are already on the same server).

5. The operation of the wa.exe module will not be modified. It will still verify usernames and passwords in real-time and its session management will still be utilized.

6. Users will create new accounts in OpenLDAP using PortalGuard's self-registration feature.

7. The .NET HTTP module configuration parameters will include the URL to the PortalGuard server and the public certificate matching the keypair it will use to sign outbound responses.

8. Successful offeror shall also install and configure the OpenLDAP server in the GSA environment as well as provide scheduled maintenance/upgrades to OpenLDAP two times annually, plus at any time that GSAIT security detects application vulnerability with a CVE rating of high or critical.

NOTE: Based on the GSAIT’s desire to not have to maintain an LDAP server, PortalGuard shall also install and configure the OpenLDAP server in the GSA environment as well as provide scheduled maintenance/upgrades to OpenLDAP two times annually.

Project Objective:

Integrate PortalGuard multi-factor authentication system with the listserv.gsa.gov site.

a. Services:

1. PistolStar shall provide PortalGuard Authentication Server

2. PistolStar shall provide PortalGuard Identity Provider

3. PistolStar shall provide Multi-Factor Self-Service Password/PIN Reset

4. PistolStar shall provide Multi-factor authentication

5. PistolStar shall provide renewable 1-year Technical Support and Maintenance

Contract

6. PistolStar shall provide Professional Single Sign On configuration Services

7. Pistolstar shall provide Professional Deployment Services

8. Pistolstar shall provide front-end Branding/Customization Services

9. Pistolstar shall enable 2-factor Enrollment and authentication for listserv.gsa.gov site.

Project Scope:

PistolStar shall deliver PortalGuard authentication server and associated services and components to configure the listerv.gsa.gov site for 2-factor authentication.

b. Detailed Authentication Flow:

The user accesses server as usual (e.g. via bookmark) The HTTP module will detect access to wa.exe's login form and automatically redirect the user to PortalGuard.

User must login through PortalGuard (using OpenLDAP…