SB1341-17-RP-0007_Cybersecurity_RFP_(Ref_17-00774)_20170316.pdf

PAGE 1 OF 114 SB1341-17-RP-0007

SOLICITATION, OFFER AND AWARD 1. THIS CONTRACT IS A RATED

ORDER UNDER DPAS (15 CFR 7900)

RATING

PAGE OF

PAGES

2. CONTRACT NUMBER 3. SOLICITATION NUMBER 4. TYPE OF SOLICITATION 5. DATE ISSUED 6. REQUISITION/PURCHASE NUMBER

SB1341-17-RP-0007 SEALED BID (IFB)

NEGOTIATED (RFP)

NB773000-17-00774

NB773000-17-00774

7. ISSUED BY CODE 000SB 8. ADDRESS OFFER TO (If other than Item 7)

NATIONAL INST OF STDS AND TECHNOLOGY

100 BUREAU DRIVE STOP 1640

BUILDING 301 ROOM B129

GAITHERSBURG MD 20899-1640

NOTE: In sealed bid solicitations "offer" and "offeror" mean "bid" and "bidder".

SOLICITATION

9. Sealed offers in original and 1 copies for furnishing the supplies or services in the Schedule will be received at the place specified in Item 8, or if handcarried, in the depository located in . until 3:00 PM ET local time MAY 01, (Hour) (Date)

CAUTION - LATE Submissions, Modifications, and Withdrawls: See Section L, Provision No. 52.214-7 or 52.215-1. All offers are subject to all terms and conditions contained in this solicitation.

B. TELEPHONE (NO COLLECT CALLS)10. FOR

INFORMATION CALL

A. NAME

CHANTEL ADAMS AREA CODE

NUMBER

975-6338

EXT.

C. E-MAIL ADDRESS

chantel.adams@nist.gov

11. TABLE OF CONTENTS

(X) SEC. DESCRIPTION PAGES(S) (X) SEC. DESCRIPTION PAGE(S)

PART 1 - THE SCHEDULE PART II - CONTRACT CLAUSES

X A SOLICITATION/CONTRACT FORM 1 - 1 X I CONTRACT CLAUSES 57 - 72

X B SUPPLIES OR SERVICES AND PRICES/COSTS 2 - 27 PART III - LIST OF DOCUMENTS, EXHIBITS AND OTHER ATTACH.

X C DESCRIPTION/SPECS./WORK STATEMENT 28 - 36 X J LIST OF ATTACHMENTS 73 - 74

D PACKAGING AND MARKING - PART IV - REPRESENTATIONS AND INSTRUCTIONS

X E INSPECTION AND ACCEPTANCE 37 - 37 X K REPRESENTATIONS, CERTIFICATIONS AND OTHER 75 - 89

X F DELIVERIES OR PERFORMANCE 38 - 38 STATEMENTS OF OFFERORS

X G CONTRACT ADMINISTRATION DATA 39 - 44 X L INSTRS., CONDS., AND NOTICES TO OFFERORS 90 - 107

X H SPECIAL CONTRACT REQUIREMENTS 45 - 56 X M EVALUATION FACTORS FOR AWARD 108 - 114

OFFER

NOTE: Item 12 does not apply if the solicitation includes the provisions at 52.214-16, Minimum Bid Acceptance Period.

12. In compliance with the above, the undersigned agrees, if this offer is accepted within calendar days (60 calendar days unless a different period is inserted by the offeror) from the date for receipt of offers specified above, to furnish any or all items upon which prices are offered at the set opposite each item, delivered at the designated point(s), within the time specified in the schedule.

13. DISCOUNT FOR PROMPT PAYMENT

(See Section I, Clause No. 52.232-8)

10 CALENDAR DAYS (%) 20 CALENDAR DAYS (%) 30 CALENDAR DAYS (%) CALENDAR DAYS (%)

14. ACKNOWLEDGMENT OF AMENDMENTS AMENDMENT NO. DATE AMENDMENT NO. DATE

(The offeror acknowledges receipt of amendments to the SOLICITATION for offerors and related documents numbered and dated):

CODE FACILITY 16. NAME AND TITLE OF PERSON AUTHORIZED TO SIGN OFFER

15A. NAME AND

ADDRESS OF

OFFEROR

(Type or print)

15B. TELEPHONE NUMBER 15C. CHECK IF REMITTANCE ADDRESS IS DIFFERENT

AREA CODE NUMBER

EXT. FROM ABOVE - ENTER SUCH ADDRESS IN SCHEDULE.

17. SIGNATURE 18. OFFER DATE

AWARD (To be completed by Government)

19. ACCEPTED AS TO ITEMS NUMBERED 20. AMOUNT 21. ACCOUNTING AND APPROPRIATION

22. AUTHORITY FOR USING OTHER THAN FULL AND OPEN COMPETITION:

10 U.S.C. 2304(c) 41 U.S.C. 3304(a)

23. SUBMIT INVOICES TO ADDRESS SHOWN IN

(4 copies unless otherwise specified

ITEM

24. ADMINISTERED BY (If other than Item 7) 25. PAYMENT WILL BE MADE BY CODE

26. NAME OF CONTRACTING OFFICER(Type or print) 27. UNITED STATES OF AMERICA 28. AWARD DATE

(Signature of Contracting Officer)

IMPORTANT - Award will be made on this Form, or on Standard Form 26, or by other authorized official written notice. (Must be fully completed by offeror)

AUTHORIZED FOR LOCAL REPRODUCTION

Previous edition is unusable

STANDARD FORM 33 (REV. 6/2014)

Prescribed by GSA - FAR (48 CFR) 53.214(c)

SCHEDULE Continued

ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

PAGE 2 OF 114 SB1341-17-RP-0007

BASE PERIOD

September 30, 2017 through September 29, 2018 0001 Contractor Performance of requirements as specified in the Performance Work Statement in Section C of this Request for Proposals.

Period of Performance: 09/29/2017 to 09/28/2018

1.00 LO

Option Period 1

September 30, 2018 through September 29, 2019

OPT

0002 Contractor Performance of requirements as specified in the Performance Work Statement in Section C of this Request for Proposals.

Period of Performance: 09/30/2018 to 09/29/2019

Option Period 2

September 30, 2019 through September 29, 2020

OPT

0003 Contractor Performance of requirements as specified in the Performance Work Statement in Section C of this Request for Proposals.

Period of Performance: 09/30/2019 to 09/29/2020

Option Period 3

September 30, 2020 through September 29, 2021

OPT

0004 Contractor Performance of requirements as specified in the Performance Work Statement in Section C of this Request for Proposals.

Period of Performance: 09/30/2020 to 09/29/2021

Option Period 4 September 30, 2021 through September 29, 2022

OPT

0005 Contractor Performance of requirements as specified in the Performance Work Statement in Section C of this Request for Proposals.

Period of Performance: 09/30/2021 to 09/29/2022

Table of Contents

PAGE 3 OF 114 SB1341-17-RP-0007

SECTION B SUPPLIES OR SERVICES AND PRICES/COSTS

B. 1 SCHEDULE OF LABOR CATEGORIES

B. 2 MINIMUM AND MAXIMUM CONTRACT AMOUNTS

SECTION C DESCRIPTION/SPECIFICATIONS/WORK STATEMENT

C. 1 IDIQ PERFORMANCE WORK STATEMENT

SECTION E INSPECTION AND ACCEPTANCE

E. 1 52.246-4 INSPECTION OF SERVICES--FIXED-PRICE (AUG 1996)

E. 2 52.246-6 INSPECTION--TIME-AND-MATERIAL AND LABOR-HOUR (MAR 2001)

SECTION F DELIVERIES OR PERFORMANCE

F. 1 52.242-15 STOP-WORK ORDER (AUG 1989)

F. 2 52.242-17 GOVERNMENT DELAY OF WORK (APR 1984)

F. 3 1352.270-70 PERIOD OF PERFORMANCE (APR 2010)

SECTION G CONTRACT ADMINISTRATION DATA

G. 1 1352.201-70 CONTRACTING OFFICER?s AUTHORITY (APR 2010)

G. 2 1352.201-72 CONTRACTING OFFICER`S REPRESENTATIVE (COR) (APR 2010)

G. 3 1352.216-76 PLACEMENT OF ORDERS (APR 2010)

G. 4 1352.245-70 GOVERNMENT FURNISHED PROPERTY (APR 2010)

G. 5 IDIQ CONTRACT INFORMATION

SECTION H SPECIAL CONTRACT REQUIREMENTS

H. 1 1352.208-70 RESTRICTIONS ON PRINTING AND DUPLICATING (APR 2010)

H. 2 1352.209-72 RESTRICTIONS AGAINST DISCLOSURE (APR 2010)

H. 3 1352.209-73 COMPLIANCE WITH THE LAWS (APR 2010)

H. 4 1352.209-74 ORGANIZATIONAL CONFLICT OF INTEREST (APR 2010)

H. 5 1352.216-74 TASK ORDERS (APR 2010)

H. 6 1352.231-71 DUPLICATION OF EFFORT (APR 2010)

H. 7 1352.237-70 SECURITY PROCESSING REQUIREMENTS - HIGH OR MODERATE RISK CONTRACTS (APR 2010). 46

H. 8 1352.237-71 SECURITY PROCESSING REQUIREMENTS - LOW RISK CONTRACTS (APR 2010)

H. 9 KEY PERSONNEL (APR 2010)

H. 10 1352.239-71 ELECTRONIC AND INFORMATION TECHNOLOGY (APR 2010)

H. 11 1352.239-72 SECURITY REQUIREMENTS FOR INFORMATION TECHNOLOGY RESOURCES (APR 2010)

H. 12 NIST LOCAL-07 COMPUTER SECURITY POLICY

H. 13 NIST LOCAL-36 TRAVEL NOTE

H. 14 NIST LOCAL-40 BILLING INSTRUCTIONS FOR DELIVERY/TASK ORDERS

H. 15 LOCAL CLAUSE - CONVERSION OF CONTRACT TYPE

H. 16 LOCAL CLAUSE CONTRACTOR RESPONSIBILITY

H. 17 LOCAL CLAUSE - NON PERSONAL SERVICES

H. 18 LOCAL FLOWDOWN PROVISION

SECTION I CONTRACT CLAUSES

I. 1 LIMITATION OF COSTS ON LABOR HOUR TASK ORDERS

I. 2 52.202-1 DEFINITIONS (NOV 2013)

I. 3 52.203-3 GRATUITIES (APR 1984)

I. 4 52.203-5 COVENANT AGAINST CONTINGENT FEES (MAY 2014)

I. 5 52.203-12 LIMITATION ON PAYMENTS TO INFLUENCE CERTAIN FEDERAL TRANSACTIONS (OCT 2010)

I. 6 52.204-4 PRINTED OR COPIED DOUBLE-SIDED ON POSTCONSUMER FIBER CONTENT PAPER (MAY 2011)

PAGE 4 OF 114 SB1341-17-RP-0007

I. 7 52.204-7 SYSTEM FOR AWARD MANAGEMENT (JUL 2013)

I. 8 52.204-9 PERSONAL IDENTITY VERIFICATION OF CONTRACTOR PERSONNEL (JAN 2011)

I. 9 52.212-4 CONTRACT TERMS AND CONDITIONS--COMMERCIAL ITEMS (MAY 2015)

I. 10 52.212-4 I CONTRACT TERMS AND CONDITIONS--COMMERCIAL ITEMS (MAY 2015)--ALTERNATE I (MAY

2014)

I. 11 52.215-2 AUDIT AND RECORDS--NEGOTIATION (OCT 2010)

I. 12 52.215-8 ORDER OF PRECEDENCE--UNIFORM CONTRACT FORMAT (OCT 1997)

I. 13 52.217-2 CANCELLATION UNDER MULTI-YEAR CONTRACTS (OCT 1997)

I. 14 52.217-7 OPTION FOR INCREASED QUANTITY--SEPARATELY PRICED LINE ITEM (MAR 1989)

I. 15 52.219-8 UTILIZATION OF SMALL BUSINESS CONCERNS (OCT 2014)

I. 16 52.223-6 DRUG-FREE WORKPLACE (MAY 2001)

I. 17 52.224-1 PRIVACY ACT NOTIFICATION (APR 1984)

I. 18 52.224-2 PRIVACY ACT (APR 1984)

I. 19 52.227-1 AUTHORIZATION AND CONSENT (DEC 2007)

I. 20 52.227-2 NOTICE AND ASSISTANCE REGARDING PATENT AND COPYRIGHT INFRINGEMENT (DEC 2007)

I. 21 52.227-3 PATENT INDEMNITY (APR 1984)

I. 22 52.227-14 RIGHTS IN DATA--GENERAL (MAY 2014)

I. 23 52.227-17 RIGHTS IN DATA--SPECIAL WORKS (DEC 2007)

I. 24 52.227-23 RIGHTS TO PROPOSAL DATA (TECHNICAL) (JUN 1987)

I. 25 52.229-3 FEDERAL, STATE, AND LOCAL TAXES (FEB 2013)

I. 26 52.232-1 PAYMENTS (APR 1984)

I. 27 52.232-8 DISCOUNTS FOR PROMPT PAYMENT (FEB 2002)

I. 28 52.232-9 LIMITATION ON WITHHOLDING OF PAYMENTS (APR 1984)

I. 29 52.232-11 EXTRAS (APR 1984)

I. 30 52.232-17 INTEREST (MAY 2014)

I. 31 52.232-18 AVAILABILITY OF FUNDS (APR 1984)

I. 32 52.232-23 ASSIGNMENT OF CLAIMS (MAY 2014)

I. 33 52.232-25 PROMPT PAYMENT (JUL 2013)

I. 34 52.233-1 DISPUTES (MAY 2014)

I. 35 52.233-3 PROTEST AFTER AWARD (AUG 1996)

I. 36 52.233-4 APPLICABLE LAW FOR BREACH OF CONTRACT CLAIM (OCT 2004)

I. 37 52.242-13 BANKRUPTCY (JUL 1995)

I. 38 52.244-2 SUBCONTRACTS (OCT 2010)

I. 39 52.245-1 GOVERNMENT PROPERTY (APR 2012)

I. 40 52.245-9 USE AND CHARGES (APR 2012)

I. 41 52.246-25 LIMITATION OF LIABILITY--SERVICES (FEB 1997)

I. 42 52.249-2 TERMINATION FOR CONVENIENCE OF THE GOVERNMENT (FIXED-PRICE) (APR 2012)

I. 43 52.249-8 DEFAULT (FIXED-PRICE SUPPLY AND SERVICE) (APR 1984)

I. 44 52.249-14 EXCUSABLE DELAYS (APR 1984)

I. 45 52.253-1 COMPUTER GENERATED FORMS (JAN 1991)

I. 46 52.212-5 CONTRACT TERMS AND CONDITIONS REQUIRED TO IMPLEMENT STATUTES OR EXECUTIVE ORDERS--

COMMERCIAL ITEMS (SEPT 2016)

I. 47 52.216-18 ORDERING (OCT 1995)

I. 48 52.216-19 ORDER LIMITATIONS (OCT 1995)

I. 49 52.216-22 INDEFINITE QUANTITY (OCT 1995)

I. 50 52.217-8 OPTION TO EXTEND SERVICES (NOV 1999)

I. 51 52.217-9 OPTION TO EXTEND THE TERM OF THE CONTRACT (MAR 2000)

I. 52 52.232-7 PAYMENTS UNDER TIME-AND-MATERIALS AND LABOR-HOUR CONTRACTS (AUG 2012)

I. 53 52.237-3 CONTINUITY OF SERVICES (JAN 1991)

I. 54 52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

PAGE 5 OF 114 SB1341-17-RP-0007

I. 55 52.252-6 AUTHORIZED DEVIATIONS IN CLAUSES (APR 1984)

SECTION J LIST OF ATTACHMENTS

J. 1 LIST OF ATTACHMENTS

SECTION K REPRESENTATIONS, CERTIFICATIONS AND OTHER STATEMENTS OF OFFERORS

K. 1 52.203-11 CERTIFICATION AND DISCLOSURE REGARDING PAYMENTS TO INFLUENCE CERTAIN FEDERAL

TRANSACTIONS (SEP 2007)

K. 2 52.204-8 ANNUAL REPRESENTATIONS AND CERTIFICATIONS (APR 2016)

K. 3 52.209-5 CERTIFICATION REGARDING RESPONSIBILITY MATTERS (OCT 2015)

K. 4 52.209-7 INFORMATION REGARDING RESPONSIBILITY MATTERS (JULY 2013)

K. 5 52.212-3 OFFEROR REPRESENTATIONS AND CERTIFICATIONS--COMMERCIAL ITEMS (JUL 2016)

K. 6 52.219-1 SMALL BUSINESS PROGRAM REPRESENTATIONS (OCT 2014)

K. 7 52.222-22 PREVIOUS CONTRACTS AND COMPLIANCE REPORTS (FEB 1999)

K. 8 52.222-25 AFFIRMATIVE ACTION COMPLIANCE (APR 1984)

SECTION L INSTRUCTIONS, CONDITIONS, AND NOTICES TO OFFERORS

L. 1 52.212-1 INSTRUCTIONS TO OFFERORS--COMMERCIAL ITEMS (OCT 2016)

L. 2 INSTRUCTIONS TO OFFERORS

L. 3 INQUIRIES

L. 4 52.216-1 TYPE OF CONTRACT (APR 1984)

L. 5 52.216-27 SINGLE OR MULTIPLE AWARDS (OCT 1995)

L. 6 52.233-2 SERVICE OF PROTEST (SEP 2006)

L. 7 52.252-1 SOLICITATION PROVISIONS INCORPORATED BY REFERENCE (FEB 1998)

L. 8 1352.233-70 AGENCY PROTESTS (APR 2010)

L. 9 1352.233-71 GAO AND COURT OF FEDERAL CLAIMS PROTESTS (APR 2010)

SECTION M EVALUATION FACTORS FOR AWARD

M. 1 EVALUATION FACTORS FOR AWARD

M. 2 52.217-5 EVALUATION OF OPTIONS (JUL 1990)

PAGE 6 OF 114 SB1341-17-RP-0007

SECTION B

SUPPLIES OR SERVICES AND PRICES/COSTS

B. 1 SCHEDULE OF LABOR CATEGORIES

PAGE 7 OF 114 SB1341-17-RP-0007

SCHEDULE OF LABOR CATEGORIES

The following section details the labor categories that will be applied to this IDIQ contract. The labor categories described here are required for this contract. Each labor category has a description of the type of work to be performed under each, the minimum experience requirements, and minimum education requirements. The description of the work to be performed under each labor category is a generalized description and may be expanded upon under individual task orders, where the work will be better defined.

It is assumed all degrees will be from accredited colleges or universities. Degrees from non-accredited institutions will not be accepted, except when these are degrees from foreign universities.

Analysis Specialist

Minimum/General Experience:

This position requires a minimum of 5 years’ experience, of which at least 2 years must be specialized experience in vulnerability analysis, incident response, or vulnerability management. Must demonstrate the ability to work independently or under only general direction.

Functional Responsibilities: Duties may include but are not limited to: Analyzes configuration settings, vulnerabilities, patches and applies standardized scoring models. Must demonstrate good written and verbal communication skills for client interactions. May provide daily supervision and direction to support staff.

Minimum Education: Associates Degree, IT industry certification in a platform or applications (i.e. MCSA, MSCE, CCNA, CCNE, SCSA, etc.) or demonstrated work experience in vulnerability analysis.

OR a Bachelor’s degree with at least 2 years specialized experience in vulnerability analysis, incident response, or vulnerability management. OR no degree and at least 6 years of experience of which 2 years must be specialized experience in vulnerability analysis, incident response, or vulnerability management.

Applications Engineer (Intermediate)

Minimum/General Experience:

This position requires a minimum of 6 years’ experience, of which at least 4 years must be specialized. Specialized experience includes: experience as an applications programmer on data base management systems, knowledge of computer equipment and ability to develop complex software to satisfy design objectives. Demonstrated ability to work independently or under only general direction.

Functional Responsibilities: Duties may include but are not limited to: Applies a systematic, disciplined, quantified engineering approach to the development, operation and maintenance of software. Analyzes functional business applications and design

PAGE 8 OF 114 SB1341-17-RP-0007

Request for Proposal No. SB1341‐17‐RP‐0007

Schedule of Labor Categories Cybersecurity Research Development & Implementation specifications for functional activities. Develops block diagrams and logic flow charts. Translates detailed design into computer software. Tests, debugs, and refines the computer software to produce the required product. Prepares required documentation, including both program-level and user-level documentation.

Enhances software to reduce operating time or improve efficiency.

May provide technical direction to programmers to ensure program deadlines are met.

Minimum Education: A Bachelor’s degree in computer science/systems, information systems/technology, engineering/engineering technology, software engineering/programming, management, natural sciences, social sciences, mathematics or business/finance. OR a Master’s Degree (in subjects described above) and 3 years general experience of which at least 3 years must be specialized experience. OR no degree and 10 years of general experience of which at least 4 years must be specialized experience.

Application Engineer (Senior)

Minimum/General Experience:

This position requires a minimum of 10 years’ experience managing or performing software engineering activities, of which at least 8 years must be specialized. Specialized experience includes:

demonstrated experience with programming languages in the design and implementation of systems and using database management systems. General experience includes increasing responsibilities in software engineering activities. Knowledgeable of applicable standards.

Functional Responsibilities: Duties may include but are not limited to: Leads the application of a systematic, disciplined, quantified engineering approach to the development, operation and maintenance of software. Analyzes and studies complex system requirements. Designs software tools and subsystems to support software reuse and domain analyses and manages their implementation. Manages software development and support using formal specifications, data flow diagrams, other accepted design techniques and, when appropriate, Computer Aided Software Engineering (CASE) tools. Estimates software development costs and schedule. Reviews existing programs and assists in making refinements, reducing operating time, and improving current techniques. Supervises software configuration management.

Minimum Education: A Bachelor’s degree in computer science/systems, information systems/technology, engineering/engineering technology, software engineering/programming, management, natural sciences, social sciences, mathematics or business/finance. OR a Master’s Degree (in subjects described above) from an accredited college or university and 7 years general experience of which at least 5 years must be specialized experience. OR no degree and 14 years of

PAGE 9 OF 114 SB1341-17-RP-0007

general experience of which at least 12 years must be specialized experience.

Application Tester

Minimum/General Experience:

This position requires a minimum of 5 years’ experience, of which at least 3 years must be specialized. Specialized experience includes: experience as an application tester for web-based applications, REST-based data services, XML or JSON data formats, knowledge of computer equipment and ability to develop complex software testing approaches to satisfy design objectives and user requirements. Have experience with automated testing frameworks for web-based user interfaces, service-based testing, and performance testing web applications. Increasingly complex and progressive experience in conducting requirements analysis consisting of development of use cases, and design of integration and functional tests for application development projects.

Demonstrated ability to work independently or under only general direction.

Functional Responsibilities: Duties may include but are not limited to: analyzes design specifications and developed applications for testing activities. Applies testing expertise to verify application functionality in support of user requirements.

Prepares required documentation, including test plans and test reports. Develops test procedures and automated testing scripts.

Participates in all phases of risk management assessments and software/hardware development with emphasis on analysis of user requirements, test design and test tools selection.

Minimum Education: A Bachelor’s degree in computer science/systems, information systems/technology, engineering/engineering technology, software engineering/programming, management, natural sciences, social sciences, mathematics or business/finance. OR a Master’s Degree (in subjects described above) and 2 years’ general experience of which at least 1 years must be specialized experience. OR no degree and 9 years of general experience of which at least 5 years must be specialized experience.

Cybersecurity Subject Matter Expert (Intermediate)

Minimum/General Experience:

This position requires a minimum 10 years of cybersecurity related experience in one or more of the critical infrastructure sectors, and familiarity with the legal and regulatory cybersecurity frameworks associated with respective critical infrastructure sectors, especially as related to executive-level risk management, common cybersecurity practices, and cybersecurity tools and metrics.

PAGE 10 OF 114 SB1341-17-RP-0007

Functional Responsibilities: Assists with applying subject matter expertise to high-level analysis, and guidance development for some of the nation’s top cybersecurity challenges. Assists with applying high-level facilitation skills within large groups in order to derive stakeholder cybersecurity imperatives and support the prioritization of sometimes competing cybersecurity imperatives.

Minimum Education: A Bachelor’s degree with a curriculum or major field of study which is closely related to the work to be performed, and/or in a computer science, information systems, engineering or a mathematics-intensive discipline. OR a Master’s Degree and 7 years of specialized experience in a field closely related to cybersecurity. OR a PhD and 4 years of specialized experience in a field closely related to cybersecurity.

Cybersecurity Subject Matter Expert (Senior)

Minimum/General Experience:

This position requires a minimum 15 years of cybersecurity related experience in one or more of the critical infrastructure sectors, and familiarity with the legal and regulatory cybersecurity frameworks associated with respective critical infrastructure sectors, especially as related to executive-level risk management, common cybersecurity practices, and cybersecurity tools and metrics.

Functional Responsibilities: Applies subject matter expertise to high-level analysis, and guidance development for some of the nation’s top cybersecurity challenges. Applies high-level facilitation skills within large groups in order to derive stakeholder cybersecurity imperatives and support the prioritization of sometimes competing cybersecurity imperatives.

Minimum Education: A Bachelor’s degree with a curriculum or major field of study which is closely related to the work to be performed, and/or in a computer science, information systems, engineering or a mathematics-intensive discipline. OR a Master’s Degree and 12 years of specialized experience in a field closely related to Cyber security. OR a PhD and 9 years of specialized experience in a field closely related to Cyber security.

Cryptographer (Intermediate)

Minimum/General Experience:

This position requires 5 years’ general experience and 3 years specialized experience is required. 5 years’ general experience includes all aspects of cryptography, and a mixture of experience from the mathematical disciplines and the demonstrated ability to work independently or under only general supervision. 3 years specialized experience includes developing cryptographic and hash algorithms including but not limited to triple DES, AES, SHA, etc.

PAGE 11 OF 114 SB1341-17-RP-0007

Demonstrated experience in developing, analyzing, testing, and researching Public Key Infrastructures using X.509 certificates, symmetric and public key algorithms, hash functions, and quantum cryptography.

Functional Responsibilities: Duties may include but are not limited to: Performing complex analysis, design, development, integration, testing and debugging cryptographic and hashing algorithms. Applying cryptography-based solutions to contemporary use cases such as evaluating for FIPS 140 compliance, electronic voting, smart grid, health care, and resource constrained environments including but not limited to smart meters, smart cards, and medical devices.

Minimum Education: A Master's degree in Cryptography, Computer Science, Engineering, Mathematics, or other related scientific or technical discipline is required. OR a Bachelor’s degree in one of the above mentioned fields plus 8 years’ related experience. OR a PhD with 2 years’ related experience.

Cryptographer (Senior)

Minimum/General Experience:

This position requires 10 years’ general experience and 5 years specialized experience is required. 10 years’ general experience includes all aspects of cryptography, and a mixture of experience from the mathematical disciplines and the demonstrated ability to work independently or under only general supervision. Five (5) years specialized experience includes developing cryptographic and hash algorithms including but not limited to triple DES, AES, SHA, etc. Demonstrated experience in developing, analyzing, testing, and researching Public Key Infrastructures using X.509 certificates, symmetric and public key algorithms, hash functions and quantum cryptography.

Functional Responsibilities: Duties may include but are not limited to: Performs complex analysis, design, development, integration, testing and debugging cryptographic and hashing algorithms. Apply cryptography-based solutions to contemporary use cases such as evaluating for FIPS 140 compliance, electronic voting, smart grid, health care, and resource constrained environments including but not limited to smart meters, smart cards, and medical devices. May supervise Intermediate Cryptographers.

Minimum Education: A PhD degree in Cryptography, Computer Science, Engineering, Mathematics, or other related scientific or technical discipline is required. OR a Master’s degree in Cryptography, Computer Science, Engineering, Mathematics, or other related scientific or technical discipline is required AND 10 years’ experience in a field closely related to the field applicable to the task order.

PAGE 12 OF 114 SB1341-17-RP-0007

Developer (Junior)

Minimum/General Experience:

This position is for those who have demonstrated interest and accomplishment in code development, but have minimal professional experience. The developer should have IT industry certification in a platform or applications (i.e. MCSA, MSCE, CCNA, CCNE, SCSA, etc.) or have demonstrated work in an open source project.

Functional Responsibilities: Duties may include but are not limited to: Participates in the design of software tools and subsystems to support reuse and domain analysis. Assists Applications Engineer and Applications Programmer to interpret software requirements and design specifications to code, and integrate and test software components.

Minimum Education: High School Diploma.

Developer (Journeyman)

Minimum/General Experience:

This position requires a minimum of 2 years’ experience, of which at least 2 years must be specialized. Specialized experience includes: experience as an applications programmer on data base management systems, knowledge of computer equipment and ability to develop complex software to satisfy design objectives. Have experience with object or functionally-oriented programming languages.

Functional Responsibilities: Duties may include but are not limited to: Analyzes functional business applications and design specifications for functional activities. Develops block diagrams and logic flow charts. Translates detailed design into computer software. Tests, debugs, and refines the computer software to produce the required product. Prepares required documentation, including both program-level and user-level documentation.

Enhances software to reduce operating time or improve efficiency.

Takes direction from application engineer to ensure program deadlines are met.

Minimum Education: A Bachelor’s degree in computer science/systems, information systems/technology, engineering/engineering technology, software engineering/programming, management, natural sciences, social sciences, mathematics or business/finance. OR a Master’s Degree (in subjects described above).

Developer (Intermediate)

Minimum/General Experience:

This position requires a minimum of 5 years’ experience, of which at least 3 years must be specialized. Specialized experience includes: experience as an applications programmer on data base

PAGE 13 OF 114 SB1341-17-RP-0007

management systems, knowledge of computer equipment and ability to develop complex software to satisfy design objectives. Have experience with object or functionally-oriented programming languages. Demonstrated ability to work independently or under only general direction.

Functional Responsibilities: Duties may include but are not limited to: Analyzes functional business applications and design specifications for functional activities. Develops block diagrams and logic flow charts. Translates detailed design into computer software. Tests, debugs, and refines the computer software to produce the required product. Prepares required documentation, including both program-level and user-level documentation.

Enhances software to reduce operating time or improve efficiency.

May take direction from application engineer to ensure program deadlines are met.

Minimum Education: A Bachelor’s degree in computer science/systems, information systems/technology, engineering/engineering technology, software engineering/programming, management, natural sciences, social sciences, mathematics or business/finance. OR a Master’s Degree (in subjects described above) and 2 years’ general experience of which at least 1 years must be specialized experience. OR no degree and 9 years of general experience of which at least 5 years must be specialized experience.

Developer (Lead)

Minimum/General Experience:

This position requires a minimum of 10 years of increasingly complex and progressive experience in performing systems analysis, development, and implementation for business, mathematical, engineering or scientific settings using a variety of information technology resources. Requires experience with current technologies and, where required for the task, emerging technologies. Have experience with object or functionally-oriented programming languages.

Functional Responsibilities: Duties may include but are not limited to: Formulates and defines system scope and objectives.

Prepares detailed specifications for programs. Designs, codes, tests, debugs, and documents programs. Works at the highest technical level of all phases of applications, systems analysis and programming activities including the installation of enhancements, security features, and analytical tools. Provides guidance and training to less experienced analysts/programmers.

Minimum Education: A Bachelor’s degree with a curriculum or major field of study which provides substantial knowledge useful in managing large, complex projects closely related to the work to be automated, and/or in a computer science, information system, a physical science, engineering or a mathematics - intensive

PAGE 14 OF 114 SB1341-17-RP-0007

discipline, or an applicable training certificate from an accredited training institution. OR a Master’s Degree (in subjects described above) with 7 years’ experience in a field closely related to the field applicable to the task order. OR a PhD with 4 years’ experience. OR no degree and 14 years of directly related experience.

Information Engineer (Junior)

Minimum/General Experience:

This position requires a minimum of 3 years’ experience, of which at least 2 years must be specialized. Specialized experience includes information systems development, functional and data requirements analysis, systems analysis and design, programming, program design and documentation preparation. The following experience is also required: demonstrated experience in the implementation of information engineering projects; systems analysis, design and programming, systems planning, business information planning, and business analysis. Must demonstrate the ability to work independently or under only general direction.

Functional Responsibilities: Duties may include but are not limited to: Applies business process improvement practices to re-engineer methodologies/principles and business process modernization projects. Applies, as appropriate, activity and data modeling, transaction flow analysis, internal control and risk analysis and modern business methods and performance measurement techniques. Assists in establishing standards for information systems procedures. Develops and applies organization-wide information models for use in designing and building integrated, shared software and database management systems. Constructs sound, logical business improvement opportunities consistent with corporate information management guiding principles, cost savings, and open system architecture objectives. May provide daily supervision and direction to staff.

Minimum Education: A Bachelor’s degree in computer science/systems, information systems/technology, engineering/engineering technology, software engineering/programming, management, natural sciences, social sciences, mathematics or business/finance. OR a Master’s Degree.

OR no degree with 7 years’ experience of which 4 must be specialized experience.

Information Engineer (Intermediate)

Minimum/General Experience:

This position requires a minimum of 6 years’ experience, of which at least 4 years must be specialized. Specialized experience includes information systems development, functional and data requirements analysis, systems analysis and design, programming, program design and documentation preparation. The following

PAGE 15 OF 114 SB1341-17-RP-0007

experience is also required: demonstrated experience in the implementation of information engineering projects; systems analysis, design and programming, systems planning, business information planning, and business analysis. Must demonstrate the ability to work independently or under only general direction.

Functional Responsibilities: Duties may include but are not limited to: Applies business process improvement practices to re-engineer methodologies/principles and business process modernization projects. Applies, as appropriate, activity and data modeling, transaction flow analysis, internal control and risk analysis and modern business methods and performance measurement techniques. Assists in establishing standards for information systems procedures. Develops and applies organization-wide information models for use in designing and building integrated, shared software and database management systems. Constructs sound, logical business improvement opportunities consistent with corporate information management guiding principles, cost savings, and open system architecture objectives. May provide daily supervision and direction to staff.

Minimum Education: A Bachelor’s degree in computer science/systems, information systems/technology, engineering/engineering technology, software engineering/programming, management, natural sciences, social sciences, mathematics or business/finance. OR a Master’s Degree and 3 years’ general experience of which at least 1 must be specialized. OR a PhD Degree. OR no degree and 10 years of general experience of which at least 6 must be specialized experience.

Information Engineer (Senior)

Minimum/General Experience:

This position requires a minimum of 10 years’ experience, of which at least 8 years must be specialized. Specialized experience includes information systems development, functional and data requirements analysis, systems analysis and design, programming, program design and documentation preparation. The following experience is also required: demonstrated experience in the implementation of information engineering projects; systems analysis, design and programming, systems planning, business information planning, and business analysis. Must demonstrate the ability to work independently or under only general direction.

Functional Responsibilities: Duties may include but are not limited to: Applies business process improvement practices to re-engineer methodologies/principles and business process modernization projects. Applies, as appropriate, activity and data modeling, transaction flow analysis, internal control and risk analysis and modern business methods and performance measurement techniques. Assists in establishing standards for information systems procedures. Develops and applies organization-wide information models for use in designing and building integrated, PAGE 16 OF 114 SB1341-17-RP-0007 shared software and database management systems. Constructs sound, logical business improvement opportunities consistent with corporate information management guiding principles, cost savings, and open system architecture objectives. May provide daily supervision and direction to staff.

Minimum Education: A Bachelor’s degree in computer science/systems, information systems/technology, engineering/engineering technology, software engineering/programming, management, natural sciences, social sciences, mathematics or business/finance. OR a Master’s Degree (in subjects described above) and 7 years’ general experience of which at least 5 years must be specialized experience. OR a PhD (in subjects described above) and 4 years of general experience of which at least 2 years must be specialized. OR no degree and 14 years of general experience of which at least 12 years must be specialized experience.

Information Engineer (Principal)

Minimum/General Experience:

This position requires a minimum of 14 years’ experience, of which at least 12 years must be specialized. Specialized experience includes information systems development, functional and data requirements analysis, systems analysis and design, programming, program design and documentation preparation. The following experience is also required: demonstrated experience in the implementation of information engineering projects; systems analysis, design and programming, systems planning, business information planning, and business analysis. Must demonstrate the ability to work independently or under only general direction.

Functional Responsibilities: Duties may include but are not limited to: Applies business process improvement practices to re-engineer methodologies/principles and business process modernization projects. Applies, as appropriate, activity and data modeling, transaction flow analysis, internal control and risk analysis and modern business methods and performance measurement techniques. Assists in establishing standards for information systems procedures. Develops and applies organization-wide information models for use in designing and building integrated, shared software and database management systems. Constructs sound, logical business improvement opportunities consistent with corporate information management guiding principles, cost savings, and open system architecture objectives. May provide daily supervision and direction to staff.

Minimum Education: A Bachelor’s degree in computer science/systems, information systems/technology, engineering/engineering technology, software engineering/programming, management, natural sciences, social sciences, mathematics or business/finance. OR a Master’s Degree (in subjects described above) and 11 years’ general experience of

PAGE 17 OF 114 SB1341-17-RP-0007

which at least 9 years must be specialized experience. OR a PhD (in subjects described above) and 8 years of general experience of which at least 6 years must be specialized. OR no degree and 18 years of general experience of which at least 16 years must be specialized experience.

Outreach Specialist (Journeyman)

Minimum/General Experience:

This position requires a minimum of 7 years of general experience of which at least 3 must be specialized.

Functional Responsibilities: Duties to include, but not be limited to: Facilitation of working sessions in workshops, preparing strategies and agendas for workshops/conferences, preparing material for posting on public websites, preparing responses to public input on various topics, and assisting to develop strategies for NIST work efforts.

Minimum Education: A Bachelor’s degree in computer science/systems, information systems/technology, engineering/engineering technology, software engineering/programming, management, natural sciences, social sciences, mathematics or business/finance. OR a Master’s Degree (in subjects described above) and 4 years’ general experience of which at least 2 years must be specialized experience. OR a PhD (in subjects described above) and 2 years of general experience of which at least 1 year must be specialized. OR no degree and 11 years of general experience of which at least 8 years must be specialized experience.

Outreach Specialist (Senior)

Minimum/General Experience:

This position requires a minimum of 10 years of general experience of which at least 5 must be specialized.

Functional Responsibilities: Duties to include, but not be limited to: Facilitation of working sessions in workshops, preparing strategies and agendas for workshops/conferences, preparing material for posting on public websites, preparing responses to public input on various topics, and assisting to develop strategies for NIST work efforts.

Minimum Education: A Bachelor’s degree in computer science/systems, information systems/technology, engineering/engineering technology, software engineering/programming, management, natural sciences, social sciences, mathematics or business/finance. OR a Master’s Degree (in subjects described above) and 7 years’ general experience of which at least 5 years must be specialized experience. OR a PhD (in subjects described above) and 4 years of general experience of

PAGE 18 OF 114 SB1341-17-RP-0007

which at least 2 years must be specialized. OR no degree and 14 years of general experience of which at least 12 years must be specialized experience.

Program Manager 1 – Assistant Level

Minimum/General Experience:

This position requires a minimum of 3 years’ general project management experience. Experience includes increasing responsibilities in project management.

Functional Responsibilities: Duties may include but are not limited to: Serves as an Assistant Project Manager on large or complicated Task Orders or as a Task Manager for small (under $250,000), simple tasks, working with the Project Manager to ensure communications are timely and clear, project materials are prepped in a timely and accurate fashion, schedules are adhered to, and all deliverables reach the COR and Tech Lead on time.

Minimum Education: No degree and 7 years of experience of which 3 must be specialized experience. OR a Master’s Degree in Project Management can be substituted for 3 years’ project management experience. OR a Project Manager Professional (PMP) certification from the Program Management Institute (PMI) may be substituted for 3 years’ project management experience. OR a Mid-level FAC-P/PM or Defense Systems Management College (DSMC) Program Management (PM) Level 2 certification may be substituted for 2 years’ project management experience.

Program Manager 2 – Task Order Level

Minimum/General Experience:

This position requires a minimum of 6 years’ general project management experience and 3 years IT experience in computer security. Experience includes increasing responsibilities in information systems design and management.

Functional Responsibilities: Duties may include but are not limited to: Serves as project manager for a large, complex task order and shall assist the Program Manager in working with the ordering activity Contracting Officer (CO), the Federal Acquisitions Contract – Project/Program Manager (FAC-P/PM), the contract-level Contracting Officer’s Representative (COR), and the task order-level COR(s), ordering activity management personnel and customer agency representatives. The Project Manager is responsible for the overall management of the specific task order(s) and insuring that the technical solutions and schedules in the task order are implemented in a timely manner. Performs enterprise wide horizontal integration planning and interfaces to other functional systems.

Minimum Education: Must either be certified as a.) Project Management Professional (PMP) by the Project Management Institute

PAGE 19 OF 114 SB1341-17-RP-0007

(PMI) or other such credentialing organization, or b.) Have been or currently are certified as a FAC- Program/Project Manager (P/PM) (Mid or Senior level). A Defense Systems Management College (DSMC) Program Management (PM) certification of Level 2 or 3 will be considered equivalent to a FAC-P/PM Mid or Senior Level. A Bachelor’s degree in computer science/engineering technology, software/programming, or mathematics can be substituted for 2 years’ general experience and 2 years IT experience. A PhD or Master’s Degree (in subjects described above) can be substituted for 3 years IT experience. A Master’s Degree in Project Management can be substituted for 3 years’ project management experience.

Program Manager 3 – Contract Level

Minimum/General Experience:

This position requires a minimum of 10 years’ general project management experience and 5 years IT experience in computer security. Experience includes increasing responsibilities in information systems design and management.

Functional Responsibilities: Duties may include but are not limited to: Serves as the program manager for the IDIQ contract as a whole.

Serves as program manager for a large, complex task order (or a group of task orders affecting the same common/standard/migration system) and shall assist the Government Program Manager in developing/presenting project materials by and between the Contracting Officer (CO), the Federal Acquisitions Contract – Project/Program Manager (FAC-P/PM), the contract-level Contracting Officer’s Representative (COR), the task order-level COR(s), ordering activities of the management personnel and customer agency representatives. The Program Manager is responsible for the overall management of all task order(s) and ensuring that the technical solutions and schedules of the task orders are implemented in a timely manner. Performs enterprise wide horizontal integration planning and interfaces to other functional systems. The Program Manager may also supervise Project Managers at the task order level.

Minimum Education: Must either be certified as a.) a Project Management Professional (PMP) by the Project Management Institute (PMI) or other such credentialing organization, or b.) Have been or is currently certified as a Senior-level FAC-Program/Project Manager (FAC-P/PM). A Defense Systems Management College (DSMC) Program Management (PM) certification of Level 3 will be considered equivalent to a FAC-P/PM Senior Level. A Bachelor’s degree in computer science/engineering technology, software/programming, or mathematics can be substituted for 2 years’ general experience and 2 years IT experience. A PhD or Master’s Degree (in subjects described above) can be substituted for 3 years IT experience. A Master’s Degree in Project Management can be substituted for 3 years’ project management experience.

PAGE 20 OF 114 SB1341-17-RP-0007

Security Engineer (Senior)

Minimum/General Experience:

This position requires 10 years’ experience in technology oriented security engineering support related to hardware, software, O/S and/or processes.

Functional Responsibility: Duties may include but are not limited to: network security design engineering, intrusion detection/prevention engineering design and/or execution, environment risk assessments, network security architectural engineering, operating system security and operational security process engineering; providing direction to intermediate and junior staff on the tasks needed to implement security objectives.

Minimum Education: A Bachelor’s degree from an accredited college or university with a curriculum or major field of study which is closely related to the work to be automated, and/or in a computer science, information system, a physical science, engineering or a mathematics-intensive discipline. OR a Master’s Degree (in subjects described above) from an accredited college or university with 7 years of applicable experience. OR no degree and 14 years of directly applicable experience coupled with an industry or vendor technical certification (i.e. CISSP, CIPA, MCSE, MCSA, CCNA, CCNE, SCSA, etc.)

Security Engineer (Intermediate)

Minimum/General Experience:

This position requires 4 years’ experience in technology oriented security engineering support related to hardware, software, O/S and/or processes.

Functional Responsibility: Duties may include but are not limited to: network security design engineering, intrusion detection/prevention engineering execution, environment risk assessments, network security architectural engineering, operating system security and operational security process engineering;

providing direction to junior staff on the tasks needed to implement security objectives.

Minimum Education: A Bachelor’s degree from an accredited college or university with a curriculum or major field of study which is closely related to the work to be automated, and/or in a computer science, information system, a physical science, engineering or a mathematics-intensive discipline. OR a Master’s Degree (in subjects described above) from an accredited college or university with 1 year of applicable experience in a field closely related to the field applicable to the task order. OR No degree and 8 years of directly applicable experience coupled with and industry or vendor technical certification (i.e. CISSP, CIPA, MCSE, MCSA, CCNA, CCNE, SCSA, etc.).

PAGE 21 OF 114 SB1341-17-RP-0007

Software Systems Engineer (Lead)

Minimum/General Experience:

This position requires 7 years of increasingly complex and progressive experience in performing systems analysis, development, and implementation of business, mathematical, or scientific settings using a variety of information technology resources. Requires experience with current technologies and, where required for the task, emerging technologies. Must have managed or had significant involvement with complex or substantive information technology projects including one year of experience demonstrating management and supervision capabilities.

Functional Responsibilities: Duties may include but are not limited to: Formulates and defines specifications for operating system applications or modifies and maintains existing applications using engineering releases and utilities from the manufacturer.

Responsible for program design, modeling, simulation, coding, testing, debugging and documentation.

Responsible for applications dealing with the overall operating system, such as sophisticated file maintenance routines, large telecommunications/communications networks, computer accounting and advanced mathematical/scientific software packages.

Instructs, directs, and checks the work of other task personnel.

Responsible for…