SOW_SBAHQ18Q0012.pdf

SBAHQ-18-Q-0012

Research on the Economic Impact of Cyberattacks on Small

Businesses

Statement of Work

The U.S. Small Business Administration’s Office of Advocacy examines the role and status of small business in the economy and independently represents the views of small business to federal agencies, Congress, and the President. It is the source for small business statistics presented in user-friendly formats and it funds research into small business issues. For more information on the Office of Advocacy, including past research projects, visit http://www.sba.gov/advocacy/847.

Type of contract: The government anticipates awarding a firm-fixed price type award

Location of work: To be completed by the contractor at the contractor’s facility

Anticipated period of performance: The base period is within six months of award. The option period (if exercised) is within eight months of exercise of the option (within 14 months of initial award).

Clearance required: None

1 Purpose

The purpose of this study is to conduct a literature review and empirical, data-intensive analysis of the economic impact of cyberattacks on small businesses, and provide insight for policymakers based on the findings of the analysis.

2 Background

Businesses of all sizes are confronting a growing number of cybersecurity threats, but small businesses often lack the knowledge and resources to invest in and maintain cybersecurity protections the way larger businesses can. Recent surveys and data breaches indicate that small businesses are highly vulnerable to costly cyberattacks but are often insufficiently prepared to detect or recover from them. While the statistics vary, a 2018 Verizon report found that 58 percent of cyber breach victims were categorized as small businesses.

The data also show that cyberattacks have a severe economic impact on businesses of all sizes. According to a 2015

National Small Business Association survey, on average, a cyberattack cost small businesses

$7,115. Average losses increased to $32,021 if a small business’s bank account was compromised in the attack.

In terms of preparation and awareness, a 2012 study by Symantec and the National Cybersecurity Alliance found that 83 percent of small business respondents did not have a written plan in place for keeping their business cyber-secure. Equally concerning, 68 percent of small business respondents said they do not provide employees with computer security

Verizon Enterprise, “2018 Data Breach Investigations Report,” 11 th edition, 2018 5, https://www.verizonenterprise.com/resources/reports/rp_DBIR_2018_Report_en_xg.pdf.

National Small Business Association, 2015 Year-End Economic Report, 2016 http://www.nsba.biz/wp-content/uploads/2016/02/Year-End-Economic-Report-2015.pdf.

http://www.sba.gov/advocacy/847 https://www.verizonenterprise.com/resources/reports/rp_DBIR_2018_Report_en_xg.pdf http://www.nsba.biz/wp-content/uploads/2016/02/Year-End-Economic-Report-2015.pdf http://www.nsba.biz/wp-content/uploads/2016/02/Year-End-Economic-Report-2015.pdf training.

Little is known about the sources and types of small business cyberattacks, the protection readiness levels of small businesses, the unique cybersecurity challenges facing small businesses, and the costs of these attacks on small businesses and its economic implications. This research will increase the understanding of the economic costs of cyberattacks on small businesses to provide policymaking insight.

3 Scope

3.1 Overview

a. Any additional terms must be submitted with the proposal. No additional terms or agreements will be considered following award.

b. The research contract will incorporate by reference the contractor’s complete research proposal, the complete Statement of Work (SOW), and additional documents.

c. This is a nonpersonal services contract to provide services as detailed herein and in the contractor’s complete research proposal.

d. The contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to perform this service as defined in this SOW. The contractor shall perform to the standards identified in this contract.

3.2 Proposal Expectations

This solicitation is for empirical research. Research proposals can use a wide range of data sources available. No additional preference will be given to proposals that cover all issues mentioned. Rather, preference will be given to proposals that exhibit strong knowledge of the proposed research area of focus, and present a clear and concise research plan. Preference will be given to research that uses timely data and econometric techniques to understand potential causal relationships.

3.3 Task Components

The contract will be divided into two tasks:

Task A, to be completed within six months of initial award:

The Contractor will conduct a thorough review and synthesis of relevant literature, and provide an overview and descriptive analysis of selected data along with tables and figures. The contractor will prepare this information into a preliminary report. The preliminary report should contain an introduction, literature review, and a data overview. The preliminary report should avoid excessive length. Additionally, the Contractor will prepare a detailed plan for empirical analysis of the selected data on the topic that builds from the literature which will outline the research strategy and expected findings. The contractor will prepare this information into a separate document for Task B consideration.

National Cybersecurity Alliance and Symantec, “2012 NSCA/Symantec National Small

Business Study,” October 2012, https://staysafeonline.org/wp-content/uploads/2017/09/2012-

NCSA-Symantec-Small-Business-Study.pdf.

Task B (if option is exercised), to be completed within eight months of exercise of the option

(within 14 months of initial award):

The Contractor will execute the empirical methodology in Task A, and prepare a final report that includes the components of Task A, the results and findings from executing the methodology, and relevant policy implications and conclusions. The final report should contain an executive summary, a comprehensive review of the current and relevant literature, discussion of the data and findings of the analysis, and overall conclusions. The final report should avoid excessive length.

4 Deliverables

4.1 Final Deliverable Schedule

The following is a general set of deliverables and deadlines for the delivery of those deliverables.

More specific deliverables and a more specific deliverable schedule shall be finalized following the award of the contract and shall be mutually agreed upon by the Contractor, Contracting

Officer, and Contracting Officer Representative at the kick-off meeting for the contract. The deliverables and deliverable schedule shall be based on the milestones identified in this section, the accepted proposal, and the specific period of performance of the contract upon award, including specific due dates within the contract term. The final deliverable schedule shall be formally amended to the contract through a modification.

4.2 Progress of Deliverables

Deliverables must show significant progress relative to each previous deliverable and must be consistent with all parts of section 5 of the Statement of Work, Performance Requirements.

SBA’s Office of Advocacy will not cover the costs associated with correcting rejected deliverables.

4.3 Acceptance of Deliverables

The Contracting Officer Representative (COR) shall review submitted deliverables over a reasonable amount of time and shall make an express determination of whether to accept or reject the deliverable.

Deliverable Due Date Format for Written

Submissions

Transition

Method

Transmitted to Whom

Post Award Conference – discuss expectations, procedures/invoicing, and deliverables milestones

10 business days after award

N/A -- Phone

Conference

N/A CO and

COR

Monthly progress reports 3rd business day of each month

Microsoft Word document

Via Email COR

Discussions on reports/submittals, including passback and edits

As scheduled by request of the COR

(possible bi-

N/A -- Phone

Conference

N/A COR/Vendor

Deliverable Due Date Format for Written

Submissions

Transition

Method

Transmitted to Whom weekly calls)

Detailed Contract Deliverables Milestones

Task A

1. Outline and Task A Initial

Briefing (includes 1.a and

1.b)

Month 1of base period

Microsoft Word documents formatted in accordance with specifications and/or statistical results (no

PDFs or locked files)

Via Email COR

a. Outline – establishes planned structure for preliminary report

Microsoft Word document

Via Email COR

b. Task A Initial Briefing – contractor presents outline, initial overview of data, key literature, projected methodology, and any preliminary findings.

Microsoft Word or

Powerpoint

Document

Via Tele-conference or in

Person

COR and internal staff including

Advocacy editors

2. Initial Draft Sections of

Report (includes 2.a)

Month 2 of base period

Microsoft Word documents formatted in accordance with specifications and/or statistical results (no

PDFs or locked files)

Via Email COR

a. Draft Introduction, Literature Review, & Data sections – submitted for review

Microsoft Word documents formatted in accordance with specifications and/or statistical results (no

PDFs or locked files)

Via Email COR

3. Final Draft of Introduction, Literature Review, & Data sections; Initial Draft of

Empirical Methodology Plan

(includes 3.a and 3.b)

Month 3 of base period

Microsoft Word documents formatted in accordance with specifications and/or statistical results (no

PDFs or locked files)

Via Email COR

a. Polished Final Draft of

Introduction, Literature

Review, & Data sections -submitted for review after initial passback

Microsoft Word documents formatted in accordance with specifications and/or statistical results (no

Via Email COR

Deliverable Due Date Format for Written

Submissions

Transition

Method

Transmitted to Whom

PDFs or locked files)

b. Initial Draft Empirical

Methodology Plan – submitted for review

Microsoft Word documents formatted in accordance with specifications and/or statistical results (no

PDFs or locked files)

Via Email COR

4. Final Draft of Empirical

Methodology Plan; Full Draft of Preliminary Report; Final passbacks (includes 4.a, 4.b)

Month 4 of base period

Microsoft Word documents formatted in accordance with specifications and/or statistical results (no

PDFs or locked files)

Via Email COR

a. Polished Final Draft of

Empirical Methodology Plan

– submitted for review after initial passback.

Microsoft Word documents formatted in accordance with specifications and/or statistical results (no

PDFs or locked files)

Via Email COR

b. Full Draft of Preliminary

Report – polished sections compiled into full draft and submitted for review

Microsoft Word documents formatted in accordance with specifications and/or statistical results (no

PDFs or locked files)

Via Email COR

6. Final passbacks and review; Task A Final

Briefing; Preliminary Report

Submission; Empirical

Methodology Plan

Submission (includes 6.a, 6.b, 6.c)

Months 5-6 of the base period

Microsoft Word documents formatted in accordance with specifications and/or statistical results (no

PDFs or locked files)

Via Email COR

a. Final passbacks and review of preliminary report between contractor and COR

Microsoft Word documents formatted in accordance with specifications and/or statistical results (no

PDFs or locked files)

Via Email

b. Task A Final Briefing –

Contractor presents overview of Task A, findings and discussion of the preliminary report draft, and the empirical

Microsoft Word or

Powerpoint

Document

Via Tele-conference or in

Person

COR and internal staff including

Advocacy editors

Deliverable Due Date Format for Written

Submissions

Transition

Method

Transmitted to Whom methodology for Task B consideration

c. Preliminary Report

Submission; Empirical

Methodology Plan

Submission

No later than a day before the end of the base period. End of Task A.

Microsoft Word or

PDF

Via Email COR to contractor

Task B (if the option is exercised)

7. Detailed Final Report

Outline –submitted for review

Month 1 of option period

(Month 7 from award date)

Microsoft Word documents formatted in accordance with specifications and/or statistical results (no

PDFs or locked files)

Via Email COR

8. Initial Draft of Empirical

Analysis section – submitted for review

Month 2 of option period

(Month 8 from award date)

Microsoft Word documents formatted in accordance with specifications and/or statistical results (no

PDFs or locked files)

Via Email COR

9. Polished Draft of

Empirical Analysis section – submitted for review after initial passback; Initial Drafts of Executive Summary, Findings / Results, Policy

Implications / Conclusions sections

Month 3 of option period

(Month 9 from award date)

Microsoft Word documents formatted in accordance with specifications and/or statistical results (no

PDFs or locked files)

Via Email COR

10. Polished Drafts of

Executive Summary, Findings / Results, Policy

Implications / Conclusions sections – submitted for review after initial passback;

Full Final Report Draft – submitted for review

Month 4 of option period

(Month 10 from award)

Microsoft Word documents formatted in accordance with specifications and/or statistical results (no

PDFs or locked files)

Via Email COR

12. Peer Review Initiated;

Final Report Draft Sent to

Peer Reviewers Selected by

COR

Month 5 of option period

(Month 11 from award)

Microsoft Word documents formatted in accordance with specifications and/or statistical results (no

PDFs or locked files)

Deliverable Due Date Format for Written

Submissions

Transition

Method

Transmitted to Whom

12. Peer Review Comments

Sent to Contractor;

Contractor Drafts and

Submits Peer Review

Response Memo to COR

Month 6 of option period

(Month 12 from award)

Microsoft Word documents formatted in accordance with specifications and/or statistical results (no

PDFs or locked files)

Via Email COR

13. Polished Final Report

Draft post-peer review – submitted for review

Month 7 of option period

(Month 13 from award)

Microsoft Word documents formatted in accordance with specifications and/or statistical results (no

PDFs or locked files)

Via Email COR

14. Final Passbacks and

Review

Month 8 of option period

(Month 14 from award

Microsoft Word documents formatted in accordance with specifications and/or statistical results (no

PDFs or locked files)

Via Email COR

15. Final Report Submission No later than a day before the end of the option period. End

Task B

Microsoft Word documents formatted in accordance with specifications and/or statistical results (no

PDFs or locked files)

5 Performance Requirements

5.1 General Requirements

a. The methodology and hypotheses put forth in the proposal will clearly show how the research will be conducted, are binding upon award, and are expected to be reflected in the final report.

b. All research team members listed in the proposal, including but not limited to subject matter and technical experts, will actively contribute through the performance of these services.

c. The resulting final submission will fully document the analysis and conclusions to fully support the position asserted.

d. The final product should contain a thorough review of the current and relevant literature, discussion of the data and findings, and overall conclusions.

e. The report should demonstrate policy relevance to current issues.

f. Deliverables as listed in the final deliverable schedule will reflect reasonable progress toward the final product and should be submitted according to final product formatting requirements, meaning all deliverables should be thoroughly proofread and edited, written clearly and concisely and free of grammatical and typographical errors.

g. For other details on the final product, see section 4 of the Statement of Work on deliverables and section 5.2 of the Statement of Work on additional requirements.

5.2 Additional Requirements

Contractors must adhere to the following when submitting draft and final deliverables, with the draft and final versions completed by the listed deadlines:

5.2.1 Adherence to Contract Terms

All submissions will be presented by the prescribed deadlines; presented under the prescribed methodology; in the prescribed format to the contracting officer’s representative (COR).

Documents shall be clearly annotated and/or identified as either a draft or a final document.

5.2.2 Deliverables

The contractor will provide the Office of Advocacy with an electronic version of the final deliverable within the contract term. All of the deliverables listed in the deliverables chart of this

SOW and any subsequent modifications to the contract, including all drafts identified as deliverables, shall be created in accordance with the terms and conditions detailed in this document. The research is expected to progress along the timeline and benchmarks as noted in the Deliverables section and as incorporated into the contract.

5.2.3 Contract Team

a. Key Personnel

Key personnel shall have the technical skills requisite to perform the project. This requires a minimum of advanced technical training in applied economic and econometric analysis and demonstrated experience as subject matter experts. For example, a Ph.D. in Economics or survey methodology would be considered acceptable. Offerors shall submit resumes that demonstrate these minimum qualifications for key personnel, such as project leads.

b. Changes in Contract Team

Contractors must seek prior written approval from the contracting officer and COR before any changes are implemented among the key personnel and other staff listed in the proposal.

Individuals that the contractor proposes to use as replacements for those listed in the proposal shall satisfy the minimum qualification requirements contained in the solicitation and the contractor must provide resumes for each proposed replacement as part of its request for prior written approval.

5.2.4 Paperwork Reduction Act Requirements

When surveys or new information collections are necessary, contractors must meet the requirements of the Paperwork Reduction Act (PRA) where applicable. In order to do so, the contractor will need to anticipate within the performance term the required public notice and

OMB review for information collections under the PRA. The creation of a new information collection will require the contractor to develop survey procedures; identify appropriate respondents; provide clarification of the collection process; provide realistic estimates of the response rates; and work to develop an appropriate survey instrument (see, https://www.whitehouse.gov/omb/information-regulatory-affairs/federal-collection-information/).

It is the contractor’s responsibility to prepare any materials necessary to obtain PRA clearances associated with the work to be performed.

5.2.5 Data Quality and Transparency Requirements

All research and data projects are subject to the Office of Management and Budget Guidelines for

Ensuring and Maximizing the Quality, Objectivity, Utility, and Integrity of Information

Disseminated by Federal Agencies (see, https://www.gpo.gov/fdsys/pkg/FR-2002-02-22/pdf/R2-

59.pdf).

Per these guidelines, data source disclosure and robustness checks will be required for any research or data project, including all data coding necessary to replicate findings and datasets derived through coding and query and used in support of analysis, unless otherwise limited by special access agreements. Peer review may range from internal Advocacy staff review to that of external reviewers in relevant fields such as academics or technical experts. Feedback from this process will be incorporated into subsequent drafts before the report can be finalized for release.

5.2.6 Data Rights

Rights in Data under FAR §§ 52.227-14 (alternates 2 and 5), 52.22715, and 52.227-16 shall apply.

5.2.7 Editing and Proofreading Requirements

The documented submissions related to the post award service, including the final report and all intervening deliverables, must be thoroughly edited and of high professional quality before submission to the COR. These high professional quality drafts and reports shall include professional language, presentation, and citations commensurate with published research in academic journals in the relevant subject matter field and shall be free of typographical and grammatical errors.

5.2.8 Style Requirements

The final report must contain an executive summary and table of contents. It must conform to the current version of one of the major style guides, such as the University of Chicago Manual of

Style or the American Psychological Association (APA) Style Manual, in terms of grammar, style, and organization. In particular, each table and figure must have a source specified on the page; references, footnotes and bibliographies shall be formatted consistent with a major style guide; and all pages shall have page numbers, including tables and figures.

5.2.9 ADA Section 508 Requirements

All government agency electronic and information technology (EIT) is required to comply with the Americans with Disabilities Act of 1990 (ADA). Section 508 of the ADA’s 1998 amendments requires the electronic documents posted by Federal agencies to be accessible to employees and members of the public with disabilities to the extent that it does not pose an

"undue burden." To comply with this mandate, the final report must be formatted in accordance with Section 508 requirements. The according to the Office of Advocacy will provide guidance to achieve 508 compatibility at the time of award; however, it is ultimately the contractor’s responsibility to provide all deliverables in accordance with the legal requirements for section

508 compliance. Per the guidelines, written descriptions of all figures and charts in the final report must be provided in a separate document.

5.2.10 Formatting Requirements

Final reports must be double-spaced. The format of the electronic version must be a native word processing software format. An Acrobat (PDF) file is not acceptable. All tables, graphics, and charts must be supplied in an editable software format. The font size used in the document will be no smaller than 12 point for manuscript text; 10 point for tables, graphics and charts; and 9 point for footnotes.

5.2.11 Disclaimer

The Office of Advocacy will prepare a cover page carrying the following disclaimer, "The statements, findings, conclusions, and recommendations found in this study are those of the authors and do not necessarily reflect the views of the Office of Advocacy, the United States

Small Business Administration, or the United States Government."

5.2.12 Product Release

If the contracted product is a complete publishable report, following approval and acceptance of the final report, the Office of Advocacy will assign a date for public release of the report. Upon release, an electronic final report, along with an Office of Advocacy-prepared research summary, will be posted on Advocacy's web site, http://www.sba.gov/advocacy/847.

5.2.13 Definition of Small Business

Within the research product, the definition of small businesses should be the same as that of the proposal and should be consistent with either the general definition of small businesses (less than

500 employees), the definition of small business established by the U.S. Small Business

Administration’s Office of Size Standards, or a reasonably justified definition of small business as substantiated in the contractor’s proposal.

5.2.14 Future Publication and Attribution

Prior to the Office of Advocacy’s release, the Contractor shall not release, distribute copies to the public, or publish the final research product without prior written permission of the Office of

Advocacy. The Office of Advocacy encourages contractors to publish their findings in professional journals, if possible, but they can do so only after completing the contract, and, only if prior to the Office of Advocacy’s release, the Contractor has received written permission of the

Office of Advocacy. Prior to publication, the Contractor must notify the Contracting Officer

Representative in writing regarding attribution to the Office of Advocacy. Attribution must cite the SBA contract number under which the research was performed.

http://www.sba.gov/advocacy/847