SOW Bug Bounty SaaS.pdf

https://www.acquisition.gov/print/11305 1/9

GENERAL SERVICES ADMINISTRATION

REQUEST FOR QUOTE

SOLICITATION NUMBER: 47HAA020Q0129

STATEMENT OF WORK (SOW)

FOR: BUG BOUNTY SaaS PLATFORM

IN SUPPORT OF:

GENERAL SERVICES ADMINISTRATION (GSA)

SECURITY OPERATION DIVISION (SecOps)

CONDUCTED UNDER:

FAR 6.302-1 (See attached justification) With intent to sole source to: HackerOne

ISSUED BY:

GENERAL SERVICES ADMIISTRATION (GSA)

Office of Internal Acquisition (OIA) 1800 F Street, NW Washington, Dc 20405

September 11, 2020 http://www.acquisition.gov/print/11305 https://www.acquisition.gov/print/11305 2/9

1.0 GENERAL

General Services Administration (GSA) Security Operation Division (SecOps) has a requirement for a public Bug Bounty SaaS Platform.

2.0 INTRODUCTION

With bug bounties becoming an established industry-wide best practice, GSA Security Operations Division (SecOps) desires to establish one of its own. As part of its programmatic focus on security, SecOps needs to purchase access to a pre-existing, commercially available Bug Bounty SaaS Platform that will allow it to launch and manage the Bug Bounty program. In addition, the platform will allow GSA to implement a Vulnerability Disclosure policy to handle and triage reports from researchers for GSA. This acquisition will provide access to a large network of security researchers, people who have an interest - both personally and financially - in helping to find and address bugs and other technical issues within GSAs web applications. Bug bounties serve as a legal and social arrangement with the security community: bounty operators, define what researchers are permitted to do in regards to discovering and reporting security issues of a production system, and in turn, researchers are assured they will not be punished for anything they do within that scope and are awarded for their findings.

3.0 BACKGROUND

GSA IT has not previously purchased Bug Bounty investigative service, but the Technology Transformation Services (GSA TTS) purchased access to a pre-existing, commercially available Bug Bounty SaaS Platform in 2017. Like GSA TTS, GSA IT would like to leverage access to a large network of security researchers, people who have an interest in helping to find and address bugs and other technical issues within GSA IT owned web applications. Bug bounties are a proven method of mitigating security risk in production systems: they incentivise researchers to report issues to the system owner who can fix them before they’re discovered by malicious actors. By the very nature of a bug bounty program, a Vendor that provides a Bug Bounty SaaS Platform while providing the best value to the government must be one that is well-established. The more well-known the provider of a Bug Bounty SaaS Platform, the larger and more talented the pool of security researchers they have in their community. The larger the community of security researchers in the Bug Bounty SaaS Platform provider’s network, the better the chance SecOps has of finding bugs and technical issues within its web applications.

4.0 OBJECTIVES

Beyond the software that makes up a SaaS Platform and the network of security researchers, a successful Vendor will also need to have the ability to provide program management and triage services.

Program management services include services related to promotion of the program, tracking and workflow, and payouts. There must also be a level of expertise in relation to how submissions will be received and how they will be managed throughout their lifecycle. Finally, for valid payouts, including the numerous small payments that will be made for the low-severity bugs that are found to be viable.

In terms of triage services, successful bug bounty and vulnerability disclosure programs result in dozens of reports per month, but the signal-to-noise ratio is low. All submissions need responses, however, or else there is a risk of alienating researchers. The workload of filtering submissions and communicating with researchers can be quite heavy. A successful Vendor will, among other things, assign a severity-rating to each vulnerability (e.g., low, medium, high), provide responses to invalid reports, provide initial responses to valid reports, and forward valid reports to SecOps within a reasonable time based on the severity.

https://www.acquisition.gov/print/11305 3/9

Platforms typically provide triage services as a separate option, so this means that the acquisition will involve 3 components, all of which are necessary:

1. The cost of access to the network and use of the SaaS platform;

2. The cost of first-line triage and communication services; and,

3. A “bounty pool” from which researchers are paid for valid reports.

5.0 SCOPE

This is a brand name specific requirement for HackerOne to deliver a Bug Bounty program which SecOPs will utilize for SecOps-owned web applications. HackerOne provides access to their Bug Bounty SaaS Platform for researchers to report vulnerabilities (“Platform/Network Access”) and allow SecOps to manage and track issues across multiple public services exposed to the Internet, triage services for those reported vulnerabilities, disburse rewards for effective vulnerabilities, and explain the reasons behind rejections (“Vulnerability Report Triage Services”). The Vulnerability Report Triage Services, must be provided on a “per web application” basis, allowing SecOps to operate a Bug Bounty for a web application independently of the other web applications that are utilizing the Platform/Network Access for their own tests. As part of these services, HackerOne must provide staff who are specialists in reviewing vulnerability reports and communicating with researchers. Ability to prorate the Optional CLINS if not used within the time period HackerOne will provide the following:

Hacker One Public/Private Platform, A Software-as-a-Service platform, with a publically available website, for researchers to report security vulnerabilities on publicly available government websites in a manner consistent with the GSA Vulnerability Disclosure Policy. The platform will:

■ Communicate the procedures of how to discover and report the security vulnerabilities on publicly available government websites in manner consistent with the GSA Vulnerability Disclosure Policy.

■ Provide a secure means for researchers to submit the site vulnerabilities they discover.

■ Ensure that researchers are aware of GSA Vulnerability Disclosure Policy and any other relevant discovery or reporting procedures.

■ Permit SecOps to add or remove any of the posted applications at any time during the period of performance.

■ Provide access to a network of security researchers and bounty hunters.

■ Provide a platform for SecOps staff to view reported vulnerabilities and update their status as the issues are managed and resolved.

■ Support both public bounties (open to any researcher on the platform) and private, invite-only bounties (open to only researchers SecOps and HackerOne select).

■ Provide a platform that can generate a customized reporting submission form page

■ Provide a platform that is FedRAMP authorized

■ Provide audit Logs to any modification to GSA dashboard

Triage of severity of reported vulnerabilities. HackerOne will provide services to:

○ Screen reported vulnerabilities and filter out invalid and duplicate reports.

○ Classify vulnerabilities according to SecOps guidelines developed for HackerOne and assign them to the proper SecOps staff, while SecOps maintains the rights to update these guidelines at any time.

○ Communicate with researchers about their reports, escalating to SecOps staff if needed.

○ The vendor agrees that any funds not used within the current POP will rollover into the next

POP.

https://www.acquisition.gov/print/11305 4/9

Bug bounty pool management:

○ Work with SecOps to identify the proper scope of vulnerability identification, disclosure and assessment, controlling for risk. Also, criteria for most significant vulnerabilities will be established with the SecOps before applications are advertised.

○ Work with SecOps to identify the proper scope of vulnerability identification and ranking. With SecOps assistance, determine, and/or adjust bounty reward tiers to manage our bounty pool most effectively.

○ Once classified and deemed within the scope of the vulnerabilities, HackerOne will manage payout to the reporter based on the agreed up bounty reward tiers by HackerOne and SecOps.

○ HackerOne will consult with SecOps before release of any funds.

○ The vendor agrees that any funds not used within the current POP will rollover into the next

POP.

○ Forward to SecOps the vulnerability reports, the names of the researchers, and the award amounts.

○ Vendor will provide the following:

POP CLIN Item QTY

Base Year CLIN 0001

Mandatory HackerOne Response Enterprise + Standard Triage

(VDP) 1

Base Year CLIN 0002 Optional CLIN Response Triage Plus Upgrade to Standard 1

Base Year CLIN 0003 Optional Response Advisory Plus Upgrade 1

Base Year CLIN 0004

Mandatory HackerOne Public/Private Bounty Enterprise + Standard Triage Parent Program 1

Base Year CLIN 0005

Optional HackerOne Public/Private Bounty Enterprise + Standard Triage Parent Program 6

Base Year CLIN 0006

Optional HackerOne Public Bounty Enterprise + Standard Triage Child Program 6

Base Year CLIN 0007

Optional CLIN for Public Bounty Triage Plus Upgrade from Standard 6

Base Year CLIN 0008 Optional Public Bounty Advisory Plus Upgrade 6

Base Year CLIN 0009

Optional HackerOne Private Bounty Enterprise + Standard Triage Child Program 6

Base Year CLIN 0010

Mandatory HackerOne Private Bounty Enterprise + Standard Triage Child Program 1

Base Year CLIN 0011 Optional Private Bounty Triage Plus Upgrade from Standard 6

Base Year CLIN 0012 Optional Private Bounty Advisory Plus Upgrade from Standard 6

Base Year CLIN 0013 Optional HackerOne Challenge + Standard Triage 2

Base Year CLIN 0014 Mandatory Bounty Pool for Public 1 https://www.acquisition.gov/print/11305 5/9

Base Year CLIN 0015 Optional Bounty Pool for Public 6

Base Year CLIN 0016 Mandatory Bounty Pool for Private 1

Base Year CLIN 0017 Optional CLIN Bounty Pool for Private 6

Base Year CLIN 0018 Optional CLIN Bounty Pool for HackerOne Challenge 2

Base Year Total Plus Options

Option Year 1 CLIN 1001

Mandatory HackerOne Response Enterprise + Standard Triage

(VDP) 1

Option Year 1 CLIN 1002 Optional CLIN Response Triage Plus Upgrade to Standard 1

Option Year 1 CLIN 1003 Optional Response Advisory Plus Upgrade 1

Option Year 1 CLIN 1004

Mandatory HackerOne Public/Private Bounty Enterprise + Standard Triage Parent Program 1

Option Year 1 CLIN 1005

Optional HackerOne Public/Private Bounty Enterprise + Standard Triage Parent Program 6

Option Year 1 CLIN 1006

Optional HackerOne Public Bounty Enterprise + Standard Triage Child Program 6

Option Year 1 CLIN 1007

Optional CLIN for Public Bounty Triage Plus Upgrade from Standard 6

Option Year 1 CLIN 1008 Optional Public Bounty Advisory Plus Upgrade 6

Option Year 1 CLIN 1009

Optional HackerOne Private Bounty Enterprise + Standard Triage Child Program 6

Option Year 1 CLIN 1010

Mandatory HackerOne Private Bounty Enterprise + Standard Triage Child Program 1

Option Year 1 CLIN 1011 Optional Private Bounty Triage Plus Upgrade from Standard 6

Optio n Year 1 CLIN 1012 Optional Private Bounty Advisory Plus Upgrade from Standard 6

Option Year 1 CLIN 1013 Optional HackerOne Challenge + Standard Triage 2

Option Year 1 CLIN1014 Mandatory Bounty Pool for Public 1

Option Year 1 CLIN 1015 Optional Bounty Pool for Public 6

Option Year 1 CLIN1016 Mandatory Bounty Pool for Private 1

Option Year 1 CLIN1017 Optional CLIN Bounty Pool for Private 6

Option Year 2 CLIN 1018 Optional CLIN Bounty Pool for HackerOne Challenge 2 https://www.acquisition.gov/print/11305 6/9

Option Year 1 One Total Cost

Option Year 2 CLIN 2001

Mandatory HackerOne Response Enterprise + Standard Triage

(VDP) 1

Option Year 2 CLIN 2002 Optional CLIN Response Triage Plus Upgrade to Standard 1

Option Year 2 CLIN 2003 Optional Response Advisory Plus Upgrade 1

Option Year 2 CLIN 2004

Mandatory HackerOne Public/Private Bounty Enterprise + Standard Triage Parent Program 1

Option Year 2 CLIN 2005

Optional HackerOne Public/Private Bounty Enterprise + Standard Triage Parent Program 6

Option Year 2 CLIN 2006

Optional HackerOne Public Bounty Enterprise + Standard Triage Child Program 6

Option Year 2 CLIN 2007

Optional CLIN for Public Bounty Triage Plus Upgrade from Standard 6

Option Year 2 CLIN 2008 Optional Public Bounty Advisory Plus Upgrade 6

Option Year 2 CLIN 2009

Optional HackerOne Private Bounty Enterprise + Standard Triage Child Program 6

Option Year 2 CLIN 2010

Mandatory HackerOne Private Bounty Enterprise + Standard Triage Child Program 1

Option Year 2 CLIN 2011 Optional Private Bounty Triage Plus Upgrade from Standard 6

Option Year 2 CLIN 2012 Optional Private Bounty Advisory Plus Upgrade from Standard 6

Option Year 2 CLIN 2013 Optional HackerOne Challenge + Standard Triage 2

Option Year 2 CLIN 2014 Mandatory Bounty Pool for Public 1

Option Year 2 CLIN 2015 Optional Bounty Pool for Public 6

Option Year 2 CLIN 2016 Mandatory Bounty Pool for Private 1

Option Year 2 CLIN 2017 Optional CLIN Bounty Pool for Private 6

Option Year 2 CLIN 2018 Optional CLIN Bounty Pool for HackerOne Challenge 2

Option Year 2 Total Cost

Total Cost for Base and all option years https://www.acquisition.gov/print/11305 7/9

6.0 OPERATIONAL REQUIREMENTS

6.1 Key Personnel

The Vendor shall provide a Technical Account Manager ("TAM") as the primary point of contact for the government’s program office to enable timely problem resolution, reporting in a timely manner, and properly aligning staffing requirements.

6.2 Deliverables

6.2.1 Vulnerability Reports

The Vendor will submit through their security disclosure platform vulnerability reports for those on the SecOps application list. These vulnerabilities will be triaged and classified based on the severity of the vulnerability before submitted to SecOps Team.

6.2.2 Monthly Status Reports

At the conclusion of each month, the Vendor will submit a status report summarizing the Vendor’s work and submit it to the CO/COR and the SecOps Team. This report will be mutually agreed to between the CO/COR, SecOps Team, and the Vendor.

6.2.3 Impact Reports

The Vendor shall be responsible for providing timely notification to the CO/COR and the SecOps Team when activities or issues outside of the Vendor’s control may directly impact the Vendor’s performance. This notification shall be provided in writing or via email within 24 hours of any anticipated or known impact.

6.2.4 List of Deliverables

Deliverables Due Date Description

Vulnerability reports delivered through the bug bounty platform

24 hours during business hours

Through the platform, the Vendor will alert SecOps Team that there is a triaged vulnerability report pending on one of the listed applications.

Monthly status reports

At the end of each month of the period of performance

Monthly report of the metrics of the Vendor delivered in a format to be agreed upon by the SecOps Team and the Vendor.

Impact Reports Within 24 hours of any anticipated or known impact

Activities or issues outside of the Vendor’s control may directly impact the Vendor’s performance.

The Vendor shall submit all deliverables to CO/COR and SecOps Team.

https://www.acquisition.gov/print/11305 8/9

6.2.5 Vulnerability Triage

The Vendor will submit through their platform vulnerabilities triaged and classified within 24 hours during business hours.

7.0 CONTRACT TYPE

Firm Fixed Price

8.0 DELIVERY

Vendor shall deliver products by electronic mail to:

Armando Quintananieves – ISO 1800F St. NW Washington, DC 20405 Office Phone: 202-394-2792 Email: armando.quintananieves@gsa.gov

9.0 PERIOD OF PERFORMANCE

Base Year: September 25, 2020 to September 24, 2021

Option Year 1: September 25, 2021 to September 24, 2022 Option Year 2: September 25, 2022 to September 24, 2023

10.0 PLACE OF PERFORMANCE/HOURS OF OPERATION

Vendor shall provide support remotely 24 hours a day, seven days per week and provide responses promptly during scheduled support hours on business days from 9:00 A.M. to 6:00 P.M. EST (U.S. Eastern Time)

11.0 PRIVACY ACT

Work on this project may require that personnel have access to Privacy Information. Personnel shall adhere to the Privacy Act, Title 5 of the U.S. Code, Section 552a and applicable agency rules and regulations.

12.0 SECURITY

This project involves unclassified data. The vendor will achieve FedRAMP Tailored authorized within 12 months of award.

13.0 GENERAL COMPLIANCE REQUIREMENTS

SECTION 508

The Vendor(s) shall provide accessibility based on FAR Subpart 39.2 Electronic and Information Technology and Section 508 of the Rehabilitation Act of 1973 (29 U.S.C.794d). All electronic and information technology (EIT) procured through this Contract must meet the applicable accessibility standards at 36 CFR 1194, unless an agency exception to this requirement exists. The 36 CFR 1194 implements Section 508 of the Rehabilitation Act of 1973, as amended. All deliverables will be Section 508 compliant, and will be reviewed for compliance by the Government which reserves the right to reject the deliverable(s) until remediation of deficiencies has been successfully completed by the Vendor. Complete technical descriptions are provided on mailto:armando.quintananieves@gsa.gov https://www.acquisition.gov/print/11305 9/9 the following website: http://www.section508.gov. Where appropriate, the Vendor(s) shall indicate whether each product or service is compliant or non-compliant with the accessibility standards at 36 CFR 1194. Further, the quote must indicate where full details of the compliance can be found (e.g., vendor’s website or other exact location).

14.0 IT SECURITY POLICIES

The following GSA policies must be followed. These policies can be found at http://www.gsa.gov/directives.

1. CIO P 2100.1 GSA Information Technology (IT) Security Policy

2. CIO P 2100.2B GSA Wireless Local Area Network (LAN) Security

3. CIO 2100.3B Mandatory Information Technology (IT) Security Training Requirement for Agency and Vendor Employees with Significant Security Responsibilities

4. CIO 2104.1A GSA Information Technology IT General Rules of Behavior

5. CIO 2105.1B GSA Section 508: Managing Electronic and Information Technology for Individuals with Disabilities

6. CIO 2106.1 GSA Social Media Policy

7. CIO 2107.1 Implementation of the Online Resource Reservation Software

8. CIO 2160.4 Provisioning of Information Technology (IT) Devices

9. CIO 2162.1 Digital Signatures

10. CIO P 2165.2 GSA Telecommunications Policy

11. CIO P 2180.1 GSA Rules of Behavior for Handling Personally Identifiable Information (PII)

12. CIO 2182.2 Mandatory Use of Personal Identity Verification (PIV) Credentials

13. CIO P 1878.2A Conducting Privacy Impact Assessments (PIAs) in GSA

14. CIO IL-13-01 Mobile Devices and Applications

15. CIO IL-14-03 Information Technology (IT) Integration Policy

16. HCO 9297.1 GSA Data Release Policy

17. HCO 9297.2B GSA Information Breach Notification Policy

18. ADM P 9732.1D Suitability and Personnel Security

The vendor’s personnel involved with this purchase order are required to review above-cited contract clauses and policies and ensure compliance throughout the life of this purchase order.

14.1 FEDERAL ACQUISTION REGULATION (FAR) PROVISIONS AND CLAUSES INCORPORATED BY

REFERENCE

This TO incorporates one or more clauses by reference with the same force and effect as if they were given in full text. Upon request the CO will make their full text available. Also, the full text of a provision may be accessed electronically at: FAR website: https://www.acquisition.gov/far/

All solicitation provisions will be removed at Task Order Award (TOA)

Clause No. Clause Title Date 52.203-19 Prohibition on Requiring Certain Internal Confidentiality

Agreements or Statements.

(JAN 2017)

52.204-7 System for Award Management. (OCT 2016) 52.204-24 Representation Regarding Certain Telecommunications and Video

Surveillance Services or Equipment (provision).

(AUG 2019)

52.204-26 Covered Telecommunications Equipment or Services- Representation. (Provision)

(AUG 2019)

52.212-1 Instructions to Offerors— Commercial Items. (JAN 2017) 52.212-2 Evaluation—Commercial Items, in solicitations for commercial items (see 12.602)

(OCT 2014)

http://www.acquisition.gov/print/11305 http://www.section508.gov/ https://www.acquisition.gov/far/ https://www.acquisition.gov/print/11305 10/

52.212-3 Offeror Representations and Certifications— Commercial Items. (NOV 2017) 52.212-4 Contract Terms and Conditions --Commercial Items. (JAN 2017) 52.212-5 Contract Terms and Conditions Required To Implement Statutes or Executive Orders— Commercial Items.

(NOV 2017)

52.217-5 Evaluation of Options (Jul 1990) 52.217-8 Option to Extend Services (Nov 1999)

52.217-9 Option to Extend the Term of the Contract (Mar 2000)

52.225-25 Prohibition on Contracting with Entities Engaging in Certain

Activities or Transactions Relating to Iran-Representation and Certifications. (Provision)

(AUG 2018)

52.223-18 Encouraging Contractor Policies to Ban Text Messaging While Driving.

(AUG 2011)

52.232-38 Submission of Electronic Funds Transfer Information with Offer. (MAY 1999) 52.232-39 Submission of Electronic Funds Transfer Information with Offer. (JAN 2013)

14.2 GENERAL SERVICES ADMINISTRATION MANUAL (GSAM) PROVISIONS

AND CLAUSES

The tables below incorporate clauses by reference, with the same force and effect as if they were given in full text. The full text may be accessed electronically at https://www.acquisition.gov/far

All provisions will be removed at the Task Order Award (TOA).

The full text of a provision may be accessed electronically at: GSAM website:

https://www.acquisition.gov/gsam/gsam.html

Clause No. Clause Title Date 552.212-4 Contract Terms and Conditions-Commercial Items (FAR

DEVIATION)

(Sep 1999)

552.212-71 Contract Terms and Conditions Applicable to GSA Acquisition of Commercial Items.

(Sep 2019)

552.212-72 Contract Terms and Conditions Required to Implement Statutes or Executive Orders Applicable to GSA Acquisition of Commercial Items.

(Sep 2019)

15.0 INVOICING/PAYMENT

PROCEDURES FOR PAYMENT

Prompt Payment Requirements: Payments will be processed in accordance with FAR Clause 52.212-4(i) Payments as supplemented and deviated from in GSAM Clause 552.212-4.

Invoices: The Vendor shall submit billings in accordance with the Government’s requirements in the SOW.

Submission of Original Invoices:

Invoices shall be submitted no later than fifteen calendar days following performance and/or delivery. The invoice must be accompanied by any applicable monthly status reports submitted during that period. The COR and CO shall receive a copy of the invoice and all supporting documentation. This can be done before, but no later than, the same time as invoice submission to the GSA Finance Office.

Invoices are authorized for payment upon the Government’s receipt and acceptance of deliverables specified in the contract and the receipt of a valid invoice. Invoices, to be proper and payable, must include the following https://www.acquisition.gov/gsam/gsam.html https://www.acquisition.gov/print/11305 11/ information:

1. Name and address of the Vendor, and

2. Invoice date and number, and

3. Contract/Order Number (as listed in Block 4 on Form SF1449) and Pegasys Document Number (PDN) (GD followed by [PIID Number as listed in Block 4 on Form SF1449]), any Contract Line Item Numbers (CLINs), and the Program/Project Title (Bug Bounty SaaS) and

4. Description of the services/products provided including CLIN number and description, quantity, unit of measure, unit price and extended price of the item(s) delivered; period of service and/or dates that services were provided, etc., and;

5. Name and address of the Vendor’s authorized representative to whom payment is to be sent, and;

6. Name, title, and phone number of the Vendor’s PoC to be notified in the event of defective invoice; and

7. Taxpayer Identification Number (TIN). The Vendor shall include its TIN on the invoice and ensure the

SAM.gov profile for the Vendor is complete including the payment remittance address and bank details.

The Vendor shall submit an original invoice for payment to GSA Financial Operations and Disbursement Center. Copies of invoices shall be emailed to the designated Contracting Officer Representative (COR), Contract Specialist and Contracting Officer outlined in Section 16.0.

Please ensure Items 1-7 above are present on the invoice. Failure to include these items could delay your payment. All invoices should be submitted electronically. Password and electronic invoice access is obtained through VCSS, https://vcss.ocfo.gsa.gov. For assistance with how to setup electronic invoicing or payment related information, please contact GSA Finance Customer Support (800) 676-3690 or kc-acctspayable.vcss@gsa.gov.

A copy of the invoice must be sent to the COR/Program Office POC, Denelle Agosto, [denelle.agosto@gsa.gov] for approval. A courtesy copy of the invoice must also be sent to the Contracting Officer, Name [vivian.fields@gsa.gov] for the official contract file.

Final Invoice: The Vendor shall submit with a GSA Form 1142- Release of Claims with submission of the final invoice at the end of the period of performance. A copy of the form should be sent via email to the Contracting Officer and COR identified as the Government POCs.

16.0 CONTRACT ADMINISTRATION

The Contracting Officer (CO) is the only person authorized to make or approve any changes to any of the requirements of this purchase order and notwithstanding any clauses contained elsewhere in this purchase order, this authority remains solely with the CO. In the event the Vendor makes any changes at the direction of any other person other than the CO, the change will be considered to have been made without authority and no adjustment will be made in the contract price to cover any increase in cost incurred as a result thereof. All questions concerning the purchase order will be directed to the CO. The Vendor shall contact the CO with any questions regarding performance issues.

Contracting Officer (CO) Vivian Fields United States General Services Administration Office of Internal Acquisition (OIA) 1800 F Street, N.W.

Washington, DC 20405-0001 Office Phone: 202-501-1741 Email: vivian.fields@gsa.gov mailto:denelle.agosto@gsa.gov https://www.acquisition.gov/print/11305 12/

Contracting Officer Representative (COR):

Denelle Agosto 1800F St. NW Washington, DC 20405 Office Phone: 215.446.5717 Email: denelle.agosto@gsa.gov

Technical POC:

Armando Quintananieves - ISO 1800F St. NW Washington, DC 20405 Office Phone: 202-394-2792 Email: armando.quintananieves@gsa.gov

17.0 EVALUATION METHODOLOGY/BASIS OF AWARD

17.1 LOWEST PRICE TECHNICALLY ACCEPTABLE (LPTA)

This acquisition will utilize Lowest Price Technically Acceptable (LPTA) source selection procedures in accordance with FAR 15.101-2. This is a competitive LPTA source selection in which price is considered the most important factor. By submission of its offer, the Offeror accepts all solicitation requirements, including terms and conditions, representations and certifications, and technical requirements. All technically acceptable offerors, with satisfactory past performance, shall be treated equally except for their prices. Failure to meet a requirement may result in an offer being determined technically unacceptable. Offerors must clearly identify any exception to the solicitation and conditions and provide complete accompanying rationale. The Government intends to select ONE contractor for award of this requirement.

17.1. Rejection of Unrealistic Offers:

The Government may reject any quote that is evaluated to be unrealistic in terms of program commitments, including contract terms and conditions, or unrealistically high or low in cost/price, or are unbalanced, such that the quote is deemed to reflect an inherent lack of competence or failure to comprehend the technical requirements.

17.2. Source Selection Decision:

The Government shall select the contractor based upon a best value evaluation of the offeror’s total price/cost and technical acceptability. The Government shall choose the lowest realistically priced, responsive, with satisfactory performance, and technically acceptable offer for award. The Government reserves the right to make an award without further discussions.

17.3 Discounts

Lowest Price Technically Acceptable (LPTA) resulting from selection of the technically acceptable quote with the lowest evaluated price; contractors are encouraged to offer discounts from pricing in the initial submission, as there may be no additional opportunity for offerors to revise pricing submissions or offer further discounts prior to the establishment of the task order.

17.4 System Award Management (SAM)

Upon submission of quotes, all Contractors must be registered in the System Award Management (SAM). You may visit https://www.sam.gov/ for instructions and assistance on registration. Contractor must verify the http://www.acquisition.gov/print/11305 mailto:denelle.agosto@gsa.gov mailto:armando.quintananieves@gsa.gov https://www.acquisition.gov/print/11305 13/ company address and DUNS number must correspond with the company’s address in System for Award Management (SAM).

18.0 QUOTE SUBMISSION INSTRUCTIONS

18.1 SUBMISSION OF QUESTIONS

The due date for submittal of questions is September 15, 2020, 10:00 AM Eastern Standard Time.

All questions must be submitted in writing via email to the Contracting Officer, Vivian Fields at vivian.fields@gsa.gov. No questions will be accepted by telephone or after the specified time and due date to submit quotes. Each question submitted must cite the Statement of Work Section number/title for which the question pertains, unless the question is general in nature and not specific to a particular portion(s) of the RFQ/Statement of Work.

18.2 QUESTIONS AND ANSWERS (Q&As)

GSA intends to provide answers to questions (Q&A’s) via the Beta SAM portal at https://beta.sam.gov/ on September 16, 2020, 10:00 PM AM Eastern Standard Time). All questions will be addressed in writing only.

18.3 SUBMISSION OF QUOTES

Due Date for Quotes: The due date for submission of quotes is Monday, September 21, 2020, 10:00 PM, Eastern Time. Quotes are to be submitted to the Contracting Officer, Vivian Fields via email:

vivian. fields@gsa.gov.

The Offeror shall provide the following products/services as specified on a Firm-Fixed-Price basis in accordance with the SOW/RFQ.

18.4 FORMAT OF QUOTES

The price quote shall be submitted based on your current commercial price list, utilizing any and all discounts. Please provide the name of the company, DUNs number, company POC and date on your price quote. Please include a copy of your applicable Commercial Price List with your quote.

ATTACHMENTS

Attachments A and B are Security Clauses which are incorporated by reference (IBR) only!

1. Attachment A - CIO 09 -48, IT Security Procedural Guide: Security and Privacy IT Acquisition Requirements.

(IBR)

2. Attachment B - CIO 12-2018, IT Policy Requirements Guide (IBR)

3. Attachment C: FAR 52.204-24 Representation Regarding Certain Telecommunications and Video Surveillance Services or Equipment (AUG 2020).

4. Attachment D: Commercial Terms and Conditions

5. Justification and Approval (J&A) mailto:vivian.fields@gsa.gov https://beta.sam.gov/ mailto:fields@gsa.gov https://www.acquisition.gov/print/11305 14/

ATTACHMENT C:

Part B: 52.204-25 Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment (AUG 2020)

(a) * * *

Backhaul means intermediate links between the core network, or backbone network, and the small subnetworks at the edge of the network (e.g., connecting cell phones/towers to the core telephone network). Backhaul can be wireless (e.g., microwave) or wired (e.g., fiber optic, coaxial cable, Ethernet).

Interconnection arrangements means arrangements governing the physical connection of two or more networks to allow the use of another's network to hand off traffic where it is ultimately delivered (e.g., connection of a customer of telephone provider A to a customer of telephone company B) or sharing data and other information resources.

Reasonable inquiry means an inquiry designed to uncover any information in the entity's possession about the identity of the producer or provider of covered telecommunications equipment or services used by the entity that excludes the need to include an internal or third-party audit.

Roaming means cellular communications services (e.g., voice, video, data) received from a visited network when unable to connect to the facilities of the home network either because signal coverage is too weak or because traffic is too high.

(b) Prohibition. (1) Section 889(a)(1)(A) of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 (Pub. L. 115-232) prohibits the head of an executive agency on or after August 13, 2019, from procuring or obtaining, or extending or renewing a contract to procure or obtain, any equipment, system, or service that uses covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system. The Contractor is prohibited from providing to the Government any equipment, system, or service that uses covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system, unless an exception at paragraph (c) of this clause applies or the covered telecommunication equipment or services are covered by a waiver described in FAR 4.2104.

(2) Section 889(a)(1)(B) of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 (Pub. L. 115-

232) prohibits the head of an executive agency on or after August 13, 2020, from entering into a contract, or extending or renewing a contract, with an entity that uses any equipment, system, or service that uses covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system, unless an exception at paragraph (c) of this clause applies or the covered telecommunication equipment or services are covered by a waiver described in FAR 4.2104. This prohibition applies to the use of covered telecommunications equipment or services, regardless of whether that use is in performance of work under a Federal contract.

(End of Clause) https://www.acquisition.gov/print/11305 15/

Part B: FAR 52.204-24 Representation Regarding Certain Telecommunications and Video Surveillance Services or Equipment (AUG 2020)

The Offeror shall not complete the representation at paragraph (d)(1) of this provision if the Offeror has represented that it “does not provide covered telecommunications equipment or services as a part of its offered products or services to the Government in the performance of any contract, subcontract, or other contractual instrument” in the provision at 52.204- 26, Covered Telecommunications Equipment or Services—Representation, or in paragraph (v) of the provision at 52.212- 3, Offeror Representations and Certifications-Commercial Items.

(a) Definitions. As used in this provision-

Backhaul, covered telecommunications equipment or services, critical technology, interconnection arrangements, reasonable inquiry, roaming, and substantial or essential component have the meanings provided in the clause 52.204-25, Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment.

(b) Prohibition. (1) Section 889(a)(1)(A) of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 (Pub. L. 115-232) prohibits the head of an executive agency on or after August 13, 2019, from procuring or obtaining, or extending or renewing a contract to procure or obtain, any equipment, system, or service that uses covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system. Nothing in the prohibition shall be construed to—

(i) Prohibit the head of an executive agency from procuring with an entity to provide a service that connects to the facilities of a third-party, such as backhaul, roaming, or interconnection arrangements; or

(ii) Cover telecommunications equipment that cannot route or redirect user data traffic or cannot permit visibility into any user data or packets that such equipment transmits or otherwise handles.

(2) Section 889(a)(1)(B) of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 (Pub. L. 115-

232) prohibits the head of an executive agency on or after August 13, 2020, from entering into a contract or extending or renewing a contract with an entity that uses any equipment, system, or service that uses covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system. This prohibition applies to the use of covered telecommunications equipment or services, regardless of whether that use is in performance of work under a Federal contract. Nothing in the prohibition shall be construed to—

(i) Prohibit the head of an executive agency from procuring with an entity to provide a service that connects to the facilities of a third-party, such as backhaul, roaming, or interconnection arrangements; or

(ii) Cover telecommunications equipment that cannot route or redirect user data traffic or cannot permit visibility into any user data or packets that such equipment transmits or otherwise handles.

(c) Procedures. The Offeror shall review the list of excluded parties in the System for Award Management (SAM) (https://www.sam.gov) for entities excluded from receiving federal awards for “covered telecommunications equipment or services.”

(d) Representations. The Offeror represents that—

(1) It [ ] will, [ ] will not provide covered telecommunications equipment or services to the Government in the performance of any contract, subcontract or other contractual instrument resulting from this solicitation. The Offeror shall provide the additional disclosure information required at paragraph (e)(1) of this section if the Offeror responds “will” in paragraph (d)(1) of this section; and

(2) After conducting a reasonable inquiry, for purposes of this representation, the Offeror represents that—

It [ ] does, [ ] does not use covered telecommunications equipment or services, or use any equipment, system, or service that uses covered telecommunications equipment or services. The Offeror shall provide the additional disclosure information required at paragraph (e)(2) of this section if the Offeror responds “does” in paragraph (d)(2) of this section.

https://www.acquisition.gov/print/11305 16/

(e) Disclosures. (1) Disclosure for the representation in paragraph (d)(1) of this provision. If the Offeror has responded “will” in the representation in paragraph (d)(1) of this provision, the Offeror shall provide the following information as part of the offer:

(i) For covered equipment—

(A) The entity that produced the covered telecommunications equipment (include entity name, unique entity identifier, CAGE code, and whether the entity was the original equipment manufacturer (OEM) or a distributor, if known);

(B) A description of all covered telecommunications equipment offered (include brand; model number, such as OEM number, manufacturer part number, or wholesaler number; and item description, as applicable); and

(C) Explanation of the proposed use of covered telecommunications equipment and any factors relevant to determining if such use would be permissible under the prohibition in paragraph (b)(1) of this provision.

(ii) For covered services—

(A) If the service is related to item maintenance: A description of all covered Start Printed Page 42679telecommunications services offered (include on the item being maintained: Brand; model number, such as OEM number, manufacturer part number, or wholesaler number; and item description, as applicable); or

(B) If not associated with maintenance, the Product Service Code (PSC) of the service being provided; an explanation of the proposed use of covered telecommunications services and any factors relevant to determining if such use would be permissible under the prohibition in paragraph (b)(1) of this provision.

(2) Disclosure for the representation in paragraph (d)(2) of this provision. If the Offeror has responded “does” in the representation in paragraph (d)(2) of this provision, the Offeror shall provide the following information as part of the offer:

(i) For covered equipment—

(A) The entity that produced the covered telecommunications equipment (include entity name, unique entity identifier, CAGE code, and whether the entity was the OEM or a distributor, if known);

(B) A description of all covered telecommunications equipment offered (include brand; model number, such as OEM number, manufacturer part number, or wholesaler number; and item description, as applicable); and

(C) Explanation of the proposed use of covered telecommunications equipment and any factors relevant to determining if such use would be permissible under the prohibition in paragraph (b)(2) of this provision.

(ii) For covered services—

(A) If the service is related to item maintenance: A description of all covered telecommunications services offered (include on the item being maintained: Brand; model number, such as OEM number, manufacturer part number, or wholesaler number; and item description, as applicable); or

(B) If not associated with maintenance, the PSC of the service being provided; an explanation of the proposed use of covered telecommunications services and any factors relevant to determining if such use would be permissible under the prohibition in paragraph (b)(2) of this provision.

(End of provision https://www.acquisition.gov/print/11305 17/

Attachment D

52.212-5 Contract Terms and Conditions Required to Implement Statutes or Executive Orders-Commercial Items.

As prescribed in 12.301(b)(4), insert the following clause:

CONTRACT TERMS AND CONDITIONS REQUIRED TO IMPLEMENT STATUTES OR EXECUTIVE ORDERS-

COMMERCIAL ITEMS (AUG 2020)

(a) The Contractor shall comply with the following Federal Acquisition Regulation (FAR) clauses, which are incorporated in this contract by reference, to implement provisions of law or Executive orders applicable to acquisitions of commercial items:

(1) 52.203-19, Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements

(JAN 2017) (section 743 of Division E, Title VII, of the Consolidated and Further Continuing Appropriations Act, 2015 (Pub. L. 113-235) and its successor provisions in subsequent appropriations acts (and as extended in continuing resolutions)).

(2) 52.204-23, Prohibition on Contracting for Hardware, Software, and Services Developed or

Provided by Kaspersky Lab and Other Covered Entities (JuL 2018) (Section 1634 of Pub. L. 115-91).

(3) 52.204-25, Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment. (AuG 2020) (Section 889(a)(l)(A) of Pub. L. 115-232).

(4) 52.209-10, Prohibition on Contracting with Inverted Domestic Corporations (Nov 2015).

(5) 52.233-3, Protest After Award (AuG 1996) (31 U.S.C. 3553).

(6) 52.233-4, Applicable Law for Breach of Contract Claim (OCT 2004) (Public Laws 108-77 and 108-78 ( 19 U.S.C. 3805 note)).

(b) The Contractor shall comply with the FAR clauses in this paragraph (b) that the Contracting Officer has indicated as being incorporated in this contract by reference to implement provisions of law or Executive orders applicable to acquisitions of commercial items:

[Contracting Officer check as appropriate.]

_ (1) 52.203-6, Restrictions on Subcontractor Sales to the Government (JUNE 2020), with Alternate I

(OcT 1995) (41 U.S.C. 4704 and 10 U.S.C. 2402).

_ (2) 52.203-13, Contractor Code of Business Ethics and Conduct (JUN 2020) (41 U.S.C. 3509)).

_ (3) 52.203-15, Whistleblower Protections under the American Recovery and Reinvestment Act of

2009 (JuN 2010) (Section 1553 of Pub. L. 111-5). (Applies to contracts funded by the American Recovery and Reinvestment Act of 2009.)

https://www.acquisition.gov/print/11305 18/

_ (4) 52.204-10, Reporting Executive Compensation and First-Tier Subcontract Awards (JuN 2020)

(Pub. L. 109-282) ( 31 U.S.C. 6101 note).

_ (5) [Reserved].

_ (6) 52.204-14, Service Contract Reporting Requirements (OCT 2016) (Pub. L. 111-117, section 743 of Div. C).

_ (7) 52.204-15, Service Contract Reporting Requirements for Indefinite-Delivery Contracts (OcT

2016) (Pub. L. 111-117, section 743 of Div. C).

_ (8) 52.209-6, Protecting the Government's Interest When Subcontracting with Contractors Debarred, Suspended, or Proposed for Debarment. (JUN 2020) (31 U.S.C. 6101 note).

_ (9) 52.209-9, Updates of Publicly Available Information Regarding Responsibility Matters (OCT 2018) (41 U.S.C. 2313).

_ (10) [Reserved].

_ (11) (i) 52.219-3, Notice ofHUBZone Set-Aside or Sole-Source Award (MAR 2020) (15 U.S.C. 657a).

_ (ii) Alternate I (MAR 2020) of 52.219-3.

_ (12) (i) 52.219-4, Notice of Price Evaluation Preference for HUBZone Small Business Concerns

(MAR 2020) (if the offeror elects to waive the preference, it shall so indicate in its offer) (15 U.S.C. 657a).

_ (ii) Alternate I (MAR 2020) of 52.219-4.

_ (13) [Reserved]

_ (14) (i) 52.219-6, Notice of Total Small Business Set-Aside (MAR 2020) (15 U.S.C. 644).

_ (ii) Alternate I (MAR 2020) of 52.219-6.

_ (15) (i) 52.219-7, Notice of Partial Small Business Set-Aside (MAR 2020) (15 U.S.C. 644).

_ (ii) Alternate I (MAR 2020) of 52.219-7.

_ (16) 52.219-8, Utilization of Small Business Concerns (OCT 2018) (15 U.S.C. 637(d)(2) and (3)).

_ (17) (i) 52.219-9, Small Business Subcontracting Plan (JuN 2020) (15 U.S.C. 637(d)(4)).

_ (ii) Alternate I (Nov 2016) of 52.219-9.

_ (iii) Alternate II (Nov 2016) of 52.219-9.

_ (iv) Alternate III (JUN 2020) of 52.219-9.

_ (v) Alternate IV (JuN 2020) of 52.219-9

_ (18) (i) 52.219-13, Notice of Set-Aside of Orders (MAR 2020) (15 U.S.C. 644(r)).

(ii) Alternate I (MAR 2020) of 52.219-13.

_ (19) 52.219-14, Limitations on Subcontracting (MAR 2020) (15 U.S.C. 637(a)(14)).

https://www.acquisition.gov/print/11305 19/

_ (20) 52.219-16, Liquidated Damages-Subcontracting Plan (JAN 1999) (15 U.S.C. 637(d)(4)(F)(i)).

_ (21) 52.219-27, Notice of Service-Disabled Veteran-Owned Small Business Set-Aside (MAR 2020)

(15 U.S.C. 657f).

_ (22) (i) 52.219-28, Post Award Small Business Program Rerepresentation (MAY 2020)

(15 U.S.C. 632(a)(2)).

(ii) Alternate I (MAR 2020) of 52.219-28.

_ (23) 52.219-29, Notice of Set-Aside for, or Sole Source Award to, Economically Disadvantaged Women-Owned Small Business Concerns (MAR 2020) (15 U.S.C. 637(m)).

_ (24) 52.219-30, Notice of Set-Aside for, or Sole Source Award to, Women-Owned Small Business

Concerns Eligible Under the Women-Owned Small Business Program (Mar2020) (15 U.S.C. 637(m)).

_ (25) 52.219-32, Orders Issued Directly Under Small Business Reserves (MAR 2020) (15 U.S.C. 644(r)).

_ (26) 52.219-33, Nonmanufacturer Rule (MAR 2020) (15U.S.C. 637(a)(l 7)).

_ (27) 52.222-3, Convict Labor (JUN 2003) (E.O.11755).

_ (28) 52.222-19, Child Labor-Cooperation with Authorities and Remedies (JAN2020) (E.O.13126).

_ (29) 52.222-21, Prohibition of Segregated Facilities (APR 2015).

_ (30) (i) 52.222-26, Equal Opportunity (SEP 2016) (E.O.11246).

_ (ii) Alternate I (FEB 1999) of 52.222-26.

_ (31) (i) 52.222-35, Equal Opportunity for Veterans (JuN 2020) (38 U.S.C. 4212).

_ (ii) Alternate I (JuL 2014) of 52.222-35.

_ (32) (i) 52.222-36, Equal Opportunity for Workers with Disabilities (JuN 2020) (29 U.S.C. 793).

_ (ii) Alternate I (JuL 2014) of 52.222-36.

_ (33) 52.222-37, Employment Reports on Veterans (JuN 2020) (38 U.S.C. 4212).

_ (34) 52.222-40, Notification of Employee Rights Under the National Labor Relations Act (DEC 2010) (E.O. 13496).

_ (35) (i) 52.222-50, Combating Trafficking in Persons (JAN 2019) (22 U.S.C. chapter 78 and E.O.

13627).

_ (ii) Alternate I (MAR 2015) of 52.222-50 (22 U.S.C. chapter 78 and E.O. 13627).

_ (36) 52.222-54, Employment Eligibility Verification (OCT 2015). (Executive Order 12989). (Not applicable to the acquisition of commercially available off-the-shelf items or certain other types of commercial items as prescribed in 22.1803.)

_ (37) (i) 52.223-9, Estimate of Percentage of Recovered Material Content for EPA-Designated

Items (May 2008) ( 42 U.S.C. 6962(c)(3)(A)(ii)). (Not applicable to the acquisition of commercially available off-the-shelf items.)

https://www.acquisition.gov/print/11305 20/

_ (ii) Alternate I (MAY 2008) of 52.223-9 (42 U.S.C. 6962(i)(2)(C)). (Not applicable to the acquisition of commercially available off-the-shelf items.)

_ (38) 52.223-11, Ozone-Depleting Substances and High Global Warming Potential Hydrofluorocarbons (Jun 2016) (E.O. 13693).

_ (39) 52.223-12, Maintenance, Service, Repair, or Disposal of Refrigeration Equipment and Air

Conditioners (JuN 2016) (E.O. 13693).

_ (40) (i) 52.223-13, Acquisition ofEPEAT®-Registered Imaging Equipment (JUN 2014) (E.O.s 13423 and 13514).

_ (ii) Alternate I (OCT 2015) of 52.223-13.

_ (41) (i) 52.223-14, Acquisition ofEPEAT®-Registered Televisions (JUN 2014) (E.O.s 13423 and 13514).

_ (ii) Alternate I (Jun2014) of 52.223-14.

_ (42) 52.223-15, Energy Efficiency in Energy-Consuming Products (MAY 2020) (42 U.S.C. 8259b).

_ (43) (i) 52.223-16, Acquisition ofEPEAT®-Registered Personal Computer Products (OCT 2015) (E.O.s 13423 and 13514).

_ (ii) Alternate I (JuN 2014) of 52.223-16.

_ (44) 52.223-18, Encouraging Contractor Policies to Ban Text Messaging While Driving (JUN

2020) (E.O. 13513).

_ (45) 52.223-20, Aerosols (JUN 2016) (E.O. 13693).

_ (46) 52.223-21, Foams (Jun2016) (E.O. 13693).

_ (47) (i) 52.224-3 Privacy Training (JAN 2017) (5 U.S.C. 552 a).

_ (ii) Alternate I (JAN 2017) of 52.224-3.

_ (48) 52.225-1, Buy American-Supplies (May 2014) (41 U.S.C. chaP-ter 83).

_ (49) (i) 52.225-3, Buy American-Free Trade Agreements-Israeli Trade Act (MAY 2014) (41 U.S.C.chaP-ter83, 19 U.S.C. 3301 note, 19 U.S.C. 2112 note, 19 U.S.C. 3805 note, 19 U.S.C.