SSA-RFP-12-1036.3.doc

SOCIAL SECURITY

Office of Acquisition and Grants

SSA-RFP-12-1036

Amendment 3

June 14, 2012

To Whom It May Concern:

The Social Security Administration (SSA) issued this Request for Proposal (RFP) to solicit proposals from responsible 8(a) small businesses to provide Independent Verification and Validation (IV&V) support services. The Office of Acquisition and Grants (OAG) is working with its customer, the Office of Information Security (OIS), to meet the Agency’s Information Security and Assurance objectives. This RFP is open to small businesses actively participating in the 8(a) Small Business Development Program under North American Industry Classification System (NAICS) Code Number 541519. Ultimately, SSA intends to award a firm-fixed price, with firm-fixed price level-of-effort elements, Indefinite-Delivery/Indefinite Quantity-type contract, spanning over five years, to the highest-rated and responsible 8(a) small business.

If you wish to submit a proposal in response to this Solicitation, you must e-mail your response to Christopher.Mettee@ssa.gov. In addition, you must deliver a hard copy of your response to the following address:

Attn: Christopher Mettee

Social Security Administration

Office of Acquisition and Grants

First Floor, Rear Entrance

7111 Security Boulevard Baltimore, MD 21244-1811 The DEADLINE for SUBMISSION OF INITIAL RESPONSES is June 27, 2011, at 5:00 p.m. Eastern Time. All Offerors must follow the specific instructions for responding to this RFP at Addendum E, Section 1.0, Instructions to Offerors (and its addenda at Addendum E, Section 2.0), and Addendum E, Section 3.0, Evaluation.

Offerors must address any questions regarding this RFP in writing, and SSA must receive them by June 21, 2012, at 5:00 p.m. Eastern Time. Offerors may send questions via e-mail to Christopher.Mettee@ssa.gov or via facsimile at (410) 965-9560. For any general procurement-related information, Offerors may contact via telephone at (410) 965-9486.

Sincerely, Christopher Mettee

Contract Specialist

Table of Contents 2Table of Contents

5Addendum A – Standard Form (SF) 1449

6Addendum B – Continuation of Standard Form

6B-1 General Information

7B-2 Pricing Table

7B-2.1 Pricing Table Elements

8B-2.2 Functional Area 1: Security Assessments

9B-2.3 Functional Area 2: Penetration Tests

9B-2.4 Functional Area 3: Policies and Procedures Support

9B-2.5 Functional Area 4: Risk Management Framework Support

10B-2.6 Miscellaneous – Travel-Related Expenses

11B-3 Description of Services

11B-3.1 Background

11B-3.2 Objective

12B-3.3 Security Assessment Requirements

12B-3.4 Penetration Test Requirements

13B-3.5 Information Assurance Policies and Procedures Support

14B-3.6 Risk Management Framework Requirements

16B-3.7 Deliverables

17B-3.8 Acceptance

19B-3.9 Assumptions

20B-3.10 Rules of Engagement

20B-3.11 Key Personnel

21B-3.12 Reports

23B-3.13 Quality Control Plan

24B-3.14 Acceptable Quality Levels

27Addendum C – Contract Clauses

27C-1 FAR Clause 52.212-4, Contract Terms and Conditions—Commercial Items (Feb 2012)

27C-2 Addendum to FAR Clause 52.212-4, Contract Terms and Conditions—Commercial Items (Feb

27C-2.1 AS 3201 – Invoice Submission and Payment Related Information (Dec 2011)

29C-3 52.212-5, Contract Terms and Conditions—Commercial Items (May 2012)

36C-4 Additional FAR Clauses Incorporated by Reference

36C-5 Additional FAR Clauses Incorporated by Full Text

37C-5.1 52.216-18 – Ordering (Oct 1995)

37C-5.2 52.216-19 – Order Limitations (Oct 1995)

37C-5.3 52.216-22 – Indefinite Quantity (Oct 1995)

38C-5.4 52.217-8 – Option to Extend Services (Nov 1999)

38C-5.5

52.232.19 – Availability of Funds for the Next Fiscal Year (Apr 1984)

38C-6 Additional Agency Specific Terms and Conditions

39C-6.1 AS 0401 – Security and Suitability Requirements (Jun 2011)

49C-6.2 AS 0402 – Federal Information Security Management Act (FISMA) and Agency Privacy Management (Oct 2008)

51C-6.3 AS 1902 – Section 8(a) Direct Award (Aug 2008)

52C-6.4 AS 2401 – Protection of Confidential Information (Dec 2008)

54C-6.5 AS 2402 – Protecting and Reporting the Loss of Personally Identifiable Information: Responsibilities Concerning Individual Employees (Dec 2008)

63C-6.6 AS 3204 – Contract Funding During a Continuing Resolution (Jul 2011)

63C-6.7 AS 4201 – Post Award Evaluation of Contractor Performance (Jul 2011)

65C.6-8 AS 4202 – Designation of Contracting Officer’s Representative (COR) and Alternate COR (Jul

67C-6.9 AS 4203 – Designation of Task Manager (TM) (MAY 2012)

69C-6.10 AS 4501 – Designation of Property Administrator and Listing of Government Property (Nov

71C-6.11 AS 4502 – Government Telecommunications/ Systems, Services, and Equipment Provided Under the Contract (Nov 2008)

72C-6.12 Insurance Requirements (Oct 2009)

73C-6.13 Task Order Procedures

77Addendum D – Contract Documents, Exhibits, and Attachments

77D-1 Attachment 1: Pricing Table

77D-2 Attachment 2: List of SSA Major Applications

77D-3 Attachment 3: Sample Rules of Engagement

77D-4 Attachment 4: Definitions

77D-5 Attachment 5: Worksheet for Reporting the Loss, Compromise, or Potential Compromise of Personally Identifiable Information

77D-6 Attachment 6: Volume III Questionnaire

77D-7 Attachment 7: Quality Assurance Surveillance Plan

78Addendum E – Solicitation Provisions

78E-1 FAR Provision 52.212-1, Instructions to Offerors—Commercial Items (Feb 2012)

78E-2 Addendum to FAR Provision 52.212-1, Instructions to Offerors – Commercial Items (Feb 2012)

78E-2.1 Format of Proposals

79E.2-2 Capabilities Statement

80E-2.3 Volume I – Business and Price Response

83E-2.4 Volume II - Technical Expertise

85E-2.5 Volume III.A – Relevant Experience Information

86E-2.6 Volume III.B - Past Performance Information

87E-2.7 Inquiries

87E-2.8 Response Due Date

88E-2.9 Period for Acceptance of Offers

88E-2.10 Multiple Awards

89E-3 FAR Provision 52.212-2, Evaluation – Commercial Items (Jan 1999)

89E-3.1 General

89E-3.2 Stage 1: Capabilities

90E-3.3 Stage 2: Non- Price Evaluation Factors

97E-3.4 Stage 2: Price Evaluation Factors

99E-3.5 Determination of Best Value

100E-4 FAR Provision 52.212-3 – Offeror Representations and Certifications—Commercial Items (Apr

112E-5 Additional FAR Provisions Incorporated by Full Text

112E-5.1 FAR 52.209-7 – Information Regarding Responsibility Matters (Apr 2010)

114E-5.2 FAR 52.216-1 – Type of Contract (Aug 1984)

114E-5.3 FAR 52.233-2 – Service of Protest (Aug 1996)

114E-6 Additional FAR Provisions Incorporated by Reference

Addendum A – Standard Form (SF) 1449 See the attached Standard Form 1449.

Addendum B – Continuation of Standard Form

B-1 General Information

(a) This requirement is to establish a performance-based Indefinite-Delivery/Indefinite-Quantity (ID/IQ) contract consisting of firm fixed-price and firm-fixed price level of effort Independent Verification and Validation (IV&V) support services. The ordering period of this Contract is for five years, beginning on September 29, 2012, and continuing until September 28, 2017. The last date to place Task Orders under the contract is September 28, 2017. Task Orders may extend beyond the end of the ordering period, not to exceed September 28, 2018.

(b) Included within this requirement are four Functional Areas related to IV&V functions that support SSA’s Information Security (IS), as follows:

· Functional Area 1: Security Assessments;

· Functional Area 2: Penetration Tests; and

· Functional Area 3: Policies and Procedures Support; and

· Functional Area 4: Risk Management Framework Support.

SSA will issue written Task Orders for work under this contract. See Addendum C, Section 6.13 for applicable Task Order procedures.

(c) References For definitions of terms used within Addendum B, see Addendum D, Attachment 4.

NIST Special Publication 800-53 revision 3, Recommended Security Controls for Federal Information Systems

NIST Special Publication 800-53A, Guide for Assessing the Security Controls in Federal Information Systems

NIST Special Publication 800-37 revision 1, Guide for Applying the Risk Management Framework to Federal Information Systems NIST Special Publication 800-30, Risk Management Guide for Information Technology Systems OMB Circular A-130, Appendix III, Security of Federal Automated Information Resources

The Contractor may obtain details about these references at the following website:

http://csrc.nist.gov/publications/nistpubs/index.html (d) Designation of Administering Contracting Specialist

SSA designated Christopher Mettee, Contracting Officer, Division of Information and Technology Support Services (DITSS), to administer the contractual aspects of this contract. Only the Contracting Officer may make changes in the scope of work, price, quantity, quality, or delivery schedule by a properly executed modification or task order. The Contractor must submit all correspondence that in any way concerns the terms or condition of this contract to the Contracting Officer at the following address:

Social Security Administration

Office of Acquisition and Grants

ATTN: Christopher Mettee

7111 Security Boulevard

1st Floor, Rear Entrance

Baltimore, MD 21244-1811

Telephone Number: (410) 965-9486 Email Address: Christopher.Mettee@ssa.gov (e) Contractor Project Manager

The Contractor Project Manager has the responsibility for all services provided under this agreement and full management authority for all Contractor personnel assigned to work on this project. The project manager will serve as the primary point of contact for the Government’s Contracting Officer Representative (COR) in matters concerning the agreement and will interact with other Government employees as appropriate.

Name:

<Offeror to complete> Address:

<Offeror to complete> Telephone Number:

<Offeror to complete> Email Address:

<Offeror to complete> B-2 Pricing Table

B-2.1 Pricing Table Elements

The Pricing Table is at Addendum D, Attachment 1. The following identify elements within the Pricing Table. The following are definitions for elements within the Pricing Table.

(a) Contract Line Item Number

The Contract Line Item Number (CLIN) represents an SSA designated number that identifies each orderable item in the contract. The Contractor agrees that it included any item not specifically identified in Attachment 1, Pricing Table, but required in performance of this contract, is included at no additional cost to the Government.

(b) Contract Year The Contract Year that the work begins in determines the unit price applicable. For example, if SSA orders services in Contract Year 1, the maximum price SSA shall pay is the unit price for Contract Year 1, regardless if work extends into another Contract Year. SSA anticipates the period of each Contract Year, as follows:

· Contract Year 1: September 29, 2012 through September 28, 2013

· Contract Year 2: September 29, 2013 through September 28, 2014

· Contract Year 3: September 29, 2014 through September 28, 2015

· Contract Year 4: September 29, 2015 through September 28, 2016

· Contract Year 5: September 29, 2016 through September 28, 2017 B-2.2 Functional Area 1: Security Assessments CLINs RA01 through RA03 represent a Firm-Fixed Price per report for the Contractor to perform Security Assessments on designated SSA Major Information System(s). Each CLIN includes varying degrees of complexity and time required. SSA included a breakdown of the estimated combined number of work-hours required by Analytical, Senior Analytical, and Subject Matter Expert engineering labor, but precluding Project Management (see Attachment 4 for definitions of labor categories):

· RA01 – High Complexity Security Assessment (estimated 1,100 work-hours);

· RA02 – Medium Complexity Security Assessment (estimated 800 work-hours); and

· RA03 – Low Complexity Security Assessment (estimated 550 work-hours).

The Contractor should assume that the work required for each Security Assessment will not exceed 25-percent more than the number of work-hours estimated above, conditioned upon the Contractor performing the Security Assessment in accordance with this Contract and where SSA does not require Major Revisions (see Section 3.8).

B-2.3 Functional Area 2: Penetration Tests CLINs PT01 through PT02 represent a Firm-Fixed Price per report for the Contractor to perform penetration tests on designated SSA Major Information System(s). Each CLIN includes varying degrees of complexity and time required. SSA included a breakdown of the estimated combined number of work-hours required by Analytical, Senior Analytical, and Subject Matter Expert engineering labor, but precluding Project Management (see Attachment 4 for definitions of labor categories):

· PT01 – High Complexity Penetration Test (estimated 650 work-hours); and

· PT02 – Medium Complexity Penetration Test (estimated 500 work-hours).

The Contractor should assume that the work required for each Penetration Test will not exceed 25-percent more than the number of work-hours estimated above, conditioned upon the Contractor performing the Penetration Test in accordance with this Contract and where SSA does not require Major Revisions (see Section 3.8).

B-2.4 Functional Area 3: Policies and Procedures Support CLINs LH01 through LH06 represent fully loaded labor rates to assist SSA develop its policies and procedures for IS. Each year, SSA anticipates to fund a Not to Exceed (NTE) amount for all labor rates based upon the unit prices specified in Attachment 1, Pricing Table, for Functional Area 3 and 4. SSA anticipates the following work-breakdown structure for Functional Area 3:

· LH01 – Recommendation of Policies/Procedures for IS Guidelines – 600 hours;

· LH02 – Recommendation of Policies/Procedures for Implementation Guidelines – 300 hours;

· LH03 – Research of IS Issues – 500 hours;

· LH04 – Provide IS Risk Remediation Recommendations – 900 hours;

· LH05 – Assist with IS Report Generation – 500 hours; and

· LH06 – Miscellaneous Support Services relating to IS Policies and Procedures – 200 hours.

B-2.5 Functional Area 4: Risk Management Framework Support CLINs RM01 through RM03 represent fully loaded labor rates to assist SSA understand its exposure to risk and adequately implement controls to prevent vulnerability exploitation. Each year, SSA anticipates to fund a Not to Exceed (NTE) amount for all labor rates based upon the unit prices specified in Attachment 1, Pricing Table, for Functional Area 3 and 4. SSA anticipates the following work-breakdown structure for Functional Area 4:

· RM01 – Security Control Implementation Guidelines – 500 hours;

· RM02 – Risk Assessment Reporting – 200 hours;

· RM03 – Security Documentation Review – 200 hours;

B-2.6 Miscellaneous – Travel-Related Expenses

CLINs TR1 through TR3 represent fixed-price travel-related costs where a Security Assessment/Penetration Test requires frequent travel from greater than 50 miles from SSA Headquarters in Baltimore, MD. For example, a Task Order may indicate that the Contractor must perform a Security Assessment at externally hosted data centers well outside of Maryland. The Contractor shall consider frequent travel less than 50-miles from SSA Headquarters in Baltimore, MD as part of its firm-fixed prices provided under Functional Areas 1 and 2. SSA estimates that 20-percent of Security Assessments/Penetration Tests will include travel requirements greater than 50 miles from SSA Headquarters. The Contractor must provide a fixed-price that includes all travel-related costs, including meals and incidental expenses, fares, taxes, parking, hotel, mileage, etc. The Contracting Officer will include travel-related funding with each Penetration Test/Security Assessment authorized, if applicable, using one, or a combination, of the following:

· TR1 – Infrequent travel required, not to exceed two visits to sites within major cities (population over 200,000) located in the eastern continental United States, and up to three days at a time.

· TR2 – Moderate travel required, not to exceed four visits to sites within major cities located in the eastern continental United States, and up to four days at a time.

· TR3 – Frequent travel required, not to exceed six visits to sites within major cities located in the eastern continental United States, and up to four days at a time.

· TR4 – Infrequent travel required, not to exceed two visits to sites within major cities located in the western continental United States, and up to three days at a time.

· TR5 – Moderate travel required, not to exceed four visits to sites within major cities located in the western continental United States, and up to four days at a time.

· TR6 – Frequent travel required, not to exceed six visits to sites within major cities located in the western continental United States, and up to four days at a time.

Upon the Contracting Officer providing travel-related funding in a Task Order, the Contractor shall obtain written approval from the COR for any travel required.

B-3 Description of Services B-3.1 Background

The Office of Management and Budget (OMB) directive requires the Social Security Administration (SSA to assess and authorize its major information systems. Part of the authorization work involves IV&V activities. This entails testing security controls of major Informational Technology (IT) systems per Special Publications NIST 800-53 (August 2009) Recommended Security Controls for Federal Information Systems and 800-53A (July 2008) Guide for Assessing the Security Controls in Federal Information Systems. IV&V also entails performing risk assessments per NIST 800-30 (July 2002) Special Publication Risk Management Guide for Information Technology Systems.

Also, for systems undergoing IV&V Security Assessment and Authorization activities, the required guidelines in NIST 800-60 Guide for Mapping Types of Information and Information Systems to Security Categories (August 2008) and FIPS 199 Standards for Security Categorization of Federal Information and Information Systems (February 2004) should be used to correctly identify/verify the correct impact level an exploited vulnerability could have on agency operations, assets, and individuals. SSA must report the results of the assessment and authorization work in the annual Federal Information Security Management Act (FISMA) Report to OMB and Congress at the end of each fiscal year.

OMB has directed Chief Information Officers (CIO’s) of Federal agencies to follow the guidance found in the National Institute of Standards and Technology (NIST) Special Publication 800-37 revision 1 (February 2010), Guide for Applying the Risk Management Framework to Federal Information Systems, to assess and authorize their major IT systems. The Office of Systems, Office of Information Security (OIS) has the overall responsibility to protect the confidentiality, integrity, and availability of information systems and assets. The Government must meet this obligation in a dynamic environment with limited qualified human capital (SSA personnel and Contractor) resources.

B-3.2 Objective The Objective of the Government is to procure Contractor expertise in the completion of Task Order-specific information assurance services for SSA major information systems. This requirement is for IT professional services to insure that SSA components have implemented adequate safeguards to protect the security and privacy of agency information resources.

Specific activities shall include:

(a) System Testing and Evaluation

(1) Independent Verification & Validation (IV&V) security control assessments;

(2) Risk Assessments; and

(3) Penetration Testing services.

(b) Establish and Apply Information Assurance Policies and Procedures

(c) Recommend Risk Management Framework Support Services These activities focus on ensuring SSA complies with Federal IS regulations, guidance, and agency policies. These services will mainly support SSA’s Office of Systems, Office of Information Security (OIS); however, other SSA programmatic offices may order services in support of OIS-sponsored security assessment activities.

The Contractor shall be responsible for all program management, technical, and administrative support for this effort. The Contractor shall provide support and technical expertise in a broad range of information security areas under this contract.

B-3.3 Security Assessment Requirements The Contractor must perform IV&V and Risk Assessment Security Authorization support for SSA’s major IT systems. SSA currently lists twenty-two (22) systems in its inventory (see Attachment 2 – List of Major Systems). However, the inventory is dynamic and SSA reserves the right to revise this list as it develops new systems to support agency functions or retires no longer needed Major Systems. The Contractor must provide Security Authorization support activities for any or all of SSA’s Major Systems. SSA’s intent is for the Contractor to conduct scheduled tri-annual assessments; respond to significant IT system and operating environment changes; and conduct random testing and assessment in response to security incidents involving SSA systems as designated in the Task Order.

B-3.4 Penetration Test Requirements

The Contractor must perform Risk Assessments/Penetration Tests to test the adequacy and effectiveness of security control measures put in place to protect the security and integrity of sensitive information technology (IT) systems, data, and network resources. The specific tasks will focus on the security of critical agency priorities, such as the MySSA user identification and authentication application. SSA will identify the specific tasks applicable upon purchasing a Penetration Test in the Rules of Engagement (ROE) (see Section 3.10). SSA will utilize the assessment/test results to identify risks and vulnerabilities in agency IT applications and evaluate the effectiveness of policy and technical controls in regards to SSA’s use of targeted applications. The agency will provide this resulting information to SSA senior management and engineers to allow them to correct or mitigate deficiencies and increase overall system security.

The Contractor shall follow common vulnerability assessment and penetration methodologies to ensure consistent and repeatable evaluations. The methodologies used must include the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-115, Open Source Security Testing Methodology Manual (OSSTMM) and Open Web Application Security Project (OWASP) testing guide. Specifically, the methodology employed by the Contractor must include adversarial system/infrastructure testing and analysis, such as penetration testing, from off-site and /or on-site at SSA facilities while preserving SSA’s security and using resources efficiently. Criticality and sensitivity of data associated with penetration test activity may necessitate on-site performance by the Contractor to enable close monitoring by SSA personnel. The Contractor must perform these activities in accordance with a ROE prepared by the Contractor, and approved by the COR.

B-3.5 Information Assurance Policies and Procedures Support

As part of Information Assurance, the Contractor must provide the following services:

· Assist in establishing OIS procedures (and reusable working papers) for security testing & evaluation, penetration testing, incident response, security detection tools, advanced persistent threat monitoring, and risk assessments;

· Provide consultative guidance, support, and assistance/instruction in identifying how security testing & evaluation, penetration testing, incident response, security detection tools/techniques, advanced persistent threat monitoring, risk assessments, and various security management tools (and outputs) can be integrated with SSA’s continuous monitoring capabilities;

· Accommodate requests for SSA and US Government information security policy interpretation and guidance;

· Accommodate requests for guidance on information security industry best practices;

· Conduct research on assorted information security issues, and make recommendations as appropriate or required in accordance with SSA policy and OIS procedures.

· Provide maintenance and update support for remediation activities associated with SSA information resources;

· Prepare or assist in developing annual, quarterly, and monthly reports required by higher monitoring authorities including OMB, DHS, and US-CERT;

B-3.6 Risk Management Framework Requirements The Contractor must perform risk management framework support services for any of SSA’s major IT systems, currently represented as twenty-two (22) systems in its IT inventory. However, the inventory is dynamic and SSA reserves the right to revise this list as it develops new systems to support agency functions or retires no longer needed Major Systems. The Contractor must provide Risk Management Framework support activities for any or all of SSA’s Major Systems.

The Contractor shall perform the following risk management framework support services:

· Control Family Implementation Guidance

· Risk Assessments

· Information Security Documentation Review

(a) Control Family Implementation Guidance:

The contractor shall provide guidance to SSA Task Manager indicated in each Task Order regarding implementation of security controls that satisfy Federal information security requirements. The Contractor shall:

· Explain security control implementation methodologies to the Task Manager, including the guidelines explained in applicable NIST Special Publications, such as NIST SP 800 series guidance.

· Offer guidance to SSA Task Managers that makes use of the most current SSA templates available to facilitate system owner security control implementations.

· Offer security control implementation guidance on the agency’s major information systems to Task Managers on an ad hoc basis as questions arise during the course of the period of performance.

(b) Risk Assessments:

In addition to Security Assessments provided under Functional Area 1, the Contractor shall perform and document risk assessments on an ad hoc basis for IT systems at various stages of development, or requiring post-implementation risk assessment. This will further ensure the security of SSA’s information systems and the information they handle, while also demonstrating compliance with Federal regulations, directives, and agency policies.

Risk Assessment activities to be performed by the contractor include delivering Risk Assessment Reports which:

· Recommend the selection and implementation methodology for security controls to satisfy risk management requirements based on system security categorization.

· Recommend security control tailoring to address risk factors such as aggregated risk and criticality to agency mission.

· Document Risk Determinations as a function of the likelihood of a given threat source exercising a particular potential vulnerability, and the resulting impact of that adverse event on the organization.

The Contractor shall employ the standard risk assessment methodology outlined by NIST 800-30 Risk Management Guide for Information Technology Systems. The Risk Assessment Report explains the identified risks, based on threat/vulnerability pairings, and recommended corrective measures aimed at reducing or eliminating the security risks. The systems requiring this attention will be identified during post-award application portfolio management discussions. The Contractor must attend application portfolio management discussions with the COR or other individuals identified in the Task Order on a weekly basis unless specified otherwise in a Task Order. These discussions will include an overview of current security assessments, penetration tests, and other work on-going by the Contractor or planned under the contract.

(c) Information Security Documentation Reviews:

The Contractor shall also be available to review System Owner-prepared Interconnection Security Agreements and component developed security documentation when the need materializes during the course of the period of performance. The Contractor review of security documentation will ensure it addresses agency security requirements in support of the SSA information security management program.

SSA will identify the IT systems that will require the services described above for this task during post-award application portfolio management discussions.

B-3.7 Deliverables The Contractor must submit all reports or other written deliverables in the format and media specified in the Task Order. For all deliverables, the Contractor shall implement effective document management by including version control and comment resolution such that each release has clear inventory of comments that were accepted / rejected as part of the version.

The Contractor must make all deliverables available at the place and time and to the COR and Task Manager defined in the Task Order for each Security Assessment/Penetration Test. The Contractor must provide deliverables within the following timeframes after receipt of a Task Order (ARO) unless specified otherwise in the Task Order:

· High Complexity Security Assessments – 180 days ARO;

· Medium Complexity Security Assessments – 120 days ARO;

· Low Complexity Security Assessments – 60 days ARO;

· High Complexity Penetration Test – 120 days ARO; and

· Low Complexity Penetration Test – 90 days ARO.

All work papers and deliverables produced by the Contractor for this Contract are the property of SSA. Moreover, the Contractor must consider all reports and other documents produced under this Contract as sensitive but unclassified (SBU) special works (see FAR 52.227-17, Rights in Data–Special Works) and must appropriately protect those reports and documents, unless otherwise designated in the Task Order/ROE for each Security Assessment/Penetration Test, respectively. SSA defines appropriately protect reports and documents as the following:

The Contractor must not release to anyone outside the Contractor’s organization any unclassified information, regardless of medium (e.g., film, tape, document) pertaining to any part of this contract or any program related to this contract, unless –

(1) The Contracting Officer has given prior written approval. The Contractor agrees to include a similar requirement in each subcontract under this Contract. Subcontracts shall submit requests for authorization to release through the prime contractor to the Contracting Officer; or

(2) The information is otherwise in the public domain before the date of release.

The Contractor must submit all deliverables in an accessible format (see Addendum B, Section 3.12).

B-3.8 Acceptance After receipt of deliverables, the COR or Task Manager (as specified in the Task Order) will have the right to reject or require correction of any deficiencies found in deliverables within the timeframe specified in the Task Order (may range from 7 to 14 days). In the event of rejection of a deliverable, the COR will notify the Contractor in writing as to the specific reason why the deliverable is being rejected. Deficiencies (major or minor) include:

· Major Revisions include content additions and deletions, substantial reorganization of report contents including moving material into appendices and attachments, adding explanatory charts and figures, replacing several paragraphs that the Contractor poorly worded or may be misread, and similar corrections. The Contractor must correct Major Revisions within a specified number of working days of notice by the Government, as defined in the Task Order.

· SSA considers Minor Revisions as essentially editorial and may request these changes orally. They include such items as typographic errors, formatting (e.g. failure to use an appropriate table of contents, lack of page numbers and dates, graphics too small to be readable), poor writing style and similar. The Contractor must correct Minor Revisions within five working days of notice by the Government.

(a) For all four Functional Areas, SSA will accept deliverables that are:

· Submitted in the Task Order prescribed format and media;

· Demonstrating version control and comment resolution;

· Made available to the COR at defined time and place designated in the Task Order;

· Appropriately protected, based on data sensitivity, as defined in the Task Order;

· Able to address identified deficiencies, including requested major and minor revisions, delivered within a specified number of workdays as defined in Task Order.

(b) In addition to (a) above, SSA will provide acceptance for Security Assessments based on the deliverable report:

· Addressing all applicable Federal security control requirements as defined in OMB and NIST published regulations and guidance, cognizant of agency tailoring to address agency specific policies, procedures, and awareness of known security threats and vulnerabilities.

· Assessing the correct control set based on established IT system security categorization and agency tailoring, evaluating control implementation status using prescribed assessment criteria as defined in OMB and NIST published guidance.

· Reporting on associated risks to system security as defined in OMB and NIST published regulations and guidance.

(c) In addition to (a) above, SSA will provide acceptance for Penetration Tests based on the deliverable report:

· Identifying all risks and vulnerabilities in agency IT applications;

· Explaining effectiveness of policy and technical controls in regards to SSA’s targeted applications.

· Complying with common vulnerability assessment and penetration methodologies to ensure consistent and repeatable evaluations. Methodologies used should have included the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-115, Open Source Security Testing Methodology Manual (OSSTMM) and Open Web Application Security Project (OWASP) testing guide.

· Adhering to ROE prepared by the Contractor, and approved by COR.

(d) In addition to (a) above, SSA will provide acceptance of Information Assurance policies and procedures based on deliverables:

· Recommending information assurance procedures applicable to SSA’s environment and reusable for purposes of security testing & evaluation, penetration testing, incident response, the use of security detection tools, advanced persistent threat monitoring, and risk assessments.

· Offering consultative guidance, support, and assistance/instruction in identifying how SSA can integrate security testing & evaluation, penetration testing, incident response, security detection tools/techniques, advanced persistent threat monitoring, risk assessments, and various security management tools (and outputs) with SSA’s continuous monitoring capabilities.

· Relating to SSA and U.S. Government information security policy interpretation and guidance have practical application to the SSA operating environment.

· Providing beneficial guidance on information security industry best practices.

· Usefulness of Contractor recommended remediation activities associated with SSA information resources identified vulnerabilities.

· Providing helpful suggestions are made by the Contractor related to annual, quarterly, and monthly reports required by higher monitoring authorities including OMB, DHS, and US-CERT.

(e) Risk Management Framework Support Services related performance quality shall be based on deliverables:

· Recommending control implementation guidance is applicable to SSA’s environment and reusable for purposes of security assessments, risk assessments, penetration testing, and incident response.

· Ensuring control implementation and risk assessment guidance offered by the Contractor makes use of current SSA assessment related templates.

· Ensuring control implementation and risk assessment methodology guidance offered by the Contractor is in agreement with the requirements of NIST SP 800 series guidelines and integrable with SSA’s continuous monitoring capabilities.

· Providing beneficial control implementation and risk assessment guidance consistent with information security industry best practices.

· Ensuring control implementation and risk assessment guidance provided by the Contractor improves the quality of SSA’s annual, quarterly, and monthly reports required by higher monitoring authorities including OMB, DHS, and US-CERT.

B-3.9 Assumptions

The Contractor must provide services controlled by means of specific objectives, deliverables, and constraints specified within the Task Order and ROE (when applicable for Penetration Tests) for services purchased, and the following terms and conditions:

· The Contractor technical personnel must address and assist with information to help resolve any major and minor issues identified during performance of security assessments or penetration tests or during deliverable review.

· SSA made its best efforts to estimate the resource requirements. The work required within this Contract is an estimate of resource requirements and is not a guarantee.

· Technical staff within SSA will be readily available for consulting throughout the project.

· SSA will review all deliverables and provide comments to the Contractor within the timeframe specified in the Task Order (may range from 7 to 14 days) to enable Contractor’s incorporating of any changes prior to the scheduled delivery date.

· During normal business hours, SSA will provide space for on-site conferences/meetings between SSA personnel and the Contractor Support Services team(s) to facilitate performance of the contract. If required, SSA will provide computer equipment and office software normally used by SSA for the purpose of work performed by the Contractor. SSA will provision and coordinate Government Furnished Equipment (GFP) on an as required basis (see Addendum C, Section 6.10).

· SSA will provide or make available information and documentation relevant to the specified tasks as appropriate. Furnishing Government information or access to Government systems may require Contractor personnel to sign confidentiality and/or non-disclosure agreements. The provisioning and coordination of Government Furnished Equipment, Workspace, and Information is the responsibility of the COR.

· Other than general office support equipment and software noted above, the Contractor must ensure that it has all the equipment, software and tools routinely used in industry to accomplish the contract objectives.

· Performance of the Functional Areas under this Contract will be at SSA’s facility, Contractor’s facility, or a combination of both.

· The Contractor must establish ROE at the Task Order level for Penetration Tests. The Task Order will identify the ROE as a deliverable that the COR must approve prior to work being started (see Section 3.10).

· SSA will reimburse the Contractor for limited travel visits (see Section 2.6). SSA may require that the Contractor make travel visits to visit externally hosted system locations to assess and test deployed security controls. SSA will specify at the Task Order level the estimated volume of specific travel and probable destinations.

· Unless otherwise specified in a payment schedule within the Task Order, the Contractor will only bill for items accepted by the COR.

· All Contractor personnel must possess Federal security clearance level 6c, High Risk – Public Trust.

B-3.10 Rules of Engagement

The Contractor must prepare a ROE document for all scheduled Penetration Tests within 45 days of a) receipt of a Task Order; or b) identification of specific Penetration Test requirements during post-award application portfolio management discussions. Each ROE must contain the applicable sections identified within Attachment 3 at Addendum D, Section 3.0. The COR will accept or reject the ROE within 14 days of delivery by the Contractor.

B-3.11 Key Personnel The Contractor shall not substitute key personnel under this contract unless approved in writing by the COR. The COR will approve all substitutions, in writing, for individuals defined as key personnel under this contract. Any substitutions are subject to the terms and conditions of this clause.

SSA identifies Key Personnel as follows:

· Project Manager

· Penetration Test Manager

Key Personnel must meet the qualification and experience levels specified under Attachment 4 definitions, as follows:

· Project Management must meet the Project Manager qualifications; and

· Penetration Test Manager must meet the Subject Matter Expert qualifications.

(a) Approval of Key Personnel The COR will review all resumes for Contractor personnel identified as key personnel to ensure conformance to the contract requirements.

(b) Removal of Key Personnel

During the first 180 days of performance, no key personnel substitutions can occur unless an individual's sudden illness, death, disciplinary action, demotion, promotion, or termination of employment necessitates such substitutions. In any of these events, the Contractor must notify the SSA Task Manager and COR within five days, in writing.

(c) Substitution Process

After the first 180 days of performance, the Contractor must provide at least 30 days advance notice for all substitutions and additions of key personnel.

B-3.12 Reports

(a) Technical Progress Report

Each month, the Contractor must submit to the COR, a report that identifies by task, the following information:

· The accomplished work;

· Description of work;

· Milestone dates;

· Current status;

· Requestor;

· Assigned technician;

· Comment;

· Problems encountered;

(b) Security Screening Report

The Contractor must maintain an electronic file of all cleared employees and Subcontractor employees working on this contract and provide the COR with copies on a monthly basis. This report must include all personnel (Prime Contractor and Subcontractors) who need access to an SSA facility, site, system, or information during performance of this contract. When requiring inside access, the Contractor personnel will need to have a security screening performed, as indicated in Addendum C, Section 6.1, Security Requirements Clause.

The report must include the following:

· Employee name

· Employee SSN

· Employee Phone Number

· Employee Email Address

· Status of screening (i.e. Pending [Contracting submitted suitability paperwork to SSA Suitability Office]); Pre-Approved ([determination made by SSA Suitability Office]; Denied [determination made by SSA Suitability Office];

· Security Awareness Training Date (required on an annual basis) For the security screening report, the Contractor must use compress and encrypt the report using 256-Bit Advanced Encryption Standard (AES) encryption method or higher. The file name of the report should be “Security Screening Report [Month] [Year].zip,” where [Month] and [Year] change based on when the report is due. The Contractor shall provide the encryption key to the COR via telephone with one-business day of submitting the report.

Documentation in Accessible Formats

The Contractor must provide any form of documentation (i.e. training manual, user guides, embedded documents etc.), including any documentation deliverables required in the statement of work, in a fully accessible format.

Therefore, the Contractor must provide the documents in one of the following formats: Text, Rich Text Format (RTF), Microsoft Word or Hypertext Markup Language (HTML) format, or properly “tagged” Portable Document Format (PDF). SSA can verify properly tagged PDF’s by using Adobe Acrobat’s Accessibility Checker.

The Contractor must ensure that documentation delivered in a manner that is interactive (e.g., table of contents, Index, Search, etc.) is keyboard navigable, move focus to selected items (or have a keyboard alternative) and be comparable in keyboard access to mouse usage. All images (especially screenshots and technical diagrams (which are the sole means for conveying instructions) should include alternative text explaining the image so that a person who is blind would understand the screenshot, chart, figure, etc. Documentation shall include information on the accessibility features of the product. If the Contractor provides keyboard shortcuts to allow access to program functionality, it shall provide a list of the keyboard shortcuts.

Any documentation that the Contractor delivers in a video or multimedia publication must comply with the Section 508 requirements detailed in 36 Code of Federal Regulations (CFR) part 1194.24 and the functional performance criteria detailed in 36 CFR 1194 Subpart C. In addition, SSA requires conformance to SSA’s accessibility requirements for all video and multi-media deliverables. SSA does not accept text equivalents used to replace speech, and requires captions synchronized with speech.

B-3.13 Quality Control Plan The Contractor must develop and maintain a Quality Control Plan to ensure that it performs IV&V services in accordance with the terms and conditions of the contract. The Contractor must develop and implement procedures to identify and prevent defective service from occurring. At a minimum, the Contractor must develop quality control procedures that address the following areas:

· An inspection system that enables the Contractor to identify and correct deficiencies in the quality of service before the level of performance becomes unacceptable and/or the Government points out the deficiencies.

· A checklist for the Contractor to use in inspections. The checklist must include every area of the Contractor’s operations under the contract, as well as all tasks performed.

· Procedures for documenting and responding to Task Orders.

· A file of all inspections conducted by the Contractor, including records of corrective actions taken as result of these inspections.

The Contractor must prepare the written Quality Control Plan no later than 30-days after the effective date of the contract, and provide this document to the COR and CO for review and comment. Moreover, the Contractor must make its written Quality Control Plan available for the COR to review and monitor anytime during the term of the contract.

B-3.14 Acceptable Quality Levels

This table specifies the standard for satisfactory performance of the tasks specified in this Addendum:

· Quality

· Timeliness

· Customer Satisfaction

SSA will measure Acceptable Quality Levels on an annual basis, at a minimum. SSA will include results of its performance monitoring in its Contractor Performance Assessment Reporting (see Addendum C, Section 6.7). Failure by the Contractor to meet Acceptable Quality Levels, or any other contract requirement, will be grounds for the Government to terminate this contract for cause.

As part of Quality Control, the Contractor must maintain an acceptable quality level for each task. SSA considers controlling quality of Contractor-produced products as part of the ongoing responsibility of the Contractor.

NOTE: The remainder of this page is blank. See next page for Performance Standards and Acceptable Quality Levels.

Contractor’s deliverables met formatting and media requirements.

80-percent of contract deliverables submitted without Major Revisions.

90-percent of Major Revisions corrected deficiencies identified by SSA.

90-percent of contract deliverables submitted for Functional Area 3 met quality requirements specified for that work.

90-percent of contract deliverables submitted for Functional Area 4 met quality requirements specified for that work.

Timeliness

Contractor submitted deliverables at defined time and place, as defined in the Task Order and ROE (when applicable).

Contractor corrected Major Revisions timely.

Contractor corrected Minor Revisions timely.

Contractor submitted responses to RFTOPs timely.

80-percent of all deliverables submitted timely.

100-percent of all non-timely deliverables submitted by new date mutually agreed to in writing by the Contractor and the Contracting Officer.

80-percent of Major Revisions and Minor Revision corrected by date and time specified in the Task Order and ROE (when applicable).

90-percent of Major Revisions and Minor Revisions not submitted timely corrected by no later than 15-days after the original due date, or a greater time as otherwise specified in writing by the COR or Task Manager.

80-percent of proposals submitted within 15 days of receipt of a RFTOP.

Customer Satisfaction

Working relationship between customer organization and Contractor is positive.

Contractor’s performance met contractual requirements, Contractor provided effective communication and facilitated task meetings with customer organization to incorporate feedback into deliverables, ensure tasks remain on schedule, and met contractual milestones.

Contractor regularly interacted with customer organization to identify issues and raise awareness of task status, including the Contractor collaborating with customer organization, providing solutions to resolve issues that threaten to negatively affect the tasks.

Contractor recommended and demonstrated ability to apply improvements to the customer’s information security program that elevate the level of implemented security controls, thereby improving confidentiality, integrity, and availability assurances.

80-percent of customer satisfaction surveys submitted by the COR, end-users, or Task Manager, after completion of work under any Functional Area, return with an overall Contractor performance satisfaction level of “GOOD” or higher.

Addendum C – Contract Clauses

C-1 FAR Clause 52.212-4, Contract Terms and Conditions—Commercial Items (Feb 2012)

In accordance with FAR 12.301 and 12.302, this contract incorporates FAR Clause 52.212-4 by reference via Block 27 of the SF 1449.

C-2 Addendum to FAR Clause 52.212-4, Contract Terms and Conditions—Commercial Items (Feb 2012)

· SSA supplemented Paragraph (g), Invoice, as follows:

C-2.1 AS 3201 – Invoice Submission and Payment Related Information (Dec 2011) The invoice shall include all elements of a proper invoice as defined in the invoice or payment clause used in this award and any other information required below or in any other contract clause.