Technical Support Services Instructions to Offerors_FINAL (CLEAN).pdf

REFERENCE DOCUMENT

INSTRUCTIONS TO OFFERORS

TECHNICAL SUPPORT SERVICES

SOLICITATION

5. GENERAL INSTRUCTIONS

Offers shall be submitted by the closing date and time noted on the cover of this solicitation.

Submission via email is required; no hard copy delivery will be accepted. Email submissions shall be sent to Kiaira Stallworth at kstallworth@oig.usaid.gov and Scott Ferrante at sferrante@oig.usaid.gov.

Offerors shall prepare a proposal as described below. Offerors must submit all elements of the technical proposal in PDF format except for the price proposal in response to “Section 6 - Mock BPA Call Order: Network Defenses” in Attachment III – Mock Call Pricing Sheet. The discount table for the BPA Contract, discussed in section 5.4.3.2, must be submitted in PDF format.

Pursuant to the Freedom of Information Act, as amended, the public is entitled to request information from Agency contract files. As a general rule, the information will be disclosed except:

• Information submitted in response to a Request for Proposal/Quotation, prior award of the contractor or other instruments, or amendments thereto.

• Information properly classified or administratively controlled by the Government.

• Information specifically exempted from disclosure under the Freedom of Information Act.

Upon award of a contract resulting from this solicitation, the Government will disclose, use or duplicate any information submitted in response to the solicitation to the extent provided in the contract and as required by the Freedom of Information Act.

In case of any disagreement or discrepancies between the terms and conditions of this RFP and the FAR, the latter shall prevail.

The Offeror shall follow the instructions contained in this RFP and supply all information and certifications, as required. Failure to furnish all information requested may disqualify the proposal.

The Offeror must set forth full, accurate and complete information as required by this RFP. The penalty for making false statements to the Government is prescribed in 18 U.S.C. 1001.

USAID/OIG reserves the right to perform a pre-award survey which may include but is not limited to: (1) interviews with individuals to establish their ability to perform contract duties under the project conditions; (2) a review of the Offeror’s financial condition, business and personnel procedures, etc.; and (3) site visits to the Offeror’s institution.

This request for proposal is written in the format found under FAR 12.303. The Offeror is encouraged to familiarize themselves with the Contract Format. This will facilitate their understanding of the terms and conditions of this solicitation, the instructions which follow, and the source selection process.

If an Offeror does not understand these instructions, then they should write Kiaira Stallworth at kstallworth@oig.usaid.gov and Scott Ferrante at sferrante@oig.usaid.gov for clarification no later than the date and time specified in the cover letter of this solicitation.

Government Obligation. The US Government is not obligated to make an award or pay for any costs incurred by the Offeror in preparation of a proposal in response hereto.

5.1 PREPARATION FOR PREPARING FOR PREPARING THE TECHNICAL

5.1.1 COVER SHEET WITH BUSINESS INFORMATION

Please include:

• The solicitation number and title.

• Company name, address, contact information, and any proposed sub-contractor or partner organization.

• Point(s) of contact: name, including title; specify name(s) of those authorized to negotiate with the Government on behalf of company; and for each, include phone number, fax number, email address, and physical address.

• Statement of the Offeror’s (and any proposed subcontractor’s) UEI number, TINS ID and the company’s GSA Multiple Award Schedule contract number.

5.1.2 TECHNICAL PROPOSAL

The technical proposal must be entirely separate from the price proposal, and it must not include price information. The technical proposal must be in Word format and PDF format.

The Technical Proposal shall be written in American English and shall address the information requested below. Offerors shall use only 8.5 inch by 11-inch paper (electronic, single spaced pages and number each page consecutively). Offerors must use Times New Roman font 11 or similar size typeset.

The technical proposal must include the following:

• Contractor’s Statement of Independence – The offer’s proposal will be automatically rejected if the offer is not independent from USAID, MCC, USADF, and IAF.

• Contractor’s Past Performance – USAID/OIG will contact two of the references provided by the offeror and consider other sources of information, including, but not limited to other government agencies, better business bureaus published media, and electronic data bases to verify at a minimum:

o That the offeror was capable, efficient, and effective.

o That the offeror’s performance conformed to the terms and conditions of the contract.

o That the offeror was reasonable and cooperative during the performance.

o That the offeror was committed to customer satisfaction.

• System of Quality Control – The offeror will be evaluated on its description of the system of quality control.

• Response to “Section 6 - Mock BPA Call Order: Network Defenses” – The offeror will be evaluated on its work plan in response to “Section 6 - Mock BPA Call Order – Network Defenses.”

• National Security Agency Certification – The offeror will be evaluated on whether the firm is certified by the National Security Agency. This is not a disqualifying factor; however, firms that are National Security Agency certified are preferred and will be given greater consideration.

5.2 EVALUATION FACTORS FOR AWARD

5.2.1 GENERAL

• The Government may award the contracts without discussions with Offerors in accordance with FAR 13.106-2(b)(3).

• The Government intends to evaluate offerors in accordance with section 5.4.2 of this instructions document and select an offeror whose proposal represents the overall best value to the U.S. Government.

• The technical information submitted will be evaluated by a technical evaluation committee

(TEC) using the technical criteria shown below. The evaluation committee may include industry experts who are not employees of the Federal Government.

• For overall purposes, technical factors are considered significantly more important than costs/price factors. Price is a separate evaluation factor and will not be scored by the TEC.

• This procurement utilizes a tradeoff process. If the Contracting Officer determines that competing technical proposals are essentially equal, price factors may become the determining factor in source selection. Conversely, if the Contracting Officer determines that competing cost/price proposals are essentially equal, technical factors may become the determining factor in source selection. Further, the Contracting Officer may award to a higher priced Offeror if a determination is made that the higher technical evaluation of that Offeror merits the additional cost/price.

5.4.2 TECHNICAL EVALUATION CRITERIA

In determining which offer represents the best value to meet the Government’s needs, the Government shall evaluate responses using the evaluation criteria below. If the Contracting Officer determines that competing technical proposals are essentially equal, price factors must become the determining factor in source selection. Conversely, if the contracting officer determines that competing price proposals are essentially equal, technical factors must become the determining factor in source selection.

• Contractor’s Statement of Independence

This section of the proposal must describe clearly state whether or not the company is independent from USAID, MCC, USADF, and IAF. Specifically, the offeror is required to affirm whether or not the company is independent from USAID, including a statement that the company (1) is free from personal and external impairments to independence from USAID, MCC, USADF, and IAF; (2) is organizationally independent; and (3) intends to maintain its independence in fact, attitude, and appearance throughout the period of performance of the scope of work. In addition, if any impairment(s) exists and/or are foreseen, the proposals must explicitly state the nature of such impairment(s).

• Contractor’s Past Performance

This section of the proposal must describe the company’s past work experience in performing work related to the audits described in Section 1.4, Scope of Work, in the Statement of Work.

The description must be no more than three (3) pages in length (with 1-inch margins), single-sided, and single-spaced.

Offerors shall also provide references for contracts with four different organizations (including Federal, State, local Government, and private) that your firm was awarded within the past five years that demonstrates your ability to perform the work identified in the scope of work. Each reference must be separately identified and include the following information: referenced organization’s name, contract number (if any), three current points of contacts who are capable of providing reference information with respect to your firm’s performance, current telephone numbers for each point of contact, current email address for each point of contact, project name, address of reference organization, facsimile number of reference firm, a brief description of the work performed, the dollar amount of the contract, the number of years of contract, and any problems encountered to include the offeror’s corrective action. USAID OIG recommends that you alert the contacts that their names have been submitted and that they are authorized to provide performance information concerning the listed and when USAID OIG requests.

• Response to Mock BPA Call Order: Network Defenses

For this section of the proposal, the offer must provide the following in response to “Section 6 - Mock BPA Call Order: Network Defenses.”

Work Plan

The offeror must provide a work plan that describes the approach and specific work steps that the offeror proposes to implement to satisfy Task 2. The work plan must detail the processes (tasks, subtasks, etc.) undertaken by the contractor and/or subcontractor, the level of effort for each process, and the timelines, project milestones, and delivery dates for performance of each task identified in the work plan. The delivery dates must be consistent with the Schedule of Deliverables for each task, factoring in the time it will take to complete the initial work in Task

1. In addition, the work plan must follow the guidelines contained in NIST SP 800-115, Technical Guide to Information Security Testing and Assessment, unless otherwise approved by the COR.

Under no circumstances may the contractor intentionally alter USAID’s network or information contained in it (e.g., correct vulnerabilities identified, installing software, or open files) or launch an attack (e.g., denial of service and move or alter files) of the Agency’s network. All internal and external scans must be coordinated with the Agency and COR following a rules of engagement agreement. See Appendix V for a sample of key terms and conditions in a rules of engagement agreement for a technical vulnerability assessment. The work plan shall, to the extent possible, exclude OIG from the scope.

In preparing the workplan, the contractor shall make the following assumptions:

o The goal is to identify vulnerabilities in the Agencies network and network defenses, thereby simulating a hacker’s activities.

o For the external penetration testing, the contractor will have no knowledge of USAID or its network.

o External penetration testing will include fake malicious links sent by email to capture the email addresses of USAID staff that click on the link, and other similar activities, the contractor deems appropriate.

o Upon award, research for external penetration testing will begin. Most research for the external penetration testing will be completed before the entrance conference only to the point of identifying potential access points and weakness that could be exploited to gain access—without scanning or accessing USAID’s network and without the knowledge of USAID officials.

o The contractor will conduct an independent, credentialed internal scan of USAID’s entire network (including web applications, servers, workstations, and network devices), analyze the results, and identify causes of vulnerabilities identified.

o The contractor’s report will present areas of specific concern (such as missing patches), rather than identifying the number of vulnerabilities by severity level that the testing tool identified.

o The contractor will use an OIG-issued laptop to test whether it can penetrate USAID’s network and to conduct the internal vulnerability assessment.

o All software licenses that the contractor will purchases for this BPA call will become the property of OIG.

o USAID must approve the software that will be installed on the OIG-issued laptop.

o OIG will issue the official draft and final reports to the Agency.

In addition, assume that it will take:

o 45 days to onboard the contractor’s staff.

o 45 days, including various meetings to receive, configure, and obtain clearance to use an

OIG laptop to perform the technical vulnerability assessment and to complete the external penetration testing; arrange administrator level network access; and complete and sign the rules of engagement, which must be in place before commencing the technical vulnerability assessment and scanning or accessing USAID’s network as part of the penetration testing.

o 30 days for contractor to work with the COR to respond to comments from internal OIG reviewers’ comments through issuance of the official draft evaluation report.

o 30 days for the Agency to provide comments on the OIG’s official draft evaluation report.

o 30 days for the contractor to work with the COR to analyze the Agency’s comments and respond to internal OIG reviewers’ comments through issuance of the official final evaluation report.

Finally, if different than the System of Quality Controls factor for the BPA Contract proposal, the contractor must describe in detail the contractor’s (and subcontractor’s if applicable) internal quality controls over its technical services provided in relation to section 1 of “Mock BPA Call Order: Network Defenses,” including planning, completion of the testing and analysis (referred to as “fieldwork”), and reporting.

• System of Quality Controls

For this section of the proposal, the offeror must describe in detail the contractor’s (and subcontractor’s if applicable) internal quality controls over its technical services provided in relation to section 1 of this BPA. Note that, for each BPA call, the contractor will be required to provide updated information on its system of quality controls and to attest whether it followed its system of quality controls for the services provided.

• National Security Agency Certification

For this section of the proposal, the offeror must provide evidence that the firm is National Security Agency Certification, if applicable.

5.4.3. PRICE PROPOSAL

5.4.3.1. MOCK CALL ORDER

THIS IS INCLUDED FOR EVALUATION PURPOSES ONLY. ACTUAL PRICING WILL BE

SUBMITTED AND EVALUATED IN ACCORDANCE WITH THE AWARD OF ANY CALL ORDER.

Offerors must provide pricing based on their work plan in response to “Section 6 – Mock BPA Call Order – Network Defenses” and complete and submit the pricing in Attachment III – Mock Call Pricing Sheet. Offerors must complete all yellow highlighted sections on all tabs of Attachment III.

During the price evaluation, price realism analysis may be performed to assess the reasonableness of the proposed level of effort. This analysis contributes to the overall assessment of the risk presented in each supplier’s proposal regarding its anticipated performance.

5.4.3.1.1 BASE PERIOD

Pricing of the base period is firm-fixed price and covers Tasks 1 & 2 of the “6 Mock BPA Call Order:

Network Defenses” portion of this document. In Attachment III, the offeror shall submit proposed labor rates for each labor category described in Section 4, Requirements for Staffing, and the level of effort (number of hours) for each labor category. Other direct costs are captured in a separate line item. For other direct costs, supplier must provide a document listing its components and their individual prices i.e., any hardware and/or software, including licenses, needing to be purchased for the technical vulnerability assessment and external penetration test. This must be presented in pdf format, separate from the technical proposal.

The contractor must assume that the OIG will provide a laptop for the internal technical vulnerability assessment. In addition, the price proposal must separate the price for conducting the external penetration testing from the internal technical vulnerability assessment; space for this is provided in Attachment III.

5.4.3.1.2 OPTION PERIOD

Pricing of the option period is labor hours to cover Task 3 of the “6 Mock BPA Call Order: Network Defenses” portion of this document. In Attachment III, the offeror shall submit proposed labor rates for each labor category described in Section 4, Requirements for Staffing, and the number of labor hours proposed for each labor category.

5.4.3.2 BPA CONTRACT

The offeror must propose a discount table showing the discount percentages on their GSA MAS contract for each year of the period of performance of the BPA contract (one base year and four options years). This must be presented in pdf format, separate from the technical proposal.

5.5 SOURCE SELECTION

The award will be made by the contracting officer to the responsible offeror whose proposal represents the best overall value to the U.S. Government after evaluation in accordance with all factors in the RFP.

5.6 BEST VALUE SOURCE SELECTION PROCESS

The Federal Acquisition Regulation (FAR) defines best value as the expected outcome of an acquisition that, in the government’s estimation, provides the greatest overall benefit in response to the requirement (FAR 2.101).

For this solicitation, under best value source selection, non-price evaluation factors, when combined are significantly more important than price. However, an offeror will not be selected for award based on superior capability without consideration of the amount of its price.

To select the winning offeror; USAID/OIG will rank offerors from best to worst by making paired comparisons, trading off the marginal differences in capability and price. If one offeror has both the better capability and the lower price, then that offeror will be the better value. If one offeror has the better capability and the higher price, then the technical evaluation panel will decide whether the marginal difference in capability is worth the marginal difference in price. If the technical evaluation panel considers the better capability to be worth the higher price, then the more capable, higher-priced offeror will be the better value. If not, then the less capable, lower- priced offeror will be the better value. If more than two proposals are received, the technical evaluation panel will continue to make paired comparisons until it has decided which offeror represents the best value.

(END OF SECTION 5)

6 Mock BPA Call Order: Network Defenses

DESCRIPTION OF SERVICES

6.1 PURPOSE

The purpose of this BPA call is to obtain external penetration and internal network vulnerability services, and to provide OIG with a clear understanding of the work performed, in support of the U.S. Agency for International Development (USAID) Office of Inspector General’s (OIG) evaluation of USAID, described herein. Such services must be conducted in accordance with the version of the Council of the Inspectors General on Integrity and Efficiency’s Quality Standards for Inspection and Evaluation that are in effect at the time of the evaluation (henceforth referred to as evaluation standards). Moreover, all work must be conducted following the principles in National Institute of Standards and Technology Special Publication 800-115, Technical Guide to Information Security Testing and Assessment.

Cybersecurity is important because USAID needs to protect its data and systems from the growing threat of cyberattacks, which can lead to unauthorized access and changes. Therefore, USAID needs to identify technical vulnerabilities and mitigate the associated risks to protect its sensitive systems and data, including Agency plans for Ukraine and Gaza. External penetration tests are critical in determining how an attacker may try to breach the security perimeter of the network, including the exploitation of vulnerabilities. Of equal importance, internal vulnerability testing allows an organization to identify potential vulnerabilities and mitigate the risk of cyberattacks.

According to Agency officials, USAID’s network supports approximately 13,000 staff members located in the Washington, DC, area and in over 80 overseas facilities, and has an average of 25,000 active internet protocol addresses a day.

6.2 CONTRACT TYPE

The government anticipates awarding a hybrid call order under the master blanket purchase agreement. The hybrid order consists of a combination of firm-fixed price and labor hours line items.

6.3 STATEMENT OF WORK

TASK 1 – Administrative

Task 1.1 –General Information from Contractor

The contractor shall, by the timeframe specified in the Schedule of Deliverables, provide the following.

• Contractor Firm’s Statement of Independence from the BPA proposal.

• Description of contractor’s past performance from the BPA proposal.

• Resume of all key personnel from the BPA proposal.

• Resume of key and non-key personnel that will be assigned to this BPA call.

• Description of the contractor’s system of quality control from the BPA call proposal.

• Any other documents required for contracted evaluations because of changes to the Council of the Inspectors General on Integrity and Efficiency’s evaluation oversight checklist, if any.

https://www.ignet.gov/sites/default/files/files/QualityStandardsforInspectionandEvaluation-2020.pdf

Task 1.2 – Security Briefing and Secure Communications

For each contractor staff that requires either unescorted access to physical USAID’s facilities or logical access to USAID’s network, the contractor must, by the timeframe specified in the Schedule of Deliverables, complete and deliver to the OIG’s Contracting Officer Representative (COR), for each (no combined forms) of its staff that require network or physical access: (1) a resume for the contractor’s staff that shows employment with the contractor, (2) a completed U.S. Office of Personnel Management optional form 306 (referred to as OF 306), and (3) any other documents required by USAID, such as a Visit Authorization Letter (referred to as VAL) and Visit Access Requests (referred to as VAR) . (Note: If the individual does not have a middle name, the VAL/VAR must specifically state “No Middle Name.”) If passwords are used when transmitting those documents to the OIG COR, each must use the same password. Note that the contractor shall assume it will take 30-45 days to complete the onboarding process. However, cancellation of appointments, such as training and PIV appointments, will delay the process and may require the contractor to submit updated documents.

Each person who requires unescorted physical access to USAID facilities or access to USAID’s network must also complete USAID’s onboarding process for contractors. That process currently includes approximately 12 training hours—which is subject to change. Immediately after receiving the activation email, contractor staff shall complete the process to obtain an RSA token for access to the OIG’s network.

To facilitate the timely, secure receipt of deliverables to OIG, at least two contractor personnel shall, by the timeframe specified in the Schedule of Deliverables, complete the process to obtain remote access to the OIG and USAID’s networks, which shall be maintained for the entire period of performance of this statement of work. This includes obtaining a USAID personal identity verification (“PIV”) card. Prior to obtaining a PIV card, each individual shall complete the 8-hour security briefing conducted by USAID’s Office of Security. Each person who requires unescorted physical access to USAID facilities or access to USAID’s network must complete USAID’s security briefing and shall have at least a public trust. All staff who require access to OIG’s network must complete all required annual training1 to maintain that access—regardless of when they completed that training or obtained access.

All exchanges of information with USAID officials must be on an Agency-approved platform, which may change at the Agency’s discretion. Therefore, contractors shall obtain and maintain access to OIG and USAID’s networks throughout the entire period of performance, following the process described above.

Task 1.3 – Independence Checklists and Statements

The contractor shall, by the timeframe specified in the Schedule of Deliverables, complete and deliver to the COR a Conceptual Framework for Independence Assessment Checklist (Appendix I) and Statement of Professional Independence (Appendix II) for each contractor personnel assigned to the evaluation.

1 As of the date of this solicitation, there are five required annual trainings that are one to two hours each.

Currently, the trainings are available on USAID’s network and cover cybersecurity, privacy, handling classified information, section 508 compliance, and active shooter. However, the location, number of required trainings, topics, and lengths are subject to change as determined by USAID (not USAID OIG).

Task 1.4 – Background Investigations

The contractor shall provide evidence that each team member has at a minimum, a moderate-risk public trust supported by a Federal Investigative Standards Tier 2 (T2) and/or Tier 2 Reinvestigation (T2R) background investigation. The moderate-risk public trust shall be active for the entire period of performance in the scope of work.

In addition, the contractor’s Senior Cybersecurity Officer (key personnel) for this BPA call and Security Officer shall provide a signed and dated certification on the contractor’s letterhead that states:

I certify that all staff on this engagement (including those that I propose at any time during the period of performance) have passed at least a Tier 2 Moderate Background Investigation (moderate risk public trust) and that it is current. I accept full responsibility for any inaccuracies in this statement. I understand that the USAID Office of Inspector General and its staff will not be responsible for any such inaccuracies.

Task 1.5 – Nondisclosure Agreements

The contractor shall, by the timeframe specified in the Schedule of Deliverables, complete and deliver to the COR standard nondisclosure agreements, included in Appendix III. The nondisclosure agreement shall be signed and dated by each contractor personnel assigned to work on this scope of work and a witness.

Task 1.6 – Attendance at Post Award Meeting and Evaluation Training Session

The contractor (at least one key personnel) shall attend a post award meeting with the COR to discuss contract administration, deliverables, the deliverable schedule, and to clarify any issues by the timeframe specified in the Schedule of Deliverables. This meeting will take place either at USAID OIG, 1300 Pennsylvania Ave, NW, Washington, DC 20523; another location in the Washington, DC, metropolitan area; or virtually, as designated by the COR.

In addition, each contractor personnel assigned to this task shall attend a two-hour session for OIG to provide high-level training on conducting evaluations in accordance with the Council of the Inspectors General on Integrity and Efficiency’s Quality Standards for Inspection and Evaluation. The purpose of the training is to give the contractor an understanding of the standards that must be met when conducting an evaluation.

Finally, the contractor shall conduct an 8-hour session to explain to the OIG team, including but not limited to the COR and task monitors, in detail the contractor’s work plan. During that session, the contractor shall answer the COR and task monitors’ questions.

Task 1.7 – Weekly Status Reports and Biweekly Meetings

In accordance with the Schedule of Deliverables, the contractor shall provide a weekly status report that describes for each task and subtask (1) the work performed during that reporting period; (2) all impediments to completing the work in accordance with the scope, quality, and schedule; (3) the overall status of completing each task and subtask; and (4) whether all applicable team members logged into the OIG network within the last 3 weeks to maintain that access. In addition, the status report shall include all tentative vulnerabilities and findings that have been identified to date.

Further, the status report must disclose if any staff (not only key personnel) are no longer working on the task. The status report template is provided in Appendix IV. Status reports shall be delivered electronically to the COR. However, a status report is not required if work was not performed on the task since the last status report—but the contractor shall inform the COR in writing.

Also, the contractor shall conduct weekly status meetings with OIG to discuss in detail all work performed, problems encountered (e.g., delays in receiving information from the Agency), potential vulnerabilities, and potential findings—before presenting them at biweekly meetings with the Agency. At the COR’s discretion, the COR or task monitor may record a video and audio of those biweekly meetings. The contractor must respond fully to the COR’s questions and requests for information. The meeting with OIG may be cancelled when not needed, but any cancellations must be approved in writing by the COR.

In addition, the contractor shall conduct biweekly status meetings with Agency staff and OIG. An agenda for each meeting must be provided to USAID and the OIG at least one day before the scheduled biweekly meetings. The agenda must include a discussion of the status of work, impediments to completing the work, and potential vulnerabilities and findings. However, the meeting with the OIG may be cancelled when not needed, but must be agreed to by Agency staff or approved in writing by the COR.

Task 1.8 – Maintain network access

The contractor shall log in to their USAID accounts at least once every 3 weeks to maintain network access for the entire period of performance. The COR will require the contractor to add a reminder to their calendar to log into the network at least once every three weeks for the entire period of performance. Due to the extensive amount of OIG time it takes to reestablish network access, for each instance that access is not maintained, OIG reserves the right to assess on the contractor a $1,000 penalty for each employee whose network access must be reestablished.

Task 1.9 – Return Remote Access Tokens, PIV Cards, and Equipment

The contractor shall, by the timeframe specified in the Schedule of Deliverables or as requested by the COR in writing, return to the OIG all USAID remote access tokens (if hard token was received) and PIV cards, laptops, and other hardware, if issued under this scope of work. In addition, the contractor shall have OIG uninstall from its laptops all copies of OIG software, if any.

TASK 2 – Conduct Evaluation Work

The objective of the evaluation2 is to answer the following question:

To what extent did USAID defend its network against malicious attacks?3

2 OIG reserves the right to change the evaluation to an audit in accordance with the U.S. General Accountability Office’s Government Auditing Standards in effect at the time of the audit, if necessary—at no additional cost to the government if the change does not increase the contractor’s level of effort. The COR must notify the contractor of such a change in writing. If the change increases the contractor’s level of effort thereby increasing the contractor’s price, the contractor must notify the COR in writing. The contracting officer must modify the contract.

3 OIG reserves the right to edit the wording of objective without changing the meaning, scope, or methodology used to answer it.

https://www.gao.gov/yellowbook

To answer the objective, the contractor shall conduct external penetration testing of USAID’s network, including tests to assess whether Agency employees are susceptible to malicious emails.

In addition, the contractor shall conduct an internal technical vulnerability assessment of USAID’s entire network, which Agency officials said has an average of 25,000 active internet protocol addresses a day.

The contractor shall work with the COR to ensure all work is performed and documented in OIG’s files in accordance with evaluation standards.

The COR will provide oversight of the contractor to ensure that contract requirements are met.

Specifically, the COR will maintain responsibility for establishing milestones for evaluation planning, fieldwork, and reporting; monitoring the evaluation’s progress in meeting milestones and adherence to standards; coordinating entrance and exit conferences; and providing comments on the draft and final reports as well as other contractor deliverables.

If requested by the COR, the contractor shall meet with the OIG’s auditors responsible for conducting the annual audit pursuant to the Federal Information Security Modernization Act of 2014 (FISMA) to discuss its work plan, scope, testing, and observations noted during the evaluation.

The contractor shall also provide documents and/or responses to the FISMA auditors, if requested.

In addition, the contractor shall allow both the OIG peer reviewers and the U.S. Government Accountability Office access to their workpapers and to full and timely access to appropriate contractor firm individuals for a period of up to three years after acceptance of the final deliverable under this scope of work.

In addition, the contractor must work closely with the OIG team to provide them with a full understanding of the work performed by the contractor for the external penetration testing and the internal technical vulnerability assessment. The contractor must respond to the COR and task monitors’ questions and requests for additional information throughout the process (through issuance of the final report) (1) to give them a sufficient understanding to assess whether the work is complete, accurate, and reliable and (2) so that the work can be fully documented in accordance with evaluation standards.

Task 2.1 – Management Assertion Letter and Initial Document Request List

By the timeframe specified in the Schedule of Deliverables, the contractor shall obtain a written management assertion letter from Agency management for them to assert, to the best of their knowledge, whether they have provided all information and access needed for the contractor to conduct its work in support of the evaluation. Appendix VI provides an example that the contractor may use and alter as needed. A draft of that letter shall be provided to Agency officials at the entrance conference so they will be aware of the assertions that will be requested. Agency officials will be required to provide a final signed letter at the exit conference or shortly thereafter.

Finally, to facilitate timely planning of the evaluation, the contractor shall provide to the COR its initial document request list (also known as ‘provided by client (PBC) list’), which the COR will provide to the Agency’s evaluation liaison. The contractor shall work directly with the Agency’s evaluation liaison after the entrance conference.

Task 2.2 – Entrance Conference

In accordance with the schedule of deliverables, the contractor shall deliver to the COR a draft handout that will be provided to the auditee. At a minimum, the handout must include the evaluation title, objective, background, scope, methodology, space for the COR to add the reporting process, tentative milestones, and key contractor and OIG employee contact information. All COR comments shall be addressed before finalizing the handout.

As specified in the Schedule of Tasks/Deliverables, the contractor shall have an entrance conference with OIG and USAID personnel, as determined by the COR, to discuss the evaluation (using the COR-accepted handout) and to answer USAID’s questions. At the entrance conference, the contractor shall present the COR-accepted handout to the participants.

Task 2.3 – Evaluation Fieldwork and Wrap-Up

The contractor shall perform evaluation fieldwork as specified in the COR-approved work plan, Task 2.1.1 deliverable. Fieldwork shall be completed by the timeframe specified in the Schedule of Deliverables. Unless otherwise directed by the COR, the contractor shall include the COR and alternate COR on all correspondence with the Agency.

To the extent possible, the contractor team shall provide USAID with written requests for information, documentation, and meetings. In addition, to the extent practical, the contractor shall consolidate its team’s requests, thus requiring coordination and communication amongst the contractor’s team members. All sensitive documents shall start with “SBU” in the file name and handled accordingly. If passwords are used, the contractor shall use the same password throughout the course of the evaluation.

OIG will notify the contractor of any deficiencies or problems with the work performed. The contractor will have 2 business days to correct any deficiencies or problems.

Unless otherwise agreed to by the COR, the work shall be completed in accordance with the schedule outlined in the COR-approved workplan.

To wrap-up the evaluation, upon completion of the technical analysis, the contractor shall develop written potential findings. Potential findings shall include the vulnerabilities identified, known as condition; criteria; the root cause(s) of the vulnerabilities, as appropriate; the effects(s) of vulnerabilities; and viable recommendations to address the root causes, if identified, and the conditions themselves. The OIG COR/task monitor(s) will be available to work with the contractor to assure each element is fully developed and that recommendations are viable.

The contractor shall vet each potential finding with responsible Agency officials before the exit conference.

Task 2.4 – Technical Report, Discussion Paper, and Exit Conference

In accordance with the Schedule of Deliverables, the contractor shall provide a (1) technical report and (2) evaluation report, as discussed below:

➢ Technical Report – The purpose of this technical report is to provide information to responsible

Agency officials in remediating or mitigating vulnerabilities identified during the evaluation.

This report must contain detailed information about the vulnerabilities, listed by criticality, including where the vulnerabilities are located and the technical fix, if available. This report shall include an analysis of each vulnerability and the techniques used to validate them. This report will not be released to the public and, therefore, may contain Sensitive But Unclassified information—but must be marked as such in the document header and footer. Nonetheless, the contractor shall not restrict the use or distribution of the technical report, unless agreed to in writing by the OIG COR. The file format must be Microsoft Word compatible.

➢ Discussion Paper – The discussion paper must contain the findings, as described in Task 2.3, after vetting them with cognizant Agency officials. Using a template that OIG will provide, it must be written with sufficient explanations and definitions of technical terms so that non-technical readers at the fifth-grade level can understand the vulnerabilities reported.

Ultimately, the contents of the discussion paper will be published in an OIG evaluation report and will be made available on the OIG’s external public-facing website. Therefore, to the extent possible, the report must not contain sensitive but unclassified information, such as internet protocol addresses and system names, thus enabling a reader to try exploiting the vulnerabilities. If not possible to write the report without sensitive information, it will be redacted before it is published on the OIG’s website. The file format must be Microsoft Word compatible and must not be locked or otherwise protected preventing the COR from using the contents as needed. Moreover, the contractor shall not restrict the use or distribution of the discussion paper.

The discussion paper shall include the following sections:

• Background – Shall include all significant criteria and definitions.

• Summary of Results – Shall include:

o Explanation of why this evaluation was performed.

o Evaluation objectives.

o Answer to evaluation objectives.

o Discussion of positive findings.

o High-level summary of negative findings and recommendations.

• Detailed Findings – This section shall contain details about the negative findings.

Specifically, this section must provide a descriptive title at the beginning of each finding and identify the criteria, condition, root cause of the condition, effect of the condition, and recommendation(s) to address the root cause and, if appropriate, condition.

• Appendix I – (Reserved for Scope and Methodology)

• Appendix II – (Reserved for USAID’s management comments on the report.)

The contractor shall address all comments provided by the COR prior to finalizing the discussion paper. After COR-acceptance, the contractor shall provide the COR-accepted discussion paper to Agency officials for distribution.

As specified in the Schedule of Tasks/Deliverables, the contractor shall conduct an exit conference with OIG and Agency officials, as determined by the COR, to discuss the evaluation results and to answer questions.

As specified in the Schedule of Tasks/Deliverables, the contractor shall provide a revised discussion paper that incorporates any changes needed based on discussions at the exit conference.

Task 2.5 – Draft Evaluation Report and Certification Contractor Followed Its Work Plan

The contractor shall work in close consultation with the COR to prepare and deliver, by the timeframe specified in the Schedule of Deliverables, a completed draft report on the evaluation results. The contractor’s report file shall not be locked, thereby allowing the OIG to revise and add comments to it, as needed. The contractor shall include the following sections in the draft report:

• Background (from final post-exit conference COR-accepted discussion paper)

• Summary of Results – (from final post-exit conference COR-accepted discussion paper)

• Detailed Evaluation Findings – (from final post-exit conference COR-accepted discussion paper, except negative evaluation findings (areas of non-compliance) must be non-Sensitive But Unclassified.4 The findings must incorporate updates, as needed, based on discussions at the exit conference and additional follow-up, if applicable.

• Appendix I – Scope and Methodology – A discussion of the scope and methodology used to answer the evaluation objective. If other appendices not listed above are needed, this will be the appendix immediately before management comments. The COR will prepare this section, but the contractor will review it for accuracy.

• Appendix II – (Reserved for USAID’s management comments on the report. If other appendices not listed above are needed, this will be last.)

Appendix VII of this scope of work identifies the report quality factors that the OIG COR will use in reviewing the evaluation report. However, the COR may make other comments, as needed. The contractor shall address all comments provided by the COR.

The contractor shall revise the report to address the COR’s comments and, if provided, the OIG editor’s and policy reviewer’s comments until OIG’s issuance of the draft report.

By the timeframe specified in the Schedule of Deliverables, the contractor shall also provide a written, certification signed by the most senior engagement official that the contractor followed its COR-approved work plan in planning, fieldwork, and reporting on (through draft report phase) its penetration testing and vulnerability assessment for the evaluation, including an assertion that the contractor followed its system of quality control plan, as specified in the BPA call proposal.

Finally, the contractor shall respond to OIG’s questions and requests for clarification through the OIG’s issuance of the official draft report to USAID.

Task 2.6 – Final Evaluation Report

The contractor shall work in close consultation with the COR to prepare and deliver to the COR by the timeframe specified in the Schedule of Deliverables a completed final report.

The final report shall include all the requirements in the draft report and shall also include the following:

4 This report must not contain Sensitive But Unclassified (SBU) information so it can be made available to the public via the OIG’s external Website. However, the Agency is responsible for determining what information is considered to be SBU. To the extent possible, without losing the elements of the finding, the contractor must remove SBU information from the report—which is normally achieved by eliminating system names.

• Summary – Update the summary that was in the draft report to summarize the status of the current year recommendations.

• Evaluation of Management Comments– The contractor shall evaluate USAID’s management comments on the draft report, including requests for closure of recommendations. (Note see Appendix VIII for guidance.

• Completed Appendix III – Shall have the full-text (Word version) of USAID’s official management comments on the draft evaluation report. To the extent possible, the format and layout of those comments must be preserved. (To be compliant with Section 508 of the U.S. Workforce Rehabilitation Act of 1973, as amended, a picture of the PDF version is not acceptable.)

The contractor shall not restrict the use or distribution of the report, unless agreed to in writing by the OIG COR. In addition, the OIG will be required to include its official, signed transmittal letter in the PDF file with the contractor’s official signed final report. Therefore, the contractor’s report file may not be locked to prevent OIG from making that addition. Also, because the report will be published on the OIG’s external website, it must be compliant with Section 508 of the U.S.

Workforce Rehabilitation Act of 1973, as amended. Finally, the contractor shall not require the OIG to date its report transmittal memo the same date of the contractor’s report, unless otherwise agreed to by the COR.

Before acceptance, the final evaluation report shall address all COR comments until OIG’s issuance of the final report. (See Report Quality Factors in Appendix VII.) The electronic form of the final report must be in Microsoft Word.

Finally, the contractor must respond to OIG’s questions and requests for clarification through the OIG’s issuance of the official final report to USAID.

Task 2.7 – Lessons Learned and Areas for Further Review

The contractor shall prepare and deliver to the COR, by the timeframe specified in the Schedule of Deliverables:

• A discussion of any lessons (administrative or evaluation specific) that the contractor learned that will help with the completion of future similar work.

• A discussion of areas of concern that should be reviewed in future evaluations or audits.

This discussion shall include the potential impact of the concern and benefit of the work.

Task 3 – Evaluate Requests for Closure of Prior FISMA Recommendations

In accordance with the schedule of deliverables, and only when and to the extent tasked by the OIG COR, the IPA must follow up on a maximum of 10 recommendations in the final evaluation report, Task 2.6. Such follow-up may include reviewing recommendation closure requests that USAID previously submitted but closure was rejected.

That follow-up will include reviewing USAID’s request for OIG to close a recommendation, including Agency’s action taken as described in its request and the supporting documentation. If needed, that work may include conducting targeted scanning and analyses to determine whether the vulnerabilities identified were mitigated. Alternatively, the work may include working with Agency officials to review the results of their scanning. In addition, that follow-up must include requesting and reviewing additional information from Agency officials, if needed to fully understand the actions that the Agency took in response to the recommendation.

For each request for Agency recommendation closure request, the contractor shall prepare a memorandum including the OIG’s official evaluation report number, full text of the official recommendation in the evaluation report, and an explanation of (1) what actions the Agency took in response to the recommendation and (2) why the Agency’s actions taken did or did not fully address the recommendation. Further, if the actions taken did not fully address the recommendation, the memorandum must explain what additional actions the Agency must take to close it. The memo must be addressed to the OIG’s Director, Information Technology Audits Division; contain the company’s logo; and be signed by Senior Cybersecurity Professional (key personnel) for this BPA call.

For each request for recommendation follow up from the OIG COR, the contractor must submit a price estimate to complete the request that includes the number of hours for each labor category involved, the prevailing call order labor rate, and the total estimated price. This must be approved by the COR prior to the start of any recommendation follow up work. If the number of hours expended will exceed the approved estimate, the contractor must notify the COR and submit a revised estimate.