VDP DRAFT PWS.pdf

Vulnerability Disclosure Policy Platform in support of:

Cybersecurity and Infrastructure

Security Agency (CISA)

SECTION C – STATEMENT OF WORK

PAGE C-1

C.1 BACKGROUND

The Cybersecurity and Infrastructure Security Agency (CISA) is the Nation’s risk advisor, working with partners to defend against today’s threats and collaborating to build more secure and resilient infrastructure for the future. In this role, CISA builds the national capacity to defend against cyber-attacks and works with the federal government to provide cybersecurity tools, incident response services and assessment capabilities to safeguard the Federal civilian

Executive Branch (FCEB) ‘.gov’ networks that support the essential operations of partner departments and agencies.

CISA recently released draft Binding Operative Directive (BOD) 20-01, which identifies the requirement that each FCEB agency develop and publish a vulnerability disclosure policy (VDP) and maintain supporting handling procedures for identified vulnerabilities. Vulnerability disclosure policies enhance the resiliency of the government’s online services by encouraging meaningful collaboration between federal agencies and the public. During development of draft

BOD 20-01, CISA identified that many FCEB agencies currently lack a formal mechanism to receive information from third parties about potential security vulnerabilities on IT systems and have no defined strategy for handling such reports about issues shared by outside parties.

In support of these FCEB agencies, CISA requires access to an existing, commercially available

Software as a Service (SaaS) platform that will provide FCEB agencies a centralized vulnerability disclosure policy platform (”Platform”). The Platform will be centrally managed by the CISA Cybersecurity Quality Services Management Office (QSMO) and is intended to support FCEB agencies by providing a standard approach to accept vulnerability submissions from a network of security researchers, validating submitted reports, and providing validated reports to FCEB agency stakeholders for resolution on-Platform.

C.2 SCOPE

The scope of this contract is to provide CISA and participating FCEB agencies access to an existing, commercially available SaaS platform, termed the Platform, which will be a managed central platform to facilitate the submission and tracking of vulnerabilities discovered in internet-accessible information systems, termed FCEB systems. of the FCEB agencies, including

Independent Agencies and all Boards, Commissions, and Committees (CFO ACT and Non-CFO

Act Agencies). In addition, the Platform shall provide agencies the ability to provide financial incentives (termed “bug bounties”) for valid submissions as an optional functionality.

Participation in the Platform will be voluntary for FCEB agencies, and therefore the platform needs to scale to support a potentially varying number of agencies at any time. FCEB agencies currently participating in the Platform are captured in the FCEB Agencies List (Section J, Attachment A). The FCEB Agencies List will be updated throughout the period of performance of this contract.

The Platform service provider , termed “Service Provider”, shall provide the Government with project management support services including robust platform reporting, security authorization support, and managing the administration and operation of the platform, including its security.

The service provider shall provide triage services that ensure submitted vulnerability reports are valid and provided to the impacted FCEB agency. The service provider shall assist agencies that desire a bug bounty program with the means to facilitate financial payment to vulnerability reporters who submit valid reports for FCEB agency systems.

PAGE C-2

Remediation of identified vulnerabilities on FECB systems is the responsibility of the appropriate FCEB agency, and not the service provider or CISA.

C.3 PLATFORM TECHNICAL REQUIREMENTS

The Platform shall facilitate the management of vulnerabilities discovered in FCEB systems by security researchers. Figure 1: Platform Overview below presents a high-level overview of the reporting process and potential process flow for a reported vulnerability:

Figure 1: Platform Overview

The following subsections provide the Platform technical requirements for system functionality, system interfaces, bug bounty functionality, and platform user expectations.

C.3.1 PLATFORM FUNCTIONALITY

The Platform’s intended functionality shall, at a minimum, include the following:

Key point of entry for vulnerability reporters to alert the government of potential issues on FCEB systems for those agencies that participate on platform.

Clear way to track reported vulnerabilities and link reports that are related by reporter, vulnerability type, or other purpose.

PAGE C-3

Web-based communication mechanism between the reporter and the agency.

Allows agency users to create and manage role-based accounts for their organization or suborganizations.

Allows stakeholders to view reported vulnerabilities and update their status as the issues are managed and resolved.

Offers an application programming interface (API) to take various actions on vulnerability reports or pull metrics.

Metrics and reports to CISA and FCEB agencies.

Alerts to the reporter and agency users on updates, as well as to CISA based on events of interest, metrics approaching or hitting defined thresholds, etc. These alerts should be configurable in the user interface and available via API.

Permits participating FCEB agencies to add or remove FCEB systems at any time during the period of performance.

C.3.2 PLATFORM INTERFACES

The Platform shall provide the following interfaces:

Web application

Provide users (vulnerability reporters, agencies, CISA) direct access to the platform feature set.

Allow reporters to submit vulnerabilities, track submissions and their status, and maintain communication (as they choose).

Allow agencies to manage submissions and view summary statistics.

Allows CISA to adjudicate submissions where the agency is unknown (or has been unresponsive), view statistical data and trends, run reports, export data, and view agency submissions.

Email

Notifications and alerts of submissions and updates can be emailed to the userbase from the platform (submission details are not included in the email). For example:

o Agencies are alerted on newly created tickets and updates, reporters are notified on ticket updates and closures.

o CISA is alerted when certain defined thresholds are met (ticket unresolved for

X days, agency accumulating more than X reports without action, etc.).

API

Allow automated application-level communications between the platform and an external application like an agency issue tracking system, via an API.

PAGE C-4

o This could, for example, automatically create a ticket in agency system once a report is submitted in the platform, or update the platform when the agency ticket is updated, etc.

C.3.3 BUG BOUNTY FUNCTIONALITY

The Platform shall include the ability for agencies to provide bug bounties (financial incentives) for valid submissions. Agencies will be responsible for funding and operating their own bug bounty programs. CISA does not intend to fund a bug bounty program for FCEB agencies. In support of the bug bounty functionality the Platform shall perform the following:

Allow FCEB agencies to post bounty amounts, on specific systems or services, and share instructions on the bounty program, Facilitate payment to security researchers for valid vulnerability submission that is eligible for a bounty. Agencies would have ultimate authority to determine that a report is valid and meets criteria for payment.

C.3.4 PLATFORM USER EXPECTATIONS

Platform user expectations include the following::

Vulnerability Reporters

Have a clear place to report vulnerabilities in FCEB systems without a requirement to need to know which specific agency or component manages the FCEB system.

Can share updates and receive updates with an agency.

Can create an account and profile.

Can log into their account to track submissions and their status.

Can be notified by e.g., email of a change in a report’s status (if desired).

Allow reporters to earn recognition or “points” for the valid reports they have submitted.

Federal Civilian Executive Branch (FCEB) Agencies

Each agency maintains a profile in the platform. FCEB agency superusers can manage their agency profile and their own users, granting and revoking access permissions (e.g. user can edit, user can only read). By logging into the platform interface, agency users can see an agency dashboard with the list of submissions

(open/closed) and general statistics.

The platform allows agencies to communicate with reporters to request more information or to verify that a vulnerability has been fixed.

Upon reporter’s submission of a vulnerability, the agency is notified (e.g., via email or via the use of the platform API hooked into the agency’s own issue tracking system). The agency can update the submission’s status via platform interface or API.

Once the vulnerability is triaged, the agency can update or close the submission, an

PAGE C-5

action that triggers a notification to the reporter.

CISA

Manages the administration of agency superuser credentialing to the system.

Maintains insight into disclosure activities but does not actively participate in each disclosure remediation process. CISA at a minimum has read-only access to all agency reports and can view aggregate statistical data and reports.

Obtains alerts when pre-defined thresholds are met (e.g. reports are not responded to, vulnerabilities are not remediated within a number of days, etc.).

Platform Service Provider

Responsible for hosting and managing the platform, including reporting and administrative responsibilities, CISA and FCEB user management, technical support, and maintaining the security of the platform in alignment with Federal and

Department of Homeland Security requirements that authorize the system to operate.

Provide screening and initial triage of submissions, validating that it appears to be a real weakness displayed in the system and routes to relevant FCEBagency.

Assist agencies with establishing a bug bounty program and facilitating payments to security researchers’ payments

C.4 TASKS

The service provider shall perform the following tasks:

Task 1: Manage, Operate, and Administer the Platform

Task 2: Triage, Route, and Track Vulnerability Reports

Task 3: Facilitate Bug Bounty Program

C.4.1 TASK 1 – MANAGE, OPERATE, AND ADMINISTER THE PLATFORM

The service provider shall provide project management services under this contract that support the successful integration of the Platform with Federal requirements and objectives. This includes ensuring the platform achieves and maintains an Authorization to Operate (ATO), participating agencies are seamlessly onboarded/offboarded from the platform, and tailored operational reports are accurate and easily assessable through the Platform itself.

The service provider shall notify the General Services Administration (GSA) Contracting Officer

(CO) and CISA Contracting Officer’s Representative (COR) of any technical, financial, personnel, Organizational Conflict of Interest (OCI), or general managerial problems encountered throughout the period of performance.

C.4.1.1 SUBTASK 1.1 – CONDUCT A PROJECT KICK-OFF MEETING

The service provider shall conduct a Kick-Off Meeting (Section F, Deliverable 01) following contract award. The meeting will provide an introduction between the service provider personnel and Government personnel. The meeting will provide the opportunity to discuss necessary technical and administrative activities associated with execution of the contract.

PAGE C-6

The Project Kick-Off Meeting Agenda shall include, at a minimum, the following topics/deliverables:

a. Introduction of team members:

1. Roles and responsibilities

2. Lines of communication overview between the service provider and Government.

b. Summary of technical approach:

1. Overview of the platform and its ability to meet technical requirements of C.3.

2. Approach to satisfying requirements of Tasks 1-3.

c. Contract Administration:

1. Reporting requirements

2. Security requirements

3. Sensitivity and protection of information.

4. Invoice Requirements

5. Additional administrative items including press/news releases.

C.4.1.2 SUBTASK 1.2 – OPERATE AND ADMINISTER THE PLATFORM

The service provider shall operate and administer the Platform, including providing the hosting and management for the platform, conducting all administrative responsibilities, provide account and user management for CISA and FCEB agencies, and providing all relevant technical support to ensure FCEB agencies are sufficiently supported during platform usage.

The service provider shall coordinate with CISA, as the Government POC for the Platform on all aspects of its operation. This shall include, but is not limited to the following:

Assist CISA with establishing criteria for categorizing submitted vulnerabilities.

Establish role-based user accounts for the CISA stakeholders

Provide CISA with the ability to manage the administration of superuser credentials.

Automate Platform system alerts for CISA when predefined thresholds are met (e.g., agency accumulates X number of unresolved submissions, submissions reach X number of days without agency update, etc.).

The Platform service provider shall provide onboarding support to FCEB agencies participating in the Platform. This support shall include at minimum the following:

Providing training materials (Section F, Deliverable 02) to agencies that document vulnerability reporting process through the Platform, operational reports available through the Platform, and FCEB agency responsibilities

Establish role-based user accounts for the FCEB agency.

Assist agencies in establishing routing techniques (e.g. email or API).

Create an agency specific page that lists all FCEB system in scope of the agency’s VDP.

Ensure that the Platform is updated to account for inclusion of a new FCEB, and that service provider staff are versed in an agency’s VDP.

PAGE C-7

Communicate to security researchers that an FCEB agency has been added (or added additional FCEB systems) and provide clear direction consistent with the agency’s VDP on reporting security vulnerabilities on agency’s internet facing systems.

The service provider shall ensure all vulnerability report records all available throughout the period of performance.

In some instances Agencies may elect to conduct its own triage and tracking of submitted vulnerabilities, and thus not utilize the service provider services under Task 2. Participating

FCEB agencies that opt-out of triage services will be denoted in the FCEB Agencies List

(Section J, Attachment A).

If during the period of performance an FCEB agency decides to no longer participate in the

Platform, the COR will inform the service provider, and the service provider shall remove all references to the FCEB agency from the Platform and work with the agency to handle disposal of vulnerability records. Any agency that no longer participates in the platform will be removed from the FCEB Agencies List (Section J, Attachment A).

C.4.1.3 SUBTASK 1.3 – MAINTAIN SECURITY OF THE PLATFORM

The service provider shall ensure that the Platform receives a CISA ATO, and then ensure that the ATO is maintained throughout any future system upgrades. The Platform’s anticipated initial

Federal Information Processing Standard (FIPS) 199 rating is Low Confidentiality, Low

Integrity, and Low Availability. This anticipated rating assumes the service provider is able to effectively segregate data in the platform to ensure that only the instantiation of the service attributed to this requirement is accredited, and that any vulnerability reporter data captured in this instantiation is minimized. In addition, this anticipated rating does not include the optional bug bounty functionality, and activation of the of the optional bug bounty functionality could potential revise the FIPS rating and result in changes to the ATO.

The service provider shall ensure the Platform maintains a system security authorization following the most recent revision of National Institute of Science and Technology (NIST)

Special Publication (SP) 800-37 Guide for Applying the Risk Management Framework to

Federal Information Systems: A Security Life Cycle Approach, NIST SP 800-53 Security and

Privacy Controls for Federal Information Systems and Organizations and DHS Sensitive

Systems Policy Directive 4300A and related DHS or CISA security policies and guidance.

The service provider shall support CISA in conducting a security assessment of the Platform through drafting of deliverables (e.g. System Security Plan (SSP)), providing artifacts and screenshots, and making system personnel available for interviews during the security assessment process. The Government desires that the ATO be completed as soon as possible after contract award.

In support of the security accreditation process of the Platform, the service provider shall perform the following:

a. Provide all the required documentation for the security authorization process (e.g., system description, system architecture, security control, POA&Ms, etc.) (Section F, Deliverable 03). This includes, but is not limited to the generation of additional security documentation to satisfy NIST 800-53 and DHS 4300A requirements.

PAGE C-8

b. Remediate all security findings and create of Plans of Action and Milestones (POA&Ms) and/or waivers, as appropriate.

c. Ensure DHS and/or CISA security requirements are met including, but not limited to, regular delivery of vulnerability scans, asset management activities, POA&Ms, and/or waiver remediation activities.

d. Support, as required, a Government provided Security Operation Center (SOC), and incident response activities such as investigative, remediation, and removal tasks, as appropriate.

e. Support Security Test and Evaluation/Security Assessment activities by ensuring availability of the technical team personnel for interviews and artifact collections as required.

For any updates to the Platform, the service provider shall update the Security

Authorization Package (Section F, Deliverable 03) and deliver updates as necessary to maintain the system ATO.

C.4.1.4 SUBTASK 1.4 – PROVIDE REPORTING ON THE PLATFORM

The service provider shall provide tailored Platform operational reports (Section F, Deliverable

04) through the Platform to CISA and FCEB agencies ona monthly basis. Platform operational reports shall be tailored to relevant stakeholders and include, at a minimum, the following:

Number of vulnerability reports

Number of reported vulnerabilities determined to be valid (e.g., in scope and not false-positive)

Number of currently open and valid reported vulnerabilities

Number of currently open and valid reported vulnerabilities older than 90 days from the receipt of the report

Median time to validate a submitted report

Median time to remediate/mitigate a valid report

Median time to initially respond to the reporter

Bug bounty metrics for Agencies opting for a bug bounty program.

C.4.2 TASK 2 – TRIAGE, ROUTE, AND TRACK VULNERABILITY REPORTS

The service provider shall provide triage, routing, and tracking support of submitted vulnerabilities for FCEB agencies participating in the Platform that have elected to receive triaging services as noted in the FCEB Agencies List (Section J, Attachment A).

The service provider shall screen all submitted vulnerabilities and triage to ensure that only valid vulnerability reports are routed to the appropriate FCEB agency for resolution. As part of the triage services, the service provider shall, at a minimum, provide the following:

Ensure that submitted vulnerability reports are consistent with FCEB agency VDP and are for a relevant FCEB system

PAGE C-9

Screen submitted vulnerabilities for obvious errant reports (“noise filtering”) and false positives

De-duplicate vulnerability reports submissions

Evaluate potential severity to an organization and provide severity rating classification

Following effective triaging of a submitted vulnerability report, the service provider shall route the valid vulnerability reports to the appropriate FCEB stakeholders. The Platform service provider should ensure the security researchers are notified of a valid vulnerability report and assist in facilitating communication between the FCEB agency and relevant security researcher.

Throughout the submission, triage, and routing process, the service provider shall ensure that the

Platform is positioned to report on the status of any vulnerability report to CISA and impacted

FCEB agency.

C.4.3 TASK 3 – FACILITATE BUG BOUNTY PROGRAM (OPTIONAL)

As addressed in Section C.3.4, the Platform shall include optional functionality for FCEB agencies to establish a bug bounty program to incentivize/reward security researchers for identifying valid vulnerabilities. FCEB agencies can elect to establish bug bounty programs by utilizing the optional CLINs on this contract.

For Agencies that elect to establish a bug bounty program, the service provider shall, at a minimum, provide the following:

Guidance to an FECB agency on establishing a sufficient pool of funding to support bug bounty.

Support to an FCEB agency in targeting certain systems for bug bounties

Manage payment to security researchers for valid vulnerability reports following effective triage in Task 2.

Report to FCEB agency on valid vulnerability reports that have resulted in a financial award, the amount of the award, and the name of the security researcher.

SECTION D – QUALITY ASSURANCE AND ACCEPTABLE CRITERIA

PAGE D-1

D.1. QUALITY ASSURANCE AND ACCEPTABLE CRITERIA

The Government will establish and maintain a Quality Assurance Surveillance Plan (QASP) for work accomplished under this contract. The QASP will be based under the following standards and acceptable quality levels (AQL)s:

Deliverable or

Service

Performance

Standard

Acceptable Quality

Level

Method of

Surveillance

Vulnerability Reports

Average time to assign toFCEB

Agency

95% assigned/tagged within 1 business day

Timestamps within platform and information included in monthly report

Vulnerability Reports Average time-to-triage initial reports

95% triaged within 1 business day

Timestamps within platform and information included in monthly report

Vulnerability Reports Minimal escalations

No more than 1% of reports result in escalations

Escalations observed via email, platform-specific escalation features, or other out-of-band communication

SECTION E – DELIVERABLES

PAGE E-1

E.1 PERIOD OF PERFORMANCE

The period of performance for this contract is a 12-month base period followed by four, 12-month option periods.

Base Period: TBD at award

First Option Period: TBD at award

Second Option Period: TBD at award

Third Option Period: TBD at award

Fourth Option Period: TBD at award

E.2 CONTRACT DELIVERABLES

The following abbreviations are used in this schedule:

DEL: Deliverable

All references to days: Government Workdays

Deliverables are due the next Government workday if the due date falls on a holiday or weekend.

The service provider shall deliver the deliverables listed in the following table on the dates specified:

DEL. # DELIVERABLE

CONTRACT

REFERENCE

DUE DATE

01 C.4.1.1 Kick-Off Meeting Within 10 workdays of contract award

02 C.4.1.2 Training Materials

Within 10 workdays of FCEB agency being added to FCEB

Agencies List

03 C.4.1.3 Security Authorization

Documentation

As soon as possible after contract award

04 C.4.1.4 Platform Operational

Reports

Updated regularly in the Platform

SECTION F – INVOICE REQUIREMENTS

PAGE F-1

F.1 INVOICING INSTRUCTION

In order to allow effective payment management, the service provider shall follow all instructions. Failure to follow invoice submission instructions or invoice requirements may result in delay of payment or rejection of the service provider’s invoice.

F.2 INVOICE SUBMISSION

The service provider is required to submit invoices according to block 24 of the GSA Form 300 or Block 18a of the Form 1449.

This electronic invoicing is in lieu of submission via U.S. Mail. Hard copy invoices will not be accepted. The website above provides registration/password instructions. Questions can be directed to GSA Finance Customer Support at FW-ClientServices@GSA.Gov or call (800) 676-

3690.

In addition, the service provider is required to upload a copy of its invoice, including all backup documentation into ITSS to facilitate prompt payment. The service provider shall provide invoice backup data in accordance with section 5.2 Invoice Requirements. 4

ITSS is GSA FAS’s business systems portal. The invoice and ITSS process/registration shall be required for proper invoice submission to GSA.

F.3 INVOICE REQUIREMENTS

Invoices shall be submitted in accordance with the Price Schedule described in Attachment 2. All invoices shall identify the specific contract line item number (CLIN), description of related task as stated in the scope of work of this task order, the billing rate and any applicable units executed. Invoices shall be submitted on an individual basis for requirements as defined in the

SOW. Invoices shall be submitted on a monthly basis and are required to be submitted in a timely manner. Invoices that do not meet the minimum requirements shall be rejected.

(a) Invoices shall be submitted as an original only, unless otherwise specified, to the designated billing office specified in this order.

(b) Invoices must include the Accounting Control Transaction (ACT) number provided in the order.

(c) In addition to the requirements for a proper invoice specified in the Prompt Payment clause of this contract, the following information or documentation must be submitted with each invoice:

GSA Contract Number: To be provided at award Task Order Number: To be provided at award ITSS Project Number: XXXXXXX ACT Number: To be provided at award Project Title: Vulnerability Reporting Platform Description: Task #, CLIN #, PoP

(d) GSA IT-Solutions Shop (ITSS) includes input fields such as invoice number, POC information for who submitted the invoice. service provider shall include backup information for any subcontracting in spreadsheet form identifying the dollar amount of invoices submitted that

SECTION F – INVOICE REQUIREMENTS

PAGE F-2

were subcontracted and how many of those dollars were subcontracted to small business and any other socioeconomic program under FAR Part 19.

F.3.1 FIRM FIXED PRICE (FFP) INVOICE REQUIREMENTS

The service provider may invoice monthly on the basis for CLIN x001 in 12 equal payments based on the yearly price.

F.3.2 TIME AND MATERIAL (T&M) INVOICE REQUIREMENTS

The service provider may invoice monthly on the basis of cost incurred for the T&M CLIN x002. The invoice shall include the PoP covered by the invoice and the CLIN number and title.

All costs shall be reported by CLIN element. The service provider shall provide supporting information in spreadsheet form. The listing shall include separate columns and totals for the current invoice period and the project to date. The spreadsheet shall include the following detailed information:

1. Number of reports triaged during the period by agency

2. Monthly and total cumulative reports triaged

3. Monthly Cost incurred for the quantity of reports triaged with clear traceability to band price discounting

F.3.3 OPTIONAL CLIN NTE CR

The service provider may invoice monthly on the basis of cost incurred for the CLIN x003. The invoice shall include the PoP covered by the invoice and the CLIN number and title. In addition, the service provider shall provide the following supporting information for each invoice submitted, as applicable:.

1. Bug Bounty paid by submission

2. Monthly and cumulative bug bounties paid.

SECTION G – CONTRACT ADMINISTRATION

PAGE G-1

G.1 ROLES AND RESPONSIBILITIES

Identification of all government personnel, including their specific roles and responsibilities:

G.1.1 CONTRACTING OFFICER

xxxxxx GSA FAS

Telephone Number:

Electronic Mail:

Responsibility for contracting activities rests solely with the Government Contracting Officer. No conversation, recommendations, or direction, whether given directly by, or implied by Government personnel, that will affect the scope, schedule, or price of the program covered by this solicitation or any resulting contract, shall be acted upon by the Contractor unless specifically approved by the Government

Contracting Officer. In the absence of the assigned CO, any GSA Region 8 CO may fill in and has full authority to act on this task order.

G.1.2 CONTRACTING SPECIALIST

xxxxxx GSA FAS

Telephone Number:

Electronic Mail:

As a member of the contract administration team, the contract specialist will be responsible for working in concert with the Contracting Officer while performing post award administrative functions and certain assigned pre-award functions.

G.1.3 CONTRACTING OFFICER’S REPRESENTATIVE (COR)

TBD, DHS

Telephone Number: TBD

Electronic Mail: TBD

CONTRACTING OFFICER'S REPRESENTATIVE (DEC 1991)

(a) Definition. “Contracting officer's representative” means an individual designated in accordance with subsection 201.602-2 of the Defense Federal Acquisition Regulation Supplement and authorized in writing by the contracting officer to perform specific technical or administrative functions.

(b) If the Contracting Officer designates a contracting officer's representative (COR), the Contractor will receive a copy of the written designation. It will specify the extent of the COR's authority to act on behalf of the contracting officer. The COR is not authorized to make any commitments or changes that will affect price, quality, quantity, delivery, or any other term or condition of the contract.

SECTION M – EVALUATION FACTORS

PAGE M-1

H.1 KEY PERSONNEL

The following are the minimum personnel who shall be designated as “Key.”

a. Project Manager (PM)

H.1.1 PROJECT MANAGER (PM)

The service provider shall provide a Project Manager as the primary point of contact for the government’s program office to enable timely problem resolution, reporting in a timely manner.

The service provider will be expected to work with the CO/COR, CISA and FCEB agencies.

If any individual proposed as Key Personnel becomes unavailable during the course of the solicitation and evaluation process, the service provider shall notify the CO immediately. Any

Key Personnel proposed who are not currently employed by the service provider shall be identified as such and an the letter shall be signed by the proposed Key Person and shall state that (1) the proposed Key Person named is employed by the offeror or has an offer of employment from the offeror that the Key Person intends to accept in the event of an award being made to the offeror; and (2) the proposed Key Person is available and committed to begin work on the project start date.

The service provider agrees that through the duration of the base period of performance of the contract, no Key Personnel substitutions shall be made unless necessitated by an individual’s sudden illness, death, or termination of employment for cause. In any of such event, the service provider shall promptly notify the CO/COR and provide the information required by paragraphs below on the proposed replacement for Government approval.

All requests for substitutions/additions of Key Personnel must include a detailed explanation of the circumstances necessitating the proposed substitution or addition. As determined by the CO, all proposed substitutes/additions must have qualifications that meet or exceed the qualifications of the person to be replaced.

The CO/COR will evaluate the request(s) for substitutions/additions of Key Personnel and the

CO will notify the service provider, in writing, of approval or disapproval. Disapproval of the proposed individual(s) shall not provide grounds for non-performance by the service provider or form the basis of any claim for monies, delivery schedule extension, or any other equitable adjustment.

Key Personnel must have a full understanding of the technical approach discussed in Section C requirements and delivered by the service provider after award.

Key Personnel will be a direct liaison to the CO/COR. Key Personnel shall be responsible for the supervision and management of the all personnel, technical assistance, and interface.