SOW_ZeroFox_SaaS_2AUG2018.docx

UNCLASSIFIED

SOW Social Media Impostor Mitigation Solution

Statement of Work (SOW) For Social Media Impostor Mitigation Solution 2 August 2018

PART 1

GENERAL INFORMATION

1.1 Description of Services/Introduction: The contractor must be capable and authorized to provide ZeroFox Software-as-a-Service (Saas), providing a worldwide web-based access social media impostor mitigation service required for use in criminal investigations and the other missions conducted by the US Army Criminal Investigation Command (USACIDC). Administration of the service will be done from the Computer Crime Investigative Unit, (CCIU), USACIDC, Quantico, VA, with users located throughout the US and overseas where there is a CCIU presence. There should be the capability to set up a small number of individual user accounts with the ability for the solution to automatically search for and present impostors for up to 50 entities.

1.2 Background: The USACIDC is the premier Military Criminal Investigative Organization (MCIO) within the Department of Defense (DoD) and is responsible for conducting worldwide felony criminal investigations anywhere there is an US Army interest. Among the other missions, the USACIDC also conducts the protective services mission for senior DoD officials, logistics security and major procurement fraud, computer crimes involving US Army networks and computers, and sensitive investigations involving senior US Army personnel and sensitive classified projects. The USACIDC is also the executive agency for the DoD Criminal Investigative Task Force (CITF) which is tasked with the investigation of alleged war crimes and acts of terrorism committed against US interests.

ZeroFox is a (SaaS) that provides the capability to query, identify and provide an alert to the following social media sites: Facebook, Google+, Twitter, LinkedIn, YouTube, and Instagram, along with other advanced data sources (Tumblr, Reddit, Deep/Dark Web and non-U.S. based programs (e.g. VK, Webo)). ZeroFox has pre-existing agreements with social media organizations that will enable the capability to successfully identify fictitious accounts and content removal from advanced data sites. The ZeroFox platform incorporates a risk rating of identified imposter accounts by identifying accounts utlizig the name, image, biography or combination of the protectee. The Graphic User Interface (GUI) offers a filtering functionality of profiles by last name, first name, rank, date, personal and professional biography, and social media venue.

1.3 Objectives: To acquire ZeroFox Software-as-a-Service (SaaS) solution that provides secure and legal social media impostor account identification and mitigation. ZeroFox is a cloud-based (SaaS) solution that supports the organizations’ ability to quickly unlock the value of social media and big data to address threat actors utilizing fictitious accounts as cover for criminal activity.

1.4 Scope: The contractor must provide the following specifications in the required ZeroFox SaaS Solution:

Technical Acceptability Criteria:

-The SaaS must be web based. No hardware or software to install.

-The capability/solution shall be a fully functional COTS capability and ready to begin to accept and enroll user profiles and enable required feature/function one (1) day after the contract is awarded.

-The capability/solution must have the ability to query, identify and provide an alert to the following social media sites: Facebook, Google+, Twitter, LinkedIn, YouTube, and Instagram, along with other advanced data sources (Tumblr, Reddit, Deep/Dark Web and non-U.S. based programs (e.g. VK, Webo)). The capability/solution shall be responsible for any, agreements with the required social media organizations that will enable the capability to perform successfully and handle the mitigation of accounts.

-The service should be 28 CFR Part 23 compliant.

Dashboard/user interface:

-The capability must have the functionality to view all identified accounts in one location. The Graphic User Interface (GUI) needs to be easy to use and to understand.

-Filtering functionality of profiles by last name, first name, rank, date, personal and professional biography, and social media venue.

-Drill down functionality for individual incident or alert by entity name, profile URL/unique identifier, date, social media venue, picture and malicious links.

-Ability to create a repository of known photographs for protectees.

-Risk rating of entity record.

-Malicious link or virus attributes data associate to discovered alerts.

-Hash tagging search, trending, and analysis capability (discovery of malicious activity).

-Discovery that includes name, rank, and picture of discoverable asset.

-Bulk reporting buttons and features.

Discovery:

-includes functional workflow for removal and remediation of discovered entities.

-whitelisting capability to convert false positives into whitelisted accounts that fall off the alert list.

-ability to identify which discovered profiles contain malware or malicious links and redirects within each affected profile.

-tracking of offending profiles by escalating risk rating, over time, including automatic reevaluation for risk of profiles originally deemed low/no risk.

Reports/Reporting:

-functional, highly flexible customizable reporting feature allowing the manipulation of field data to be excluded or included in each report (e.g. time and date stamps of found alerts, priority, comparable risk rating criteria, malware indication, last name, rank, first name, social media site, platform specific identifiers, status including but not limited to closed, open, whitelist, reported for deletion etc.)

-customizable executive level reports, exportable by the customer in Adobe Acrobat .pdf and Microsoft Excel .xls formats containing desired/required information (e.g. last name, rank, social media site, risk level).

-must have trending and analytical data available for further analysis by the customer. (e.g. bar charts, graphs, line charts, showing date/site/alert identifying trending and analysis of data).

-bulk reporting buttons and features automating the submission for identified “impersonators”.

Remediation:

-include functional workflow process(es) to remediate alerts once government personnel complete human review and categorize alert profile as fake, fraudulent, or malicious. Remediation for the purposes of this document means that the alerted profile has been deleted by the social media site.

-response time for reported Impersonation accounts is 4 weeks from the first day of reporting by the customer.

-must have business agreements, processes and relationships in place for fictitious account removal from the following included but not limited to sites: Facebook, Google+, Twitter, LinkedIn, YouTube, and Instagram.

-must have business agreements, processes and relationships in place for fictitious account and content removal from advanced data sites.

-must contain training materials.

Service Level Agreement (SLA):

-Technical Helpdesk Support must be provided to Government users 24hr/7days/365.

-System uptime of 99.97% and shall inform the CCIU designated representative(s) (e.g. the Contracting Officer’s Representative, “COR”) in writing no less than 2 weeks prior to any scheduled maintenance or planned outages that may degrade or interrupt service or user access to the system.

-The capability shall be accessible to the Government user 24hr/7days/365 (web-based).

1.5 Period of Performance: The period of performance for this SOW is from date of award through 1 year thereafter, with 3 (1-year) options that may extend the cumulative term of contract to 4 years.

1.6 Place of Performance:

1.7 Delivery/Acceptance: Web-based access will be provided and accessible 24/7/365 upon the date of contract award.

1.8 Quality Assurance: N/A

1.9 Type of Contract: The government anticipates award of a firm-fixed price (FFP) type contract.

1.10 Security Requirements: There are no physical security requirements as the contractor will have no government property and all transactions will be conducted in a web-based environment.

1.11 Physical Security. N/A

1.12 Key Control. N/A

1.13 Special Qualifications: N/A

1.14 Contract Manager/Point of Contact: The contractor shall provide a contract manager/point of contact that shall be responsible for the performance of the work. The name of this person and an alternate who shall act for the contractor when the manager is absent shall be designated in writing to the contracting officer. The contract manager or alternate shall have full authority to act for the contractor on all contract matters relating to daily operation of this contract.

PART 2

GOVERNMENT FURNISHED PROPERTY, EQUIPMENT, AND SERVICES

2.1 General: N/A

PART 3

CONTRACTOR FURNISHED ITEMS AND SERVICES

3.1 General: The contractor shall provide the necessary labor, equipment and material required to perform this contract to include a monthly usage report to be provided via email to the requiring activity or via US mail to CCIU, USACIDC, Attn: Deputy Dir - Support, Russell-Knox Building, 27130 Telegraph Road, Quantico, VA 22134. The monthly usage report should include the total usage for all users as well as detailed usage information for all users under the contract.

PART 4

SPECIFIC TASKS

4.1 Standard Services: The contractor shall provide technical/helpdesk support via phone, email and/or online support seven days a week and 24 hours a day.

PART 5

ARMY ELECTRONIC INVOICING INSTRUCTIONS

5.1 Invoice Instructions: IAW Department of Defense Federal Acquisition Regulations (DFARS) 252.232-7003, Electronic Submission of Payment Request, please submit all invoices using the Wide Area Work Flow (WAWF) online database system. To become a registered user, go to https://wawf.eb.mil. Additionally, training for WAWF, may be obtained by visiting http://wawftraining.com/.

PART 6

ATTACHMENT/TECHNICAL EXHIBIT LISTING

6.1 Attachment/technical exhibits applicable to this SOW are listed below.

N/A.

PROCUREMENT SENSITIVE - UNCLASSIFIED