Combined_Synopsis_Solicitation_PEO_CSCSS_RMF_Training.pdf

Combined Synopsis and Solicitation

W56HZV-19-R-L611

PEO CS&CSS RMF Training

I. INTRODUCTION

A. This is a combined synopsis/solicitation for commercial items prepared in accordance with the format in Subpart 12.6, as supplemented with additional information included in this notice. This announcement constitutes the only solicitation; quotations are being requested and a written solicitation will not be issued.

B. The combined synopsis and Request for Quotation (RFQ) number is: W56HZV- 19-R-L611

C. This solicitation document and incorporated provisions and clauses are those in effect through Federal Acquisition Circular FAC 2005-94 Effective 19 Jan 2017.

D. Small Business Set-Aside: Yes

E. Posting Date: 30 May 2019

F. Response Date: 07 June 2019

G. Contracting Office: Army Contracting Command - Warren (ACC-WRN) 6501 E.

Eleven Mile, Warren, MI 48397.

Contract Specialist: Elida Kellezi, email: elida.kellezi.civ@mail.mil

H. The provision at FAR 52.212-1 Instructions to Offerors – Commercial, as modified by

52.212-4003 below, applies to this acquisition. The NAICS code applicable to this acquisition is 611430. Offeror must be certified under this NAICS code prior to receiving an award. This solicitation will result in only one (1) award.

I. BASIS FOR AWARD: Lowest Price, Technically Acceptable, Brand Name or Equal.

Award will be made to the vendor whose quote is the lowest evaluated price among all technically acceptable quotes.

J. SUBMISSION OF QUESTIONS:

Any questions regarding this Request for Quote (RFQ) and the Site Visit must be received by June 3, 2019 at 1400 hrs. (2:00 PM EST). Questions shall be submitted by email to contract specialist at elida.kellezi.civ@mail.mil . Responses to questions are not considered changes to the RFQ as the only way the RFQ can be modified is through an amendment that will be issued. Oral explanations or instructions given before the award http://farsite.hill.af.mil/reghtml/regs/far2afmcfars/fardfars/far/12.htm#P263_45123 mailto:elida.kellezi.civ@mail.mil mailto:elida.kellezi.civ@mail.mil of a contract will not be binding. Upon receipt of questions, the Government will provide answers to all questions by email. Contractors will be notified if an extension is needed to respond to the questions submitted.

A. Submission Due Date: All Quotes are due by Friday, 07 June 2019 at 1600hrs (4:00 PM Eastern Standard Time). All responses received within this time frame will be considered by the government. Responses shall be submitted electronically to elida.kellezi.civ@mail.mil concerning this acquisition. Offeror must be registered in System for Award Management (SAM) prior to receiving an award. Refer to website https://www.sam.gov/portal/public/SAM/.

II. REQUIREMENT

B. The Program Executive Office Combat Support (PEO CS&CSS) in Warren, Michigan has a requirement for the following:

The contractor is to provide hands-on, lab driven Risk Management Framework (RMF) training to PEO CS&CSS organization. We are looking to award a base year with two option years.

Location: Class will be held at Defense Acquisition University in Sterling Heights, 38219 Mound Rd Sterling Heights, MI 48310 from August 5-9, 2019. A classroom has been reserved for this event.

TASK ORDER NO.:

CLIN: REV.: N/A DATE:

CONTRACT NO.:

CONTRACT REFERENCE:

CONTRACTOR:

PROJECT TITLE: Risk Management Framework (RMF) Training

START DATE: 5 August 2019 COMPLETION DATE: 9 August 2019

Base Year:

CLIN 0001, Description, TOTAL DOLLARS: $

Option Year One:

CLIN 1001, Description, TOTAL DOLLARS: $

Option Year Two:

CLIN 2001, Description, TOTAL DOLLARS: $

C. Delivery and Acceptance:

F.O.B. DESTINATION

https://www.sam.gov/portal/public/SAM/

D. This acquisition is unrated under the Defense Priorities and Allocations System (DPAS).

PERFORMANCE WORK STATEMENT (PWS)

The contractor shall provide hands-on, lab driven Risk Management Framework (RMF) training for five consecutive days during the week of August 5-9, 2019. The classes will be 8 hours each to include a 1 hour lunch and breaks as required for a total of 40 hours. The training will be conducted at the DAU facility in Sterling Heights, Michigan as no charge to the contractor. Overheads, laptops & Internet connectivity will be provided by DAU. Classes will accommodate up to 25 students from various Army Programs of Record (POR) in our PEO CS&CSS organization who are responsible for acquisition of materials that have components subject to the RMF. The target audience for this training will have minimum RMF knowledge or no knowledge at all. The offeror will provide the students material in accordance with the Section “References” to include slides and workbooks used for the course.

I. The course will cover the following topics of NIST Special Publication 800-37/CNSS

Instruction 1253:

Prepare Step Prepare carries out essential activities at the organization, mission and business process, and information system levels of the enterprise to help prepare the organization to manage its security and privacy risks using the Risk Management Framework.

Categorize Step Categorize the system and the information processed, stored, and transmitted by that system based on an impact analysis1.

Select Step Select an initial set of baseline security controls for the system based on the security categorization;

tailoring and supplementing the security control baseline as needed based on organization assessment of risk and local conditions2 .

Implement Step Implement the security controls and document how the controls are deployed within the system and environment of operation3.

See appropriate NIST publication in the publications section.

Assess Step Assess the security controls using appropriate procedures to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security requirements for the system.

Authorize Step

Authorize system operation based upon a determination of the risk to organizational operations and assets, individuals, other organizations and the Nation resulting from the operation of the system and the decision that this risk is acceptable 4.

Monitor Step Monitor and assess selected security controls in the system on an ongoing basis including assessing security control effectiveness, documenting changes to the system or environment of operation, conducting security impact analyses of the associated changes, and reporting the security state of the system to appropriate organizational officials 5.

References:

1. The RMF categorize step, including consideration of legislation, policies, directives, regulations, standards, and organizational mission/business/operational requirements, facilitates the identification of security requirements. FIPS 199 provides security categorization guidance for non-national security systems. CNSS Instruction 1253 provides similar guidance for national security systems.

2. NIST Special Publication 800-53 Revision 4 provides security control selection guidance for non-national security systems. CNSS Instruction 1253 provides similar guidance for national security systems.

3. NIST Special Publication 800-53A Revision 4 provides security control assessment procedures for security controls defined in NIST Special Publication 800-53.

4. NIST Special Publication 800-37 Revision 2 provides guidance on authorizing system to operate.

5. NIST Special Publication 800-37 Revision 2 provides guidance on monitoring the security controls in the environment of operation, the ongoing risk determination and acceptance, and the approved system authorization to operated status.

I. ENTERPRISE MISSION ASSURANCE SUPPORT SERVICE (eMASS) Training (in conjunction with the steps above as to how to apply eMASS to each RMF:

In addition, vendor shall provide training on the use of ENTERPRISE MISSION ASSURANCE SUPPORT SERVICE (eMASS) which is a government-owned, commercial off the-shelf tool that will automate a broad range of services for comprehensive, fully-integrated information assurance (IA) management at the DoD component level. eMASS is created to store, track and manage the activities of the Certification & Accreditation process (and/or risk management framework steps). It is managed on the NIPR & SIPR. This is what is contained in a typical EMASS repository for a system that requires RMF:

• System Registration

• Security Controls and Test Results

• Artifacts

• Asset Manager

• Plan of Action and Milestones (POA&M)

We are looking for a training vendor that has developed an eMASS simulation tool that allows our students to utilize and become familiar with one of the most difficult components of the RMF process: submitting to eMASS and having the submitted content accepted. The eMASS simulation tool shall be provided along with the quote.

Using the eMASS simulator, students will learn how eMASS works. The offeror will teach them how to set up roles, submit packages, reject packages, accept packages and finally approve each other. The outcome is that the students will become very familiar with working with eMASS in automating the C&A process, management of workflow among users, and generating reports.

The vendor must allow students to login to the vendor’s simulator to perform this training.

III. SOLICITATION PROVISIONS AND CONTRACT CLAUSES

The following provisions and clauses apply to this Combined Synopsis/Solicitation:

CLAUSES INCORPORATED BY REFERENCE:

52.203-19 Prohibition on Requiring Certain Internal JAN 2017

Confidentiality Agreements or Statements 52.204-9 Personal Identity Verification of Contractor JAN 2011

Personnel 52.204-13 System for Award Management Maintenance OCT 2016 52.204-19 Incorporation by Reference of Representations and DEC 2014

Certifications.

52.212-4 Contract Terms and Conditions--Commercial Items JAN 2017 52.212-5 (Dev) Contract Terms and Conditions Required to JAN 2017

Implement Statutes or Executive Orders-- Commercial Items (Deviation 2013-O0019)

52.223-18 Encouraging Contractor Policies To Ban Text AUG 2011 Messaging While Driving

52.225-13 Restrictions on Certain Foreign Purchases JUN 2008 52.232-33 Payment by Electronic Funds Transfer--System for JUL 2013 Award

Management 252.204-7006 Billing Instructions OCT 2005 252.204-7012 Safeguarding Covered Defense Information and OCT 2016 Cyber

Incident Reporting

252.204-7015 Notice of Authorized Disclosure of Information for MAY 2016 Litigation Support

252.215-7000 Pricing Adjustments DEC 2012 252.225-7012 Preference For Certain Domestic Commodities DEC 2016 252.204-7015 Notice of Authorized Disclosure of Information to MAY 2016

Litigation Support Contractors.

252.225-7048 Export-Controlled Items JUN 2013 252.232-7010 Levies on Contract Payments DEC 2006 252.243-7001 Pricing Of Contract Modifications DEC 1991 252.246-7000 Material Inspection And Receiving Report MAR 2008 252.247-7023 Transportation of Supplies by Sea APR 2014

CLAUSES INCORPORATED BY FULL TEXT:

52.201-4000 (TACOM) WARREN OMBUDSPERSON (April 2011) Information regarding the TACOM-Warren Ombudsperson is located at the website http://contracting.tacom.army.mil/acqinfo/ombudsperson.htm.

52.204-4016 (TACOM) WARREN ELECTRONIC CONTRACTING (AUG 2015)

(a) All Army Contracting Command – Warren (DTA) solicitations will be publicized on the Federal Business Opportunities website (https://www.fbo.gov). Any additional attachments, including Technical Data Packages (TDPs) when available electronically, will be separate attachments or links embedded in the solicitation.

(b) As of 10 August 2015, unless directed to do otherwise in Section L of this solicitation, vendors are required to submit a quote or proposal via the Federal Business Opportunities (FBO) system. Proposals or quotes submitted after this date using any other mechanism, including the Army Single Face to Industry Bid Response System (ASFI BRS) may be deemed non-responsive.

(c) Requirements for the online FBO bid submission:

1. Vendors must log into the FBO System to be able to submit electronic responses for opportunities.

2. Vendors must be registered in the System for Award Management (SAM) at www.sam.gov (a Federal Government owned and operated free web site) and have a CAGE Code and CCR Marketing Partner Identification Number (MPIN).

3. Once logged into the FBO System, vendors will be asked to enter basic information and directed to upload one or more files containing the proposal/quote and any additional information as outlined in the solicitation.

4. FBO will send an email to vendor’s registered email address confirming the electronic submission.

http://contracting.tacom.army.mil/acqinfo/ombudsperson.htm

5. For additional information on submitting electronic bid responses via the FBO system see the FBO Vendor Guide – Section 4.3.1 “Submitting an Electronic Response” (https://www.fbo.gov/downloads/FBO_Vendor_Guide.pdf).

(d) Note to offerors:

Please pay close attention to the solicitation closing date and time as stated on the cover page of this solicitation, local time for the Army contracting Command - Warren, (DTA), Michigan. In accordance with FAR 15.208(a), offerors are responsible for submitting proposals, and any revisions, and modifications, so as to be received by the Government office designated in the solicitation by the time specified.

It is the responsibility of the Offeror to ensure the proposal/quote is received by the date and time specified on the cover page of this solicitation. In accordance with FAR 15.208, if the proposal/quote was not received at the initial point of entry to the Government infrastructure (in this case, received through FBO) by the exact date and time specified on the cover page of this solicitation, it will be determined late. Proposal/quote is defined to mean ALL volumes or parts required in the solicitation are included in the electronic submission.

Note: There is no "expected" or "target" length of time for proposal submission; size and content may be factors, therefore offerors are strongly cautioned when submitting proposals to allow adequate time for submission.

Solicitations may remain posted on the FBO after the solicitation closing date. If the response deadline has passed for the solicitation, vendors will no longer be able to submit electronic responses.

(e) Any award issued as a result of this solicitation will be distributed electronically. In the event of a FOIA request for a copy of any award issued as a result of this solicitation, or any subsequent modifications to the contract, the contract and modifications will be released, including the awarded unit price. This is the notice required by Executive Order 12600 (June 23, 1987) of our intention to release unit prices in response to any request under the Freedom of Information Act (FOIA), 5 USC 552. Unit price is defined as the contract price per unit or item purchased as it appears in Section B of the contract and is NOT referring to nor does it include Cost or Pricing data/information. If you object to such release in the base contract or contract modifications, and you intend to submit an offer, notify the contracting officer in writing prior to the closing date identified in this solicitation and include the rationale for your objection consistent with the provisions of FOIA. A release determination will be made based on rationale given.

(f) Questions pertaining to this solicitation should be directed to the Contract Specialist identified in Block 10 on the cover page of this solicitation. For technical assistance in doing business with the Government, and doing business electronically, please visit the Procurement Technical Assistance Center (PTAC) website at http://www.aptac-us.org/ to locate a regional center.

[End of Notice]

52.204-4020 (TACOM)

ACCESS AND GENERAL PROTECTION/SECURITY POLICY AND PROCEDURES

(MAR 2015)

a. The contractor and all associated subcontractors’ employees shall comply with applicable installation, facility, and area commander installation and facility access and local security policies and procedures (provided by the Government representative). The contractor shall also provide all information required for background checks to meet installation access requirements to be accomplished by the installation Provost Marshal Office, Director of Emergency Services, or Security Office. The contractor workforce must comply with all personal identity verification requirements (FAR clause 52.204-9 “Personal Identity Verification of Contractor Personnel”) as directed by DoD, HQDA, and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes.

b. For contractors requiring Common Access Card (CAC). Before CAC issuance, the contractor employee requires, at a minimum, a favorably adjudicated National Agency Check with Inquiries (NACI) or an equivalent or higher investigation in accordance with Army Directive 2014-05, The contractor employee will be issued a CAC only if duties involve one of the following: (1) Both physical access to a DoD facility and access, via logon, to DoD networks on-site or remotely; (2) Remote access, via logon, to a DoD network using DoD-approved remote access procedures; or (3) Physical access to multiple DoD facilities or multiple non-DoD federally controlled facilities on behalf of the DoD on a recurring basis for a period of six (6) months or more. At the discretion of the sponsoring activity, an initial CAC may be issued on a favorable review of the FBI fingerprint check and a successfully scheduled NACI at the Office of Personal Management (see clause 52.204-4600 “Trusted Associate Sponsorship System (TASS) Program”).

c. For contractors that do not require CAC, but require access to a DoD facility or installation.

Contractor and all associated sub-contractors employees shall comply with adjudication standards, and procedures using the National Crime Information Center Interstate Identification Index (NCIC-III) and Terrorist Screening Database (TSDB) (Army Directive 2014-05/AR 190- 13), applicable installation, facility and area commander installation/facility access and local security policies and procedures (see provision (TACOM) 52.215-4405 “Access to the Detroit Arsenal; Identifying Contractor Employees; Non-disclosure Statement”), or at OCONUS locations, in accordance with Status of Forces Agreement and other theater regulations.

(End of Clause)

52.204-4023 (TACOM) NOTICE OF ELEVATED THREAT LEVEL FORCE

PROTECTION CONDITION (FPCON) (JUN 2016)

Contractor is hereby notified that there is a potential impact on contractor performance on during increased FPCON during periods of increased threat. During FPCONs Charlie and Delta, services may be discontinued / postponed due to higher threat. Services will resume when FPCON level is reduced to level Bravo or lower.

52.204-4024 (TACOM) NOTICE OF RANDOM ANTITERRORISM MEASURES

PROGRAM (RAMP)

In accordance with AR 525-13, Contractor personnel working on an Army installation, arsenal, base or other DoD facility (owned or leased by DoD/Department of the Army), are subject to participation in Installation RAMP security program (e.g. vehicles searches, wearing of ID badges, etc).

52.209-4011 (TACOM) Contractor Responsibility and Eligibility for Award (JUL 2016)

(a) The Government will award a contract to the offeror that:

(1) submits the lowest evaluated offer if award is based on price only, or the offer that provides the best value to the Government if factors in addition to price are identified elsewhere in this solicitation, and

(2) submits a bid or proposal that meets all the material requirements of this solicitation, and

(3) meets all the responsibility criteria at FAR 9.104.

(b) To make sure that an offeror meets the responsibility criteria at FAR 9.104 the Government may:

(1) arrange a visit to the offeror’s plant and perform a preaward survey;

(2) ask the offeror to provide financial, technical, production, or managerial background information.

(c) If the offeror does not provide the Government with the data requested within 7 days from the date the requested is received, or if the offeror refuses to have an onsite visit to the offeror’s facility, the Government may determine the offeror to be nonresponsible.

(d) If the Government visits the offeror’s facility, please make sure that current certified financial statements and other data relevant to the bid or proposal available for Government personnel to review.

(End of Provision)

52.209-4020 (TACOM) ANTI-TERRORISM (AT) LEVEL I TRAINING REQUIREMENT

(JUL 2014)

All contractor employees, including subcontractor employees, requiring access to Army installations, facilities, or controlled access areas shall complete AT Level I awareness training within [XX]*** calendar days after contract start date or effective date of incorporation of this requirement into the contract, whichever applies. The contractor shall submit certificates of completion for each contractor employee and subcontractor employee requiring access to Army installations, facilities, or controlled access areas to the COR (or to the contracting officer, if a COR is not assigned) within [XX]*** calendar days after completion of training. AT Level I awareness training is available at https://jkodirect.jten.mil Course #JS-US007-14.

52.212-4003 (TACOM) ALL OR NONE-COMMERCIAL ITEM ACQUISITION

(SEP 1996)

https://jkodirect.jten.mil/

This provision serves as an addendum that modifies paragraph (h) of FAR 52.212-1, entitled INSTRUCTIONS TO OFFERORS--COMMERCIAL ITEMS. Paragraph (h) is modified to say that you must offer to provide the total quantity of the items in this solicitation.

ONLY ONE AWARD WILL BE MADE AS A RESULT OF THIS SOLICITATION. OFFERS

SUBMITTED FOR LESS THAN THE TOTAL QUANTITIES OF ALL THE ITEMS IN THIS

SOLICITATION WILL NOT BE CONSIDERED FOR AWARD.

[End of Clause]

52.214-4000 (TACOM) Acknowledgements of Amendments (OCT 1993)

Acknowledge all the amendments you've received from us by identifying the amendment number and its issue date in the box below:

: Amendment Number : Date :

[End of Provision]

52.233-4001 (TACOM) HQ-AMC Level Protest Procedures (OCT 2013)

Complete AMC Protest Procedures can be found at:

http://www.amc.army.mil/amc/commandcounsel.html

An agency protest may be filed with either the contracting officer or to HQAMC but not both following the procedures listed on the website above.

[End of Clause]

DFARS CLAUSES INCORPORATED BY FULL TEXT:

252.232-7003 Electronic Submission of Payment Requests and Receiving Reports (JUN 2012)

(a) Definitions. As used in this clause— http://www.amc.army.mil/amc/commandcounsel.html

(1) “Contract financing payment” and “invoice payment” have the meanings given in section 32.001 of the Federal Acquisition Regulation.

(2) “Electronic form” means any automated system that transmits information electronically from the initiating system to all affected systems. Facsimile, e-mail, and scanned documents are not acceptable electronic forms for submission of payment requests. However, scanned documents are acceptable when they are part of a submission of a payment request made using Wide Area WorkFlow (WAWF) or another electronic form authorized by the Contracting Officer.

(3) “Payment request” means any request for contract financing payment or invoice payment submitted by the Contractor under this contract.

(4) “Receiving report” means the data required by the clause at 252.246-7000, Material Inspection and Receiving Report.

(b) Except as provided in paragraph (c) of this clause, the Contractor shall submit payment requests and receiving reports using WAWF, in one of the following electronic formats that WAWF accepts: Electronic Data Interchange, Secure File Transfer Protocol, or World Wide Web input. Information regarding WAWF is available on the Internet at https://wawf.eb.mil/.

(c) The Contractor may submit a payment request and receiving report using other than WAWF only when—

(1) The Contracting Officer administering the contract for payment has determined, in writing, that electronic submission would be unduly burdensome to the Contractor. In such cases, the Contractor shall include a copy of the Contracting Officer’s determination with each request for payment;

(2) DoD makes payment for commercial transportation services provided under a Government rate tender or a contract for transportation services using a DoD-approved electronic third party payment system or other exempted vendor payment/invoicing system (e.g., PowerTrack, Transportation Financial Management System, and Cargo and Billing System);

(3) DoD makes payment for rendered health care services using the TRICARE Encounter Data System (TEDS) as the electronic format; or

(4) When the Governmentwide commercial purchase card is used as the method of payment, only submission of the receiving report in electronic form is required.

(d) The Contractor shall submit any non-electronic payment requests using the method or methods specified in Section G of the contract.

(e) In addition to the requirements of this clause, the Contractor shall meet the requirements of the appropriate payment clauses in this contract when submitting payment requests.

http://www.acq.osd.mil/dpap/dars/dfars/html/current/252246.htm https://wawf.eb.mil/

(End of clause)

252.232-7006 WIDE AREA WORKFLOW PAYMENT INSTRUCTIONS (MAY 2013)

(a) Definitions. As used in this clause--

Department of Defense Activity Address Code (DoDAAC) is a six position code that uniquely identifies a unit, activity, or organization.

Document type means the type of payment request or receiving report available for creation in Wide Area WorkFlow (WAWF).

Local processing office (LPO) is the office responsible for payment certification when payment certification is done external to the entitlement system.

(b) Electronic invoicing. The WAWF system is the method to electronically process vendor payment requests and receiving reports, as authorized by DFARS 252.232-7003, Electronic Submission of Payment Requests and Receiving Reports.

(c) WAWF access. To access WAWF, the Contractor shall--

(1) Have a designated electronic business point of contact in the System for Award Management at https://www.acquisition.gov; and

(2) Be registered to use WAWF at https://wawf.eb.mil/ following the step-by-step procedures for selfregistration available at this Web site.

(d) WAWF training. The Contractor should follow the training instructions of the WAWF Web-Based Training Course and use the Practice Training Site before submitting payment requests through WAWF. Both can be accessed by selecting the “Web Based Training” link on the WAWF home page at https://wawf.eb.mil/.

(e) WAWF methods of document submission. Document submissions may be via Web entry, Electronic Data Interchange, or File Transfer Protocol.

(f) WAWF payment instructions. The Contractor must use the following information when submitting payment requests and receiving reports in WAWF for this contract/order:

(1) Document type. The Contractor shall use the following document type(s).

Combo / Invoice

(2) Inspection/acceptance location. The Contractor shall select the following inspection/acceptance location(s) in WAWF, as specified by the contracting officer.

W56HZV

(3) Document routing. The Contractor shall use the information in the Routing Data Table below only to fill in applicable fields in WAWF when creating payment requests and receiving reports in the system.

Routing Data Table* Field Name in WAWF Data to be entered in WAWF Pay Official DoDAAC HQ0490 Issue By DoDAAC W56HZV Admin DoDAAC W56HZV Inspect By DoDAAC Ship To Code Mark For Code

(4) Payment request and supporting documentation. The Contractor shall ensure a payment request includes appropriate contract line item and subline item descriptions of the work performed or supplies delivered, unit price/cost per unit, fee (if applicable), and all relevant back-up documentation, as defined in DFARS Appendix F, (e.g. timesheets) in support of each payment request.

(5) WAWF email notifications. The Contractor shall enter the email address identified below in the “Send Additional Email Notifications” field of WAWF once a document is submitted in the system.

(g) WAWF point of contact. (1) The Contractor may obtain clarification regarding invoicing in WAWF from the following contracting activity's WAWF point of contact.

Charles Maves Elida.kellezi.civ@mail.mil 586-282-2611

(2) For technical WAWF help, contact the WAWF helpdesk at 866-618-5988.

(End of clause)

PERFORMANCE WORK STATEMENT (PWS)