Solicitation_W56JSR-17-R-0004.pdf

SOLICITATION, OFFER AND AWARD 1. This Contract Is A Rated Order Under

DPAS (15 CFR 700)

Rating Page of Pages

2. Contract Number 3. Solicitation Number 4. Type of Solicitation 5. Date Issued 6. Requisition/Purchase Number Sealed Bid (IFB)

Negotiated (RFP)

7. Issued By Code 8. Address Offer To (If Other Than Item 7)

NOTE: In sealed bid solicitations ‘offer’ and ‘offeror’ mean ‘bid’ and ‘bidder’.

SOLICITATION

9. Sealed offers in original and copies for furnishing the supplies or services in the Schedule will be received at the place specified in item 8, or if handcarried, in the depository located in until (hour) local time (Date).

Caution - Late Submissions, Modifications, and Withdrawals: See Section L, Provision No. 52.214-7 or 52.215-1. All offers are subject to all terms and conditions contained in this solicitation.

10. For Information A. Name B. Telephone (No Collect Calls) C. E-mail Address

Call: Area Code Number Ext.

11. Table Of Contents

(X) Sec. Description Page(s) (X) Sec. Description Page(s)

Part I - The Schedule Part II - Contract Clauses A Solicitation/Contract Form I Contract Clauses

B Supplies or Services and Prices/Costs Part III - List Of Documents, Exhibits, And Other Attach.

C Description/Specs./Work Statement J List of Attachments D Packaging and Marking Part IV - Representations And Instructions E Inspection and Acceptance K Representations, Certifications, and F Deliveries or Performance Other Statements of Offerors G Contract Administration Data L Instrs., Conds., and Notices to Offerors H Special Contract Requirements M Evaluation Factors for Award

OFFER (Must be fully completed by offeror) NOTE: Item 12 does not apply if the solicitation includes the provisions at 52.214-16, Minimum Bid Acceptance Period.

12. In compliance with the above, the undersigned agrees, if this offer is accepted within _____ calendar days (60 calendar days unless a different period is inserted by the offeror) from the date for receipt of offers specified above, to furnish any or all items upon which prices are offered at the price set opposite each item, delivered at the designated point(s), within the time specified in the schedule.

13. Discount For Prompt Payment 10 Calendar Days (%) 20 Calendar Days (%) 30 Calendar Days (%) Calendar Days (%) (See Section I, Clause No. 52.232-8)

14. Acknowledgment of Amendments (The offeror acknowledges Amendment No. Date Amendment No. Date receipt of amendments to the SOLICITATION for offerors and related documents numbered and dated):

15A. Name and Code Facility 16. Name and Title of Person Authorized to Sign Offer Address of (Type or Print) Offeror

15B. Telephone Number 15C. Check if Remittance Address is 17. Signature 18. Offer Date Area Code Number Ext. Different From Above – Enter such

Address In Schedule

AWARD (To be completed by Government)

19. Accepted As To Items Numbered 20. Amount 21. Accounting And Appropriation

22. Authority For Using Other Than Full And Open Competition: 23. Submit Invoices To Address Shown In Item

10 U.S.C. 2304(c)( ) 41 U.S.C. 253(c)( ) (4 copies unless otherwise specified)

24. Administered By (If other than Item 7) Code 25. Payment Will Be Made By Code

26. Name of Contracting Officer (Type or Print) 27. United States Of America 28. Award Date

(Signature of Contracting Officer)

IMPORTANT - Award will be made on this Form, or on Standard Form 26, or by other authorized official written notice.

AUTHORIZED FOR LOCAL REPRODUCTION Standard Form 33 (Rev. 9-97) Previous edition is unusable Prescribed By GSA-FAR (48 CFR) 53.214(c)

W56JSR-17-R-0004

X

DOA7

SEE SCHEDULE

W56JSR

ACC-APG Division E (W56JSR)

6001 Combat Drive

APG, MD 21005-1846

JOHNNY SCHULTZ

(443)861-4862

CCAP-CCE

JOHNNY.R.SCHULTZ.CIV@MAIL.MIL

ARMY CONTRACTING CMD APG

10205 BURBECK RD

FORT BELVOIR, VA 22060-5863

1 69

X 1

X 3 X 13

X 30 X 31

X 32

X 34

X 37

X 53

X 54

X 60

X 67

CONTINUATION SHEET

Reference No. of Document Being Continued Page of

Name of Offeror or Contractor:

PIIN/SIIN MOD/AMD

SECTION A - SUPPLEMENTAL INFORMATION

Buyer Name: JOHNNY SCHULTZ

Buyer Office Symbol/Telephone Number: CCAP-CCE/(443)861-4862

Type of Contract 1: Firm Fixed Price

Type of Contract 2: Cost Plus Fixed Fee

Kind of Contract: Service Contracts

*** End of Narrative A0000 ***

2 69

Name of Offeror or Contractor:

PIIN/SIIN MOD/AMD

SECTION B - SUPPLIES OR SERVICES AND PRICES/COSTS

B.1 Contract types on task orders and/or contract line item numbers (CLINs) may include Firm-Fixed-Price (FFP), Cost-Plus-Fixed-Fee

(CPFF) and Cost No Fee (CNF).

*** END OF NARRATIVE B0001 ***

3 69

PIIN/SIIN

Page of

Name of Offeror or Contractor:

ITEM NO SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

Reference No. of Document Being Continued

MOD/AMD

1001 SIMPLE SYSTEM $ _____________ __________________

See Range Pricing

SERVICE REQUESTED: SOFTWARE CODE ASSESSMENT

CLIN CONTRACT TYPE:

Firm Fixed Price

Range Quantities ________________

FROM TO UNIT PRICE ____ __ __________

1 8 $

9 16 $

17 25 $

CLIN performance shall be in accordance with PWS

Paragraph 3.2 and all subparagraphs.

The CLIN ordering period is 60 months from time of award.

This is a Firm-Fixed-Price (FFP) line item.

(End of narrative B001)

Inspection and Acceptance _________________________

INSPECTION: Destination ACCEPTANCE: Destination

Deliveries or Performance _________________________

1002 MEDIUM SYSTEM $ _____________ __________________

See Range Pricing

SERVICE REQUESTED: SOFTWARE CODE ASSESSMENT

CLIN CONTRACT TYPE:

Firm Fixed Price

Range Quantities ________________

FROM TO UNIT PRICE ____ __ __________

1 8 $

9 16 $

17 25 $

CLIN performance shall be in accordance with PWS

Paragraph 3.2 and all subparagraphs.

The CLIN ordering period is 60 months from date of award.

This is a Firm-Fixed-Price (FFP) line item.

(End of narrative B001)

4 69

Page of

Name of Offeror or Contractor:

ITEM NO SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

Reference No. of Document Being Continued

MOD/AMD

Inspection and Acceptance _________________________

INSPECTION: Destination ACCEPTANCE: Destination

Deliveries or Performance _________________________

1003 COMPLEX SYSTEM $ ______________ __________________

See Range Pricing

SERVICE REQUESTED: SOFTWARE CODE ASSESSMENT

CLIN CONTRACT TYPE:

Firm Fixed Price

Range Quantities ________________

FROM TO UNIT PRICE ____ __ __________

1 8 $

9 16 $

17 25 $

CLIN performance shall be in accordance with PWS

Paragraph 3.2 and all subparagraphs.

The CLIN ordering period is 60 months from date of award.

This is a Firm-Fixed-Price (FFP) line item.

(End of narrative B002)

Inspection and Acceptance _________________________

INSPECTION: Destination ACCEPTANCE: Destination

Deliveries or Performance _________________________

1004 PROGRAM MANAGEMENT $ __________________ __________________

SERVICE REQUESTED: PROGRAM MANAGER POSITION

CLIN CONTRACT TYPE:

Cost Plus Fixed Fee

The Program Manager shall provide Monthly Status

Reports IAW CDRL C003, Performance and Cost Reports

IAW CDRL B001, Meeting Minutes IAW CDRL A003, Status of GFE Reports IAW CDRL C001, create Process and

Procedures IAW CDRL D005, PWS paragraph 3.2 and all sub-paragraphs and Contract Management Reporting

(CMR).

5 69

Page of

Name of Offeror or Contractor:

ITEM NO SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

Reference No. of Document Being Continued

MOD/AMD

The CLIN ordering period is 60 months from date of award.

This is a Cost-Plus-Fixed-Fee (CPFF) line item.

(End of narrative B001)

Inspection and Acceptance _________________________

INSPECTION: Destination ACCEPTANCE: Destination

Deliveries or Performance _________________________

6101 BASIC CLIN FOR EXHIBITS (ELIN) ______________________________

The below ELINs are associated with the Data Item

Numbers on the Contract Data Requirements List (CDRL)

(DD Form 1423), in Section J of this contract.

Under this Contract, each ELIN is numbered according to the Data Item Number found in the CDRL to which that particular ELIN corresponds.

(End of narrative A001)

A001 CONFERENCE, WORKING GROUPS & TRIP REPORTS 1 LO $ ** NSP ** _________________________________________ __________________

SERVICE REQUESTED: DI-ADMN-81308A

Conference, Working Groups & Trip Reports in accordance with PWS Paragraph 3.1.6 and Exhibit A, Data Item A001 within Section J.

(End of narrative B001)

Inspection and Acceptance _________________________

INSPECTION: Destination ACCEPTANCE: Destination

DLVR SCH PERF COMPL

REL CD QUANTITY DATE ________ ______________ __________

001 1 SEE DD FORM 1423

A002 BRIEFING/DEMONSTRATION MATERIAL 1 LO $ ** NSP ** _______________________________ __________________

6 69

Page of

Name of Offeror or Contractor:

ITEM NO SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

Reference No. of Document Being Continued

MOD/AMD

SERVICE REQUESTED: DI-ADMIN-81373

Briefing and Demonstration Material in accordance with PWS Paragraph 3.2.1.7 and Exhibit A, Data Item

A002 within Section J.

(End of narrative B001)

Inspection and Acceptance _________________________

INSPECTION: Destination ACCEPTANCE: Destination

DLVR SCH PERF COMPL

REL CD QUANTITY DATE ________ ______________ __________

001 1 SEE DD FORM 1423

A003 MEETING MINUTES 1 LO $ ** NSP ** _______________ __________________

SERVICE REQUESTED: DI-ADMIN-81505

Meeting Minutes in accordance with PWS Paragraphs

3.2.1.1 & 3.2.1.4 and Exhibit A, Data Item A003 within Section J.

(End of narrative B001)

Inspection and Acceptance _________________________

INSPECTION: Destination ACCEPTANCE: Destination

DLVR SCH PERF COMPL

REL CD QUANTITY DATE ________ ______________ __________

001 1 SEE DD FORM 1423

B001 PERFORMANCE AND COST REPORT 1 LO $ ** NSP ** ___________________________ __________________

SERVICE REQUESTED: DI-FNCL-80912

Performance and Cost Report in accordance with PWS

Paragraph 3.1.5 and Exhibit A, Data Item B001 within

Section J.

(End of narrative B001)

Inspection and Acceptance _________________________

INSPECTION: Destination ACCEPTANCE: Destination

DLVR SCH PERF COMPL

REL CD QUANTITY DATE ________ ______________ __________

001 1 SEE DD FORM 1423

7 69

Page of

Name of Offeror or Contractor:

ITEM NO SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

Reference No. of Document Being Continued

MOD/AMD

C001 STATUS OF GFE REPORTS 1 LO $ ** NSP ** _____________________ __________________

SERVICE REQUESTED: DI-MGMT-80269

Status of GFE Reports in accordance with PWS

Paragraphs 3.1.1 and 3.1.5 and Exhibit A, Data Item

C001 within Section J.

(End of narrative B001)

Inspection and Acceptance _________________________

INSPECTION: Destination ACCEPTANCE: Destination

DLVR SCH PERF COMPL

REL CD QUANTITY DATE ________ ______________ __________

001 1 SEE DD FORM 1423

C002 STATUS REPORT CRITICAL PERSONNEL CHANGE 1 LO $ ** NSP ** _______________________________________ __________________

SERVICE REQUESTED: DI-MGMT-80269

Status Report Critical Personnel Change in accordance with PWS Paragraph 3.1.7 and Exhibit A, Data Item

C002 within Section J.

(End of narrative B001)

Inspection and Acceptance _________________________

INSPECTION: Destination ACCEPTANCE: Destination

DLVR SCH PERF COMPL

REL CD QUANTITY DATE ________ ______________ __________

001 1 SEE DD FORM 1423

C003 MONTHLY STATUS REPORT 1 LO $ ** NSP ** _____________________ __________________

SERVICE REQUESTED: DI-MGMT-80368A

Monthly Status Report in accordance with PWS

Paragraph 3.1.5 and Exhibit A, Data Item C003 within

Section J.

(End of narrative B001)

8 69

Page of

Name of Offeror or Contractor:

ITEM NO SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

Reference No. of Document Being Continued

MOD/AMD

Inspection and Acceptance _________________________

INSPECTION: Destination ACCEPTANCE: Destination

DLVR SCH PERF COMPL

REL CD QUANTITY DATE ________ ______________ __________

001 1 SEE DD FORM 1423

C004 TRAINING EVENTS 1 LO $ ** NSP ** _______________ __________________

SERVICE REQUESTED: DI-MISC-80508B

Training Events in accordance with PWS Paragraph

3.2.1.8 and Exhibit A, Data Item C004 within Section

J.

(End of narrative B001)

Inspection and Acceptance _________________________

INSPECTION: Destination ACCEPTANCE: Destination

DLVR SCH PERF COMPL

REL CD QUANTITY DATE ________ ______________ __________

001 1 SEE DD FORM 1423

D001 AGGREGATED REPORT OF POTENTIAL DEFECTS 1 LO $ ** NSP ** ______________________________________ __________________

SERVICE REQUESTED: DI-MISC-80508B

Aggregated Report of Potential Defects in accordance with PWS Paragraph 3.2.1.3 and Exhibit A, Data Item

D001 within Section J.

(End of narrative B001)

Inspection and Acceptance _________________________

INSPECTION: Destination ACCEPTANCE: Destination

DLVR SCH PERF COMPL

REL CD QUANTITY DATE ________ ______________ __________

001 1 SEE DD FORM 1423

D002 DATA ACCESSION LIST 1 LO $ ** NSP ** ___________________ __________________

SERVICE REQUESTED: DI-MISC-80508B

Data Accession List in accordance with PWS Appendix D

9 69

Page of

Name of Offeror or Contractor:

ITEM NO SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

Reference No. of Document Being Continued

MOD/AMD

and Exhibit A, Data Item D002 within Section J.

(End of narrative B001)

Inspection and Acceptance _________________________

INSPECTION: Destination ACCEPTANCE: Destination

DLVR SCH PERF COMPL

REL CD QUANTITY DATE ________ ______________ __________

001 1 SEE DD FORM 1423

D003 FINAL SOFTWARE ASSURANCE ASSESSMENT REPORT 1 LO $ ** NSP ** __________________________________________ __________________

SERVICE REQUESTED: DI-MISC-80508B

Final Software Assurance Assessment Report in accordance with PWS paragraph 3.2.1.9 and Exhibit A, Data Item D003 within Section J.

(End of narrative B001)

Inspection and Acceptance _________________________

INSPECTION: Destination ACCEPTANCE: Destination

DLVR SCH PERF COMPL

REL CD QUANTITY DATE ________ ______________ __________

001 1 SEE DD FORM 1423

D004 PHASE OUT PLAN 1 LO $ ** NSP ** ______________ __________________

SERVICE REQUESTED: DI-MISC-80508B

Phase Out Plan in accordance with PWS paragraph 3.1.4 and Exhibit A, Data Item D004 within Section J.

(End of narrative B001)

Inspection and Acceptance _________________________

INSPECTION: Destination ACCEPTANCE: Destination

DLVR SCH PERF COMPL

REL CD QUANTITY DATE ________ ______________ __________

001 1 SEE DD FORM 1423

D005 PROCESS AND PROCEDURES 1 LO $ ** NSP ** ______________________ __________________

10 69

Page of

Name of Offeror or Contractor:

ITEM NO SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

Reference No. of Document Being Continued

MOD/AMD

SERVICE REQUESTED: DI-MISC-80508B

Process and Procedures in accordance with PWS paragraph 3.2.1.8 and Exhibit A, Data Item D005 within Section J.

(End of narrative B001)

Inspection and Acceptance _________________________

INSPECTION: Destination ACCEPTANCE: Destination

DLVR SCH PERF COMPL

REL CD QUANTITY DATE ________ ______________ __________

001 1 SEE DD FORM 1423

D006 SUMMARY VIEW OF POTENTIAL DEFECTS 1 LO $ ** NSP ** _________________________________ __________________

SERVICE REQUESTED: DI-MISC-80508B

Summary View of Potential Defects in accordance with

PWS paragraph 3.2.1.3 and Exhibit A, Data Item D006 within Section J.

(End of narrative B001)

Inspection and Acceptance _________________________

INSPECTION: Destination ACCEPTANCE: Destination

DLVR SCH PERF COMPL

REL CD QUANTITY DATE ________ ______________ __________

001 1 SEE DD FORM 1423

D007 TAILORED AGGREGATED REPORT OF POTENTIAL DEFECTS 1 LO $ ** NSP ** _______________________________________________ __________________

SERVICE REQUESTED: DI-MISC-80508B

Tailored Aggregated Report of Potential Defects in accordance with PWS paragraph 3.2.1.3 and Exhibit A, Data Item D007 within Section J.

(End of narrative B001)

Inspection and Acceptance _________________________

INSPECTION: Destination ACCEPTANCE: Destination

DLVR SCH PERF COMPL

REL CD QUANTITY DATE ________ ______________ __________

001 1 SEE DD FORM 1423

11 69

Page of

Name of Offeror or Contractor:

ITEM NO SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

Reference No. of Document Being Continued

MOD/AMD

D008 TAILORED SUMMARY VIEW OF POTENTIAL DEFECTS 1 LO $ ** NSP ** __________________________________________ __________________

SERVICE REQUESTED: DI-MISC-80508B

Tailored Summary View of Potential Defects in accordance with PWS paragraph 3.2.1.3 and Exhibit A, Data Item D008 within Section J.

(End of narrative B001)

Inspection and Acceptance _________________________

INSPECTION: Destination ACCEPTANCE: Destination

DLVR SCH PERF COMPL

REL CD QUANTITY DATE ________ ______________ __________

001 1 SEE DD FORM 1423

7000 ACCOUNTING FOR CONTRACTOR SERVICES 1 LO $ ** NSP ** __________________________________ __________________

SERVICE REQUESTED: CONTRACTOR MANPOWER REPORTING

CLIN CONTRACT TYPE:

Firm Fixed Price

Contracting Manpower Reporting (CMR) shall be in accordance with the PWS paragraph 3.1.9 and Section

J.

Reporting period will be the Period of Performance not to exceed twelve (12) months ending 30 September of each Government fiscal year and must be reported by 31 October of each calendar year.

This not separately priced CLIN shall be used for the collection and reporting of CMR data.

(End of narrative A001)

Inspection and Acceptance _________________________

INSPECTION: Destination ACCEPTANCE: Destination

DLVR SCH PERF COMPL

REL CD QUANTITY DATE ________ ______________ __________

001 1 AS REQUIRED

12 69

Name of Offeror or Contractor:

PIIN/SIIN MOD/AMD

SECTION C - DESCRIPTION/SPECIFICATIONS/WORK STATEMENT

Performance Work Statement (PWS)

For

Software Code Assessment

Table of Contents

C.1 Scope

C.1.1 Background

C.2 Applicable Documents and Websites

C.3 Requirements

C.3.1 General

C.3.1.1 Materials, Equipment and Facilities

C.3.1.2 Security

C.3.1.3 Inspection and Acceptance

C.3.1.4 Phase In and Phase Out

C.3.1.5 Contract Management

C.3.1.6 Travel

C.3.1.7 Personnel Qualifications

C.3.1.8 Work Hours

C.3.1.9 Contractor Manpower Reporting (CMR)

C.3.1.10 Contractor Mandatory Training

C.3.1.11 Formal Reviews

C.3.2 Performance

C.4 Reserved

C.5 Data Rights

C.1 Scope

Communications-Electronics Command (CECOM) Software Engineering Centers (SEC) requirement is to build, through this contract, the capability to provide, as a service for primarily Army Customers, software source code assessment to identify vulnerabilities and to assist Customers in remediating and repairing software code. The goal is to improve the cybersecurity posture of mission systems in a manner that will counter the growing threat to software intensive systems that the Army relies on to accomplish its mission. CECOM SEC aims to accomplish this goal in a fast, economical, and relatively easy to use manner. The future end result will be that the Government has the capability to perform the services internally with Government personnel.

To accomplish this, the Government intends to employ a third party software code analysis tool which will aggregate the results of multiple individual code analysis tools. The requirements to be performed hereunder will cover two basic areas. First is the analysis of the system source code to determine if it is in suitable condition to be processed. If not, it may require that the code be compiled to allow it to be processed. This also covers the operation of the third party software code analysis tool which will perform the analysis and produce a basic report of vulnerability findings. The second requirement is to review these findings and to provide a subsequent report making the findings actionable as it relates to the specific system and customer. It may also include the provision of recommended courses of action for resolution of the findings.

C.1.1 Background

The SECs goal is to improve the cybersecurity of mission applications and mission support systems in a manner that will counter the growing threat to software intensive systems that the Army relies on to meet mission requirements.

The requirement entails the ability to conduct on-site and on-demand software code analytic scans using a suite of commercial, government, and open source software code analyzer tools. The Third Party Software Review shall analyze source code for errors, bugs, coding constructs suspected of introducing vulnerability, to include all coding non-compliance with the Defense Information Systems

Agency (DISA) Application Security & Development Security Technical Implementation Guide (STIG), and all areas prone to failure, violations to published software coding practices, as identified in the DISA STIGs, memory leaks, and dead code using multiple static code analysis tools.

The objective is to provide a quality and accuracy reporting level of at least 90% using multiple tools in order to be well over the approximate 20% accuracy achieved through the use of any single tool.

The Third Party Software Review will be conducted in a Government environment that includes unclassified sensitive or classified up to

SECRET. The code being tested shall not leave the Governments control; therefore, a Software as a Service (SaaS) is not required.

CECOM SEC requires that the vendor provide the capability to take the software code baseline of required systems, ingest the code, and run the code through an automated code review. This capability will begin with the receipt of software from a customer or SEC project lead. Software submitted for static code analysis is required to be in a pre-compiled state. Binary code analysis may be required on code in a post-compiled state. Post-compiled software may be obfuscated or encrypted, depending on the specific system. At the present

13 69

Name of Offeror or Contractor:

PIIN/SIIN MOD/AMD

time, SECs analysis capabilities are focused on static code analysis, although binary and dynamic analysis will be integrated into the assessment process over the expected period of performance. The Contractor is required to perform a software assurance review using the software provided. This review shall aggregate the results of a Government-provided and hosted suite of twenty or more multiple static or dynamic code analysis tools, normalize and filter the output into a form that identifies non-compliance with requirements such as the

DISA Application Security & Development STIG. The output of the data reduction and normalization capability shall be summary reports that result in identification and prioritization of potential software vulnerabilities for each critical component.

The Third Party Software Review shall include a post report review by an analyst that can analyze the output report to verify that findings against the software code baseline correctly identify deficiencies related to the system softwares compliance with established security technical implementation guidance and software coding standards to include those outlined in the applicable DISA STIGs associated with the technology using multiple software assurance tools to improve the quality and accuracy of reporting over the use of any single tool.

The analyst shall be able to resolve false findings and to assist developers and maintainers in understanding and using the output report to address errors or weaknesses.

C.2 Applicable Documents and Websites

The following documents and websites are referenced for the performance of this contract. The Government reserves the right to update applicable documents.

Defense Information System Agency (DISA) Application Security and Development Security Technical Implementation Guides (STIG) http://iase.disa.mil/stigs/app-security/app-security/Pages/index.aspx

Risk Management Framework (RNF) for DoD Information Technology (DoD 8510.01) http://www.dtic.mil/whs/directives/corres/pdf/851001_2014.pdf

National Institute of Standards and Technology (NIST) Source Code Security Analyzers http://samate.nist.gov/index.php/Source_Code_Security_Analyzers.html

Information Assurance Workforce Improvement Program (DoD 8570-01-M) http://www.dtic.mil/whs/directives/corres/pdf/857001m.pdf

Information Assurance http://www.apd.army.mil/pdffiles/r25_2.pdf

Department of the Army Information Security Program http://armypubs.army.mil/epubs/pdf/r380_5.pdf

C.3 Requirements

C.3.1 General

C.3.1.1 Materials, Equipment and Facilities

Government Furnished Material (GFM) and Government Furnished Equipment (GFE) will be provided to support this effort. GFE clauses will be included in the contract. The Contractor shall be responsible for preventing damage to all GFM/GFE while moved, handled, disassembled, inspected, repaired, modified, reassembled and stored. The Contractor shall be responsible for conducting all necessary examinations, inspections, maintenance and tests. The Contractor shall be responsible for reporting all inspection results, maintenance actions, losses and damage to the Government. If the Contractor loses or damages the equipment, it will be the Contractors responsibility to replace or repair the equipment to the Governments satisfaction at no additional cost to the Government. GFM/GFE items, except consumables, shall be returned to the Government in good condition upon completion of the contract. The determination of

"good condition will be made by the Procurement Contracting Officer (PCO) or designee at the PCOs sole discretion.

Government furnished materials, equipment, and facilities for this contract are identified in Appendix G - GFP.

The Government will provide access to computers, workstations, telephones, printers, and work related networks. The Government will procure software licenses and hardware as required to enable the execution of the requirements of this PWS.

C.3.1.2 Security

The highest level of facility clearance required for performance on this contract is SECRET, with personnel clearances at the SECRET level. The highest level of classified material the contractor will be required to safeguard at its own facility is NONE.

The following security requirements apply to contract and are further described in the DD Form 254, Contract Security Classification

Specification:

14 69

Name of Offeror or Contractor:

PIIN/SIIN MOD/AMD

1. This contract will require access to For Official Use Only Information (FOUO).

2. This contract will require access to NIPRNET/SIPRNET.

3. In performing this contract, the contractor will have access to classified information only at another contractor's facility or a

Government activity.

Additional security requirements are identified in Appendix E.

C.3.1.3 Reserved

C.3.1.4 Phase In and Phase Out

There is no incumbent contractor; therefore, there is no phase-in period for this contract.

A transition period is anticipated for a sixty (60) day period prior to contract end date (phase-out) to allow for orderly contract transition. In order to maximize the effectiveness of the transition process, an initial meeting between the Government's Contracting

Officers Representative (COR) and Contract Managers for the incoming and outgoing Contractors shall be held to address phase-in and phase-out requirements and responsibilities no later than seven (7) days into the phase in/phase out period, and subsequent meetings will be held as determined by the PCO, but not less than weekly thereafter.

If the incumbent contractor is also the successor contractor, these meetings will not be waived, since the orderly transition from one work specification to another will also require management involvement in the transition process.

During the period immediately prior to the end of this contract, if the contractor is not awarded the subsequent contract for these services, the contractor shall permit the successor to observe and become familiar with any and all operations under this contract. The contractor shall remain responsible and liable for the completion of all requirements of this contract which began on or before the final day of this contract. The contractor shall not defer any requirements for the purpose of avoiding responsibility and transferring such responsibility to the successor contractor or the Government. The contractor shall fully cooperate with the successor contractor and the Government and shall not interfere with their work or duties.

The contractor shall provide the Contracting Officer with a phase-out plan in accordance with CDRL D004 no later than ninety (90) calendar days prior to the contract end date. This plan shall detail disposition action for all furnishings, equipment, and documentation with moderate Government input, outlining the Contractors approach to fulfill the requirements of the contract and applying all relevant factors and information gathered throughout the performance of the contract.

C.3.1.5 Contract Management

The contractor shall provide Monthly Status Reports IAW CDRL C003, Performance and Cost Reports IAW CDRL B001, Meeting Minutes IAW CDRL

A003, and Status of GFE Reports CDRL C001, create Processes and Procedures IAW CDRL D005 and PWS Paragraph 3.2.1.6 and provide Contract

Management Reporting (CMR).

In addition to the above referenced CDRLs, the Program Manager shall provide Government Furnished Property, Security, Phase-out, Critical Personnel Reporting and general IDIQ/Task Order management responsibilities.

C.3.1.6 Travel

There is no anticipated CONUS or OCONUS travel for this contract; however, if travel requirements are identified at a later date, the

Government will provide a minimum of two weeks notification.

All travel shall be authorized in advance by the PCO or designee and be done IAW established travel regulations and policies. Authorized travel shall be payable as a direct cost. There will be no reimbursement for local travel in and around the primary work site. Local travel is defined as fifty (50) miles or less. Reimbursement for the cost of lodging and incidental expenses will be considered to be reasonable and allowable to the extent that costs submitted for reimbursement do not exceed the rates and amounts allowed by the Joint

Travel Regulation as it applies to civilian employees of the United States Government. If required, the contractor shall prepare and deliver trip reports IAW CDRL A001 Conference, Working Groups & Trip Reports.

C.3.1.7 Personnel Qualifications

The contractor shall employ only personnel who meet the minimum qualifications provided under PWS Appendix A Personnel Qualifications and are fully qualified and competent to perform the tasks specified in this PWS. The contractor shall ensure that such personnel are utilized in a manner that maximizes productivity and efficiency. For purposes of surveillance, resumes of contractor personnel performing support services as described within this PWS are subject to verification by the COR to ensure that the support personnel meet or exceed the proposed category descriptions, qualifications, and possess the minimum technical skills and experience specified at

Appendix A of this PWS.

The critical personnel specified in Appendix A of this PWS are considered essential to work performance. At least 30 days prior to diverting any of the specified individuals to other programs or contracts (or as soon as possible, if an individual must be replaced, for example, as a result of leaving the employ of the Contractor), the Contractor shall notify the PCO and shall submit, IAW CDRL D002

Status Report Critical Personnel Change, comprehensive justification for the diversion or replacement request (including proposed substitutions for critical positions) to permit evaluation by the Government of the impact on performance under the contract. The

15 69

Name of Offeror or Contractor:

PIIN/SIIN MOD/AMD

Contractor shall not divert or otherwise replace any critical personnel without the written consent of the PCO. The Government may modify the contract to add or delete personnel at the request of the Contractor or Government. Critical positions shall be filled within thirty (30) calendar days of any vacancy. Non-critical positions shall be filled within forty-five (45) calendar days of any vacancy.

This task covers the selected duties outlined in DoD 8570.01-M Information Assurance Workforce Improvement Program and the specific task statements listed in PWS Section 3. Contract staff shall be trained, experienced, and meet an IA baseline certification as identified in the DoD 8570.01-M per PWS Appendix A. Contract staff shall have a U.S. Army recognized computing environment certification in accordance with DoD 8570.01-M Paragraph C.3.2.4.8.3. They should be a U.S. citizen and shall hold a U.S. Government security clearance and be able to obtain local access approvals commensurate with the level of information processed on the system or network. Due to the ever-evolving nature of Cybersecurity and the growing threat to Information Systems, all individuals expected to maintain their certifications during the life of this contract and be knowledgeable on new policies and guidance that emerge.

C.3.1.8 Work Hours

The contractor is responsible for conducting business between the hours of 0800 and 1700 Monday thru Friday except Federal holidays.

When the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings, contractor personnel who normally work in the closed Government facility are not responsible for conducting business.

The Contractor shall not be reimbursed when the Government facility is closed for the above reasons. The Contractor shall at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the Government facility is open for operations.

C.3.1.9 Contractor Manpower Reporting (CMR)

The Office of the Assistant Secretary of the Army (Manpower & Reserve Affairs) operates and maintains a secure Army data collection site where the contractor shall report ALL contractor manpower (including subcontractor manpower) required for performance of this contract.

The contractor is required to completely fill in all the information.

The required information includes:

1. Contracting Office, Contracting Officer, Administrative Contracting Officer;

2. Contract Number;

3. Beginning and ending dates covered by reporting period;

4. Contractor name, address, phone number, email address, identify of contractor employee entering data;

5. Estimated direct labor hours (including sub-contractors);

6. Estimated direct labor dollars (including sub-contractors);

7. Total payments (including sub-contractors);

8. Predominant Federal Service Code (FSC) reflecting services provided by contractor (and separate predominant FSC for each sub-contractor, if different);

9. Estimated data collections cost;

10. Organizational title associated with the Unit Identification Code (UIC) for the Army Requiring Activity (the Army Requiring Activity is responsible for providing the contractor with its UIC for the purposes of reporting this information);

11. Locations where contractor and subcontractor perform the work (specified by zip code in the United States or nearest city, country when in an overseas location, using standardized nomenclature provided on website);

12. Presence of deployment or contingency contract language; and

13. Number of contractor and sub-contractor employees deployed in theater during this reporting period (by country). As part of its submission, the contractor shall also provide the estimated total cost (if any) incurred to comply with this reporting requirement.

Reporting period will be the period of performance not to exceed 12 months ending September 30 of each calendar year.

Contractors may use a direct XML data transfer to the data base server or fill in the fields on the website. The XML direct transfer is a format for transferring files from a contractor's systems to the secure web site without the need for separate data entries for each required data element at the web site. The specific formats for the XML direct transfer may be downloaded from the web site. The

Contractor shall NOT mark any data provided to the USG under the contract as proprietary; this includes records, files, memoranda, reports, listings, SOPs, plans, programs, studies, tests, property listings, etc., or any other data acquired or produced by the

Contractor in support of the contract.

C.3.1.10 Contractor Mandatory Training

The contractor shall complete all Government mandated training requirements as determined by CECOM SEC for contractor employees that occur during the period of performance for this contract. Contractors shall track Mandatory Training compliance using their own resources. Evidence of compliance shall be presented upon Government request. The use of the Total Employee Development (TED) system is not required.

C.3.1.11 Formal Reviews

The Contractor shall hold a post award orientation meeting at Aberdeen Proving Ground (APG), Maryland within ten (10) business days after award of contract.

C.3.2 Performance

The following section specifies the Performance Objectives and Performance Elements for the contract. These requirements shall apply to

16 69

Name of Offeror or Contractor:

PIIN/SIIN MOD/AMD

systems of three levels of complexity:

1. Simple System - Code bases which can be scanned directly via an automated capability. It is estimated that the Automated Analysis phase for this level should not exceed 40 hours. The Total Analysis time for this type of effort should not exceed 240 hours.

2. Medium System - Single language code bases with a single development environment/host, but which cannot be scanned directly with automation (e.g. an analyst shall run individual scan tools themselves, due to the limitations of the aggregating toolset). It is estimated that the Automated Analysis phase for this level should not exceed 80 hours. The Total Analysis time for this type of effort should not exceed 320 hours.

3. Complex System - Multiple languages as part of the code base, consisting of multiple development environments and/or operating system hosts, which cannot be scanned directly with automation. It is estimated that the Automated Analysis phase for this level should not exceed 120 hours. The Total Analysis time for this type of effort should not exceed 400 hours. In rare cases where a complex effort involves more than 400 hours, a separate task order or equitable adjustment may be required for specialized language skills or an extended effort based on the number of languages, platforms, interfaces, and other areas of complexities.

For each of the above levels of complexity, manual analysis shall be required to analyze findings after execution of the automated capability.

The Government estimates that the ratio of small: medium: large systems to be tested shall be approximately 1:2:1 ratio. The Government estimates that services will be required for approximately 84 systems in the base year and 98 systems each year thereafter. It is expected that a minimum of five (5) and as many as fourteen (14) systems may undergo analysis simultaneously.

Because systems will be undergoing the assessment process from within SEC, Team C4ISR, and across the Army over the period of performance, it is not possible to predict specifications of individual systems until scoping of individual efforts is conducted.

Similarly, metrics such as lines of code per application are not available.

Systems being assessed are a mix of systems currently in sustainment and those under development. System code will be transferred to the

Software Assurance Lab for analysis, not tested in the production environment.

Any and all documentation which is available from the system owner (e.g. data flow diagrams, build procedures, developers notes) associated with individual systems will be provided at the beginning of individual assessment efforts. This documentation may not be available for all efforts, and is not available before that efforts scoping process.

SwA artifacts are provided for informational purposes in PWS Appendix H.

C.3.2.1 Provide customer and engineering support for software data analytics capability.

C.3.2.1.1 The Contractor shall participate in technical meetings with customers to discuss the customer's software data analytics requirements.

The technical meetings shall serve to: (1) establish an accurate understanding of the customer's requirements and system scope, and (2) inform the customer of the data analytics process. It is expected that one meeting will occur at the inception of each effort, with potential follow up meetings as-needed to work through the process of building the software in the Software Assurance Lab.

Performance Standards_____________________

a) STD: Attend and participate in scheduled meetings when requested by the Government.

Acceptable Quality Level (AQL): 85%, attend and participate in scheduled meetings when requested by the Government.

b) STD: Provide meeting minutes for meetings requiring attendance in a timely manner and in accordance with the CDRL.

AQL: 80%, submission of all meeting minutes within 2 business days; 100%, submission of all remaining meeting minutes within 1 business day.

Deliverables____________

A003 Meeting Minutes

C.3.2.1.2 The Contractor shall prepare customer source code and/or binaries for code analysis and submit into the automated tool suite.

The Government will provide the source code and/or binaries via email, external hard drive, optical media, or other means. The contractor shall be responsible for packaging the provided source code and binaries into the format needed for scanning with the automated tool suite, and for ensuring that the code compiles as required for analysis.

Performance Standards_____________________

STD: Notify the Government Technical Lead within 1 working day of any significant issues that will cause delays in the analysis.

AQL: 90%, submission of all notifications within 1 business day; 100%, submission of all remaining notifications within 2 business days.

17 69

Name of Offeror or Contractor:

PIIN/SIIN MOD/AMD

C.3.2.1.3 The Contractor shall generate and deliver reports containing tailored, aggregated results of the analysis.

Aggregated results shall consist of raw data as generated by multiple test tools, normalized, and categorized based on vulnerability type and location. Tailored results are results filtered based on specific, government-specified threshold values. For example, a report may be tailored to only include DISA STIG CAT I findings.

Performance Standards_____________________

a) STD: Reports of raw data shall be provided upon completion of each automated analysis.

AQL: 80%, submission of all reports within 5 business days; 100%, submission of all remaining reports within 4 business days. There shall be no more than 20% rework required.

b) STD: Reports shall be in accordance with the CDRLs and Government regulations, policy and mandates.

AQL: 100% in accordance with standard.

Deliverables____________

D001 Aggregated Report of Potential DefectsD006 Summary View of Potential DefectsD007 Tailored Aggregated Report of Potential

DefectsD008 Tailored Summary View of Potential Defects

C.3.2.1.4 The Contractor shall attend meetings with customers to discuss assessment results.

Meetings may be held to discuss tailored aggregated reports of findings, and/or actionable result reports.

Performance Standards_____________________

a) STD: Attend and participate in scheduled meetings when requested by the Government.

AQL: 85%, attend and participate in scheduled meetings when requested by the Government.

b) STD: Provide meeting minutes for meetings requiring attendance in a timely manner and in accordance with the CDRL.

AQL: 80%, submission of all meeting minutes within 2 business days; 100%, submission of all remaining meeting minutes within 1 business day.

Deliverables____________

A003 Meeting Minutes

C.3.2.1.5 The Contractor shall provide status updates for project milestones.

The Government will provide the reporting tool and/or reporting format templates during the first 45 days after contract award. The proposed project performance milestones are kickoff, submission, aggregation completion, actionable report completion, and customer debrief.

Performance Standards_____________________

STD: Provide status updates of milestone completion in a timely manner.

AQL: 80%, submission of all milestone status updates within 1 business day; 100%, submission of all remaining milestone status updates within 3 business days.

C.3.2.1.6 The Contractor shall assist in the creation and update of processes and procedures for consistent software code analysis operations.

Process and procedural changes will be based on experience performing system analysis and customer feedback and new requirements (e.g.

new scan tools). The processes and procedures shall enable the Government to perform the software code assessment.

Performance Standards_____________________

STD: Upon the identification of a new software assurance capability, draft procedures shall be provided by date agreed to by the

Government.

AQL: 90%, submission of all processes and procedures within 6 business days; 100%, submission of all remaining processes and procedures within 10 business days.

Deliverables____________

D005 Process and Procedures

C.3.2.1.7 The Contractor shall provide demonstrations of the software data analytics capability.

Demonstrations shall show the data analytics capability and process to a live audience. Tasks to support demonstration shall also include preparation of briefing slides and hands on application of data analytics capability. The Government estimates that four demonstrations will be required per year.

Performance Standards_____________________

a) STD: Contractor shall be prepared to conduct demonstration in a timely manner.

AQL: 90%, all demonstrations conducted within 5 business days; 100%, conduct all remaining demonstrations within 7 business days.

18 69

Name of Offeror or Contractor:

PIIN/SIIN MOD/AMD

b) STD: Contractor shall provide draft demonstration/briefing material, as requested by the Government.

AQL: 90%, submission of all demonstration/briefing material within 3 business days; 100%, submission of all remaining demonstration/briefing material within 5 business days.

Deliverables____________

A002 Briefing and/or Demonstration Material

C.3.2.1.8 The Contractor shall provide training enabling the Government to implement the Software Code Assessment capability.

Training and/or knowledge transfer shall be provided at the Government site and conducted as a need arises. Government estimates class size not to exceed 10 attendees. The type of training (e.g. hands-on, over-the-shoulder, classroom, etc.) shall be determined at the time of the need. Further, it may cover but not limited to, topics such as best practices, process life cycle, introduction of new tools, regulatory changes, etc.

Performance Standards_____________________

a) STD: Training shall provide attendees with the information necessary for a working understanding of the topic.

AQL: 90%, submission of all attendee training material within 5 business days; 100%, submission of all remaining attendee training material within 7 business days.

b) STD: No unresolved user complaints that impact compliance with the standards or performance.

AQL: No more than 5% unresolved user complaints per quarter.

Deliverables____________

C004 Training Materials

C.3.2.1.9 The Contractor shall analyze and provide actionable reports for each software assessment.

Actionable reports shall be based on normalized, aggregated data generated by the software code assessment tools. Contractor is responsible for reviewing raw findings to identify false positives, categorize the severity of each finding, and provide recommendations to remediate or mitigate each finding. Categorization (STIG Cat I, II, III, etc.) shall be based on impact of each finding within the source code.

Performance Standards_____________________

a) STD: Categorization will be based on applicable standards such as the DISA Application and Security Development Guide STIG and the

DoD Risk Management Framework.

AQL: 100%, findings correctly categorized in accordance with the standards.

b) STD: Delivery of report is required following completion of PWS 3.2.1.3.

AQL: 90%, submission of all actionable assessment reports within 30 calendar days; 100%, submission of all remaining actionable assessment reports within 45 calendar days.

Deliverables____________

D003 Final software assurance assessment report

C.4 Reserved

C.5 Data Rights

The Government's rights in non-commercial technical data and software deliverables shall be governed by DFARS 252.227-7013 and DFARS

252.227-7014, respectively. Additional provisions related to technical data and software rights are provided in Appendix D.

19 69

Name of Offeror or Contractor:

PIIN/SIIN MOD/AMD

APPENDIX A__________

PERSONNEL QUALIFICATIONS________________________

Labor Categories: Program Manager - Cost-Plus-Fixed-Fee (CPFF)

Critical Position: Yes

Location: Aberdeen Proving Ground, MD

Minimum Qualifications:

1. The contractor shall process a Bachelors degree or advanced degree in Management, Business Administration, Computer Science, Systems

Engineering or other Engineering discipline.

2. Contractor personnel shall have 10 Years of experience managing Software Development efforts within the last 15 Years and 2 years experience in Software Assurance within the last 5 Years.

3. Contractor personnel shall be capable of planning, coordinating, and directing the activities of administrative, program control, and technical personnel involved in providing services in fulfillment of the contract.

4. Shall have a thorough understanding and experience in the complete life-cycle of the software in military systems. Shall have knowledge and experience with Department of Defense (DOD)/Army plans, policies, standards, and methods aimed at the acquisition and support of software and computer resources for Army systems.

5. Shall be capable of managing and controlling schedules and cost to provide on time, within budget, performance of all aspects of the contractual effort. Shall be capable of providing direction for operations and ensuring compliance with all management policies, plans, and procedures. Shall be capable of providing recommendations for resolution to technical problems.

6. The Program Manager shall at all times be a role model to subordinate employees, be a workforce motivator, and be a provider of constructive criticism.

7. Shall possess an Army Acquisition Corps Level 2 certification in logistics, program management OR information technology OR recognized industry equivalent professional certification.

Labor Categories: Senior Software Developer…