BUG BOUNTY SaaS PLATFORM
Closed Solicitation Posted
- Solicitation number
- 47HAA020Q0129
- Agency
- Office of Administrative Services General Services Administration
- Responses due
- Set-aside
- Total Small Business
Opportunity facts
- NAICS code
- 561611 Investigation and Personal Background Check Services
- PSC
- D305 It And Telecom – Teleprocessing, Timeshare, Cloud Computing, And High Performance Computing
- Place of performance
- Washington DC 20405 USA
Notice details come from SAM.gov. Updated .
About this opportunity
This solicitation seeks a bug bounty software-as-a-service platform and vulnerability report triage services from HackerOne to support the General Services Administration's Office of Administrative Services. The bug bounty platform will allow security researchers to report vulnerabilities across multiple public-facing GSA web applications while enabling the agency to manage and track issues. HackerOne must also provide specialists to review reports, communicate with researchers, and manage the program separately for each application. Questions are due by September 16, 2020 and proposals are due by September 21, 2020.
This requirement has a total small business set-aside designation. The primary NAICS code is 541519 and PSC code D302. The potential incumbent is HackerOne. The total estimated value including two one-year option periods is $10,904,220 to be performed in Washington, DC from September 2020 through September 2024. Services must be provided separately for each application utilizing the platform.
Notice text
This is a brand name specific requirement for HackerOne to deliver a Bug Bounty program which SecOPs will utilize for SecOps-owned web applications. HackerOne provides access to their Bug Bounty SaaS Platform for researchers to report vulnerabilities (“Platform/Network Access”) and allow SecOps to manage and track issues across multiple public services exposed to the Internet, triage services for those reported vulnerabilities, disburse rewards for effective vulnerabilities, and explain the reasons behind rejections (“Vulnerability Report Triage Services”). The Vulnerability Report Triage Services, must be provided on a “per web application” basis, allowing SecOps to operate a Bug Bounty for a web application independently of the other web applications that are utilizing the Platform/Network Access for their own tests. As part of these services, HackerOne must provide staff who are specialists in reviewing vulnerability reports and communicating with researchers
Attachments
| File | Type | Posted |
|---|---|---|
| Questions and Answers for RFQ 47HAA020Q0129.pdf | ||
| ATTACHMENT A Security_and_Privacy_Requirements_for_IT_Acquisition_Efforts_CIO_IT_Security.pdf | ||
| Bug Bounty SaaS JA.pdf | ||
| SOW Bug Bounty SaaS.pdf | ||
| ATTACHMENT B.pdf |
On GovTribe
Work this opportunity on GovTribe
- Track it in your pipeline
- Find teaming partners
- Similar opportunities
- Ask GovTribe AI about this opportunity