NIST Computer and Information Security Services IDIQ

Award Notice Solicitation SB1341-12-RP-0019 The purpose of this notice is to notify the public that Request for Proposal (RFP) No. SB1341-12-RP-0019 has been awarded. Contract No. SB1341-12-CQ-0016 has been awarded to Trusted Security Alliance LLC in accordance with the evaluation factors for award stated in section M of RFP No. SB1341-12-RP-0019. This contract is a single award Indefinite-Delivery, Indefinite-Quantity (ID/IQ) contract with a maximum capacity of $70,000,000.00. The period of performance is for a base period of one year, and four option periods of one year each. The awardee, Trusted Security Alliance LLC is a Small Business under the small business size standard of $25 million associated with NAICS code 541519. As stated in the original synopsis for this RFP posted on April 20, 2012, "NIST may award more than one Indefinite-Delivery, Indefinite-Quantity (ID/IQ) contract as a result of this RFP. The quality of the proposals submitted in response to this RFP will dictate whether or not it is in the best interest of the Government to award more than one ID/IQ contract." It was determined by the contracting officer that a single award ID/IQ contract was in the best interests of the Government. The first task order under this ID/IQ contract was awarded to Trusted Security Alliance LLC as a labor-hour type task order for a total ceiling price of $12,950,554.80 (including option periods). The task order number is 12-902. This task order is for a base period of six months, followed by four option periods of 12 months each, as denoted in the RFP SB1341-12-RP-0019. The Performance Work Statement for this task order was included as part of the RFP SB1341-12-RP-0019, and the proposals were evaluated in accordance with Section M of RFP No. SB1341-12-RP-0019. The first task order was competed and awarded as a labor-hour type task order because it was not possible at the time of placing the contract or order to accurately estimate the extent or duration of the work or to anticipate costs with any reasonable degree of certainty. Several tasks in this task order are expected to vary daily and do not average consistently over weeks, months, or even years. Vulnerability scoring and analysis of Common Vulnerability Enumerations (CVE) using the Common Vulnerability Scoring System (CVSS), in addition to the new task of Common Configuration Enumeration (CCE) scoring using the Common Configuration Scoring System (CCSS), are two such examples. CVSS scores are used by the DoD and the Payment Card Industry (PCI) for critical business functions. For example, certain credit card processing computing systems are required to be taken offline if they have a vulnerability with a CVSS score above certain thresholds. DoD likewise relies on CVSS scoring to prioritize their remediation targets. On a given day, the scoring and analysis requirements may exceed projected staffing hours and other days when a surge is not present, the number of labor hours required may be less than the projected required amount. As such, a labor-hour type contract is better suited toward tasks such as this than a firm-fixed price contract type. The use of a firm-fixed price contract type on requirements such as this would place undue risk on the Government because the contractor would be inclined to overestimate the number of hours that the task order would require. In addition, there may be undue risk placed on the contractor through the use of a firm-fixed price contract type for this task order because of the unknown elements with regards to the number of labor hours required. However, the ID/IQ Contract contains a clause that states, "The Government reserves the right to convert the Labor-Hour type task order to Firm-Fixed Price type task order once the Government is able to better define the tasks. This right may be exercised at any time throughout the life of the task order through a bilateral modification to the task order." Therefore, the requirements of this task order will be evaluated constantly throughout the period of performance to determine whether it can be converted to firm-fixed price. END OF TEXT.