Cloud Based Internet Isolation Service

Justification for Other Than Full and Open Competition (J&A)

This document justifies the use of other than full and open competition for the procurement of the Cloud Based Internet Isolation (CBII) Service. The service provides a secure, managed browser isolation solution for Department of War (DoW) users, ensuring safe access to web resources and protecting DoW networks from cyber threats. The action involves renewing and procuring new subscription licenses for Menlo Security, Inc.'s Cloud Browser (MSCB) product, including its Highly Evasive and Adaptive Threats (HEAT) Shield with AI/ML capabilities.

• Secure, cloud-based browser isolation for commercial web browsing.

• Protection against malicious source code and cyber threats.

• Optimization of web traffic flow and reduction of network strain.

• Support for over 3 million DoW users, with scalability up to 3.4 million.

• Compliance with FedRAMP+ Level 2 standards.

• Support for IPv6 traffic.

• Integration with DISA's advanced security tools.

• Capabilities include threat mitigation, secure/isolated web sessions, and network optimization.

• Contract Type: Firm Fixed Price (FFP), FAR-based follow-on.

• Period of Performance: One-year base period with four one-year option periods (April 15, 2026 – April 14, 2031).

• Funding: Fiscal Year 2026 Defense Working Capital Funds.

• Sourced through open-market procedures on SAM.gov.

• This document is a justification for other than full and open competition, not a solicitation for proposals.

• The Contracting Officer will determine if prices are fair and reasonable.

• This procurement is brand-name specific to Menlo Security, Inc.'s MSCB product.

• Market research indicated no other solutions meet the government's CBII requirements or are compatible with existing infrastructure.

• The requirement cannot be set aside for small businesses due to subcontracting limitations.

• The MSCB solution has been in production since 2020 and is critical for national security.

• Replacing MSCB would cause significant disruption and pose a threat to national security.

• Future market research will be conducted to identify potential competitive actions.

Form / Attachment / Pricing Sheet

This document, titled "Attachment 4 CDRLS_Exhibit A.pdf", is an attachment to the SAM.gov opportunity record. Its specific purpose is not detailed in the provided metadata or document content, but it is likely related to contract data requirements list (CDRLs) or an exhibit.

As the document content could not be accessed, specific key elements, fields, categories, or data points cannot be identified.

Bidders should refer to the main solicitation or related documents for instructions on how to utilize or address "Attachment 4 CDRLS_Exhibit A.pdf". Its content is likely crucial for proposal preparation or fulfilling contractual obligations if awarded.

Form / Attachment / Pricing Sheet

This document is a template for submitting Questions and Answers (Q&A) regarding the Request for Proposal (RFP) HC108426R0005. It provides instructions for bidders on how to format and submit their questions, comments, and recommendations.

• Instructions: Details on how to complete the spreadsheet, including not changing the format and deleting sample blue text.
• Column B (Page): Requires the specific page number from the contract.
• Column C (Section/Paragraph): Requires the applicable section and paragraph number from the contract.
• Column D (CLIN/Clause/Other): Requires CLIN, Clause, Provision, Appendix, or Attachment numbers.
• Column E (Questions/Comments/Recommendations): Requires bidders to state their questions or comments, prefaced by the topic.
• Government Response: A column for the government's response (left blank in the provided sample).

This template is crucial for bidders to effectively communicate any questions or concerns about the RFP. Following these instructions ensures that questions are submitted in the correct format, which can expedite the government's response process and ensure clarity. Bidders must use this template to submit their inquiries related to the RFP, including specific references to contract pages, sections, or attachments.

Attachment / Other

This document is a Quality Assurance Surveillance Plan (QASP) for the Cloud Based Internet Isolation (CBII) Service contract. It outlines the systematic methods the government will use to monitor and evaluate the contractor's performance.

• Contract Title: Cloud Based Internet Isolation (CBII) Service.
• QASP Purpose: To define what will be monitored, how, by whom, and how results will be documented. It clarifies that the contractor is responsible for their own quality control, while the government is responsible for objective performance evaluation.
• Roles: Defines the roles of the Program/Project Manager (PM), Contracting Officer (KO), and Contracting Officer's Representative (COR) in performance surveillance.
• Surveillance Methods: Primarily uses Random Sampling and Periodic Inspection.
• Performance Standards: Details specific performance objectives, Acceptable Quality Levels (AQLs), and methods of calculation for various tasks, including:
  • Contract managed services support (90% AQL).
  • Key milestone and activity reporting via Microsoft Project Schedule (100% AQL).
  • Weekly Activity Reports (WAR) (90% AQL).
  • Program/briefing documentation management (90% AQL).
  • Overall contract management services (90% AQL).
  • Development and sustainment of Cloud Service Offering (CSO) (95% AQL).
  • HEAT Shield protections implementation (95% AQL).
  • Operational support (DESMF) (100% and 90% AQLs).
  • Risk Management Framework (RMF) and Accreditation & Authorization (A&A) lifecycle support (100% AQL).
  • SOP maintenance for patching and eMASS data entry (100% AQL).
  • User migration and sustainment approach (100% AQL).
  • Training delivery and documentation (100% AQL).
  • Engineering support for new technologies (95% AQL).
  • Integrated test lab maintenance (95% AQL).
  • Mobile device service integration (95% AQL).
• Performance Documentation: Outlines processes for documenting acceptable and unacceptable performance, including the use of Performance Assessment Reports (PARs), Customer Complaint Records, and Corrective Action Reports (CARs).
• Compliance: Requires contractor compliance with specific regulations (FAR 52.222-50, DFARS 252.203-7002) and submission of affirmations regarding employee whistleblower rights.

Performance Work Statement (PWS)

To maintain and enhance a secure, cloud-based internet isolation (CBII) managed service for up to 3.4 million Department of War (DoW) users, providing safe and reliable access to web resources while mitigating cyber threats.

This PWS outlines requirements for a managed service utilizing the Menlo Security, Inc. (MSCB) solution. Key areas include:

• Program Support: Drafting agendas, managing meetings, financial management, program management, and administrative tasks.
• Managed Services: Contract management, schedule management, reporting (Weekly Activity Reports, After Action Reports), documentation management, and financial oversight.
• Cloud Service Offering (CSO): Delivering, deploying, and sustaining an unclassified CSO engineered by Menlo Security, Inc. This includes isolation of internet traffic, threat mitigation, bandwidth freeing, and compliance with FedRAMP+ Level 2 requirements.
• Operational Service Support: Providing a tiered service desk infrastructure (Tier 0, I, II, III) for end-user support, incident management, and request fulfillment.
• Accreditation & Authorization (A&A): Supporting all phases of the Risk Management Framework (RMF) and A&A lifecycle, including security engineering and compliance with DoD 8500 series publications.
• Migration, Readiness Assessments, and Sustainment: Developing and executing a user migration strategy, providing technical support during upgrades and enhancements.
• Training: Developing and delivering training materials for subscribers, administrators, and instructors.
• Engineering Support: Providing systems, architecture, network, configuration management, test, cybersecurity, and mobility engineering services.

Performance standards are defined for various tasks, including contract management plan completeness, schedule accuracy, report timeliness, documentation accuracy, CSO engineering effectiveness, operational support response times, A&A compliance, migration support, and training delivery. Specific Acceptable Quality Levels (AQLs) are detailed for each task.

• Period of Performance: One-year base ordering period and four one-year option ordering periods (totaling up to five years). Base period: April 15, 2026 - April 14, 2027.

• Place of Performance: Primarily remote/on-site at contractor facilities. Classified work may require performance at government facilities (e.g., DISA Ft. Meade, MD). Travel may be required.

• Security: Personnel must possess Final Secret clearance. Compliance with DoD 8500 series, FedRAMP+ Level 2, and CMMC Level 2 (C3PAO) is required.

• Identity Management: Support for DoW PK-Enabled/PIV authentication, Role-Based Access Control (RBAC).

• Interoperability: Must integrate with DISN Joint Infrastructure (DJI) security stack, support IPv6, and comply with DoD mandates.

• Data Management: All data must reside in servers located in the United States. Compliance with data breach reporting and privacy impact assessment requirements.

• Supply Chain Risk Management (SCRM): Submission of an SCRM plan is required.

• Section 508 Accessibility: ICT must conform to Revised 508 Standards.

• Cybersecurity: Emphasis on AI/ML for threat detection and mitigation (HEAT Shield), Data Loss Prevention (DLP), and compliance with various cybersecurity frameworks.

Other / Unclassified

This document is a placeholder or error message indicating that the PDF content could not be displayed by the viewer. It provides instructions for upgrading Adobe Reader and links for assistance.

This document does not contain substantive information related to a SAM.gov opportunity. It is a technical message related to PDF rendering and does not provide details on requirements, scope, or submission instructions for bidders.

Form / Attachment / Pricing Sheet

This document is a proposal template provided by the Defense Information Systems Agency (DISA) for cost/price evaluation. It serves as guidance for Offerors to detail and verify their proposed pricing.

• Instructions: Offerors must complete the CLIN Summary and all corresponding sheets, ensuring all formulas are included and calculations are correct. Pricing notes are not permitted. Additional rows, columns, or tabs can be added as necessary, with costs rolling up to appropriate sheets.
• CLIN Structure: The template includes sections for Base Year, Option Years 1-4, and a Summary sheet. It outlines two main CLINs: CLIN x001 (CBII Managed Service) and CLIN x002 (Travel).
• Pricing Details: For CLIN x001, Offerors must provide a detailed build-up of proposed pricing, including labor, and specify the basis for the price (e.g., commercial price list, prior prices). For CLIN x002 (Travel), a placeholder cost of $15,000.0 is provided for each period.
• Summary Sheet: This sheet consolidates CLIN information, contract types (FFP for Managed Service, Cost-Reimbursable for Travel), and estimated prices for the Base Period through Option Period 4, including a 6-month extension for evaluation purposes.

This worksheet is critical for bidders to accurately structure and present their cost proposals. It ensures traceability of pricing from detailed breakdowns to the CLIN Summary, as required by the RFP/RFQ. Offerors must adhere to the template's instructions for formula inclusion, calculation accuracy, and data traceability to ensure compliance with the government's cost/price evaluation process.

Solicitation / RFP / RFQ

This document is a solicitation (RFP HC108426R0005) for commercial items, issued by DISA/DITCO-SCOTT-PS84. The government is procuring "CBII Managed Service" and related "Travel Cost" services. The solicitation is set aside for Unrestricted competition, with a NAICS code of 541519 and a size standard of $34,000,000.

• CBII Managed Service: Requires provision of CBII Managed Service in accordance with Performance Work Statement (PWS) Tasks 6.1 - 6.7. Invoicing is monthly in arrears based on actual usage. Contractors are obligated to notify the government at 75% of their commitment usage.

• Travel Cost: Reimbursable expenses for travel are allowed in accordance with FAR Part 31, excluding travel within 50 miles of the contractor's place of performance. Detailed travel cost breakouts are required with monthly invoices.

• Surge Support: Optional surge support is available, not to exceed 5% of the contract value.

• Contract Type: Firm-fixed-priced contract.

• Period of Performance:

  • CLIN 0001: 15-APR-2026 to 14-APR-2027
  • CLIN 0002: 15-APR-2026 to 14-APR-2027
  • CLIN 1001: 15-APR-2027 to 14-APR-2028
  • CLIN 1002: 15-APR-2027 to 14-APR-2028
  • CLIN 2001: 15-APR-2028 to 14-APR-2029
  • CLIN 2002: 15-APR-2028 to 14-APR-2029
  • CLIN 3001: 15-APR-2029 to 14-APR-2030
  • CLIN 3002: 15-APR-2029 to 14-APR-2030
  • CLIN 4001: 15-APR-2030 to 14-APR-2031
  • CLIN 4002: 15-APR-2030 to 14-APR-2031
  • CLIN 9999: Surge

• Option to Extend Services: The government may require continued performance for up to 6 months at specified rates.

• Option to Extend Term: The contract term may be extended up to five years in total.

• Offer Due Date: 12:00 PM 16 Mar 2026

• Proposal Submission: Technical and price proposals are required. Oral presentations will be conducted virtually via MS Teams.

• Evaluation: Award will be made to the responsible offeror whose proposal represents the overall best value using a lowest price technically acceptable (LPTA) evaluation process.

• Key Deadlines:

  • Questions due: NLT March 2, 2026
  • Proposals due: NLT March 16, 2026

• Set-Aside: Unrestricted.

• NAICS Code: 541519

• Size Standard: $34,000,000

• Cybersecurity Requirements: Contractors must comply with Cybersecurity Maturity Model Certification (CMMC) Level 2 requirements.

• The solicitation incorporates FAR 52.212-1, 52.212-3, and 52.212-4 by reference.

• Specific clauses are incorporated by reference and full text, including those related to cybersecurity, payment instructions (WAWF), and organizational conflicts of interest.

• Points of Contact: Contracting Officer Angela K. Zang and Contract Specialist Melissa A. Weh.

Form / Attachment / Pricing Sheet

This document is a checklist for reviewing a Subcontracting Plan, as required by FAR 52.219-9. It outlines the essential elements that a subcontracting plan must contain for approval. Bidders are expected to use this checklist to ensure their proposed subcontracting plan meets all regulatory requirements.

This checklist details 17 required elements for a subcontracting plan, including:

• Identification of the contractor, date, and solicitation details.
• Specific goals for subcontracting with various small business categories (Small Business, Small Disadvantaged Business, Women-Owned Small Business, HUBZone Small Business, Veteran-Owned Small Business, Service-Disabled Veteran-Owned Small Business) across different contract periods.
• Descriptions of the types of supplies and services to be subcontracted.
• Methods for developing goals and identifying potential sources.
• Assurances regarding the equitable opportunity for small businesses to compete, reporting requirements (ISR/SSR via eSRS), and record-keeping.
• Provisions for timely payments to subcontractors and the ability for subcontractors to discuss matters with the Contracting Officer.
• Requirements for a signature page with appropriate approvals.

Bidders must submit a compliant subcontracting plan as part of their proposal. This checklist serves as a guide to ensure all necessary components are included, which is critical for proposal acceptability. Failure to meet these requirements can lead to a plan being rated as 'Unacceptable'.

Form / Attachment / Pricing Sheet

This document, "Attachment 7 GFP Attachment.xlsx", is an Excel spreadsheet that serves as an attachment to a solicitation. It details Government Furnished Property (GFP) that will be provided to the selected contractor for use during contract performance.

• The attachment contains a list of "Requisitioned Items" or "Provisioned" GFP items.
• Each item includes a line number, item name, and description.
• Fields such as NSN, Mfr CAGE, Part Number, and Model Number are present, with specific completion requirements noted:
  • '*' denotes a required field.
  • '†' indicates a minimum of one field is required.
  • '††' means if 'Mfr CAGE' or 'Part Number' is entered, the other is also required.
• Other details include serial management status, property classification and usage, quantity, unit of measure, unit acquisition cost, and whether items are to be used as-is or are upgradable.
• Contact information for the Government Contracting Officer (Angela K. Zang), including email and phone number, is provided.

Bidders must review this attachment to understand the specific Government Furnished Property that will be provided. This information is critical for:

• Accurately estimating costs.
• Planning logistics.
• Understanding the overall scope of work.
• Assessing resource needs and capabilities.
• Preparing proposals and cost estimations.
• Understanding responsibilities related to the management and use of GFP.

Form / Attachment / Pricing Sheet

This document is a Non-Disclosure Agreement (NDA) for contractor personnel working with the Defense Information Systems Agency (DISA) or other relevant DoD entities. It outlines the obligations of contractor employees regarding sensitive or proprietary information they may access during contract performance.

• Agreement to Protect Information: Contractor personnel must agree not to disclose specific categories of information, including:
  • Planning, programming, and budgeting system information.
  • Contractor bid or proposal information or source selection information.
  • Information exempt from FOIA (e.g., trade secrets, proprietary, financial).
  • Personally-identifiable information (PII) or protected health information (PHI).
  • Confidential or For Official Use Only (FOUO) information.
• Use of Information: Information must be used solely for contract performance and not for personal gain or competitive advantage.
• Post-Contract Obligations: Obligations continue after contract performance ends until the information is approved for public release.
• Return of Information: All sensitive information in possession must be returned to the Government upon contract completion.
• Sanctions: Violations may result in administrative, civil, and criminal sanctions, including removal from contract assignment.
• Permitted Disclosures: Exceptions are made for disclosures to Congress, authorized agency officials, or the Department of Justice for reporting substantial legal violations, and for disclosures required by court order.
• Whistleblower Protections: The agreement incorporates and does not supersede existing whistleblower protections and statutes related to classified information, congressional reporting, Inspector General reporting, and national security.

Bidders should be aware that personnel assigned to this contract will be required to sign this NDA. It signifies the sensitive nature of the data and systems involved in the opportunity and highlights the strict confidentiality requirements that will be imposed on contractor staff. This may impact staffing decisions and the vetting process for personnel proposed for the contract.