Cybersecurity Support Services Bridge Contract

Form / Attachment / Pricing Sheet

This document, "A23 Attachment 3 Personnel Matrix.xlsx," is a required attachment for the solicitation (Solicitation Number: HQ003425RE144 and HQ003426QE095 for the "Cybersecurity Support Services" opportunity). It serves as a template for bidders to detail their proposed personnel structure for Firm-Fixed Price CLINs.

• Base Year (9 Months): Bidders must complete the matrix for the base period, detailing proposed labor categories, hours, FTEs, security clearance levels, and whether personnel are prime or sub-contractors.
• Option Period 1 (3 Months): A separate section for detailing personnel requirements during the first option period.
• 52.217-8 Ext. (6 Months): A section for detailing personnel requirements for the extension period under clause 52.217-8.
• For each CLIN, bidders need to specify:
  • Proposed Labor Category
  • GSA Labor Category
  • Proposed Hours for Each Personnel
  • Security Clearance Level
  • Specify if Prime or Sub-contractor
  • Duties/Responsibilities
  • Qualifications (Years of Experience, Certifications, Education)

This attachment is crucial for bidders to outline their staffing plan and demonstrate their capability to meet the personnel requirements of the Cybersecurity Support Services contract. Accurate and complete submission of this matrix is essential for proposal evaluation.

Form / Attachment / Pricing Sheet

This document outlines the Key Personnel Qualification Requirements for specific labor categories within the opportunity. Bidders must use this attachment to identify and propose personnel who meet the specified qualifications.

Cybersecurity Engineer:

• Security Clearance: SECRET
• Education/Certification: 4-year degree in Information Technology or related field; PMP; Identity and Access Management (IAM) Level III Certified (CASP + CE, CCNP Security, CISA, CISSP, GCED, GCIH, CCSP).
• Years of Experience: Twelve (12) years of IT experience; Ten (10) years of Government Cybersecurity experience (including requirements definition, systems analysis, test and evaluation, scanning).

Security Architect:

• Security Clearance: SECRET
• Education/Certification: 4-year degree in Information Technology or related field; Information Assurance System Architects and Engineers (IASAE) Level II Certified (CASP +CE, CISSP, CSSLP).
• Years of Experience: Ten (10) years of IT experience; Eight (8) years of experience with technical engineering (including requirement analysis, systems engineering, network/systems administration, cybersecurity).

This attachment is critical for proposal preparation. Bidders must ensure their proposed key personnel for Cybersecurity Engineer and Security Architect roles meet or exceed all listed education, certification, and experience requirements. Failure to propose qualified personnel may impact proposal evaluation and award.

Solicitation / RFP / RFQ

This document is a Sole Source Justification under Simplified Procedures for Certain Commercial Items, citing FAR 6.103-1. The Department of War (DoW), Washington Headquarters Services (WHS), Acquisition Directorate (AD), Enterprise Security Services Division (ESSD), intends to award a sole source bridge contract for Cybersecurity Support Services (CSS) to Starlo Innovation, LLC (Starlo). This contract is necessary to avoid a gap in services when the current contract expires on June 14, 2026, and to maintain mission-critical support for the Defense Security Cooperation Agency (DSCA).

• The contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to perform CSS as defined in the Performance Work Statement (PWS).

• The services are critical for DSCA's cybersecurity operations, including day-to-day cyber defense, incident response capabilities, and compliance management.

• Contract Type: Firm-fixed price.

• Funding: Fiscal Year (FY) 2026, Operations and Maintenance (O&M) funding.

• Period of Performance (POP): Three-month base period (June 15, 2026 - September 14, 2026), with three one-month option periods.

• The follow-on contract will be competitively acquired via GSA OASIS+ GWAC.

• This is a sole source justification, not a solicitation for proposals.

• Pricing will be determined fair and reasonable using procedures in FAR 15.404-1, including comparison of proposed price to historical prices and independent Government cost estimates.

• The original acquisition was a sole-source 8(a) Direct award authorized by the Small Business Administration (SBA).

• The follow-on requirement is being competed among 8(a) GSA OASIS+ contractors.

• A Notice of Intent (NOI) to award a sole source bridge contract to Starlo Innovation, LLC was published on SAM.gov on April 27, 2026.

• Market research has been conducted via historical data and the NOI.

• Starlo Innovation, LLC is the incumbent contractor.

Other / Unclassified

This document is a placeholder or error message indicating that the PDF content could not be displayed by the viewer. It provides instructions for upgrading Adobe Reader and links for further assistance.

This document does not contain substantive information related to the SAM.gov opportunity. It is a technical message related to PDF rendering and does not provide details on requirements, deliverables, or submission instructions for bidders.

Statement of Work (SOW) / Performance Work Statement (PWS)

To provide qualified, professional, responsive, clear, and reliable Cybersecurity support services to the Defense Security Cooperation Agency (DSCA) Information Technology (IT) systems, focusing on Governance, Risk, Compliance, and Operations.

The contractor will provide support in the following areas:

• Cybersecurity Compliance Support

• Cybersecurity Risk Support

• Cybersecurity Operations Support

• Cybersecurity Governance Support

• Strategic and Program Support Enhancements

• Advisory Services to improve policy, process, and procedure for the Cybersecurity Branch (CYBR).

• Base Period: 15 June 2026 – 14 September 2026 (3 months)

• Option Period 1: 15 September 2026 - 14 October 2026 (1 month)

• Option Period 2: 15 October 2026 - 14 November 2026 (1 month)

• Option Period 3: 15 November 2026 - 14 December 2026 (1 month)

• Quality Control Program (QCP) required within 30 days of award.

• Deliverables will be reviewed within 5 business days for acceptance.

• Performance will be evaluated per the Quality Assurance Surveillance Plan (QASP).

• Key Performance Indicators (KPIs) include personnel qualifications, report timeliness and quality, and key personnel retention.

• Non-personal services contract.

• Contractor personnel must be U.S. citizens.

• Facility clearance of SECRET required at the time of proposal and maintained throughout the contract.

• All contractor employees must complete annual Government-furnished training.

• Contractor personnel must sign Non-Disclosure Agreements (NDAs) within one business day of onboarding.

• Work will be performed at contractor facilities, with exceptions for Secure Internet Protocol Router (SIPR) access requiring performance at DSCA HQ or DSCA Mechanicsburg.

• Firm-Fixed-Price contract type.

• Key Personnel: Cybersecurity Engineer and Security Architect with specific experience and education requirements.

• Compliance with various DoD regulations, NISPOM, and OPSEC requirements.

• Contractor must provide a phase-out plan and support transition to an incoming contractor.

Form / Attachment / Pricing Sheet

This document is the Contractor Conflict of Interest Disclosure Form, required for WHS solicitations or contracts. It is used to identify and disclose any actual or potential organizational or personal conflicts of interest.

• Solicitation/Contract Information: Fields for WHS Solicitation or Contract Number, Program Supported, and Organization Name.

• Conflict Identification: Sections to describe the work performed under a related contract (Block 6 & 7), the relationship between current and past work (Block 8), and an evaluation of actual or potential organizational conflicts of interest (Block 9).

• Mitigation Plans: Requirements to describe planned actions to avoid, neutralize, or mitigate organizational conflicts (Block 10) and personal conflicts (Block 11).

• Official Certification: Fields for the responsible official's typed name, signature, and date.

• Be specific, citing relevant RFP/SOW paragraphs.

• Include subcontractors in conflict analysis.

• If no conflict exists (Block 6), only Blocks 12-14 need completion.

• Block 7 requires a summary of work performed under the contract listed in Block 6.

• Block 8 requires a summary of the relationship between the current solicitation's work and the work in Block 6.

• Block 11 requires analysis of potential personal conflicts for key personnel.

Bidders must complete and submit this form to disclose any potential conflicts of interest related to the solicitation or contract. Failure to properly address potential conflicts may impact eligibility or proposal evaluation. This form helps ensure fair competition and compliance with conflict of interest regulations.

Form / Attachment / Pricing Sheet

This document is a template for bidders to submit questions regarding the Draft Request for Proposal (RFP). It provides a structured format for identifying specific sections of the RFP that require clarification and categorizing the impact of the question.

• Draft RFP Document: Specifies which document the question pertains to (e.g., PWS).
• Section/Subsection: Identifies the exact location within the RFP document.
• Page # / Line #: Pinpoints the specific page and line number for reference.
• Impact: A categorization of how significant the question's impact is on the RFP.
• Question: The actual question or request for clarification, including necessary context.

This template is crucial for bidders to effectively communicate their questions to the government. Using this standardized format ensures that all necessary information is provided for each question, facilitating clear and concise responses from the issuing agency. It helps bidders ensure their concerns are properly documented and addressed, which can impact their proposal preparation and understanding of the requirements.

Form / Attachment / Pricing Sheet

This document is an Excel spreadsheet containing pricing templates for the DSCA Cybersecurity Support Services requirement (RFP Number HQ003426QE115). It provides a structure for bidders to detail their proposed pricing for labor categories across the base period and option periods.

• CLIN Pricing Summary Sheet: Lists Contract Line Item Numbers (CLINs) for various labor categories (e.g., Cybersecurity Engineer, Security Architect, Cybersecurity Analyst) required for the base period (3 months) and four option periods (1 month each). It includes columns for Quantity (QTY), Unit of Issue (U/I), Unit Price, and Total Price. All prices are currently listed as 0.0.
• Labor Category Sheet: Provides a more detailed breakdown for pricing. Bidders are instructed to tailor this sheet as needed. It includes columns for CLIN, RFQ Labor Category, Proposed Labor Category, GSA Labor Category, Total Proposed Hours, Hours Performed by Prime/Sub-Contractor, FSS Hourly Rate, FSS Discounted Hourly Rate, Discounted Rate %, and Total. All values in this sheet are also currently 0.0.

This attachment is crucial for bidders to understand the structure required for submitting their price proposals. Bidders must populate this template with their proposed labor rates, hours, and total costs for each CLIN and period of performance to comply with the solicitation's pricing requirements. The provided template outlines the specific labor categories and contract periods for which pricing is expected.

Solicitation / RFP / RFQ

This solicitation (HQ003426QE115) is for Cybersecurity Support Services. The government is procuring these services to meet its cybersecurity needs.

The solicitation outlines various cybersecurity support services, including:

• Cybersecurity Engineer Services
• Security Architect Services
• Cybersecurity Analyst (IAM 2) Services
• Mid-Level Vulnerability Assessment Analyst (IAT2) Services
• Mid-Level Information Systems Security Officer (IAM 2) Services
• Mid-Level Computer Network Defense Analyst (IAT1) Services
• Incident Responder Services
• Cybersecurity Analyst (IAT 1) Services

These services are to be performed in accordance with Section 5 of the Performance Work Statement (PWS) and other associated attachments.

• The North American Industry Classification Standard (NAICS) code is 541990, with a size standard of USD 19,500,000.00.

• The contract type is Firm Fixed Price.

• The period of performance spans from June 15, 2026, to December 14, 2029, with various option periods.

• The Offer Due Date is June 5, 2026, at 09:00 AM.

• Proposals must be submitted electronically via email to the specified DSCA mailbox and contacts.

• Evaluation will be based on technical acceptability and fair and reasonable pricing.

• The total evaluated price will be the sum of the base period, all option periods, and the one-month extension authorized by FAR clause 52.217-8.

• The acquisition is unrestricted.

• The solicitation is being issued electronically only via email.

• Offerors must acknowledge all amendments.

• Specific cybersecurity requirements, including Cybersecurity Maturity Model Certification (CMMC) levels, are detailed in the solicitation (DFARS 252.204-7021 and 252.204-7025).

• Attachments include the PWS, DD254, Personnel Matrix, Key Personnel Qualifications, Pricing Template, RFP Questions Template, and Contractor CIO Disclosure Form.