Research Requirements for Finding Security Weaknesses in Selected Software

This is a combined synopsis/solicitation for commercial items prepared in accordance with the format in FAR Subpart 12.6, as supplemented with additional information included in this notice. FAR Part 13, Simplified Acquisition Procedures, are being utilized for this acquisition. This announcement constitutes the only solicitation; quotations are being requested and a written solicitation document will not be issued. This is a Request for Quotation (RFQ). This solicitation document and incorporated clauses are those in effect through Federal Acquisition Circular 2005-53. Offerors will be responsible for obtaining related amendments to this solicitation, if any, from www.fbo.gov. It is the responsibility of each potential offeror to monitor www.fbo.gov for any amendments or other information related to this solicitation. The associated North American Industrial Classification System (NAICS) code for this procurement is 541511. The National Institute of Standards and Technology (NIST) Information Technology Laboratory (ITL) is working with the U.S. Department of Homeland Security National Cyber Security Division to improve the state of the practice in software assurance. The Software Assurance Metrics and Tool Evaluation (SAMATE) project at NIST (http://samate.nist.gov/ ) is dedicated to improving software assurance by developing methods to enable software tools evaluations, measuring the effectiveness of tools and techniques, and identifying gaps in tools and methods. One approach to help increase the use of software analysis tools and improve such tools is to hold expositions for these tools. The Static Analysis Tool Exposition (SATE), held annually by NIST, is designed to advance research (based on large test sets) in, and improvement of, static analysis tools that find security-relevant defects in source code. Briefly, participating tool makers run their tools on a set of programs. Researchers led by NIST examine subsets of warnings from tool reports. As one method of selecting the subsets of warnings, the programs are analyzed to identify the high severity weaknesses. Any warning from a tool that corresponds to an identified weakness is included. For additional background information, see http://samate.nist.gov/SATE.html This procurement addresses a requirement for a contractor to determine the high severity weaknesses in a program listed at http://samate.nist.gov/SATE4/resources/testcases/. "Severity" is defined as the estimate of the security relevance of the weakness. The Contractor shall provide services in accordance with the attached Statement of Work. All responsible offerors that can meet the attached requirements are invited to submit quotations in accordance with the instructions below. NIST reserves the right to award a purchase order without discussions, based solely on the submission of the Contractor. EVALUATION FACTORS FOR AWARD: The award will be made to the responsible authorized offeror whose technically acceptable quotation is deemed to represent the lowest price. In order to be technically acceptable, an offer must demonstrate that the offeror can perform the specific tasks and meet the specified deliverables in accordance with the attached Statement of Work. All offerors must be registered in CCR (https://www.bpn.gov/ccr/default.aspx) in order to be considered for award. Any communications regarding this acquisition must be made via email to Divya Soni at contact@example.gov and shall identify the solicitation number, company name, company address, as well as point of contact email address and phone number. All quotations shall be submitted electronically to contact@example.gov referencing the solicitation number.