Attachment_3_Solicitation_Amendment_1_Questions_and_Answers_0001.pdf

1. Clarify On site services - Is this a 5 day project or is this a six month project (due date of 11/30 is noted). Assuming this is running the project over a six month period.

RSA SecureID will be on site working for 5 days a week for a period of 6 months from the date of contract award.

2. What is the relationship to RSA project management? A RACI chart would help to understand the relationship between this resource, RSA and the DIO.

A RACI chart I do not have at this point. Upon contract award vendor will be conducting pre-engagement teleconference to plan and schedule the engagement’s tasks.

3. Are the deliverables under the service brief the items that will be provided by RSA and/or the DIO (or a combination)?

Deliverables, those are a combination of both RSA SecureID and DIO. We are to have the environment ready for engagement and provide at least 1 Admin personnel to work with RSA SecureID on the engagement.

4. If RSA is already engaged, what phase of the project are they in?

RSA SecureID delivered the Identity Manager Appliance for the SDDC project and provided technical support with setting up that device and configuring it.

5. Does the validation of functionality tasks include creation of test scripts or do those already exist?

Since this project is to provide an MFA solution to all program applications that will not work with HSPD-12 (PIV) cards using test scripts to validate operational status would defeat the MFA requirements on the deliverable.

6. Is the customer currently using MFA?

The customer is DIO, and we have partial MFA within the Indian Affairs domain. RSA SecureID is being contracted to provide DIO with an overarching MFA platform that will bridge the gap for the applications that do not support HSPD-12 (PIV) authentication and those customers of DIO that do not have HSPD-12 (PIV) cards to do MFA while using applications that Indian Affairs offer for Tribal use.

7. Is end user training and deployment of tokens required? If yes, how many users?

The training of DIO end Users is required for all admins that will be managing the MFA platform. The number of Token deployments depends on the total number of programs that tribal members use. The directive is to provide an MFA solution to all public facing applications, the use of that solution is not mandatory from the public side.

8. Is RSA securID Access Authentication currently deployed for other systems?

Currently RSA solution is used in the DIO's SDDC solution. That solution is for internal use only. The requested RSA professional services contract is to expand the use of the current RSA solution and to offer an enterprise-wide MFA solution to all non- Department Employee and contractor.

9. Will MFA be enabled for all users of the target systems or only privileged users?

This solicitation is to provide MFA to every application that doesn't support the HSPD-12 (PIV) MFA solution. So YES, MFA will be used for all users and admins.