Questions_and_Answers_0002.pdf

Q1. What security protocols and access control measures are in place to prevent unauthorized access and ensure data integrity?

A1. To prevent unauthorized access and maintain data integrity, security protocols typically include:

strong password policies, multi-factor authentication (MFA), encryption, firewalls, access control lists (ACLs), frequent vulnerability scans, regular security audits, monthly system patching, file integrity checking, and user access controls based on the principle of least privilege.

Q2. What is the payment structure for the project? Is it split into half upfront and half upon completion, or is another method used?

A2. Payment is submitted through IPP. Since this is a service, it can be in portions, such as quarterly.

However, it must be when work is fully completed, then the invoice may be submitted to IPP with period of performance, service and dollar amount to match invoice. No payment is made upfront and no prepayment allowed. This goes for each task order that is submitted.

Q3. What does the internal infrastructure consist of, including the database architecture, AWS environment, and other relevant components?

A3. The infrastructure consists predominately of Linux virtual machines running on VMware ESXi hosts.

The virtual environment consists of a set of hosts and a Storage Area Network. DBMS are typically either PostgreSQL, MySQL or SQLite. Schemas for AQMS, Winston and other major software used are typically available at each application's Git repo. Ansible is increasingly being used for configuration management. Many of the software suites use message-oriented-middleware such as ActiveMQ or NATS. Both commercial AWS and USGS CHS AWS environments are used.

Q4. Does the current database access model follow a Zero Trust approach, role-based access control (RBAC), or a combination of both?

A4. Zero Trust and RBAC are employed at various points within the network and systems.

Q5. How will revisions and updates to ShakeAlert resources be managed post-implementation?

A5. All ShakeAlert updates are managed by a Gitlab repository for any changes that are propagated to the system. Ansible is used to manage implementation of revisions and updates.

Q6. What role does ActiveMQ play in the current system architecture, and how is it integrated with other components?

A6. ActiveMQ and NATS are the message-oriented-middleware packages used to read and write messages to pre-defined topics and communicate information throughout the ShakeAlert system.

Q7. In C. Past Performance, Reference Information Sheets are referenced to list relevant contract activities. Will the Government release this document?

A7. You may list relevant contract activities on a sheet of your choice and submit with proposals.

Q8. The pricing template does not have any guidance. Will the contractor be able to provide labor category and pricing for IDIQ level and labor category and hours for the task order pricing?

A8. Yes, the contractor will provide pricing for however they plan on doing the work. You may submit as labor categories of firm-fixed priced price for the entire IDIQ and the first task order. Please be sure to include the total amounts.

Q9. Will the Government consider accepting the proposal using the NAICS code to 518210, which is more relevant to the work required in the SOW?

A9. The Government will accept and review all proposals submitted by small businesses by the cutoff date. Selection will be based on the criteria listed as well as pricing.