15F06718R0000093_Questions_and_Answers_Final.pdf

RFP 15F06718R0000093 Questions and Answers

1. One thing that is not obvious in the solicitation is Place of Performance. I’ve heard different things, will it be in DC or Chantilly, VA? This definitely matters for recruiting efforts.

a. At present, the Government expects the primary place-of-performance will be at the FBI’s facilities located in the Penn Quarter area of Washington D.C. However, off-site FBI locations in the Northern Virginia area (e.g., Chantilly, VA) may be made available.

2. Will a virtual test environment based on the FBI environment (standard images) be available for the Red Team to practice Tactics, Techniques and Procedures (TTPs)?

a. Each offeror is expected to propose their unique and innovative approach (including any and all assumptions and dependencies) for designing, building, and operating a security lab relative to Red Team TTPs.

3. Will the awarded contractor have access to the current suite of security tools used by the FBI?

a. At present, the Government intends to make available the Contractor’s access to as many of the current suite of security tools utilized by the FBI that circumstances will allow.

4. Should all personnel be cleared to TS level?

a. All contractor personnel directly supporting this program are required to have a Top

Secret security clearance and must be eligible for Sensitive Compartmented Information (SCI) access.

5. Will FBI require and facilitate polygraph for SCI Access?

a. The FBI will sponsor applicable personnel for SCI access.

6. Will the government clarify the number of separate volumes they would like to receive? (ie Should 5 separate volumes be submitted; one for each subsection?)

a. Proposals shall be presented electronically, in three (3) separate files, named as follows:

“PrimeContractorName_REBL_VolOne,” “PrimeContractorName_REBL_VolTwo,” and “PrimeContractorName_REBL_VolThree,”. The information presented with Volume One shall only consist of Subsection 1 of the RFP’s instruction for proposal preparation; the Offeror’s proposed PWS. The PWS shall be no greater than twenty-five (25) pages, exclusive of front and back cover pages and table of content. Full-page diagrams shall be counted as one (1) of the twenty-five (25) page limit. Volume One shall be presented in a format compatible with MS Word. The information presented with Volume Two shall consist of Subsection 2 (Past Performance) and Subsection 3 (Staffing Plan) of the RFP’s instruction for proposal preparation. There is no page-limit for Volume Two. The information presented with Volume Three shall consist of Subsection 4 (Cost Proposal) and Subsection 5 (Basis of Estimate) of the RFP’s instruction for proposal preparation.

The cost information shall be presented in a format compatible with MS Excel in both a locked and unlocked version. The Basis of Estimate shall be presented in a format compatible with MS Word. There is no page limitations with Volume Three.

7. Would Red Team actions include physical security testing?

a. The Government expects that there will be an element of physical security testing in

Red Team actions.

8. Please confirm 25-page limit only refers to Technical Approach (Performance Work Statement) and that the Past Performance, Staffing Plan, Cost Proposal, Basis of Estimate and Resume submittal do not have page limits as they are based on the offeror’s approach.

a. See response to Question No. 6.

9. The RFP makes reference of a draft Award Fee Plan forwarded with the solicitation, however, no such document was provided. Would the Government please provide the draft Award Fee Plan?

a. The applicable draft Award Fee Plan is available at the associated Federal Business Opportunities (FBO) posting as of 11:59 Eastern Time Zone, June 29, 2018.

10. Given the likelihood of varying approaches in meeting the Government’s objectives, vendors may be disincentivized to offer innovative solutions requiring materials and equipment expenditures. Would the Government please provide offerors a “plug figure” for equipment, materials, and other direct costs associated with this contract to allow the government to fairly evaluate all offers?

a. Each offeror is expected to propose their unique and innovative approach (including any and all assumptions and dependencies) for the Government achieving the Objectives delineated at the applicable Statement of Objectives.

11. Will this work be performed at contractor facilities or only FBI facilities? If contractor facilities are expected to be used at any point during life of this contract, please confirm the contractor should propose “off-site rates”?

a. At present, the Government considers it is possible that certain unclassified or general tasks may be performed at a contractor facility.

12. Can Government please confirm that proposal submittal is electronic only, submitted to the Contracting Officer at email address: bchrostowski@fbi.gov?

a. See the response to Question No. 6. The email address applicable to proposal submission is as follows: bchrostowski@fbi.gov.

13. Once operational, what is the expected number of assessments that will be performed monthly and annually? What is the expected maximum and minimum number of assessments that can be expected to run concurrently?

a. The Government expects each offeror to reference the Background section of the Statement of Objectives. Each offeror is expected to propose their unique and innovative approach (including any and all assumptions and dependencies) for designing, building, and operating a REBL program. As regards the competition for award of any resulting contract, each element of the Offeror’s proposed approach (such as the planned number of assessments, travel, staffing, etc.) will impact the evaluation of all remaining elements comprising the total approach.

14. May the Government please provide the validity period for proposals?

a. Proposals must be valid for one-hundred and twenty (120) days from the proposal due date.

15. Given the requirements in pages 120 and 109 of the RFP, we understand that the Government expects a proposal submission of six (6) volumes or separate parts each to be submitted as separate files. Is this a correct understanding, or is the compensation plan part of one of the 5 volumes or parts stated on RFP page 120 and if so, which volume?

a. See response to Question No. 6.

b. Compensation Plans should be presented at Volume Three.

16. Please provide a draft DD-254.

a. The associated DD Form 254, Contract Security Classification Specification, will be included as an attachment to any resulting contract.

17. Please confirm submission of ARQ and KMPL are not required with proposal. Please confirm these forms are not considered a factor in evaluating risk under the evaluation process.

a. The submission of the ARQ and KMPL are not required to be submitted with the proposal.

mailto:bchrostowski@fbi.gov mailto:bchrostowski@fbi.gov

b. The information presented with the ARQ and KMPL will not be evaluated in the course of the associated contract award process.

18. The RFP includes FAR clauses that require completion by the Bidder (i.e. 52.204-17, 52.222-25, etc.) Please indicate in which section/volume the Government would prefer for Bidders to include this information.

a. This information should be included within the signed copy of the proposal that is submitted to the Government. Any additional forms should be included in Volume Three.

19. Proposal submission is via email directly to the Contracting Officer; please confirm via RFP modification and/or in FBO.

a. See answer to Question 12.

20. Due to size of submission, please confirm maximum limit for email attachments.

a. Attachments must be no larger than 10MB.

21. Does the Government have a preferred nomenclature for splitting up the proposal sections or volumes specified in the RFP including those in listed in page 109 under paragraph titled “REBL Plus Proposal Content” and RFP 120 (Compensation Plan) and any other required content.

a. See answer to Question 6.

22. Please clarify the Government’s intent on quantity of awards to be made under this RFP.

a. At present, the Government intends to make a single award.

23. Is it allowable to propose base fee and award fee?

a. See Federal Acquisition Regulation (FAR) Subpart 16.305(a), Cost-Plus-Award-Fee Contracts.

24. Based on government past experience, on average, how many Red Team, Blue Team, and Enterprise Compliance & Continuous Monitoring Support Team remote technical assessments did the FBI conduct annually?

a. See response to Question 13.

25. On average, how many Red Team, Blue Team, and Enterprise Compliance & Continuous

Monitoring Support Team remote technical assessments does the FBI expect to conduct under this contract?

a. See response to Question 13.

26. On average, how many Red Team, Blue Team, and Enterprise Compliance & Continuous

Monitoring Support Team technical assessments requiring travel did the FBI conduct annually?

a. See response to Question 13.

27. On average, how many Red Team, Blue Team, and Enterprise Compliance & Continuous Monitoring Support Team technical assessments does the FBI expect will require travel under this contract?

a. See response to Question 13.

28. On average, what was the length of time to conduct technical assessments in past by Red Team, Blue Team, and Enterprise Compliance & Continuous Monitoring Support Teams?

a. See response to Question 13.

29. May the Government please confirm that Letters of Commitment are required only for key personnel proposed that are not currently employees of the offeror’s company?

a. As clearly stated at the Solicitation’s proposal preparation instructions, “The resume and a fully executed Letter of Intent (as applicable) for any individual proposed as key to the success of the offeror’s approach (i.e., a Key Personnel)”.

30. Can Classified Past Performances be submitted? If so, please provide an email address where appropriate past performances can be submitted to.

a. No classified information should be presented in response to the solicitation of past performance.

31. If the Government does not allow Classified Past Performances, would the Government at least consider classified past performances that are/were performed with the FBI, as these showing greater knowledge and understanding of the FBI’s technology, networks, and personnel.

a. See response to Question 30.

32. Will the Government please define what is meant by Sub Area in the Fee Plan?

a. Annex 4 of the Draft Award Fee Plan represents the Government’s current plan for communicating applicable point distribution and weights during the execution of the award fee.

33. What metrics will be used to determine performance or is the Government only using subjective measures to determine performance for this engagement?

a. The Government expects each offeror to reference the content of the Draft Award Fee Plan, within such is the complete delineation of the process currently envisaged for administering the planned award fee process is delineated.

34. Will the Government provide specific rating criteria by sub factor in the annex?

a. See the response to Question 32.

35. Please provide minimum Font Size for Responses.

a. Proposals shall utilize normal 1 inch margins with 11 point Calibri font.

36. Does the FBI expect the Red Team to staff personnel at the government facility 24x7x365? Or does on call support with a pre-determined response time meet this requirement?

a. The FBI does not expect 24x7x365 staffing to support this program. Each offeror is expected to propose their unique and innovative approach (including any and all assumptions and dependencies) for designing, building, and operating a REBL program.

As regards the competition for award of any resulting contract, each element of the Offeror’s proposed approach (such as the planned number of assessments, travel, staffing, etc.) will impact the evaluation of all remaining elements comprising the total approach.

37. Is the SA&A and Continuous Monitoring effort intended to be conducted remotely or are regular on-site assessments required? Can the government clarify which security controls will need to be covered?

a. SA&A and CM security control assessments are conducted remotely; however, there may be cases where an on-site effort is required. The program is not the primary security control assessor for the FBI; rather it will support the technical security assessment portion of FISMA and ICD 503.