Q_and_A_1645BC_19_R_0001.docx

1. Can you tell me if there is an incumbent contractor currently performing work for this requirement? If so, could you please provide their company name and contract number?

Datawiz Corporation DOL-MSH-15-F-00038

2. Regarding the four certification required in section 1.6.8. :

(a) Would the government please clarify the phrasing "....are required of the prime contractor and any subcontractor"? Is the government requiring both the prime and any/all subcontractors to each hold all four listed certifications? Or, is the government's requirement to ensure that collectively, the Offering Team, has all four certifications? (Be it for example: 4 and 0, 3 and 1, 2 and 2).

Prime needs to have all the certifications.

(b) The number of 8a companies that possess all four certifications is extremely limited. By requiring both the prime and the subcontractor to both possess all four certifications the government is creating a burden & limiting competition which will in effect increase the cost to government. Will the government consider revising the requirement to one which states that the PRIME contractor must hold all 4 certifications or that the Offering Team as a whole must possess all four certifications? The net effect of this change is anticipated to enable 8a firms with the certifications are able to team with other experienced companies that may or may not possess all four certifications, but do bring DOL institutional knowledge or other added values to the team and in the end to the customer.

PWS has been amended to show only Prime contractor to hold all four certifications. Amended PWS has been attached to this modification.

3. In reviewing the solicitation, we felt that this severely restricts the competition based on minimum certifications required. As such, we are requesting DOL to consider the following

(a) Page 40: Would DOL accept CMMI Dev(3) in place of CMMI Svcs (3)?

No – this is a services contract.

(b) Page 40: Would DOL accept ISO 9000:2015 in place of ISO 27001 or ISO 20000?

No.

4. Section 1.6.8 of the PWS states the contractor is required to have a CMMI Level 3 certification. This certification is typically utilized for contracts requiring software development, but the PWS requirements do not state the contractor will need to perform software development under this contract. We believe this requirement is unneeded and limits the pool of potential bidders. We would like to know if the requirement for a CMMI Level 3 certification can be removed?

No. Government requires CMMI Level 3 SVS certification to align the maturity level of the entire agency.

5. Section 1.6.8 of the PWS states the contractor is required to have an ISO/IEC 27001 certification. This certification is generally seen as an international standard for Cybersecurity in the commercial marketplace. However, the MSHA is a Federal agency and is required to meet federal cybersecurity regulations, such as NIST Risk Management Framework (RMF), utilizing the SP 800-37 as a guideline for applying Cybersecurity to Federal Systems. We believe this requirement limits the pool of potential bidders and should be replaced with the appropriate Federal guidelines. We would like to know if the ISO 27001 requirement can be removed?

MSHA requires all bidders to understand NIST RMF and other FISMA standards. MSHA also requires the successful bidder to be certified in those industry standards as described in question 4’s answer.

5. Can you please tell me what product this if for? It only states renewal dates with no vendor product name.

There is no product under discussion in the PWS.

6. Section 1.6.5 of the Performance Work Statement (PWS). Does the Project Manager have to be PMP certified? Could they have an equivalent or equal certification?

PMP is required for the PM role.

7. Does the government require a specific format for Volume III, price proposal?

NO

8. Will security clearances be required for the FTEs working on the contract? If so, at what level?

Public Trust - NACI

9. In addition to resumes, will letters of intent be required?

If the proposed team is currently employed by the bidder, letter of intent is not required. In case of new hire, Letter of Intent is required.

10. For the certifications outlined in 1.6.8 of the PWS, will proof/confirmation that certifications are pending suffice? Are there alternative/substitute certifications that will suffice?

The bidder must hold the certification at the time of submission. There is no substitute for these certifications.

11. Due to the four certifications required in section 1.6.8, the government is increasing likelihood of protest and limiting competition by requiring both prime and subcontractors to possess all four certifications. By proceeding in this fashion the government is likely to see an unnecessary increased cost of services. Will the government please consider revising the requirement in any of the following ways?

a) That the Offering team (comprised of prime and sub(s) collectively possess all four certifications

b) That the Offering team is required to possess any three of the four certifications

c) That the Prime contractor is required to possess any three of the four certifications See answer to Question 3, 4, and 5.

12. As per the Solicitation, section 1.6.8, Both Prime and Subcontracts must have all the following certifications to be eligible for award or if prime and subcontractors combined covers this requirement (Prime having some certifications and subcontractor covers remaining). Please clarify this.

See answer to Question 3,4, and 5.

13. Can a major subcontractor having the certs satisfy the requirement?

No. Prime needs to possess these certifications at the time of the submission.

14. Can a joint venture that is established under the SBA All Small mentor protégé program meet the ISO certification if the large business mentor holds the certs?

In case of a JV, JV needs to hold these certifications.

15. PWS Page 12 - Could the Government provide a list of commercial tools being used currently by MSHA for information security protection, scanning, monitoring, and/or response, assumed to be GFE?

HPE Dynamic Code Analyzer and Fortify Static Code Analyzer for applications and code scan. Infrastructure, OS and database scans are managed by the DOL.

16. PWS Page 22- Given the relatively small size of the expected contract in terms of number of staffs, would the Government obviate the requirement to complete and submit Past Performance Questionnaires by Government customer POCs?

No.

17. PWS Page 13, Section 4.3- Is any of the requested positions to be designated as Key Personnel?

All the positions are KEY as mentioned under section 4.3.

18. RFP Page 2 of 35- Will the Government please provide the correct dates for Base Year and Option Year I Period of Performance?

Period of performance will be re-established after the award of this contract.

19. PWS Page 1 -Will the Government please verify the performance period dates indicated against those stated on the RFP Optional Form 336?

Please refer to the response of question #18.

20. RFP Page 1 of 35-Would the government consider a change to the proposal due date from Sunday, October 28th to Monday October 29th or that week?

Response Date is changed to Monday October 29, 2018 – 5:00 PM EST.

21. How will proposals be evaluated? Is this award on a LPTA or Best Value basis?

This will be evaluated as a best value procurement.

22. Page 21 – Proposal Format Are there any font/font size requirements for text, tables and figures?+ Times Roman 12 for the text. Arial 10 for the tables and figures.

23. We are in the process of getting ISO 27000 certification- would this be acceptable to MSHA? We feel that since we already have other ISO certifications, getting the additional cert to comply with the requirement would go very quickly.

The bidders must have all the certifications at the time of the submission.