RFP 2011-N-13073 Questions Answers Round 4.docx

July 6, 2011

RFP 2011-N-13073

Subject: Questions and Answers Round 4

QUESTION 1: On page 75 of the RFP, it says system security plan (SSP) should be included in the offeror's response and indicates it should be a "brief and general narrative description of the system and it's integration with the CDC Network Infrastructure and should follow the format and guidelines of NIST SP 800-18"; however later on that page it states that "details contained in the Offer's draft SSP shall include NIST SP-800-53 security control baselines for moderate impact system." NIST 800-53 for moderate systems contains approximately 150 controls that must be addressed. For the draft SSP submitted with the RFP, what level of detail does CDC want? Specifically, do you want each of the applicable NIST 800-53 individual controls addressed or does that just need to be addressed by the chosen offeror?

ANSWER: The confidentiality, integrity and availability assessment of moderate is only an example. The system will be assessed during the certification and accreditation (C&A) process as a low, moderate or high. The mandated NIST SP 800-53 controls must be successfully completed for the system to receive an Authority To Operate. The C&A boundary can be extended to encompass externally hosted systems/databases as long as compliance with NIST SP 800-53 is attained. We will not start the C&A process until after the contract award. The moderate used in the IT Security verbiage is only meant to be a sample.

QUESTION 2 : What percentage of the total effort for the project could be subcontracted to a woman-owned small buiness if a specific skill set is needed?

Answer: That is left up to the indidvidaul offeror/ prime to decide. However, regulations require that the prime complete at least 51% of the effort.

QUESTION 3: We want to understand if we will be taking possession of the current servers (hardware) with all of the existing content, data, and SharePoint infrastructure already in place. Or will we be transferring / porting the data and content to our own servers and re-implementing the structure on our servers. The former of course requires less effort than the latter.

ANSWER: The existing content, data, and SharePoint infrastructure are currently housed on servers leased by the current contractor from a third-party provider. We hope to transfer the remainder of the lease from the current contractor to the new contractor, if the contract can be awarded and the new contractor is prepared to take over the lease within the time allotted, in order to avoid any interruption of access to the online training. The new contractor will then have the option of extending the agreement with the third-party server provider or transferring the data and content to other servers in such a way that grantee access is maximized.