Solicitation_Questions_061317.pdf

# Received RFP Section

RFP

Page

Section Title RFP Language Question Answer

The requirement as stated requires clarification. The database tables, the ERD and the interface point’s documentation can certainly be created for the DCS for the BEP. However, we are not sure what is meant by “and all subsystems”. Do you mean also those subsystems outside the DCS and if so, which subsystems?

All subsystems of the DCS are required to be documented.

Secondly, what is meant by “all calculation items” and “all DCS functions and processes”?

Any algorythims that are used for computations, need to be documented. Values that are used for performing various functions, needs to be documented.

2 6/7/2017 H.25 105 INTERNET

PROTOCOL VERSION

6 (IPV6)

In accordance with BEP Directives, this acquisition requires all functionality, capabilities and features to be supported and operational in both a dual‐stack IPv4/IPv6 environment and an IPv6 only environment. Furthermore, all management, user interfaces, configuration options, reports and other administrative capabilities that support IPv4 functionality will support comparable IPv6 functionality. The Contractor is required to certify that its products have been tested to meet the requirements for both a dual‐stack IPv4/IPv6 and IPv6 only environment. BEP reserves the right to require the Contractor’s products to be tested within a BEP or third party test facility to show compliance with this requirement.

In accordance with FAR 11.002(g) and BEP Directives, this acquisition must comply with the NIST USGCB Profile and IPv6 Test Program. The Contractor must fund and provide resources necessary to support these testing requirements.

The above paragraph contradicts C.5.3.11 (4) I have only added the relevant excerpt from C.5.3.11 (4) below:

In accordance with BEP Directives, this acquisition requires all functionality, capabilities and features of non‐embedded IT components to be supported and operational in both a dual‐stack IPv4/IPv6 environment and an IPv6 only environment. Any IT component or system utilizing a second internal network for connecting to a press or machine network must use a separate NIC for such a connection and is considered an embedded IT component or system; as such this component is exempt from the “IPv6 only” requirement as it relates to this separate NIC because the machine network may use “IPv4 only” or a proprietary protocol.

Please confirm that C.5.3.11 (4) will take precedence.

As per Federal mandate, all connections to the BEP network must support IPv6. If there is a second NIC in use and not connected to the BEP network, the vendor will be allowed to use IPv4.

3 6/7/2017 H.31 108 SECURITY

TECHNICAL

IMPLEMENTATION

The Contractor must certify applications are fully functional and operate correctly as intended on systems using the Federal Desktop Core Configuration (FDCC)\United States Government Configuration Baseline (USGCB).

The standard installation, operation, maintenance, updates, and/or patching of software must not alter the configuration settings from the approved FDCC\USGCB configuration. The information technology should also use the Windows Installer Service for installation to the default “program files” directory and should be able to silently install and uninstall.

Applications designed for normal end users must run in the standard user context without elevated system administration privileges.

The Contractor must apply due diligence at all times to ensure that the required level of security is always in place to protect BEP systems and information, such as using Defense Information Systems Agency Security Technical Implementation Guides (STIGs).

The above paragraph contradicts C.5.3.11 (1) I have only added the relevant excerpt from C.5.3.11 (1) below:

(1) Managing Cybersecurity Risks BEP reserves the right to request the vendor provide information related to the non‐ embedded IT components and how the vendor solution may be configured or implemented for supporting management of cyber risks in accordance with FAR 39.10; compliance with Federal Information Security Management Act (FISMA) (44 U.S.C. 3544); OMB’s implementing policies including Appendix III of OMB Circular A‐ 130; and guidance and standards from the Department of Commerce’s National Institute of Standards and Technology (NIST). To assist with scoping, BEP has identified the following Federal Information Processing Standards (FIPS) that are applicable to the non‐embedded IT components that may be present within the vendor solution:

Please confirm that C.5.3.11 (1) will take precedence.

C.5.3.11 (1) is complimentary to H31.

1 A complete detailed design document for the Data Collection System (DCS) and all subsystems shall be provided. The documentation shall include a complete isting of all database tables, entity‐relationship diagram (ERD), all calculation items, interface points, DCS functions and processes, process flow diagrams, hardware and software configurations and a glossary of all terms and entries.

Electronic Database Documentation

69C.6.4(5)6/7/2017

4 6/7/2017 H.32 108 FIPS140

ENCRYPTION

REQUIREMENTS

Cryptographic modules used to protect BEP information must be compliant with the current FIPS 140 version and validated by the Cryptographic Module Validation Program (CMVP). The Contractor must provide the validation certificate number to BEP for verification. Encryption is required to protect federal and contractor data when transmitting between systems.

KBA‐NotaSys assume the ns‐LEPE press is considered one system and therefore there is no requirement for encrypted communication between internal press components; the requirement for encryption exists only between systems but not between internal components of one system. It would not be feasible to encrypt communication between press controllers without compromising press functionality. Can the BEP confirm this assumption is consistent with this requirement?

Onpress does not require encryption. Offpress encryption must be used at a minimum for web and passing credentials.

5 6/9/2017 C.5.1.26 44 PRODUCTION

CONFIGURATIONS

(Select paragraphs)

Sheet Cutting: Operation of cutting/packaging section of the ns‐LEPE is in stand‐ alone mode. The cutting/packaging section may be manually loaded for cutting of sheets into straps and packaging.

B – Stand‐alone Cutting: Operation of the cutting/packaging section of the machine in standalone mode. Manual feeding of stacks of sheets into the system.

The ns‐LEPE shall be configurable for the following productions modes:

Sheet Cutting: Operation of cutting/packaging section of the ns‐LEPE in stand‐alone mode. The cutting/packaging section may be manually loaded for cutting of sheets into straps and packaging.

And then in the next paragraph it has:

Special Operational Modes: The ns‐LEPE shall be operable in the following special modes:

B – Stand‐alone Cutting: Operation of the cutting/packaging section of the machine in stand‐ alone mode. Manual feeding of stacks of sheets into the system.

Can the BEP please explain if there is a difference between these two production modes?

No, they are the same mode.

6 6/9/2017 C.7 78 Options Nowhere in the solicitation does it define the dates for which the options can be exercised. If the machines were purchased one after the other with the next option being exercised at the time of the BAT of the preceding machine, it could conceivably be that the last machine would not be purchased until 11 years after the first machine.

Can the BEP provide better guidance here for manufacturing and pricing purposes?

The options for the additional ns‐LEPE is for the new facility. Since we will not know if we are getting one or re‐furbinishing the existing until 2022, options are requested to be good til then.

7 6/9/2017 C.6.20 76 Start Up Assistance (Paragraphs 1 & 2 only) After completion of the Testing and Training, the contractor shall assist the BEP in the transition of the equipment into full production with “live” product. The BEP will operate the ns‐LEPE for a six months period (Extended Run), during which the system is to demonstrate the required Performance Requirements (Production, Spoilage, Mean‐Time‐Between‐Failure and Mean‐Time‐To‐Repair).

The Contractor's Printer/Instructor, Assembler/Mechanic, and Programmer/Electrician shall be on‐site to provide guidance and recommendations to BEP personnel during the extended operation of the ns‐LEPE. Each shall be present for two – 4 week segments. The BEP and contractor will coordinate on the weeks for the support services to be present, including the shifts they will support.

Other than for the first machine at each facility, is the start‐up assistance required on the additional optional machines?

Start Up Assistance is required on each machine delivered.