II_01 Attachment 4 - Questions and Answers MASTER LIST.xlsx
XLSX spreadsheet 59 KB Posted
- Attached to
- RFQ PROTECTS
- Solicitation number
- 2032H5-24-Q-00009
About this file
This document is a Request for Quote (RFQ) for the Department of the Treasury's PROviding Treasury Enterprise Cybersecurity Technology and Services (PROTECTS) program. The RFQ outlines the requirements for a Blanket Purchase Agreement (BPA) to provide a range of cybersecurity services and solutions, including security operations center (SOC) management, vulnerability assessments, threat hunting, incident response, and other related cybersecurity capabilities.
The RFQ is a total small business set-aside with a minimum of 5 expected awards. Offerors must have both the 54151HACS and 54151S SINs on their GSA Schedule contract to be considered responsive. Phase I proposals consisting of the Demonstrated Corporate Experience and Mock Scenario are due by June 17, 2024. Phase II submissions, including the Technical Capability, Price, and Oral Presentation, will be requested from selected offerors after the Phase I advisory downselect. Pricing is required using the provided template, with labor categories and rates mapped to the offeror's GSA Schedule. There is no incumbent, as this is a new standalone contract requirement.
View the file
Other files
Show all 20
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
RFQ Questions
| Providing Treasury Enterprise Cybersecurity Technology & Services (PROTECTS) | |||
| Questions and Answers | |||
| Number | Questions | Answers | |
| 1 | I saw an update, but it just referenced a FAR for consolidating. What was consolidated? | Please see attachment 10, D&F Consolidation for further description. | |
| 2 | Background/References: The RFQ cover letter states: “All questions or requests for clarification, citing the specific solicitation section, shall be posted on GSA eBuy by 28 May 2024 at 10:00 AM eastern | ||
| via attachment 4,” and RFP Paragraph 8.1, p. 31 states “All questions should be directed via eBuy by 28 May 2024 at 10:00 AM eastern;” however, the associated eBuy RFQ page states "“Questions will only be accepted via email at the following: jonathan.w.carney@irs.gov and alison.m.adamson@irs.gov." Question: How are Offerors to submit questions; via (a) eBuy, or (b) via email? | Questions can be submitted via GSA eBuy or email. | ||
| 3 | Background/References: The RFQ cover letter states "The Quoters must have BOTH 54151HACS and 54151S SINS to be considered responsive;" and RFP Paragraph 9.0, p. 42 states ""Quoters must have both 54151HACS and 54151S SINS under their MAS to be considered for this requirement," however, RFP Paragrapgh 2.0, p.6 states "The work shall be performed in accordance with all sections of this RFQ and the quoter’s contract awarded under the GSA MAS IT HACS SIN;" and the associated eBuy RFQ page specifies “MAS: 54151HACS – Cyber Hunt –“ as the applicable SIN. As the first two citations state both SINs are required, and the second two citations indicate only SIN 54151HACS is required, there is a conflict. Question: Since (a) SIN 54151HACS is a specialiized subset of SIN 54151S with the same overarching requirements, and (b) small businesses are not likely to have both SINs on their GSA MAS, the requirement for both SINs appears to unecessarily limit competition. Please confirm 54151HACS is the only SIN required for an Offeror to be considered responsive. | Quoters are required to have BOTH 54151HACS as well as 54151S. | |
| 4 | Does the offerer need to be on the GSA schedule in order to bid on this requisition? | Yes. | |
| 5 | Could the Government please confirm that only Phase 1 (Factors I and II) are due on June 6, 2024 at 10am EST via eBuy? | In accordance with Amendment #2, Phase I (Factor I and II) is due on 17 June 2024 at 10am EST via eBuy. | |
| 6 | On page 3, the RFQ states that the Quoter must have both 54151HACS and 54151S SINS to be considered responsive. Would the Government confirm that it is acceptable for a Quoter to submit if one company has a HACS and one company has a 54151S SIN to meet all requirements? | That is acceptable only if there is a Teaming / JV agreement in place at time of Phase I submission. | |
| 7 | Can a company who has submitted for the IT70 SIN and is awaiting an award from GSA still submit for the opportunity due to the requirement to hold both IT70 and HACS SINS? | The quoter must be under contract and have the required SINS at time of Phase I submission. | |
| 8 | Are quoters able to include an executive summary introducing their team as part of the Phase I response? If so, are there any page restrictions? | No. Resumes are part of Phase II in the format provided. | |
| 9 | Shall the required signed cover letter by an authorized company negotiator to constitute agreement with all terms and conditions of this RFQ be submitted with Phase I response? | Yes - this is referenced on page 2. The cover letter referenced on page 34 for Volume III does not need to be signed by a company negotiator. | |
| 10 | (RFQ 8.5) May the offeror also submit an executive summary as part of Phase 1 submisison outside of page limitations? | No. | |
| 11 | (RFQ 8.5.1.1) May offeror submit a separate, single page Word/PDF attachment to the Demonstrated Corporate Experience, Factor 1 summarizing the submitted references and their similarity to the PROTECTS PWS scope? | No. Demonstrated Corporate Experience shall be submitted in the format provided (see Attachment 7). | |
| 12 | RFQ, page 2 |
Indicates "The quoter will submit a signed cover letter by an authorized company negotiator to
| constitute agreement with all terms and conditions of this RFQ." Please confirm that a cover letter is required to be submitted with Phase I, Volume I. | See answer #9. | ||
| 13 | If a cover letter is required with phase I, Volume I, please advise of any page limits that may apply. | See answer #9. Page limit is 2. | |
| 14 | RFQ, page 3 |
states that "Quoters must have BOTH
| 54151HACS and 54151S SINS to be considered responsive." Will the Government please confirm that bidders must have all five (5) sub-categories of the HACS SIN including High Value Asset Assessments, Penetration Testing, Risk and Vulnerability Assessments, Incident Response, and Cyber Hunt, in order to be eligible to bid? | Yes, bidders must have all five sub-categories of the HACS SIN. | |
| 15 | RFQ Section 8.5.2, page 35 | |
| Does the Government have an anticipated timeframe of when Phase I Advisory Down Select notices will be sent to Phase I bidders? | No. | |
| 16 | Section 8.5, pages 32 and 33 | |
| Due to the multiple layers of response required between enterprise and Bureau level functions, and the need for increased fidelity on a real-world scenario, will the Government please increase the page limit of Phase I, Volume I Mock Scenario responses to 15 pages? | No. | |
| 17 | RFQ Section 8.5.3, page 36 |
Indicates that bidders are to include their technical approach to the PWS Task Area. These Task Areas align to the Core Operational Framework areas 1 through 7 and do not align with the Functional Areas (PWS 1.8 through 1.14). Please confirm that the technical response for Phase II, Volume I requires that bidders provide their technical approach and capabilities for the Core Operational Framework areas #1 - #7 and are not required to address all of the requirements for each Functional Area in their response.
| If offerors are required to respond to Core Operational Framework areas and Functional areas, will the Government consider increasing the page limit to 35 pages? | Yes, 35 pages is acceptable. | ||
| 18 | RFQ Section 6.7, page 26 (Security Requirements Information Security Requirements/National Industrial Security Program (NISP) Requirements) | ||
| Will the Government confirm that a DD254 will be provided at the TO level? | DD 254 will be provided at the BPA and Task Order level. | ||
| 19 | RFQ 8.5, Quote Format, page 35 | ||
| Can the Government provide an approximate # of days allowed for bidders to submit Phase II, Technical Capability Statement after Advisory Down Select notification? | That will be specified as part of the advisory down select notification. | ||
| 20 | RFQ 8.5.4.1, Rules of Engagement #3, page 37 | ||
| The instructions state "The Quoter may not generally ask questions during the oral presentation. Any questions asked should only deal with logistics and conduct of the oral presentation." Please clarify that the Quoter may ask questions of the Government to clarify the question or validate technical assumptions. | Yes, however those questions will be very limited. | ||
| 21 | RFQ 8.5.4.1, Rules of Engagement, #1, page 37 | ||
| The instructions state "The Government will not provide the Quoter a copy of its written proposal submissions during the oral presentation." Please clarify that Quoter may bring to the Oral Presentation materials including its written proposal and other notes. | Yes, the Quoter is in control of the material it presents and may choose not to present or respond to any question provided by the Government. | ||
| 22 | RFQ 8.5.4.1, Table, portion 2, page 37 | ||
| The instructions state there is a 60-minute limit, 30 minutes for each question, answer, and clarifications. Please clarify that the 30-minute limit for each question applies to the Quoter's response, and does not include time for a) CO's asking of the question, b) Quoter clarification questions/CO answer, nor c) Government clarification after each Quoter's answer. | 30 minute limit for each question is inclusive of the question being asked by the CO, the quoters answer, and any follow-up clarifying questions by the program office. | ||
| 23 | RFQ 8.5.4.1, Rules of Engagement #4, page 37 | ||
| The instructions state "The Quoter is in control of the material it presents and may choose not to present or respond to any question provided by the Government." Please clarify that Quoter may present visual material during the answer to a question, whether on Teams (remote) or in-person. Examples may include a graphic, table, or other written material. | See answer to #21. | ||
| 24 | RFQ 8.5.4.1, Rules of Engagement #8, page 37 | ||
| The instructions state "The Quoter attendees shall mute their microphones when not speaking if the presentation is virtual." Please clarify that, if the presentation is virtual, Quoter attendees may mute their microphones while planning their response to questions. | No. The microphones are to be muted during the question portion. Once the question is ask, the microphones are to be on. | ||
| 25 | Could the government please clarify the number of files we need submit for Phase I in accordance with RFQ Section 8.5 Quote Format? | See RFQ table on pg 33 for Phase I Technical Quote requirements. | |
| 26 | Could the government please clarify in which Phase I sections we need to include a cover letter? | See answer to #9. | |
| 27 | Could the government please confirm that we need submit for Phase I Factor 1 in Excel file format (attachment 7, demonstrated corporate experience)? | Yes. Demonstrated Corporate Experience shall be submitted in the Excel format provided (see Attachment 7). | |
| 28 | Please confirm that we can submit City and State level Corporate Experience as well apart from federal level experience. | Yes, as long as it is within the same size, scope and complexity of the PWS. | |
| 29 | II_01 Attachment 1 - Price Template | ||
| Could the government please specify, in Price Template TAB 5, "the vendor has to put their published all LCATs with a rate from GSA MAS"? | The quoter must list their published LCATS from their GSA MAS Schedule in TAB 5. | ||
| 30 | II_01 Attachment 1 - Price Template | ||
| In the price template, it is mandatory for the vendor to provide additional labor categories for TAB 7? | No. | ||
| 31 | Ref: RFQ Section 8.5, "Quote Format," Page 34: Can the Government please confirm that the only required reference to the Offeror's Subcontracting Plan would be in "Volume III - Business Quote," TAB C, and therefore no teaming arrangements should be referenced as part of the Phase I submission? | Teaming arrangements in the form of CTAs or JVs are required as part of Phase I submission as part of the quoter signed cover letter in accordance with page 2 fot the RFQ. Major sub contractors are not required until submission of Volume III. | |
| 32 | Ref: RFQ Introduction, Second Paragraph, Page 3 states that "Quoters must have BOTH 54151HACS and 54151S SINS to be considered responsive." Does this mean that the Offeror's subcontractors must also have both schedules? | The quoters must have both SINS or a Teaming / JV that includes both SINS at the prime contractor level. | |
| 33 | Ref: RFQ Section 8.5.1.1, Paragraph 3, Page 34: Can the Government please clarify what is intended by, Item "#7, Current Status? Please provide an example of an adequate response to fulfill this requirement. | Please read attachment 7. Current status is the status of the experience referenced. | |
| 34 | REF: RFQ 8.5.6 Tab D (page 39) Representations and Certifications - where the government states, "...the representations and certifications currently posted at | ||
| https://www.sam.gov/portal/SAM/ have been entered or updated in the last 12 months, are current, accurate, complete, and applicable to this solicitation. Any changes to the Quoter’s Annual Representations and Certifications must be updated accordingly at https://www.sam.gov/portal/SAM/ prior to award." Will the government confirm which of the following are required as stipulated in this clause: 1. Offerors must be a qualified small business with SAM records updated in the last 12 months; 2. Offerors must be a qualified small business with SAM records updated to reflect current status as of time of proposal submission; and/or 3. Offerors must recertify their status as a small business and hold an active GSA schedule including SINs 54151HACS and 54151S prior to award? | The quoter is to ensure at time of submission that the representations and certifications are current, accurate and complete within the last 12 months. | ||
| 35 | Ref RFQ 1.2.1 (page 4) Treasury Small Business Goals: Will the government please confirm whether they intend to award BPAs across each socio-economic classification or whether all awards will be considered as General Small Business Set-Asides? | Treasury will award to the highest rated contractors in accordance with the RFQ. | |
| 36 | Ref RFQ 1.2.1 (page 4) Treasury Small Business Goals: Does the government anticipate setting Call Orders under this BPA aside for specific socio-economic classes? | Not at this time. | |
| 37 | Ref RFQ 6.18 (pages 28 and 29) On-Ramping: Where the government states, "During this process the Government may allow existing Prime Contractors/Team Leads the opportunity to restructure existing teams. This open season will allow the existing Prime Contractors/Team Leads to add new team members, delete current team members, and/or otherwise revise teaming arrangement(s) to respond to future PROTECTS Order requirements," will the government please confirm that subcontractors can be added at the discretion of the BPA holder to address specific Delivery Order requirements throughout the life of the BPA without requiring any modification or approval from the government? | The subcontractors are the responsibility of the contractor to manage in order to meet the requirements under the BPA. Teaming and or JVs are not considered subcontractors. | |
| 38 | Will the government please modify the RFQ section 8.5.1.1 (page 34) to ensure consistency with Attachment 7 - Demonstrated Corporate Experience. Currently, the RFP reads "A minimum of three federal or commercial examples…" while the Attachment 7 reads "Only three federal or commercial examples". Please clarify whether offerors should submit a minimum of 3 or only 3. | It is only three. | |
| 39 | Ref RFQ Section 8.5.3 (page 36): where the government states, "The Offeror may also propose alternate key personnel using Attachment 5 – PROTECTS Resume Template and provide rationale in section three in the resume template," will the government confirm whether offerors may propose more than 3 Key Personnel, or must any proposed "alternative" Key Personnel be offered as a replacement for one of the required 3 Key Personnel? | The contractor can submit additonal key personnel to those listed in Appendix 6. They will be evaluated as part of Phase II, Factor 3. | |
| 40 | Ref RFQ Section 8.5.3 (page 36): where the government states, "The Offeror may also propose alternate key personnel using Attachment 5 – PROTECTS Resume Template and provide rationale in section three in the resume template," will the government confirm whether additional or alternative Key Personnel must also participate in oral presentations? | The key personnel must be part of the oral presentation as outlined. | |
| 41 | Ref RFQ section 9.0 (page 42): where the government states, "Quoters must have both 54151HACS and 54151S SINS under their MAS to be considered for this requirement," will the government please confirm that, in the event multiple GSA schedules are referenced on a offeror's quote, that EACH GSA schedule referenced to support pricing must have both SINS included? | Both SINS are required as part of the Quoters submission. | |
| 42 | Ref RFQ section 9.1 (page 42): As this requirement is a small business set-aside, will the government please confirm that the Corporate Experience component of Phase 1 will be evaluated as an aggregate assessment of the 3 Past Experience references vs. evaluating each experience reference individually for coverage of entire program size, scope, and complexity. | Corporate experience will be evaluated as an aggregate and will receive one confidence rating. | |
| 43 | Ref RFQ (page 2) where is states "The quoter will submit a signed cover letter by an authorized company negotiator to constitute agreement with all terms and conditions of this RFQ.” Will this cover letter need to be submitted with phase 1 separately, or with the mock scenario? Does a cover letter also need to be submitted with phase 2 as well? If so, which section? | See answer #9. | |
| 44 | 8.5.6 Vol III: Business Proposal, Tab B - Quality Assurance Surveillance Plan (QASP). Given that this Volume will not be rated, will the government consider removing the Tab B requirement at award and make it a deliverable due 15 days after business award (aligning with the Task 2.2.5.1 deliverable)? If not, please provide the requirements for the QASP. | No, submit a draft QASP as part of Tab B. The final QASP will be negotiated with the successful vendors after award. | |
| 45 | Will Treasury require the small business to recertify? |
1.2 Set Aside Information, Page 3
"Pursuant to FAR 8.405-5, this acquisition will be a total set aside for small business. The Treasury intends to award a minimum of five (5) vendors under the BPA. GSA and/or Treasury reserves the right to add more vendors during the evaluation process."
6.18 On-Ramping, Page 28
"On-Ramping. The BPA Contracting Officer has determined that it is in the Government’s best interest that at all times during the term of the BPAs, there remain an adequate number of small business BPA holders eligible to compete for orders. Recognizing this, Treasury intends to review the total number of BPA holders participating in the ordering
| process one year after BPA establishment (then annually thereafter) to determine whether it is in the best interest of the Government to issue an amendment for purposes of adding additional small business BPA holders. Over time, the total number of BPA holders may fluctuate due to various reasons including industry consolidation, significant changes in the marketplace or advances in technology, general economic conditions, the Government's exercise of the off-ramp process, or other reasons. The Government is under no obligation to solicit or establish additional BPAs. This is a discretionary unilateral authority of the Government." | No, once awarded the BPA the quoter will be considered a small business as long as they are operating under the BPA. | |
| 46 | 8.5.2 Advisory Down Select: p 35 | |
| Can the Government provide an anticipated timeline (# of days) from notification to submission dates by Phase? | See answer #19 | |
| 47 | Service Level Agreements (SLAs): | |
| • Question: Could you provide more detailed information on the performance metrics and Service Level Agreements (SLAs) that will be used to evaluate the contractor's performance, particularly in relation to incident response times and system availability? • Rationale: Clarity on SLAs and performance metrics is crucial for planning resources and ensuring the ability to meet contractual obligations. | This will be defined at the task order level. | |
| 48 | Transition and Integration: |
• Question: Can you provide more details on the expected transition period and any specific integration requirements with existing government systems and services, including any support required from the incumbent contractor?
| • Rationale: Detailed information on the transition period and integration requirements will help in planning the transition smoothly and ensuring continuity of services without disruption. | Transition period will be determined at the Task Order level and will be between 60-120 days. The transition plan submission is due 15 days after the award in accordance with PWS Sections 2.2.3.2 and 2.1 deliverable table. It is the Government's expectation there is continuity of service with no interuption. | |
| 49 | Service Priority Weighting: |
• Question: "How will the criteria for managed service providers be weighted in terms of service priority, and what factors will be most critical in the evaluation process?"
| • Rationale: Understanding how service priority will be weighted and which factors are most critical will help in prioritizing aspects of the proposal to align with the government’s evaluation criteria. | They will be evaluated as defined in the RFQ Section 8.5.3 | ||
| 50 | RFQ Page 36, Section 8.5.4.1. Can the responsible corporate official participate in the Oral Presentation? | The responsible corporate official is required per 8.5.4.1 'Oral Presentation Participants'. | |
| 51 | RFQ Page 39, Section 8.5.6. For the Draft Quality Assurance Surveillance Plan (QASP), we request clarification on the QASP instructions and evaluation criteria. Specifically, will the government provide detailed guidance on the requirements and expectations for developing the QASP, including any mandatory elements or sections? Additionally, could the government please provide information on how the Draft QASP will be evaluated, specifically the evaluation criteria and the process that will be used to assess the adequacy and effectiveness of the QASP in meeting the contract requirements? | See answer to #44. | |
| 52 | RFQ Page 42, Section 9.2. Will the Factor 2 - Mock Scenarios A and B be evaluated together so offerors can cross reference sections to save page space? | Factor 2 will be evaluated as one. | |
| 53 | RFQ Page 21, Section 6.1 states, "The contractor shall identify one person as the lead and key personnel who shall provide management, administrative, and technical interface between Government and contractor personnel in the day-to-day performance of the contract. An important element of this requirement is the ability for the contractor to provide expertise as needed." Could the Government please clarify if this person is in addition to the Program Manager (PM)? | This individual is the Program Manager. | |
| 54 | RFQ Page 21, Section 6.1 Key Personnel states, "All proposed personnel performing risk and vulnerability testing shall hold a current, active, and favorably adjudicated U.S. Government background investigation, minimum Office of Personnel Management Tier 2 (Background Investigation)) in which Department of Treasury can accept reciprocity." Could the Government please clarify what this means? Specifically, is this equivalent to a Public Trust clearance? | Yes, a Public Trust clearance is equivalent. | |
| 55 | RFQ Page 36, Section 8.5.3 Volume I, Factor 3 – Technical Capability states, “The Offeror may also propose alternate key personnel using Attachment 5 – PROTECTS Resume Template and provide rationale in section three in the resume template.” Would the Government allow offerors to propose additional resumes/key personnel? Allowing the addition of new LCAT roles would benefit the Treasury by enabling specialized, experienced personnel in key positions. This can lead to improved efficiency, enhanced expertise in critical areas, and more effective accomplishment of tasks, ultimately strengthening the overall performance and success of the program. | Yes, that is what the referenced section states. | |
| 56 | RFQ Page 33, Section 8.5. Will the Government allow offerors to submit an acronymn list outside of the page limitations for Phase II - Volume I, Factor 3 – Technical Capability? | Yes. | |
| 57 | RFQ Page 33, Section 8.5. Would the Government confirm that key personnel resumes should be submitted as an appendix to the Phase II Factor 3: Technical Capability volume? | Confirmed. | |
| 58 | RFQ Page 21, Section 6.1 states, “The contractor shall identify one person as the lead and key personnel who shall provide management, administrative, and technical interface between Government and contractor personnel in the day-to-day performance of the contract." Will the Government confirm that there should be three key personnel and that offerors should designate one of the keys as the lead? | Confirmed. See answer to #53. | |
| 59 | RFQ Page 33, Section 8.5. In order to be fully responsive to Factor 3 – Technical Capability, offerors will need to address their overall approach to Task Areas 1-7, Deliverables, and the Service Delivery Summary while also including information that demonstrates their technical capability and knowledge of cyber services. Would the Government consider increasing the total page count for Phase II, Volume I Technical Quote to 30 pages to ensure offerors can fully address all requirements? | See answer #17. | |
| 60 | Previous PROTECTS HACS Draft contained attachment 1 - MSS Template, where vendors can provide pricing for Managed Security Services Support for CLIN 0002. The current solicitation does not contain this document. Is there still a pricing sheet for MSS or will the Government be evaluating MSS pricing at the call order level? | Pricing will be based off Attachment 1. | |
| 61 | Will the Government allow additional questions be allowed after phase one? | That will be taken into consideration. | |
| 62 | Does the Government have an anticipated number of awardees for this BPA? | The Government intends to award to the highest rated quoters. | |
| 63 | Can the Government clarifiy the discrepency in number of required demonstrated corporate experence? The RFQ states n section 8.5.1 Evaluation Factor 1, evalution criteria a minimum of 3 demonstrated corporate experience however in attachment 7, it's limited to 3. | See answer to #38. | |
| 64 | Are the Key Personnel resumes discussed in section 8.5.3 meant to be representative resumes or will those personnel be expected to serve in a key personnel role across all task orders? | They are expected to serve as key personnel across all task orders. | |
| 65 | Will the government allow inclusion of a cover letter to introduce our team for Phase 1? | This is allowable so long as it is signed by an authorized company negotiator in accordance with page 2 of the RFQ. Page Limit as outlined in answer #13. | |
| 66 | Will the government please provide a 1 week extension to allow vendors time to incorporate answers to questions? | See answer to #5. | |
| 67 | Based on the requirements for LCATS, will the government require Prime's to have an existing TS FCL at time of Phase 2 submission? | Yes. | |
| 68 | Will the government please consider allowing past performance to be submitted in Word or PDF instead of Excel? | Submission requirements are to be in the format provided. | |
| 69 | Since this is a total SB set-aside, will the government mandate that corporate experience references come from only the Prime or SB partners/subs? | Please review the description for clarification of Attachment 7. | |
| 70 | Can a SB prime this effort and participate as a sub on another team? | No. | |
| 71 | RFQ Section 4.3, Deliverables Table on page 10 of the RFQ states that the automated reporting interfaces for system status must be available starting 5 business days after award. However, it is unlikely that the awardee will have access to the systems that produce the required data that soon after award. Can the government please clarify if this just refers to a basic dashboard and not the actual interfaces with the systems, or perhaps clarify the due date? | Where this is already available, it is expected to continue to be available during the transition phase. | |
| 72 | RFQ Section 8.5 Quote Format Table, Volume III – Business Quote, Tab C calls for subcontractor agreements. However, Section 8.5.6 says that the Tab C requirement is a Letter of Commitment from each major subcontractor. Which is correct? | They are synonymous. | |
| 73 | Past Performance Template Attachment 7. To answer question 8 of the Corporate Experience. Is the quoter permitted to extend the box or does the government have any limitation on that. | Yes, the quoter can extend the box to provide enough detail as required to answer the question. | |
| 74 | The table on Page 33 of the RFQ states Attachment 8 is a Quoter's submission requirement. Will the Government remove the requirement for Attachment 8 as a submission requirement if Offeror's are providing a Narrative Response? | The quoters are required to respond to the mock scenario in attachment 8. | |
| 75 | Will the Government reopen Q&A after Phase I submission to allow quoters to ask questions for Phase II? | See answer to #61. | |
| 76 | Will the Government please provide quoters at least five business days notice for when Phase II Factor 4: on the Spot Problem Questions will occur? | Yes. | |
| 77 | Attachment 7 states, "The Quoter must serve as the prime offeror for one of the three required experience examples." Can the government please confirm that the "Quoter" means the offering team? | Yes. | |
| 78 | 2.2.2 Staff Certifications 100% of contractor staff hold required | ||
| certifications. | Yes. | ||
| 79 | Is the Government anticipating the three Key Personnel to operate at the BPA or Task Order level? | The BPA level. Each Task Order will also include specified key personnel. | |
| 80 | If the Government intends for the Key Personnel to operate at the BPA level, is it the Government's intention to issue contracts to all awardees to pay for aforementioned key personnel? | See answer to #79. | |
| 81 | The RFQ states that “If additional proposed LCATS are accepted those rates will also be compared against similar additional proposed rates by competing offers.” If additional LCATs are proposed, how will these LCATs be evaluated as it relates to the Total Evaluated Price (TEP)? How will additional LCATs become part of the TEP calculation? | Additional LCATs will be considered for incorporation into the awarded BPA. For evaluation purposes, only GSA MAS LCATs in Tab 3 will be used for the TEP calculation. | |
| 82 | Will bidders down-selected for Oral Presentations be given the choice of an in-person or virtual session? | No. | |
| 83 | For Oral Presentations, will materials such as white boards, pens, papers, etc. be allowed? | See answer to #21 | |
| 84 | If Oral Presentations will be virtual, can connectivity be tested beforehand? | Yes. | |
| 85 | If Oral Presentations will be virtual, is a contingency plan in place should connectivity issues occur? | Yes. | |
| 86 | Referencing Attachment 7 - PROTECTS Demonstrated Corporate Experience, is the response limited to 35 lines per example or can we expand? | See answer to #73. | |
| 87 | Reference: Section 8.5.1.1 page 34 and Attachment 7 |
We note the RFQ Section 8.5.1.1 does not discuss using demonstrated corporate experience from subcontractors, however the instructions on Attachment 7 allow it as per the following statement "The Quoter may present an experience example from a major subcontractor. If experience is presented from a major subcontractor, the major subcontractor must have served as the prime contractor on the experience example. A major subcontractor is defined as a subcontractor that, in performance of this contract, is expected to be awarded a subcontract that equals or exceeds 25% of the total proposed price."
It is our understanding that upto two (2) experiences can be used from the same major subcontractor. We request the Government to confirm the requirement for past performance from a major subcontractor. It is the responsibility of the quoter to provide the appropriate demonstrated corporate experience as outlined in Attachment 7. A major subcontractor can only be used for up to 2 examples.
PWS Questions
| Providing Treasury Enterprise Cybersecurity Technology & Services (PROTECTS) | ||
| Questions and Answers | ||
| Number | Questions | Answers |
| 1 | (PWS 1.5) Will the government return the experiece requirements of the Key Personnel positions of SOC Project Manager and the Chief Cybersecurity Engineer to the same level included in the Draft RFQ (1/12/24)? |
SOC Project Manager -3 years of running a SOC -Preference for experience running a combined on-premises/cloud SOC -Five years of experience in cybersecurity incident response in one or more single environments with 50,000+ endpoints
Chief Cybersecurity Engineer -CISSP certification with two years of experience or four years of experience employed in a governmental organization (as a government or contract employee) as a cybersecurity engineer
| -Two years of experience with governmental (FedRAMP) hybrid on-premises and cloud technology stack environments | No | |
| 2 | (PWS 1.5) Would the government consider adjusting the years of experience requirements as follows for offeror's proposed Key Personnel? |
SOC Project Manager -Seven (7) years of running a SOC, with at least 5 years of experience running a combined onpremises/cloud SOC.
-Five (5) years of experience in cybersecurity incident response in one or more single environments with 50,000+ endpoints
Chief Cybersecurity Engineer -Two (2) years of experience with governmental (FedRAMP) hybrid on-premises and cloud technology stack environments, with preference given to cybersecurity engineers with transition experience moving from an on-premises to a hybrid on-premises and cloud
| network solution. | No | ||
| 3 | PWS Section 1.5, page 8 | ||
| Indicates that "The contractor shall assign a SOC Project Manager and Chief Cybersecurity Engineer with appropraite technical certifidation (e.g., CISSP) to assist the Program Manager with the technical responsiblites." Please confirm that the SOC Project Manager is not required to have a CISSP. | Confirmed, CISSP was only an example. | ||
| 4 | Ref: Atch. 2. "PROTECTS PWS," Section 2.1 "Deliverables," Page 37 states that the Deliverable for "Automated reporting and query interface(s) for status and events" must be "Available 24h x 365 days/yr., starting five (5) business days after award." Can the Government confirm that there is an existing ticketing system already in place. Functional areas 2 and 5 contain significant subtasks that would make a five-day implementation challenging. Please provide additional context to better understand this requirement. | Dependent on the Bureau but for example IRS, DO, FS have ticketing systems. | |
| 5 | Ref PWS Section 1.8.4 (page 14) - Can the government confirm whether it is anticipated that there will be only 1 Task Order for each Treasury Bureau and that work within the scope of the PWS that was not awarded with the original TO can/will be added as a modification to the pre-existing TO? | No, there will likely be more than one Task Order for each treasury bureau, a primary TO and subsequent orders are probable given scope and/or value restrictions. | |
| 6 | Ref PWS Section 5 (page 46) states that the company providing the services must have a Top Secret Facility Clearance prior to bidding. Can the Government confirm that this requirement applies to the Prime Contractor only at time of proposal submission, and that the Prime Contractor can then sponsor subcontractors for their Facility Clearance prior to allowing them to work on any resulting Task Orders? | The Prime MUST have a TS FCL and the Sub under the Prime MUST have their own FCL | |
| 7 | Ref PWS Section 5 (page 46) states that the company providing the services must have a Top Secret Facility Clearance prior to bidding. Can the Government confirm that this requirement will not apply to a subcontractor who exclusively provides cloud-based shared services and does not require access to classified information? | See answer to #6, | |
| 8 | 1.12.7 For the Cloud Security Capability Deployment and Management, does the Treasury require the vendor to only have experience monitoring and controlling cloud activity between the bureau and multiple FedRAMP CSP environments, or to also provide the solution from a FedRAMP environment, especially with respect to MSSPs? Additionally, given the sensitivity of the data housed in the cloud, will the Government confirm the required FedRAMP level is FedRAMP High? | The expectation is that the offeror either have a FEDRAMP HIGH SOC or have something comparable that is documented and verifiable. | |
| 9 | Does the Government expect that services delivered under an MSSP model will be done at the time of initial transition to the new provider, or will the government accept that "as-is" operations may be required for a period of time to reduce risk for transition to Supplier's premises and equipment? | Per 1.8.3.2 the contractor shall develop a SOC incoming transition plan that ensures there is no degradation of SOC services during the transition. | |
| 10 | Will the government please provide insight into the average number of events AND Incidents per month at the Department level and at each of the participating Bureaus? | No | |
| 11 | The PWS (Section 1.1 Background) states, “…an operational presence in Africa, Asia, Europe, and Latin America.” Will the offeror be expected to provide cybersecurity staff at any of these listed OCONUS locations? | No | |
| 12 | The PWS (Section 1.1 Background) states, , “…an operational presence in Africa, Asia, Europe, and Latin America.” Are the OCONUS Treasury locations, personnel, equipment, data considered assets part of the enterprise security boundary requiring coverage under offered capabilities or services? | While there is an OCONUS mission, technology delivery, inclusive of cybersecurity, occurs from the U.S. | |
| 13 | The PWS (Section 1.11 FA4) states the need for contractors to be cleared up to TS and be able to process and integrate classified CTI information up to the Top-Secret (TS) level, however it is unclear if the protected networks, assets, or data are also classified. Does the government expect that classified systems and data are also in scope for PWS capabilities and services for the BPA or any task orders subsequently released? | Yes | |
| 14 | PWS 1.11.5 lists "Adversary Emulation" services with delivery of Pentesting reports. Pentesting scopes may include black, grey, and white-box testing, where emulation testing is always from the vantage point of the attacker undertaking simulated multi-stage, realistic attack scenarios. Does the Government intend that 1.11.5 should cover BOTH Emulation services AND more traditional Pentesting under the same services scope? | It is possible that a contractor could be asked to do both in the same scope, however at the BPA level a contractor needs to prove competency in completing either method. Specific requirements will be defined at the Task Order level. | |
| 15 | Within 1.12 FA5 SOC Architecture & Strategy, does the Government have an enterprise level Security and Data Architecture these subordinate SOC architectures are supposed to align to and would the government be willing to share these architectures to offerors under this solicitation? We do not see any reference to such enterprise architecture documentation under Appendix C: Applicable Documents. | No, the SOCs are currrently independently architected. | |
| 16 | Page 15 - Information Security Incident Management - What will be the approximate annual volume for such incidents? | Please reference Appendix B Under TSSSOC Number of Tickets | |
| 17 | Page 20 - How many web applications included for Web application assessments? | Estimated to be 100+ | |
| 18 | Page 20 - How many databases included for database assessment? What is the average size of a database? | Please reference Appendix B | |
| 19 | PWS Page 35-40, Section 2. Please confirm that all deliverables are at the Call Order Level and not at the BPA level. | Confirmed | |
| 20 | PWS Page 18, Section 1.9.6. Fly-Away Incident Response states, "The Contractor shall perform onsite incident response, at the direction of the Bureau Government lead, at physical locations where SOC analysts do not routinely reside. The Contractor shall maintain a Fly-Away Kit containing tools and copies of procedures, to include but not limited to digital media analysis tools, necessary to perform response activities. The Contractor response team shall be able to deploy within 24 hours of notification. The contractor shall have hands-on involvement in gathering artifacts and recovering systems, as needed. In all cases, the Contractor shall perform the onsite incident response in coordination with the Bureau SOC, external service providers, Bureau system owners, system administrators, and Information System Security Officers (ISSOs), as appropriate." Could the Government please clarify which specific position(s) this requirement applies to? | Reference Attachment 1 Price Template, tab 1 and tab 2. | |
| 21 | PWS Page 32-35, Section 1.14. The Cybersecurity Executive Order 14028 of 2021 and its ensuing mandates set forth a theme of centralized security monitoring and control, to support effective D/A operations and access by CISA and the FBI as necessary. 1) The OMB M-21-31 mandate contains multiple requirements for centralizing and monitoring security tool, agent, device, and system data by both the “component level” and “top-agency” level SOCs. Therefore, the Government would face challenges complying with this mandate if the TSSSOC or a Bureau/DO level SOC was outsourced as an MSSP. 2) OMB Mandate M-22-09 covers centralized EDR tooling and provisioning access for CISA. If the contractor was to host and operate Treasury/Bureau/DO EDR tooling this would complicate compliance with this mandate. 3) OMB M-22-09 covers the centralization of Identity and Access Management and SOC, and identifies the challenges with decentralization. Under the MSSP model IAM would be decentralized. |
| Based on these Government-wide mandate concerns would the Government consider removing the MSSP requirement? | No | |
| 22 | PWS Page 32-35, Section 1.14. The use of an MSSP service to support the TSSSOC, or Bureau/DO SOC would involve configuring Treasury security tooling, systems, devices, and applications to ship log data out of Treasury’s networks to the contractor MSSP provider. With the MSSP contractor providing assets and licensing this would mean the management tooling would be outside of the Treasury network, however contractor-provider security agents and devices would need to be installed on Treasury hosts. Therefore, the MSSP model introduces several considerations for Treasury. 1) The Department’s security posture would be inextricably linked to the MSSP contractor, broadening the Department’s attack surface 2) Risk for the Department, including Cyber supply-chain risk would increase 3) Bandwidth utilization would increase due to log shipping and security tooling connections extending out of the Department’s network. This may increase cost and network architecture changes may be required. |
| Based on these security risk concerns would the Government consider removing the MSSP requirement? | No | |
| 23 | PWS Page 32-35, Section 1.14. The use of the MSSP model for SOC would impede Treasury’s overall SOC and incident response operations as it gives up all control over tooling and process choices to the contractor. The Cyber Executive Order 14028 of 2021 and its ensuing mandates structure government-wide requirements to centralize security services, including logging, under the top-line agency SOC. Further to this, they instruct CISA to centralize more monitoring from D/As. CISA established the CLAW (Centralized Log Aggregation Warehouse), PAC (Persistent Access Capability), FAST (Federal Attack Surface Testing), and PDNS (Protective DNS) in alignment with Cyber EO requirements. These new CISA programs rely on centralized integrations into D/A networks and their tooling. The use of the MSSP model therefore complicates integration with these programs. |
| Would the Government consider removing the MSSP requirement in favor of a more efficient, compliant, and unified government-aligned model by keeping the management of security tooling and services within the Department? | No | ||
| 24 | PWS Page 20, Section 1.10.3.3. Are non-outward facing web applications in-scope? | Per pg 20 1.10.3.3, The Contractor shall provide a Web Application Assessment that includes scanning, testing, orboth of outward facing web applications for defects in web service implementation that may leadto exploitable vulnerabilities | |
| 25 | PWS Page 33, Section 1.14.1 states, "… Offers must therefore include responsive technical solutions and pricing against both these business operating models." Please confirm MSSP pricing will be requested at the Call Order level when specific details are available to scope the required services. | Confirmed Call Order is a Task Order | |
| 26 | PWS Page 34, Section 1.14.3 states, "v. Capability Research and Development Support." Please confirm this should be "1.12.3 SOC Research and Engineering," as the currently stated requirement no longer exists in the PWS. | Refer to PWS 1.14.3 | |
| 27 | PWS Page 19-20, Section 1.10.3 Vulnerability Assessments states, "The Contractor’s Vulnerability Assessment Analysts shall provide onsite and remote vulnerability assessment capabilities as a sustained, full-time program independent of incident detection, recovery, or reporting activities. Activities shall include full-knowledge, open-security assessment of a Bureau site, enclave, or system. The Contractor shall work with system owners and system administrators to holistically examine the security architecture and vulnerabilities of their systems, through security scans, examination of system configuration, review of system design documentation, and interviews. The Contractor shall use network and vulnerability scanning tools, as well as invasive technologies used to interrogate systems for configuration and status. Deliverables for Vulnerability Assessment include, but are not limited to, a Vulnerability Assessment Report of Findings, along with recommended remediation. Specific types of vulnerability assessments are detailed in the following subtasks." Additionally, "1.10.3.2 Wireless Assessment: The Contractor shall include wireless access point detection, penetration testing, or both. A wireless assessment is performed while onsite at a customer’s facility. Deliverables for a Wireless Assessment include but are not limited to a Wireless Assessment Report that includes an executive summary, networking mapping, vulnerability analysis, and a wireless network configuration assessment on the wireless system." Could the government please confirm if these tasks are applicable solely to Vulnerability Assessment Analysts, or are there other positions that are also responsible for these tasks? Additionally, are these staff members required to be onsite to perform these activities? | Per 1.10.3 Vulnerability Assessements the contractor shall provide onsite and remote vulnerability assessment capabilities at the BPA level. Additional information may be provided at the TO level. | |
| 28 | PWS Page 35, Section 2.1. Would the Government please fix the numbered references to tasks in the deliverables table so offerors can ensure they are mapping them to the correct task area? Currently, they are all mapping to Section 2 when all task and subtask areas are under Sections 1.8 - 1.14. | Refer to 1.8 thru 1.14 | |
| 29 | 1.8.2 SOC Operations Management - For Number 6, Ensure that all staff possess the necessary technical skills and certifications to operate the |
Contractor’s solution set to deliver the required services, and that staff receive ongoing
| training necessary to maintain those skills and certifications. Is there a list of acceptable certifications? | No | ||
| 30 | 2.2.2 Staff Certifications - Do you have a list of acceptable staff certifications? | No | |
| 31 | Will the Government sponsor the contractor for FedRAMP Authorization? | No | |
| 32 | Will the Government consider increasing the maximum number of demonstrated corporate experience? | No | |
| 33 | Ref 1.4.2 - With reference to performing the work remotely, is the contractor expected to work in various government clouds used by the agencies? If yes, please provide the names of the various cloud providers used. | Yes the Gov is working in a multi cloud enviornment like MS, AMZ, Oracle | |
| 34 | Ref 1.5 - Are the key personnel expected to have any specific cloud certifications? If yes, please list the desired cloud certifications. | No | |
| 35 | Ref 1.6.1 - Does the government have any preferred tools, software, or platforms for project management, communication, and reporting that the contractor should use? | No | |
| 36 | Ref 1.8.5.1 - Are there any specific shortcomings in the existing SOC performance metrics that the government would want the contractor to address? Are there any specific areas where the metrics today do not provide the desired information? | Specifics may be addressed in a Task Order | |
| 37 | Ref 1.9.2 - With respect to incident management, is the contractor required to possess expertise in specific incident management tools? If yes, please specify which vendor tools are currently used for incident management. | No | |
| 38 | Ref 1.10.2 - With respect to vulnerability scanning and patch management, are there specific SLAs that the contractor is expected to follow? If yes, please specify. | SLAs will be further defined at the Task Order Level | |
| 39 | Ref 1.11.3 - The government requires the contractor to apply threat hunting beyond the scope of current detection and analytical capabilities deployed by the Bureau. Could you please provide an example of the current capabilities employed within the Bureau environment? | The expectation of a Threat Hunt is already described. Any further detail needed would be defined at the Task Order. | |
| 40 | Ref 1.12.7 - Does the government require proficiency with respect to specific CASB vendors? If yes, please specify which CASB vendors are currently leveraged by the government. | No | |
| 41 | Ref 1.13.1 - Will the selected contractor be expected to collaborate with other contractors or third-party vendors? If so, are there any established protocols for such collaboration? | Yes | |
| 42 | Ref 1.14.1 - Are there specific response time expectations for different types of incidents or requests that the contractor should be prepared to meet? | SLAs will be further defined at the Task Order Level | |
| 43 | Other than the KPs outlined in section 1.5 there are no other references to "what" certifications are required by role. Will Treasury provide guidance on what certifications are required or what standard is followed (e.g. NIST NICE, DoD 8140/8570, SANs, etc.)? | Addressed at Task Order Level Reference Atth 6 | |
| 44 | Does Treasury provide the Fly-Away Kits as GFE for the contractor to maintain? | Yes | |
| 45 | Is the Fly Away Kit an on premise or a cloud based Kit? | On Premise | |
| 46 | Will Treasury provide additional information to the reference to "compliance status". What guidance is followed, DOD STIG/SRG, CIS Benchmarks, Others? What is the frequency of the compliance scans (e.g. OSSA, DB Assessments, etc.)? | Information not applicable at the BPA level but may be provided at the TO |
This is the start of the file's text. The full file is on GovTribe.
File details come from the government source that posted it. Updated .