II_01 Attachment 4 - Questions and Answers MASTER LIST v1.xlsx
XLSX spreadsheet 63 KB Posted
- Attached to
- RFQ PROTECTS
- Solicitation number
- 2032H5-24-Q-00009
About this file
This document is a Request for Quotation (RFQ) for the Department of the Treasury's PROviding Treasury Enterprise Cybersecurity Technology and Services (PROTECTS) requirement. The RFQ covers a broad range of cybersecurity services including vulnerability assessments, incident response, threat hunting, and cloud security services. The solicitation is set-aside for small businesses that hold both the 54151HACS and 54151S Schedules under the GSA Multiple Award Schedule. Quotes are due in two phases, with Phase I due on June 17, 2024 and Phase II due after an advisory downselect. The government intends to award a minimum of 5 BPAs with a base year plus 7 option years. Pricing is requested on both a labor hour and firm-fixed-price basis. The document also includes detailed information on key personnel requirements, deliverables, and performance metrics that will be evaluated. Several attachments provide templates for pricing, resumes, and a mock scenario that offerors must respond to as part of their technical quote.
View the file
Other files
Show all 20
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
RFQ Questions
| Providing Treasury Enterprise Cybersecurity Technology & Services (PROTECTS) | |||
| Questions and Answers | |||
| Number | Questions | Answers | |
| 1 | I saw an update, but it just referenced a FAR for consolidating. What was consolidated? | Please see attachment 10, D&F Consolidation for further description. | |
| 2 | Background/References: The RFQ cover letter states: “All questions or requests for clarification, citing the specific solicitation section, shall be posted on GSA eBuy by 28 May 2024 at 10:00 AM eastern | ||
| via attachment 4,” and RFP Paragraph 8.1, p. 31 states “All questions should be directed via eBuy by 28 May 2024 at 10:00 AM eastern;” however, the associated eBuy RFQ page states "“Questions will only be accepted via email at the following: jonathan.w.carney@irs.gov and alison.m.adamson@irs.gov." Question: How are Offerors to submit questions; via (a) eBuy, or (b) via email? | Questions can be submitted via GSA eBuy or email. | ||
| 3 | Background/References: The RFQ cover letter states "The Quoters must have BOTH 54151HACS and 54151S SINS to be considered responsive;" and RFP Paragraph 9.0, p. 42 states ""Quoters must have both 54151HACS and 54151S SINS under their MAS to be considered for this requirement," however, RFP Paragrapgh 2.0, p.6 states "The work shall be performed in accordance with all sections of this RFQ and the quoter’s contract awarded under the GSA MAS IT HACS SIN;" and the associated eBuy RFQ page specifies “MAS: 54151HACS – Cyber Hunt –“ as the applicable SIN. As the first two citations state both SINs are required, and the second two citations indicate only SIN 54151HACS is required, there is a conflict. Question: Since (a) SIN 54151HACS is a specialiized subset of SIN 54151S with the same overarching requirements, and (b) small businesses are not likely to have both SINs on their GSA MAS, the requirement for both SINs appears to unecessarily limit competition. Please confirm 54151HACS is the only SIN required for an Offeror to be considered responsive. | Quoters are required to have BOTH 54151HACS as well as 54151S. | |
| 4 | Does the offerer need to be on the GSA schedule in order to bid on this requisition? | Yes. | |
| 5 | Could the Government please confirm that only Phase 1 (Factors I and II) are due on June 6, 2024 at 10am EST via eBuy? | In accordance with Amendment #2, Phase I (Factor I and II) is due on 17 June 2024 at 10am EST via eBuy. | |
| 6 | On page 3, the RFQ states that the Quoter must have both 54151HACS and 54151S SINS to be considered responsive. Would the Government confirm that it is acceptable for a Quoter to submit if one company has a HACS and one company has a 54151S SIN to meet all requirements? | That is acceptable only if there is a Teaming / JV agreement in place at time of Phase I submission. | |
| 7 | Can a company who has submitted for the IT70 SIN and is awaiting an award from GSA still submit for the opportunity due to the requirement to hold both IT70 and HACS SINS? | The quoter must be under contract and have the required SINS at time of Phase I submission. | |
| 8 | Are quoters able to include an executive summary introducing their team as part of the Phase I response? If so, are there any page restrictions? | No. Resumes are part of Phase II in the format provided. | |
| 9 | Shall the required signed cover letter by an authorized company negotiator to constitute agreement with all terms and conditions of this RFQ be submitted with Phase I response? | Yes - this is referenced on page 2. The cover letter referenced on page 34 for Volume III does not need to be signed by a company negotiator. | |
| 10 | (RFQ 8.5) May the offeror also submit an executive summary as part of Phase 1 submisison outside of page limitations? | No. | |
| 11 | (RFQ 8.5.1.1) May offeror submit a separate, single page Word/PDF attachment to the Demonstrated Corporate Experience, Factor 1 summarizing the submitted references and their similarity to the PROTECTS PWS scope? | No. Demonstrated Corporate Experience shall be submitted in the format provided (see Attachment 7). | |
| 12 | RFQ, page 2 |
Indicates "The quoter will submit a signed cover letter by an authorized company negotiator to
| constitute agreement with all terms and conditions of this RFQ." Please confirm that a cover letter is required to be submitted with Phase I, Volume I. | See answer #9. | ||
| 13 | If a cover letter is required with phase I, Volume I, please advise of any page limits that may apply. | See answer #9. Page limit is 2. | |
| 14 | RFQ, page 3 |
states that "Quoters must have BOTH
| 54151HACS and 54151S SINS to be considered responsive." Will the Government please confirm that bidders must have all five (5) sub-categories of the HACS SIN including High Value Asset Assessments, Penetration Testing, Risk and Vulnerability Assessments, Incident Response, and Cyber Hunt, in order to be eligible to bid? | Yes, bidders must have all five sub-categories of the HACS SIN. | |
| 15 | RFQ Section 8.5.2, page 35 | |
| Does the Government have an anticipated timeframe of when Phase I Advisory Down Select notices will be sent to Phase I bidders? | No. | |
| 16 | Section 8.5, pages 32 and 33 | |
| Due to the multiple layers of response required between enterprise and Bureau level functions, and the need for increased fidelity on a real-world scenario, will the Government please increase the page limit of Phase I, Volume I Mock Scenario responses to 15 pages? | No. | |
| 17 | RFQ Section 8.5.3, page 36 |
Indicates that bidders are to include their technical approach to the PWS Task Area. These Task Areas align to the Core Operational Framework areas 1 through 7 and do not align with the Functional Areas (PWS 1.8 through 1.14). Please confirm that the technical response for Phase II, Volume I requires that bidders provide their technical approach and capabilities for the Core Operational Framework areas #1 - #7 and are not required to address all of the requirements for each Functional Area in their response.
| If offerors are required to respond to Core Operational Framework areas and Functional areas, will the Government consider increasing the page limit to 35 pages? | Yes, 35 pages is acceptable. | ||
| 18 | RFQ Section 6.7, page 26 (Security Requirements Information Security Requirements/National Industrial Security Program (NISP) Requirements) | ||
| Will the Government confirm that a DD254 will be provided at the TO level? | DD 254 will be provided at the BPA and Task Order level. | ||
| 19 | RFQ 8.5, Quote Format, page 35 | ||
| Can the Government provide an approximate # of days allowed for bidders to submit Phase II, Technical Capability Statement after Advisory Down Select notification? | That will be specified as part of the advisory down select notification. | ||
| 20 | RFQ 8.5.4.1, Rules of Engagement #3, page 37 | ||
| The instructions state "The Quoter may not generally ask questions during the oral presentation. Any questions asked should only deal with logistics and conduct of the oral presentation." Please clarify that the Quoter may ask questions of the Government to clarify the question or validate technical assumptions. | Yes, however those questions will be very limited. | ||
| 21 | RFQ 8.5.4.1, Rules of Engagement, #1, page 37 | ||
| The instructions state "The Government will not provide the Quoter a copy of its written proposal submissions during the oral presentation." Please clarify that Quoter may bring to the Oral Presentation materials including its written proposal and other notes. | Yes, the Quoter is in control of the material it presents and may choose not to present or respond to any question provided by the Government. | ||
| 22 | RFQ 8.5.4.1, Table, portion 2, page 37 | ||
| The instructions state there is a 60-minute limit, 30 minutes for each question, answer, and clarifications. Please clarify that the 30-minute limit for each question applies to the Quoter's response, and does not include time for a) CO's asking of the question, b) Quoter clarification questions/CO answer, nor c) Government clarification after each Quoter's answer. | 30 minute limit for each question is inclusive of the question being asked by the CO, the quoters answer, and any follow-up clarifying questions by the program office. | ||
| 23 | RFQ 8.5.4.1, Rules of Engagement #4, page 37 | ||
| The instructions state "The Quoter is in control of the material it presents and may choose not to present or respond to any question provided by the Government." Please clarify that Quoter may present visual material during the answer to a question, whether on Teams (remote) or in-person. Examples may include a graphic, table, or other written material. | See answer to #21. | ||
| 24 | RFQ 8.5.4.1, Rules of Engagement #8, page 37 | ||
| The instructions state "The Quoter attendees shall mute their microphones when not speaking if the presentation is virtual." Please clarify that, if the presentation is virtual, Quoter attendees may mute their microphones while planning their response to questions. | No. The microphones are to be muted during the question portion. Once the question is ask, the microphones are to be on. | ||
| 25 | Could the government please clarify the number of files we need submit for Phase I in accordance with RFQ Section 8.5 Quote Format? | See RFQ table on pg 33 for Phase I Technical Quote requirements. | |
| 26 | Could the government please clarify in which Phase I sections we need to include a cover letter? | See answer to #9. | |
| 27 | Could the government please confirm that we need submit for Phase I Factor 1 in Excel file format (attachment 7, demonstrated corporate experience)? | Yes. Demonstrated Corporate Experience shall be submitted in the Excel format provided (see Attachment 7). | |
| 28 | Please confirm that we can submit City and State level Corporate Experience as well apart from federal level experience. | Yes, as long as it is within the same size, scope and complexity of the PWS. | |
| 29 | II_01 Attachment 1 - Price Template | ||
| Could the government please specify, in Price Template TAB 5, "the vendor has to put their published all LCATs with a rate from GSA MAS"? | The quoter must list their published LCATS from their GSA MAS Schedule in TAB 5. | ||
| 30 | II_01 Attachment 1 - Price Template | ||
| In the price template, it is mandatory for the vendor to provide additional labor categories for TAB 7? | No. | ||
| 31 | Ref: RFQ Section 8.5, "Quote Format," Page 34: Can the Government please confirm that the only required reference to the Offeror's Subcontracting Plan would be in "Volume III - Business Quote," TAB C, and therefore no teaming arrangements should be referenced as part of the Phase I submission? | Teaming arrangements in the form of CTAs or JVs are required as part of Phase I submission as part of the quoter signed cover letter in accordance with page 2 fot the RFQ. Major sub contractors are not required until submission of Volume III. | |
| 32 | Ref: RFQ Introduction, Second Paragraph, Page 3 states that "Quoters must have BOTH 54151HACS and 54151S SINS to be considered responsive." Does this mean that the Offeror's subcontractors must also have both schedules? | The quoters must have both SINS or a Teaming / JV that includes both SINS at the prime contractor level. | |
| 33 | Ref: RFQ Section 8.5.1.1, Paragraph 3, Page 34: Can the Government please clarify what is intended by, Item "#7, Current Status? Please provide an example of an adequate response to fulfill this requirement. | Please read attachment 7. Current status is the status of the experience referenced. | |
| 34 | REF: RFQ 8.5.6 Tab D (page 39) Representations and Certifications - where the government states, "...the representations and certifications currently posted at | ||
| https://www.sam.gov/portal/SAM/ have been entered or updated in the last 12 months, are current, accurate, complete, and applicable to this solicitation. Any changes to the Quoter’s Annual Representations and Certifications must be updated accordingly at https://www.sam.gov/portal/SAM/ prior to award." Will the government confirm which of the following are required as stipulated in this clause: 1. Offerors must be a qualified small business with SAM records updated in the last 12 months; 2. Offerors must be a qualified small business with SAM records updated to reflect current status as of time of proposal submission; and/or 3. Offerors must recertify their status as a small business and hold an active GSA schedule including SINs 54151HACS and 54151S prior to award? | The quoter is to ensure at time of submission that the representations and certifications are current, accurate and complete within the last 12 months. | ||
| 35 | Ref RFQ 1.2.1 (page 4) Treasury Small Business Goals: Will the government please confirm whether they intend to award BPAs across each socio-economic classification or whether all awards will be considered as General Small Business Set-Asides? | Treasury will award to the highest rated contractors in accordance with the RFQ. | |
| 36 | Ref RFQ 1.2.1 (page 4) Treasury Small Business Goals: Does the government anticipate setting Call Orders under this BPA aside for specific socio-economic classes? | Not at this time. | |
| 37 | Ref RFQ 6.18 (pages 28 and 29) On-Ramping: Where the government states, "During this process the Government may allow existing Prime Contractors/Team Leads the opportunity to restructure existing teams. This open season will allow the existing Prime Contractors/Team Leads to add new team members, delete current team members, and/or otherwise revise teaming arrangement(s) to respond to future PROTECTS Order requirements," will the government please confirm that subcontractors can be added at the discretion of the BPA holder to address specific Delivery Order requirements throughout the life of the BPA without requiring any modification or approval from the government? | The subcontractors are the responsibility of the contractor to manage in order to meet the requirements under the BPA. Teaming and or JVs are not considered subcontractors. | |
| 38 | Will the government please modify the RFQ section 8.5.1.1 (page 34) to ensure consistency with Attachment 7 - Demonstrated Corporate Experience. Currently, the RFP reads "A minimum of three federal or commercial examples…" while the Attachment 7 reads "Only three federal or commercial examples". Please clarify whether offerors should submit a minimum of 3 or only 3. | It is only three. | |
| 39 | Ref RFQ Section 8.5.3 (page 36): where the government states, "The Offeror may also propose alternate key personnel using Attachment 5 – PROTECTS Resume Template and provide rationale in section three in the resume template," will the government confirm whether offerors may propose more than 3 Key Personnel, or must any proposed "alternative" Key Personnel be offered as a replacement for one of the required 3 Key Personnel? | The contractor can submit additonal key personnel to those listed in Appendix 6. They will be evaluated as part of Phase II, Factor 3. | |
| 40 | Ref RFQ Section 8.5.3 (page 36): where the government states, "The Offeror may also propose alternate key personnel using Attachment 5 – PROTECTS Resume Template and provide rationale in section three in the resume template," will the government confirm whether additional or alternative Key Personnel must also participate in oral presentations? | The key personnel must be part of the oral presentation as outlined. | |
| 41 | Ref RFQ section 9.0 (page 42): where the government states, "Quoters must have both 54151HACS and 54151S SINS under their MAS to be considered for this requirement," will the government please confirm that, in the event multiple GSA schedules are referenced on a offeror's quote, that EACH GSA schedule referenced to support pricing must have both SINS included? | Both SINS are required as part of the Quoters submission. | |
| 42 | Ref RFQ section 9.1 (page 42): As this requirement is a small business set-aside, will the government please confirm that the Corporate Experience component of Phase 1 will be evaluated as an aggregate assessment of the 3 Past Experience references vs. evaluating each experience reference individually for coverage of entire program size, scope, and complexity. | Corporate experience will be evaluated as an aggregate and will receive one confidence rating. | |
| 43 | Ref RFQ (page 2) where is states "The quoter will submit a signed cover letter by an authorized company negotiator to constitute agreement with all terms and conditions of this RFQ.” Will this cover letter need to be submitted with phase 1 separately, or with the mock scenario? Does a cover letter also need to be submitted with phase 2 as well? If so, which section? | See answer #9. | |
| 44 | 8.5.6 Vol III: Business Proposal, Tab B - Quality Assurance Surveillance Plan (QASP). Given that this Volume will not be rated, will the government consider removing the Tab B requirement at award and make it a deliverable due 15 days after business award (aligning with the Task 2.2.5.1 deliverable)? If not, please provide the requirements for the QASP. | No, submit a draft QASP as part of Tab B. The final QASP will be negotiated with the successful vendors after award. | |
| 45 | Will Treasury require the small business to recertify? |
1.2 Set Aside Information, Page 3
"Pursuant to FAR 8.405-5, this acquisition will be a total set aside for small business. The Treasury intends to award a minimum of five (5) vendors under the BPA. GSA and/or Treasury reserves the right to add more vendors during the evaluation process."
6.18 On-Ramping, Page 28
"On-Ramping. The BPA Contracting Officer has determined that it is in the Government’s best interest that at all times during the term of the BPAs, there remain an adequate number of small business BPA holders eligible to compete for orders. Recognizing this, Treasury intends to review the total number of BPA holders participating in the ordering
| process one year after BPA establishment (then annually thereafter) to determine whether it is in the best interest of the Government to issue an amendment for purposes of adding additional small business BPA holders. Over time, the total number of BPA holders may fluctuate due to various reasons including industry consolidation, significant changes in the marketplace or advances in technology, general economic conditions, the Government's exercise of the off-ramp process, or other reasons. The Government is under no obligation to solicit or establish additional BPAs. This is a discretionary unilateral authority of the Government." | No, once awarded the BPA the quoter will be considered a small business as long as they are operating under the BPA. | |
| 46 | 8.5.2 Advisory Down Select: p 35 | |
| Can the Government provide an anticipated timeline (# of days) from notification to submission dates by Phase? | See answer #19 | |
| 47 | Service Level Agreements (SLAs): | |
| • Question: Could you provide more detailed information on the performance metrics and Service Level Agreements (SLAs) that will be used to evaluate the contractor's performance, particularly in relation to incident response times and system availability? • Rationale: Clarity on SLAs and performance metrics is crucial for planning resources and ensuring the ability to meet contractual obligations. | This will be defined at the task order level. | |
| 48 | Transition and Integration: |
• Question: Can you provide more details on the expected transition period and any specific integration requirements with existing government systems and services, including any support required from the incumbent contractor?
| • Rationale: Detailed information on the transition period and integration requirements will help in planning the transition smoothly and ensuring continuity of services without disruption. | Transition period will be determined at the Task Order level and will be between 60-120 days. The transition plan submission is due 15 days after the award in accordance with PWS Sections 2.2.3.2 and 2.1 deliverable table. It is the Government's expectation there is continuity of service with no interuption. | |
| 49 | Service Priority Weighting: |
• Question: "How will the criteria for managed service providers be weighted in terms of service priority, and what factors will be most critical in the evaluation process?"
| • Rationale: Understanding how service priority will be weighted and which factors are most critical will help in prioritizing aspects of the proposal to align with the government’s evaluation criteria. | They will be evaluated as defined in the RFQ Section 8.5.3 | ||
| 50 | RFQ Page 36, Section 8.5.4.1. Can the responsible corporate official participate in the Oral Presentation? | The responsible corporate official is required per 8.5.4.1 'Oral Presentation Participants'. | |
| 51 | RFQ Page 39, Section 8.5.6. For the Draft Quality Assurance Surveillance Plan (QASP), we request clarification on the QASP instructions and evaluation criteria. Specifically, will the government provide detailed guidance on the requirements and expectations for developing the QASP, including any mandatory elements or sections? Additionally, could the government please provide information on how the Draft QASP will be evaluated, specifically the evaluation criteria and the process that will be used to assess the adequacy and effectiveness of the QASP in meeting the contract requirements? | See answer to #44. | |
| 52 | RFQ Page 42, Section 9.2. Will the Factor 2 - Mock Scenarios A and B be evaluated together so offerors can cross reference sections to save page space? | Factor 2 will be evaluated as one. | |
| 53 | RFQ Page 21, Section 6.1 states, "The contractor shall identify one person as the lead and key personnel who shall provide management, administrative, and technical interface between Government and contractor personnel in the day-to-day performance of the contract. An important element of this requirement is the ability for the contractor to provide expertise as needed." Could the Government please clarify if this person is in addition to the Program Manager (PM)? | This individual is the Program Manager. | |
| 54 | RFQ Page 21, Section 6.1 Key Personnel states, "All proposed personnel performing risk and vulnerability testing shall hold a current, active, and favorably adjudicated U.S. Government background investigation, minimum Office of Personnel Management Tier 2 (Background Investigation)) in which Department of Treasury can accept reciprocity." Could the Government please clarify what this means? Specifically, is this equivalent to a Public Trust clearance? | Yes, a Public Trust clearance is equivalent. | |
| 55 | RFQ Page 36, Section 8.5.3 Volume I, Factor 3 – Technical Capability states, “The Offeror may also propose alternate key personnel using Attachment 5 – PROTECTS Resume Template and provide rationale in section three in the resume template.” Would the Government allow offerors to propose additional resumes/key personnel? Allowing the addition of new LCAT roles would benefit the Treasury by enabling specialized, experienced personnel in key positions. This can lead to improved efficiency, enhanced expertise in critical areas, and more effective accomplishment of tasks, ultimately strengthening the overall performance and success of the program. | Yes, that is what the referenced section states. | |
| 56 | RFQ Page 33, Section 8.5. Will the Government allow offerors to submit an acronymn list outside of the page limitations for Phase II - Volume I, Factor 3 – Technical Capability? | Yes. | |
| 57 | RFQ Page 33, Section 8.5. Would the Government confirm that key personnel resumes should be submitted as an appendix to the Phase II Factor 3: Technical Capability volume? | Confirmed. | |
| 58 | RFQ Page 21, Section 6.1 states, “The contractor shall identify one person as the lead and key personnel who shall provide management, administrative, and technical interface between Government and contractor personnel in the day-to-day performance of the contract." Will the Government confirm that there should be three key personnel and that offerors should designate one of the keys as the lead? | Confirmed. See answer to #53. | |
| 59 | RFQ Page 33, Section 8.5. In order to be fully responsive to Factor 3 – Technical Capability, offerors will need to address their overall approach to Task Areas 1-7, Deliverables, and the Service Delivery Summary while also including information that demonstrates their technical capability and knowledge of cyber services. Would the Government consider increasing the total page count for Phase II, Volume I Technical Quote to 30 pages to ensure offerors can fully address all requirements? | See answer #17. | |
| 60 | Previous PROTECTS HACS Draft contained attachment 1 - MSS Template, where vendors can provide pricing for Managed Security Services Support for CLIN 0002. The current solicitation does not contain this document. Is there still a pricing sheet for MSS or will the Government be evaluating MSS pricing at the call order level? | Pricing will be based off Attachment 1. | |
| 61 | Will the Government allow additional questions be allowed after phase one? | That will be taken into consideration. | |
| 62 | Does the Government have an anticipated number of awardees for this BPA? | The Government intends to award to the highest rated quoters. | |
| 63 | Can the Government clarifiy the discrepency in number of required demonstrated corporate experence? The RFQ states n section 8.5.1 Evaluation Factor 1, evalution criteria a minimum of 3 demonstrated corporate experience however in attachment 7, it's limited to 3. | See answer to #38. | |
| 64 | Are the Key Personnel resumes discussed in section 8.5.3 meant to be representative resumes or will those personnel be expected to serve in a key personnel role across all task orders? | They are expected to serve as key personnel across all task orders. | |
| 65 | Will the government allow inclusion of a cover letter to introduce our team for Phase 1? | This is allowable so long as it is signed by an authorized company negotiator in accordance with page 2 of the RFQ. Page Limit as outlined in answer #13. | |
| 66 | Will the government please provide a 1 week extension to allow vendors time to incorporate answers to questions? | See answer to #5. | |
| 67 | Based on the requirements for LCATS, will the government require Prime's to have an existing TS FCL at time of Phase 2 submission? | Yes. | |
| 68 | Will the government please consider allowing past performance to be submitted in Word or PDF instead of Excel? | Submission requirements are to be in the format provided. | |
| 69 | Since this is a total SB set-aside, will the government mandate that corporate experience references come from only the Prime or SB partners/subs? | Please review the description for clarification of Attachment 7. | |
| 70 | Can a SB prime this effort and participate as a sub on another team? | No. | |
| 71 | RFQ Section 4.3, Deliverables Table on page 10 of the RFQ states that the automated reporting interfaces for system status must be available starting 5 business days after award. However, it is unlikely that the awardee will have access to the systems that produce the required data that soon after award. Can the government please clarify if this just refers to a basic dashboard and not the actual interfaces with the systems, or perhaps clarify the due date? | Where this is already available, it is expected to continue to be available during the transition phase. | |
| 72 | RFQ Section 8.5 Quote Format Table, Volume III – Business Quote, Tab C calls for subcontractor agreements. However, Section 8.5.6 says that the Tab C requirement is a Letter of Commitment from each major subcontractor. Which is correct? | They are synonymous. | |
| 73 | Past Performance Template Attachment 7. To answer question 8 of the Corporate Experience. Is the quoter permitted to extend the box or does the government have any limitation on that. | Yes, the quoter can extend the box to provide enough detail as required to answer the question. | |
| 74 | The table on Page 33 of the RFQ states Attachment 8 is a Quoter's submission requirement. Will the Government remove the requirement for Attachment 8 as a submission requirement if Offeror's are providing a Narrative Response? | The quoters are required to respond to the mock scenario in attachment 8 as stated in RFQ para 8.5.1.2. Offerors do not need to submit the Government provided mock scenario. | |
| 75 | Will the Government reopen Q&A after Phase I submission to allow quoters to ask questions for Phase II? | See answer to #61. | |
| 76 | Will the Government please provide quoters at least five business days notice for when Phase II Factor 4: on the Spot Problem Questions will occur? | Yes. | |
| 77 | Attachment 7 states, "The Quoter must serve as the prime offeror for one of the three required experience examples." Can the government please confirm that the "Quoter" means the offering team? | Yes. | |
| 78 | 2.2.2 Staff Certifications 100% of contractor staff hold required | ||
| certifications. | Yes. | ||
| 79 | Is the Government anticipating the three Key Personnel to operate at the BPA or Task Order level? | The BPA level. Each Task Order will also include specified key personnel. | |
| 80 | If the Government intends for the Key Personnel to operate at the BPA level, is it the Government's intention to issue contracts to all awardees to pay for aforementioned key personnel? | See answer to #79. | |
| 81 | The RFQ states that “If additional proposed LCATS are accepted those rates will also be compared against similar additional proposed rates by competing offers.” If additional LCATs are proposed, how will these LCATs be evaluated as it relates to the Total Evaluated Price (TEP)? How will additional LCATs become part of the TEP calculation? | Additional LCATs will be considered for incorporation into the awarded BPA. For evaluation purposes, only GSA MAS LCATs in Tab 3 will be used for the TEP calculation. | |
| 82 | Will bidders down-selected for Oral Presentations be given the choice of an in-person or virtual session? | No. | |
| 83 | For Oral Presentations, will materials such as white boards, pens, papers, etc. be allowed? | See answer to #21 | |
| 84 | If Oral Presentations will be virtual, can connectivity be tested beforehand? | Yes. | |
| 85 | If Oral Presentations will be virtual, is a contingency plan in place should connectivity issues occur? | Yes. | |
| 86 | Referencing Attachment 7 - PROTECTS Demonstrated Corporate Experience, is the response limited to 35 lines per example or can we expand? | See answer to #73. | |
| 87 | Reference: Section 8.5.1.1 page 34 and Attachment 7 |
We note the RFQ Section 8.5.1.1 does not discuss using demonstrated corporate experience from subcontractors, however the instructions on Attachment 7 allow it as per the following statement "The Quoter may present an experience example from a major subcontractor. If experience is presented from a major subcontractor, the major subcontractor must have served as the prime contractor on the experience example. A major subcontractor is defined as a subcontractor that, in performance of this contract, is expected to be awarded a subcontract that equals or exceeds 25% of the total proposed price."
| It is our understanding that upto two (2) experiences can be used from the same major subcontractor. We request the Government to confirm the requirement for past performance from a major subcontractor. | It is the responsibility of the quoter to provide the appropriate demonstrated corporate experience as outlined in Attachment 7. A major subcontractor can only be used for up to 2 examples. | |
| 88 | Background/References: RFQ Section 4.3, paragraph 4, p. 9 states "The final [deliverable] document must be approved and accepted by the Government prior to payment submission" and "The Government requires ten (10) business days for review and submission of written comments to the contractor on draft documents." |
Since the Contractor's authorization to submit invoices appears to depend on the Government's acceptance of deliverables, timely Government review is critical for the Contractor, particularly a small business.
| Question: In the event the Government does not respond to a Contractor draft deliverable within 10 Government business days of receipt of that draft deliverable, please confirm the Contractor may assume the draft is accepted by the Government as final. | Yes, if no Government comments are received within 10 day, the contractor can | |
| 89 | Background/References: RFQ Section 6.1, paragraph 5, p. 21 states "At least 30 days prior to the contractor voluntarily diverting any of the specified individuals to other programs or contracts, the contractor shall notify the CO and shall submit a justification for the diversion or replacement and a request to replace the individual." However, RFQ Section 6.4, p. 22 states "Prior to utilizing other than personnel specified in response to this RFQ, the contractor shall notify the appropriate CO and COR. This notification shall be no later than 14 calendar days in advance of any proposed substitution." |
These two sections conflict.
Question 1: Please confirm the Contractor will have 30 days to notify the Government about Key Personnel changes.
| Question 2: Please confirm the Contractor is required to send this notification to only the Contracting Officer. | IAW PWS Paragraph 2.3, "The GTM or COR will notify the Contractor of deliverable acceptance or provide comments in writing within ten (10) Government workdays of receipt of a deliverable." | |
| 90 | Background/References: RFQ Section 6.8, Paragraph 1, p. 24 states "For TOs requiring personnel clearances, contracted employees must have, prior to starting, and maintain favorably adjudicated security clearances at the Top Secret or Secret level, depending on the task, throughout the life of the BPA." |
It makes sense that any personnel clearance required for BPA-level positions must be maintained throughout the life of the BPA; however, this language appears to say that personnel clearances required at the TO level must also be maintained throughout the life of the BPA.
| Question: Please confirm that personnel clearances required at the TO-level must be maintained only for the duration of the TO. | Confirm, TO-level clearances must only be maintained for the duration of the TO. | |
| 91 | Background/References: RFQ Section 6.12, p. 26 states "The contractor’s employees assigned to any contract/task order under this contract/task order shall be required to sign contract specific Nondisclosure Agreements (NDAs) and/or Individual COI forms which become part of the Organizational Conflict of Interest (OCI) Plan." |
This is the only reference to "OCI Plan" that we have been able to locate.
Question 1: Please confirm an OCI Plan is not required with the BPA quote submission.
Question 2: If an OCI Plan is required, please provide instructions on where in the quote it should be included.
| Question 3: Also please confirm any required OCI Plan is excluded from any page limits. | See provision IR1052.209-9001 Organizational Conflicts of Interest. OCI Plan should be submitted with the proposal submission if there is an apparent OCI. This is excluded from any page limitation. | |
| 92 | Background/References: RFQ Section 6.18, Paragraphs 1-2, pp. 28-29 describe the on-ramp process and indicates on-ramping may be necessary due to "the Government's exercise of the off-ramp process." However, the only other mention of off-ramping is in RFQ Section 1.7, p. 5, which indicates a Contractor not complying with clearance requirements may be off-ramped. |
Question 1: What is the off-ramp process?
| Question 2: Under what other circumstances might the Government off-ramp a Contractor from the BPA? | Off-ramping may occur by not exercising a contractor's next option period. The Contracting Officer will make a determination in accordance with FAR 17.207 prior to exercising all option periods. | |
| 93 | Background/References: RFQ Section 6.18.1, pp. 29-30. This section describes the Open Season process for team changes at the BPA level. |
Question 1: Since it is impossible to know the exact requirements for every future TO, please confirm Contractors will be permitted to add team members on a TO basis and only for the subject TO.
| Question 2: If confirmed, what is the process for adding a team member for a specific TO? | Contractors are responsible for managing their subcontractors at the task order level. Additional teaming arrangements and JV will be considered at the BPA level in accordance with RFQ paragraph 6.18.1. | |
| 94 | Background/References: RFQ Section 8.4, Paragraph (5), p. 32 states "Document/attachment size restrictions for email are 5MB." |
This implies quote submission may be made via email; however, the RFQ Notice to Prospective Offerors, Paragraph 5, p. 2, states quotes are due via eBuy.
| Question: Please confirm the required method of quote submission is via eBuy. | See answer #5. | |
| 95 | Background/References: RFQ Section 8.5, Table on pp. 33-34 shows Volume III Business Quote Tab C is "Major Subcontractor agreement" with a limit of 2 pages per major subcontractor. However, RFQ Section 8.5.6, Paragraph 5, p. 39 indicates the requirements is for a "Letter of Commitment for Each Major Subcontractor" with a limit of 2 pages per major subcontractor. | |
| Question: Please confirm the requirement is for Quoters to submit letters of commitment and not teaming agreements. | Major Subcontractor Agreements are different than Teaming/JV agreements. A letter of commitment may be submitted as the major subcontractor agreement in Volume III. Teaming / JV agreements must be in place at time of Phase I submission. | |
| 96 | Background/References: RFQ Section 8.5, Table on pp. 33-34. |
Question 1: Are there any requirements for the content of the cover pages for Volume I?
| Question 2: Is a cover page required for Volume II? | The quoter will submit a signed cover letter by an authorized company negotiator to constitute agreement with all terms and conditions of this RFQ. Also, see answer to #9. | |
| 97 | Background/References: RFQ Section 8.5.1.1, Paragraph 1, p.34 states "A minimum of three federal or commercial examples, within the last three (3) years from the federal or commercial sector in similar size, scope, and complexity shall be presented." However, Attachment 7, Row 4 on all three tabs states "Only three federal or commercial examples, within the last three (3) years from the federal or commercial sector in similar size, scope, and complexity shall be presented." | |
| Question: Please confirm offerors must submit exactly 3 examples. | See answer #38. | |
| 98 | Background/References: RFQ Section 8.5.5, Paragraph 1, p. 38 states "All pricing proposed in response to this RFQ shall be LH and FFP..." | |
| Question: Are Quoters required to provide a single rate per site that will apply to both LH and FFP TOs, or may Quoters propose separate LH and FFP labor rates per site? | All LH and FFP Prices shall be for the Government and Contractor site and submitted IAW Attachment 1, Pricing Template. | |
| 99 | Background/References: RFQ Section 8.5.6, Paragraph 2, p. 39 states "The Quoter shall sign and date the SF-1449 and subsequent amendments." |
The RFQ does not include an SF-1449.
| Question: Please provide the SF-1449 and an amendment as applicable with the answers to questions. | See GSA eBuy for a copy of the posted SF 1449, Attachment 11, and posted SF 30 amendments. | |
| 100 | Background/References: RFQ Section 9.0, Paragraph 1, p. 42 states "Technical factors are more important than price. Phase I evaluation factors are more important than Phase II evaluation factors." |
Question 1: Are Factors 1, 2, 3, and 4 all considered "technical" factors?
Question 2: Within Phase I, what is the relative importance between Factor 1 and Factor 2?
| Question 3: Within Phase II, what is the relative importance between Factor 3 and Factor 4? | Factors 1, 2, 3, and 4 are technical factors. Relative importance between Phase I, Factors 1 and 2, and Phase II, Factors 3 and 4 will not be defined further. | ||
| 101 | Background/References: General. | ||
| Question: What is the required minimum proposal validity period? | 120 days phase II submission | ||
| 102 | Background/References: RFQ Section 8.5.2, Paragraph 1, p. 35 states "Quoters who are rated most highly for Factor I and Factor II will be advised to proceed to Phase II and will receive a due date for Phase II submissions..." | ||
| Question: Please confirm Quoters who are advised to proceed will have a chance to ask additional questions in Phase II. | See answer to #61. | ||
| 103 | The instructions allow offerors to use Font Size 9 for the tables and graphics within the Technical Quote. Can the government please confirm if TNR 9 can be used for Attachment 7 - Demonstrated Corporate Experience? | Confirmed | |
| 104 | On Page 2 of the RFQ, the government requests the offeror to submit a signed cover letter by an authorized company negotiator, but there are no similar instructions under Phase I. Can the government please confirm that the cover letter is not required for Phase I? If it is required, can the government please provide the page count information and other instructions for the cover letter? | See answer to #9 | |
| 105 | Can the government please clarify how they will evaluate the offerors' corporate experience in regards to the size and complexity of the PWS? | The vendor is responsible for providing corporate expereince that is similar to size and complexity within the PWS. See attachment 7 for further details. | |
| 106 | Can the government please confirm if there will be another QA period before the Phase II submission? | See answer to #61 | |
| 107 | Can the government please confirm if the offerors are required to submit a detailed past performance narrative to show the relevance to the PWS? If yes, can the government please provide detailed instructions and page limitations? | Please provide documents as required in Section 8 in the RFQ for submission requirements. | |
| 108 | Considering the long weekend and the short QA turnaround time, can the government please extend the Phase I deadline by one week, which will allow the offerors to submit a compelling and detailed approach? | See answer to #5 |
PWS Questions
| Providing Treasury Enterprise Cybersecurity Technology & Services (PROTECTS) | ||
| Questions and Answers | ||
| Number | Questions | Answers |
| 1 | (PWS 1.5) Will the government return the experiece requirements of the Key Personnel positions of SOC Project Manager and the Chief Cybersecurity Engineer to the same level included in the Draft RFQ (1/12/24)? |
SOC Project Manager -3 years of running a SOC -Preference for experience running a combined on-premises/cloud SOC -Five years of experience in cybersecurity incident response in one or more single environments with 50,000+ endpoints
Chief Cybersecurity Engineer -CISSP certification with two years of experience or four years of experience employed in a governmental organization (as a government or contract employee) as a cybersecurity engineer
| -Two years of experience with governmental (FedRAMP) hybrid on-premises and cloud technology stack environments | No | |
| 2 | (PWS 1.5) Would the government consider adjusting the years of experience requirements as follows for offeror's proposed Key Personnel? |
SOC Project Manager -Seven (7) years of running a SOC, with at least 5 years of experience running a combined onpremises/cloud SOC.
-Five (5) years of experience in cybersecurity incident response in one or more single environments with 50,000+ endpoints
Chief Cybersecurity Engineer -Two (2) years of experience with governmental (FedRAMP) hybrid on-premises and cloud technology stack environments, with preference given to cybersecurity engineers with transition experience moving from an on-premises to a hybrid on-premises and cloud
| network solution. | No | ||
| 3 | PWS Section 1.5, page 8 | ||
| Indicates that "The contractor shall assign a SOC Project Manager and Chief Cybersecurity Engineer with appropraite technical certifidation (e.g., CISSP) to assist the Program Manager with the technical responsiblites." Please confirm that the SOC Project Manager is not required to have a CISSP. | Confirmed, CISSP was only an example. | ||
| 4 | Ref: Atch. 2. "PROTECTS PWS," Section 2.1 "Deliverables," Page 37 states that the Deliverable for "Automated reporting and query interface(s) for status and events" must be "Available 24h x 365 days/yr., starting five (5) business days after award." Can the Government confirm that there is an existing ticketing system already in place. Functional areas 2 and 5 contain significant subtasks that would make a five-day implementation challenging. Please provide additional context to better understand this requirement. | Dependent on the Bureau but for example IRS, DO, FS have ticketing systems. | |
| 5 | Ref PWS Section 1.8.4 (page 14) - Can the government confirm whether it is anticipated that there will be only 1 Task Order for each Treasury Bureau and that work within the scope of the PWS that was not awarded with the original TO can/will be added as a modification to the pre-existing TO? | No, there will likely be more than one Task Order for each treasury bureau, a primary TO and subsequent orders are probable given scope and/or value restrictions. | |
| 6 | Ref PWS Section 5 (page 46) states that the company providing the services must have a Top Secret Facility Clearance prior to bidding. Can the Government confirm that this requirement applies to the Prime Contractor only at time of proposal submission, and that the Prime Contractor can then sponsor subcontractors for their Facility Clearance prior to allowing them to work on any resulting Task Orders? | The Prime MUST have a TS FCL and the Sub under the Prime MUST have their own FCL | |
| 7 | Ref PWS Section 5 (page 46) states that the company providing the services must have a Top Secret Facility Clearance prior to bidding. Can the Government confirm that this requirement will not apply to a subcontractor who exclusively provides cloud-based shared services and does not require access to classified information? | See answer to #6, | |
| 8 | 1.12.7 For the Cloud Security Capability Deployment and Management, does the Treasury require the vendor to only have experience monitoring and controlling cloud activity between the bureau and multiple FedRAMP CSP environments, or to also provide the solution from a FedRAMP environment, especially with respect to MSSPs? Additionally, given the sensitivity of the data housed in the cloud, will the Government confirm the required FedRAMP level is FedRAMP High? | The expectation is that the offeror either have a FEDRAMP HIGH SOC or have something comparable that is documented and verifiable. | |
| 9 | Does the Government expect that services delivered under an MSSP model will be done at the time of initial transition to the new provider, or will the government accept that "as-is" operations may be required for a period of time to reduce risk for transition to Supplier's premises and equipment? | Per 1.8.3.2 the contractor shall develop a SOC incoming transition plan that ensures there is no degradation of SOC services during the transition. | |
| 10 | Will the government please provide insight into the average number of events AND Incidents per month at the Department level and at each of the participating Bureaus? | No | |
| 11 | The PWS (Section 1.1 Background) states, “…an operational presence in Africa, Asia, Europe, and Latin America.” Will the offeror be expected to provide cybersecurity staff at any of these listed OCONUS locations? | No | |
| 12 | The PWS (Section 1.1 Background) states, , “…an operational presence in Africa, Asia, Europe, and Latin America.” Are the OCONUS Treasury locations, personnel, equipment, data considered assets part of the enterprise security boundary requiring coverage under offered capabilities or services? | While there is an OCONUS mission, technology delivery, inclusive of cybersecurity, occurs from the U.S. | |
| 13 | The PWS (Section 1.11 FA4) states the need for contractors to be cleared up to TS and be able to process and integrate classified CTI information up to the Top-Secret (TS) level, however it is unclear if the protected networks, assets, or data are also classified. Does the government expect that classified systems and data are also in scope for PWS capabilities and services for the BPA or any task orders subsequently released? | Yes | |
| 14 | PWS 1.11.5 lists "Adversary Emulation" services with delivery of Pentesting reports. Pentesting scopes may include black, grey, and white-box testing, where emulation testing is always from the vantage point of the attacker undertaking simulated multi-stage, realistic attack scenarios. Does the Government intend that 1.11.5 should cover BOTH Emulation services AND more traditional Pentesting under the same services scope? | It is possible that a contractor could be asked to do both in the same scope, however at the BPA level a contractor needs to prove competency in completing either method. Specific requirements will be defined at the Task Order level. | |
| 15 | Within 1.12 FA5 SOC Architecture & Strategy, does the Government have an enterprise level Security and Data Architecture these subordinate SOC architectures are supposed to align to and would the government be willing to share these architectures to offerors under this solicitation? We do not see any reference to such enterprise architecture documentation under Appendix C: Applicable Documents. | No, the SOCs are currrently independently architected. | |
| 16 | Page 15 - Information Security Incident Management - What will be the approximate annual volume for such incidents? | Please reference Appendix B Under TSSSOC Number of Tickets | |
| 17 | Page 20 - How many web applications included for Web application assessments? | Estimated to be 100+ | |
| 18 | Page 20 - How many databases included for database assessment? What is the average size of a database? | Please reference Appendix B | |
| 19 | PWS Page 35-40, Section 2. Please confirm that all deliverables are at the Call Order Level and not at the BPA level. | Confirmed |
This is the start of the file's text. The full file is on GovTribe.
File details come from the government source that posted it. Updated .