Question and Answers for Posting.pdf

Question and Answers Draft PWS Solicitation 24322624R0006

Question 1: Is this a new or a follow-on effort? If so, can you provide the contractor’s name and contract number? Any information you can provide will be helpful.

Answer 1: Currently two contractors provide work (Bering Global Solutions LLC and KaiYuh Information Technologies) for this requirement and was consolidated; however, the work is different and is a new requirement.

Question 2: SAM shows the release for 2322624R0006 (OPM ECIOSS), however when I was reviewing the documents, I noticed that the “RFP 2322624R0006” document was missing the signature and the submittal dates (boxes 6 and 30(a-c)).

Answer 2: Submittal dates are identified on page 7. Signatures are not needed by a contracting officer on an RFP.

Question 3: Is there an incumbent on this contract? If so, please provide the incumbent name, current contract number, Period of performance, and value of the contract.

Answer 3: Please see answer to Question 1.

Question 4: Is there an incumbent on this contract? If so, please provide the incumbent name, current contract number, Period of performance, and value of the contract.

Answer 4: Please see answer to Question 1.

Question 5: Can you please tell me if there is an incumbent? If so, contract information?

Answer 5: Please see answer to Question 1.

Question 6: Would you kindly confirm if this is an entirely new effort or is there an incumbent currently providing these services? If so, would you please provide the incumbent contract details?

Answer 6: Please see answer to Question 1.

Question 7: What will be the contract value for this opportunity?

Answer 7: Please utilize https://www.gsa.gov/small-business/forecast-of-contracting-opportunities for further information.

Question 8: Could you kindly provide information on whether this opportunity will result in a multiple or single award contract?

Answer 8: This requirement will be met by a single award definitive contract.

Question 9: Additionally, we are interested in learning about the estimated dollar value of the contract.

Answer 9: Please see answer to Question 7.

Question 10: Is there an incumbent associated with this effort?

Answer 10: See answer to Question 1.

Question 11: For the initial draft PWS, subtask 2.3.8 was dedicated to training and awareness.

From my observation, training and awareness has been excluded from the solicitation. Am I correct in my observation that there are no training and awareness asks within the solicitation 24322624R0006?

Answer 11: Correct. Training and awareness was removed.

Question 12: Could you please confirm the name of the current incumbent for this work?

What is the current status of the incumbent's performance on this contract? Are there any outstanding issues or concerns that have arisen?

Answer 12: See answer to Question 1. Currently there are no concerns.

Question 13: For Past performance page count it was mentioned that “Shall Not Exceed 2 Pages”, is it for each PP or overall?

Answer 13: Past performance page count is limited to two pages.

Question 14: Does Prime need to hold any PPs or is it fine if all the PPs are from Sub?

Answer 14: Offerors may submit past performance for subcontractors, however, greater consideration is given to PP of the prime.

https://www.gsa.gov/small-business/forecast-of-contracting-opportunities https://www.gsa.gov/small-business/forecast-of-contracting-opportunities

Question 15: How many employees are in the environment?

Answer 15: There are roughly 4500 users in the environment.

Question 16: How many IP addresses are associated with the network infrastructure?

Answer 16: There are 14551 IP addresses.

Question 17: How many extremal and/or internal endpoints?

Answer 17: There are 11550 endpoints.

Question 18: Can you please let me know the incumbent currently performing the task and the estimated value for the opportunity?

Answer 18: See answer to Question 1 and Question 7.

Question 19: I would like to know the clearance required for the positions in this notice.

Answer 19: The PWS has been updated. Refer to other questions in the Q&A related to clearances. In addition, Attachment A was inadvertently excluded from the original posting is now available.

Question 20: Can the Government confirm if Step One: Factor 1 - Qualification should be submitted in a single volume, or should each section under Factor 1 be in a separate volume?

Answer 20: Single volume.

Question 21: If each section is to be in a separate volume, can the Government confirm that we may include a cover page and table of contents for each volume?

Answer 21: See answer to Question 20.

Question 22: Can the Government clarify if the cover page (the first page of the proposal) is different from the one-page cover letter?

Answer 22: There is no difference.

Question 23: Can the Government specify the required clearance level for the key personnel?

Answer 23: See the pricing workbook, Key Personnel tab. See the answer to Question 19.

Question 24: Can the Government confirm if the two-page limit applies to all past performance references collectively?

Answer 24: See answer to Question 13.

Question 25: Please confirm that to comply with the “minimum qualifications outlined in the PWS” that key personnel are required to possess at least one of the certifications identified?

Answer 25: Personnel are required to meet all qualifications. OPM acknowledges certifications are just one measure of technical and professional competence; however, experience could be used in lieu of certification at the government’s discretion. The contractor shall have at least 1 of the following certifications unless otherwise stated. All certifications listed should be read with an implied “or equivalent or greater”.

Question 26: For Factor 2 - Demonstration, the requirement states "Attendance at the demonstration will be limited to the firm’s key personnel," considering there are 46 key personnel. Can the Government specify which key positions should attend the demonstration?

Answer 26: The offeror shall at a minimum include one subject matter expert from each task area. The subject matter expert could represent multiple task areas if their skillset aligns appropriately. Questions will seek to understand how collaboration works amongst the team as well as gain an understanding of how the team solves problems related to cybersecurity and network operations. Questions will cover the following: Patch Management, Implementing Enterprise Asset Inventory System, Network Access to Azure via Express Route, Migration from On-Premises to Microsoft Azure Cloud, and Autopilot.

Question 27: For Section 5: Past Performance, if there are no CPARs for a contract, how will the Government assess its relevancy?

Answer 27: The Government may contact POC identified in reference for additional information on relevancy and quality of work.

Question 28: In PWS Section 1.6.1 Place of Performance, the requirement states "It is expected that the contractor will support the 24 hours per day, 7 days per week, 365 days per year integrated monitoring center in the contractor’s facility, not at an OPM location." Is the Government expecting the contractor to provide a facility?

Answer 28: Remote work is permissible if that is the business and staffing model.

Question 29: Clause 1752.209-71 significantly advantages OPM incumbent contractors. We request the playing field be leveled by requiring all key personnel within the stated transition period (30 days). Please see also PWS Paragraph 2.1.1, which requires the transition of key personnel in 30 days (6th bullet).

Answer 29: This does not favor incumbent contractors due to this is not a recompete, but rather a new requirement.

Question 30: As stated in PWS Section 1.6.6 "The names of these personnel and any alternates shall be designated in writing to the contracting officer", Please confirm the citation reference to designating alternates to the COR occurs post-award (during transition, for example).

Answer 30: If a key personnel is replaced, the contractor shall submit a replacement to the contracting officer with a courtesy copy to the contracting officer representative.

Question 31: For Enterprise Firewall Lead (PWS Section 1.6.6.9), Can the Government please clarify if the government requires two Key Personnel for these roles (one each for Boyers and Macon)?

Answer 31: Removed Key Personnel for this function, however, awardee is expected to have staff readily available to physically support Boyers and Macon locations.

Question 32: The following Key Personnel Location requirements currently do not specify Telework, Remote or other requirements (PWS 1.6.6.13, 1.6.6.14, 1.6.6.15, 1.6.6.16, 1.6.6.17, 1.6.6.18, 1.6.6.19, 1.6.6.20, 1.6.6.21, 1.6.6.24). Kindly clarify government requirements for these Key people?

Answer 32: The Key Personnel tab in the Pricing Workbook further clarifies location requirements. If the physical location states N/A the flexibility is remote status. Remote means anywhere in the continental United States. The PWS has also been updated.

Question 33: Citation: PWS § 2.2.1, 2nd Bullet. “The Managed Security Service Provider must be Microsoft Intelligent Security Association (MISA) member and maintain at least 1 additional Federal or DoD client.”

Question: We analyzed the top 30 USA-based MSSPs found on the respected MSSP Alert’s 2023 ranking report, and compared their rankings to Microsoft’s MISA list of members. We found there are only 3 firms on both lists. Out of those 3 firms, we find only 1 firm is does federal business (using FPDS and website reviews). For this reason, the MISA Membership requirement should be considered unduly restrictive and removed as a requirement. Please confirm the removal of the requirement.

Answer 33: Section re-addressed.

Question 34: Citation: PWS § 2.2.1, 2nd Bullet. “The Managed Security Service Provider must be Microsoft Intelligent Security Association (MISA) member and maintain at least 1 additional Federal or DoD client.”

Question 2: MISA membership is irrelevant to demonstrating competency in performing MSSP services and therefore request the requirement be removed from OPM’s requirements.

An analysis of the requirements for MISA membership shows it is based on achieving a “Microsoft Solution Area competency” score. However, MISA “competency” scoring is actually based on the applicant’s sales figures (both initial Microsoft sales and selling more Microsoft products/services to customers). Additionally, there are no scoring components associated with delivering MSSP services. Rather than being based on technical MSSP expertise, membership eligibility is driven by proving sales of Microsoft products and services. As such, the MISA program exists to endorse firms that drive Microsoft products and services sales. Because MISA membership is irrelevant to demonstrating competency in meeting OPM’s MSSP solution delivery requirements, we request removal of the requirement.

Kindly confirm.

Answer 34: See the answer to Question 33.

Question 35: Citation:

a) Attachment 2, Labor Definitions Tab. “Maximum telework acceptable, but candidate is required to be located within a 50-mile radius of Washington DC. OPM's current policy allows for a maximum of 3 days of telework a week. Policy is subject to change for the life of the contract.”

b) PWS § 1.6.1 "Telework is defined as a physical presence at an OPM facility at a minimum of one day per week."

Question: Kindly clarify government policy on telework

Answer 35: The PWS is revised to reflect 3 days of telework a week.

Question 36: For task areas 4 – 6, the clearances are stated in the pricing worksheet, but what about task areas 1 – 3.

Answer 36: Key Personnel clearance levels are identified in the Pricing Workbook. Non-Key Personnel are discussed in Section 1.6.7 of the PWS.

Question 37: The instructions tab in Attachment 2 states Vendors must provide fully burdened rates for each category provided. However, no LCATs are listed on any of the provided tabs.

Can the government please list the required LCATs in column A for each tab as well as provide the labor hours in Column G so that offerors can provide accurate pricing?

Answer 37: LCATs are for offerors to propose on including their labor hour amount of hours and the fully burden labor rate.

Question 38: Can the Government please confirm the LOI is not included in the three (3) page count and is not counted for technical volume?

Answer 38: Per the RFP states Key Personnel Resumes/ LOI do not count towards technical volume.

Question 39: Citation: Section 3: Key Personnel: The offeror shall describe the suitability of the proposed Key Personnel to the proposed position based on the relevant experience and qualifications described in the resume.

Question: Can the Government please clarify where should we describe this?

Answer 39: Resumes shall describe how work experience relates to contract scope and the individual's capability to function effectively in the proposed position.

Question 40: Citation: PWS § 1.6.8, 2nd Paragraph. “All certifications listed should be read with an implied “or equivalent or greater”. The contractors supporting Task Areas 2 & 3 must attain, at least 1, certifications identified in section 1.7.8.1 within 6 months of contract award and maintain certification throughout the period of performance, which will serve to fulfill the requirement for specialized training..”

Question: Please note Section 1.7.8.1 does not exist. Please confirm the correct citation is 1.6.6.

Answer 40: Confirmed, PWS is revised to reflect this.

Question 41: Citation: PWS § 1.6.8, 2nd Paragraph. “The contractors supporting Task Areas 2 & 3 must attain, at least 1, certifications identified in section 1.7.8.1 within 6 months of contract award and maintain certification throughout the period of performance, which will serve to fulfill the requirement for specialized training..”

Question: Please confirm the citation above applies to Key Personnel with purviews that include Task Areas 2 & 3..

Answer 41: See the answer to Question 40.

Question 42: Citation: PWS § 1.6.8, / Task Area 1.

Question: The requirement to have all personnel supporting Task 1 to possess all certifications will unnecessarily drive-up costs. Please consider limiting the requirement of Key Personnel in Task.

Answer 42: OPM acknowledges certifications are just one measure of technical and professional competence; however, experience could be used in lieu of certification at the government’s discretion. The contractor shall have at least 1 certification unless otherwise stated. All certifications listed should be read with an implied “or equivalent or greater”.

Question 43: Citation: PWS § 1.6.8, / All Task Areas.

Question: Some Key Personnel have purviews that span multiple Task Areas. Kindly refer to Key Personnel defined in PWS § 1.6.6.01, 1.6.6.01.1, 1.6.6.01.2, and 1.6.6.01.3. Please clarify Key Personnel standards of compliance for positions spanning multiple Task Areas. For example, do key personnel with multiple purviews need to comply with certifications specified in 1.6.6, 1.6.8, or both?

Answer 43: Key Personnel covering multiple task areas should have certifications as identified in the section they are identified in. For example: 1.6.6.1.1 Senior Program Management Lead

– Network should have the certifications identified in section 1.6.6.1.1 despite covering multiple task areas. OPM acknowledges certifications are just one measure of technical and professional competence; however, experience could be used in lieu of certification at the government’s discretion. The contractor shall have at least 1 the following certifications unless otherwise stated. All certifications listed should be read with an implied “or equivalent or greater”.

Question 44: Citation: PWS § 1.6.8, / All Task Areas.

Question: Do requirements in 1.6.8 apply to Key Personnel?

Answer 44: No Key Personnel requirements are stated in the Key Personnel section.

Question 45: Citation: PWS § Task Area 2: Managed Services.

Question: Please specify the government's security requirements for personnel assigned to the Managed Security Operations Center.

Answer 45: See the answer to Question 40.

Question 46: Citation: PWS § Task Area 2: Managed Services

Question: Kindly confirm tools required to perform DFIR are provided by the government.

Answer 46: Tools leveraged by OPM are listed Appendix B.

Question 47: Citation: PWS § Task Area 2: Managed Services

Question: Kindly confirm if and how DFIR retainer costs should be priced.

Answer 47: The Managed Services task is firm fixed price.

Question 48: Citation: PWS 1.6.8: Task Area 4 (Includes all Task Area 4 Sub-tasks)

Question: Please clarify if all certifications are required for all positions. For example, Sub- Task: Cyber Threat intelligence includes requirements for three certifications; . Threat Intelligence Fundamentals + CTIS-1 Certification, CREST Practitioner Threat Intelligence Analyst, and GIAC Cyber Threat Intelligence (GCTI). Does each individual in providing Cyber Threat Intelligence Services have to possess all three certifications, including junior and mid-level personnel?

Answer 48: OPM acknowledges certifications are just one measure of technical and professional competence; however, experience could be used in lieu of certification at the

Question 49: We are writing to seek clarification and further information regarding the qualifications required for the key personnel. For example, Enterprise Firewall Lead position specified in the recent contract requirements. As stated, the position demands a minimum of 7 years of experience, along with four specific certifications:

AZ-900: Microsoft Azure Fundamentals AZ-700: Designing and Implementing Azure Networking Cisco Certified Network Associate (CCNA) Palo Alto Accredited Certification Engineer (ACE) While we understand the necessity of highly qualified individuals to ensure robust network security and effective management, it is important to note that professionals meeting these criteria are likely to command higher salaries due to their advanced skills and extensive experience. This could significantly impact the overall cost of the contract. Is there any flexibility in the certification requirements? For example, would equivalent certifications or a combination of certifications and additional experience be acceptable to meet the job requirements?

Answer 49: Key Personnel removed for Firewall lead.

Question 50: Will the Government please clarify if they are providing scenarios along with the advisory notice for Step Two to allow offers to prepare?

Answer 50: The government will provide the scenarios the day of the oral sessions.

Question 51: Will the Government please clarify, if scenarios are not provided, how much of the 1 hour and 40 minutes is allocated for on-the-spot preparation?

Answer 51: The offeror has 20 minutes total to prepare and respond. If preparations take 15 minutes, then the offeror has 5 minutes to provide a response.

Question 52: Are the offerors required to prepare any PowerPoint slides for the presentation?

Answer 52: No the offeror does not need prepare any PowerPoint slides for the oral presentation.

Question 53: There are many ambiguities regarding the certifications required for various positions and those that are considered desirable. Could the Government please clarify this by providing a detailed list of all required certifications for key personnel in PWS 1.6.6?

Additionally, considering these ambiguities, could the Government please provide a two-week extension following the release of the Q&A to allow sufficient time to identify key personnel?

Answer 53: The certifications listed under Key Personnel are required. Solicitation is extended.

Question 54: Who is the current incumbent working on this opportunity? If there is an incumbent, could you provide the Award ID?

Answer 54: Please see answer to Question 1.

Question 55: Do contractors need to have any clearance?

Answer 55: Please see the PWS sections 1.6.6 and 1.6.8.

Question 56: The RFP requires offerors to submit SBA-verification, signed amendments, and the CTA. Will the government please confirm if these items should be submitted as individual files or in the cover page file?

Answer 56: Individual files.

Question 57: Will the government please confirm that the Small Business Administration (SBA) 8(A) Status, Amendments, and CTAs are excluded from the Vol 1 page count restrictions?

Answer 57: They are excluded.

Question 58: Section 1.6.6 includes a list of required Key Personnel LCATs, descriptions, and locations.

Can the government please clarify the intent of the various “Location” requirements for each KP i.e. When multiple locations are listed for a key person, is it person per named position or is it one at each listed location?

Answer 58: See the Key Personnel section in the PWS. It has been updated to provide clarity.

Question 59: Will the Government please confirm if the four network specialists in Section

1.6.6.6 are telework or onsite positions?

Answer 59: All network related staff in network engineering and operations (supporting section 2.5.1) will need to be available to go on site for the duration of the contract. Telework is acceptable but all staff will be required to be on site for support needs as required.

Question 60: RFP Section 1.6.8 – Skills and Certifications states that “contractors supporting Task Areas 2 & 3 must attain, at least 1, certifications identified in section 1.7.8.1 within 6 months of contract award.”

However, Section 1.7.8.1 does not appear within the RFP/PWS; will the Government please provide?

Answer 60: See the answer to Question 40.

Question 61: PWS Section 1.6.6 states “Resumes, proof of certification, and signed letters of intent for these key personnel shall be submitted with the contractor’s technical quotation […] They shall contain a complete resume for the proposed substitute or addition, the mandatory certifications, and any other information requested by OPM”.

However, neither the instructions to offerors nor method of evaluation for Key Personnel state that offerors need to provide proof of certifications for each KP or that we must provide resumes and certs for the proposed substitute of each KP as well.

Will the Government please confirm that offerors:

1) only need to provide resumes and LOIs for their proposed KPs to be compliant with this proposal submission requirement?

2) Do not need to provide substitute resumes and their proof of certification;

Answer 61: Offerors shall provide resumes and signed letters of intent. The instructions to offerors and method of evaluation have been revised.

Question 62: The table shown in Section 1.6.8 shows the Junior Level as requiring greater than (>) 5 years’ experience. Since Mid-Level is defined as between 5 – 10 years’ experience, should Junior be defined as less than (<) 5 years’ experience?

Answer 62: Correct. The typo is corrected in the revised PWS.

Question 63: Will the Government please confirm that the Letter of Intent is excluded from the resume page limit?

Answer 63: Letter of intent is excluded.

Question 64: Section 1.6.8. states that an individual with 10+ years of experience would be considered a Senior Career Level, would the government accept baseline+ 5 years of experience in lieu of the certification requirement for a specific LCAT.

Answer 64: No, the government will not accept a baseline of +5 years.

Question 65: Step 1, Factor 1, Section 5 (Past Performance) indicates “Offerors may submit past performance for subcontractors however, references shall be provided on the Prime contractor.”

Will the Government please confirm that references need to be provided by a Federal POC when using a subcontractor past performance?

Answer 65: References do not need to be provided by a Federal POC.

Question 66: Can the Government provide an estimated timeframe from the submission of Step 1, (Qualification) to the scheduling of Step Two Demonstrations?

Answer 66: Demonstrations will be scheduled after Qualifications evaluations are complete.

Question 67: Step 2, Factor 2, Demonstration states that “The offeror will be given four scenarios. Oral presentations will consist of one hour and 40 minutes. Offerors will be given

20 minutes per scenario the remaining time will be for Government questions and clarifications.”

1. Will the Government please confirm that all offerors will be given the same four scenarios?

2. Will the oral presentations be held in person at the OPM HQ location?

Answer 67: All scenarios will be the same and held via Microsoft Teams.

Question 68: Step 2, Factor 2, Demonstration states that “The offeror will be given four scenarios. Oral presentations will consist of one hour and 40 minutes. Offerors will be given 20 minutes per scenario the remaining time will be for Government questions and clarifications.”

1. Will the Government please confirm which KPs at a minimum will need to be present at orals?

2. When will the government provide the four scenarios to the Offeror (eg., 24 hours in advance or at the start of the orals sessions)?

Answer 68: See the answer to Question 26. The government will provide the scenarios the day of the oral sessions. The government requires observation of collaboration efforts.

Question 69: The RFQ states that “Offeror shall be evaluated on the recency and relevancy of the submitted contracts. No more than 10 older than the past 5 years will not be considered.”

Should this be restated as follows: No more than 10 past performance references shall be submitted, and Contracts older than 5 years will not be considered.

The RFP instructions state that offerors can provide up to 10 references for Section 5: Past performance. However, the evaluation factors have other requirements. Will the Government please confirm that they will only evaluate up to 10 past performance references that are performed within 5 years?

Answer 69: The submission shall submit a list of up to ten (10) references within 5 years.

Question 70: Row 1 of Task Area 3 there is a KPI that reads "Customer Satisfaction Rating".

The PWS indicates that a "99.99%" performance standard is required. Typically "Customer Satisfaction Ratings" are measured on a different scale. Usually Customer Satisfaction is measured on a "1 to 5" type ratting where 1 = very unhappy and 5 = Very happy. Can the government either update the KPI measurement customer satisfaction or further explain how this will be measured?

Answer 70: The KPI measurement has been removed.

Question 71: The RFP states “OPM will need key staff to support specific on-premise solutions only until the services are migrated to the cloud and the on-premise components are sunset.”

Can the government provide more clarification regarding key staff and required skills, as it relates to this requirement?

Answer 71: Please see the PWS.

Question 72: Can the Government please confirm that there will be another Q&A period during Step 2 of the proposal process.

Answer 72: The Government does not intend to hold another Q&A during step 2.

Question 73: For enterprise firewall lead, we interpret there are two personnel required because “candidates” is plural. Here is the direct quote from the RFP: “Location: Maximum telework acceptable, but candidates are required to be located within a 50-mile radius of Boyers or Macon in the event of catastrophic outages” Can the government please clarify how many FTEs are required in Enterprise Firewall Lead?

Answer 73: Key Personnel for Firewall Lead removed.

Question 74: Citations:

PWS § 1.6.6 Key Personnel (includes all sub-sections) Attachment 2 Pricing Worksheet PWS § 1.6.7 “ “The contractor shall possess the appropriate level of security clearance as designated for each Task Area role. The contractor shall hire the required security cleared personnel for the length of the contract as identified in the ECIOSS Staffing Table Attachment.”

Question: Please note that Attachment 2 Pricing Worksheet does not include clearance requirements for the FFP Tasks. Please provide guidance on OPM’s security requirements for Task Areas 1, 2, and 3. The request for clarification includes Key Personnel and non-key personnel with Purviews in Tasks 1, 2, and 3 as well.

Answer 74: The PWS has been revised in Section 1.6.7.

Question 75: Citation:

Attachment 2 Pricing Worksheet / the Task Area tabs PWS § 1.6.6 and § 1.6.8

PWS § 1.6.7 “ “The contractor shall possess the appropriate level of security clearance as designated for each Task Area role. The contractor shall hire the required security cleared personnel for the length of the contract as identified in the ECIOSS Staffing Table Attachment.”

Question: Each Task Area tab in the spreadsheet contains lists of seniority/clearance/location requirements. However, the government did not link each row of the Pricing Worksheet to PWS sub-tasks and did not describe the roles associated for each seniority/clearance/location requirement that would link all requirements associated with all roles. To ensure proposals properly staffed, are priced appropriately reflecting all personnel requirements, and are fully compliant with Attachment 2 and PWS 1.6.6 and 1.6.8, we request the government provide additional information of resource roles and their associated sub-task assignments for each row of the Pricing Worksheet. Kindly confirm the government will provide the required linkage from the pricing worksheet to the PWS.

Answer 75: See the answer to Question 74.

Question 76: Is there an incumbent on this contract? If so, please provide the incumbent name, current contract number, Period of performance, and value of the contract.

Answer 76: Please see answer to Question 1.

Question 77: Is there an incumbent currently performing the task?

Answer 77: See answer to Question 1.

Question 78: Estimated value for the opportunity?

Answer 78: See answer to Question 7.

Question 79: Concern 1 The Key Personnel requirement is excessive for an 8a organization.

Most 8a organizations would find it unduly difficult or impossible to provide 21 resumes for this solicitation. Most will not have 21 employees “sitting on bench” waiting to be employed.

Will the government consider reducing the Key Personnel Resume requirement to:

Senior Program Manager Program Manager Cyber Senior Program Manager Lead Network Cloud Engineer and Architect Senior MS365 Enterprise Administrator

Answer 79: The Key Personnel section of the PWS has been updated. OPM requires the stated Key Personnel outlined in the PWS.

Question 80: RFP Instructions to Offerors, Page 2 - The page limitations state the Key Personnel Resumes / Letters of Intent are "Not to Exceed 3 Pages per Resume. Can the Government confirm the Letter of Intent is excluded from this page limit?

Answer 80: See answer to Question 38.

Question 81: The Network Operations Support Staff description states that two (2) network support specialists are required at each data center location, in Boyers, PA, and Macon, GA. Is the offeror expected to submit four (4) resumes for this position?

Answer 81: See the revised PWS.

Question 82: The instructions state that "Offerors may submit past performance for subcontractors; however, references shall be provided on the Prime contractor." Will the Government allow subcontractors to submit references for contracts for which they were not the Prime (i.e., a subcontractor)?

Answer 82: - See answer to Question 14.

Question 83: The RFP states that the contract will be "commencing two (2) weeks after the date of award." Does the Government have an estimate of when an award would be made following the July 11, 2024, submission date?

Answer 83: The Government cannot anticipate time of award.

Questions 84: Will the Government confirm the number of Key Personnel for positions where location is listed as "Boyers, PA, Macon, GA, and Washington DC" OPM locations?

Answer 84: See the revised PWS.

Question 85: Will the Government please confirm the location for the demonstration (Factor 2), whether it is expected to be online or in person?

Answer 85: See answer to Question 67.

Question 86: Reference: Not to Exceed 3 Pages per Resume. These pages do not count for your technical volume.

Answer 86: See answer to Question 38.

Question 87: Reference: Past Performance Shall Not Exceed 2 Pages.

Would the government please confirm the allocated 2 Pages is for all (up to 10 References) and is not per Past Performance Reference?

Answer 87: See the answer to Question 13.

Question 88: Reference: Vol II Price, SF 1449 and Attachment 2 Pricing Worksheet.

Would the government please confirm Vol II and SFs are not due with Step One?

Answer 88: Past performance is in step one.

Question 89: Reference: The government will schedule Offerors for Step Two Demonstrations immediately after the completion of Step One.

Will the government provide an approximate time it will take to complete the Step One review?

Answer 89: We cannot anticipate at this time.

Question 90: Will the government evaluate Past Performance of the Prime contractor and subcontractors equally as long as some references are from the Prime Contractor?

Answer 90: See answer to Question 14.

Question 91: As this is an 8(a) set-aside, will the government require that the prime offeror submit at least half of the representative Past Performance references to align to prospective FAR Limitations on Subcontracting that mandate that the prime contractor perform at least 50% of the required work?

Answer 91: Prime contractor is required to perform 51% of the required work.

Question 92: Reference: Offerors may submit past performance for subcontractors however, references shall be provided on the Prime contractor.

Is this meant to suggest that teams may submit Past Performance of subcontractors as long as at least 50% of the references are from the prime contractor?

Answer 92: See answer to Question 91.

Question 93: To help us prepare better and have the right Key Personnel attend the Demonstration session, will the government consider providing example/s of the what would be considered a demonstration scenarios topic?

Answer 93: See answer to Question 50.

Question 94: Will the government consider issuing the 4 scenarios prior to contractor's scheduled Demonstration Day?

Answer 94: See answer to Question 93.

Question 95: Reference: Offerors will be given 20 minutes per scenario the remaining time will be for Government questions and clarifications.

How many Key Personnel from the Offeror's team should attend the Demonstration?

Answer 95: See the answer to Question 26.

Question 96: Reference: Oral presentations will consist of one hour and 40 minutes. Offerors will be given 20 minutes per scenario the remaining time will be for Government questions and clarifications. Will the government consider adding 30 minutes of preparation time prior to the presentations?

Answer 96: Not at this time.

Question 97: Reference: Resumes, proof of certification, and signed letters of intent for these key personnel shall be submitted with the contractor’s technical quotation and must meet the minimum qualifications and certifications for the position.

Will the government consider accepting similar, alternate certifications than those listed for Key-Personnel or will the government accept experience in lieu of certifications for Key- Personnel?

Will the government consider allowing all Key Personnel 6 months following award of contract to earn the required certifications?

Answer 97: OPM acknowledges certifications are just one measure of technical and professional competence; however, experience could be used in lieu of certification at the

Question 98: Will the government clarify if the certifications listed for Key Personnel are "mandatory" or preferred?

Answer 98: See the answer to Question 97.

Question 99: Reference: The Managed Security Service Provider must be a Microsoft Intelligent Security Association (MISA) member and maintain at least 1 additional Federal or DoD client.

Will the government consider the removal of this requirement given the scarcity of MS-approved providers and the impact of limiting competition?

Is the Prime required to be a member of the Microsoft Intelligent Security Association (MISA) or can a partner on the Prime's team hold the certification?

Answer 99: See the answer to Question 33.

Question 100: Did the government intend to include an Attestation form exclusively related to SAR and SSE? The scope of attestation appears out of alignment with the total scope of the program.

Should there be an updated form to which the government would like the offerors to attest?

Answer 100: Yes, it was intended. The Attestation form is required for the cybersecurity portion of this contract.

Question 101: Where the government states in bullet 2 under "Format" - "Double-sided pages," will the government please confirm whether the page limits in the table on page 2 apply to each "double-sided" page (i.e. 1 page, front and back = 1 page) or whether each side of each page counts as 1 page?

Answer 101: Each side of a page is considered one page.

Question 102: Will the government please clarify whether offerors should align to the projected line items in the tabs to establish physical locations and flexibility? Without projected roles/LCATs, it is difficult to determine what roles the government intends to mandate for onsite work.

Answer 102: Please see the PWS for location requirements. All network related positions are teleworking positions. All other positions unless otherwise stated are remote or up to the staffing model of the Offeror.

Question 103: Will the government please confirm that offerors have the flexibility to determine levels and locations for roles on each tab despite the pre-populated information that is in the task tabs?

Answer 103: For all positions outside of Key Personnel yes. Please note network related positions are teleworking positions not remote.

Question 104: Will the government provide baseline guidance on the number of roles that must be either "Telework" or "Onsite" by Task Area and, where possible, note which specific roles are required as such?

Answer 104: Please see all questions and answers related to location in this document. Please note the PWS requirements.

Question 105: Will the government please clarify "No more than 10 older than the past 5 years will not be considered" to reflect what we believe to be the government's intent, "No more than 10 total references. Any reference that ended more than 5 years prior to proposal submission will not be considered."

Answer 105: The submission shall submit a list of up to ten (10) references within 5 years.

Question 106: Can the government please clarify which certifications listed for each of the Key Personnel are "required" and which are "representative"

Answer 106: OPM acknowledges certifications are just one measure of technical and professional competence; however, experience could be used in lieu of certification at the government’s discretion. The contractor Key Personnel shall have at least 1 certification unless otherwise stated. All certifications listed should be read with an implied “or equivalent or greater”.

Question 107: Cant the government confirm whether it is anticipated that only one Key Personnel position exists for each of the noted Key Personnel descriptions 1.6.6.1.1 through 1.6.6.24… or are all personnel associated with those LCATs anticipated to be Key Personnel (i.e. multiple "Network Operations Support Staff" (1.6.6.6))?

Answer 107: See the revised PWS.

Question 108: Where multiple locations are listed for Key Personnel staff, should it be assumed that a KP is needed at each location or that any of those locations are acceptable for a single Key Personnel to fill the role (i.e. are Senior Exchange Engineer required at both Boyers, PA and Macon, GA - or is one person at either location sufficient?)

Answer 108: See the revised PWS.

Question 109: Will the government please clarify which certifications are required for the Continuous Monitoring and Authorization Services Lead? The full list of certifications is rarely held by a single individual.

Answer 109: Certifications have been updated. See all answers in Q&A and the PWS.

Question 110: Network Operations Support Staff shows 2 specialists at 2 different location required - does this mean that this is a total of 4 Key Personnel for this single role?

Answer 110: See the revised PWS.

Question 111: This position suggests that the Senior Exchange Engineer is required at both Boyers, PA Does this position require 2 Key Personnel (one for each location)?

Answer 111: See the revised PWS.

Question 112: This position suggests that the Senior Systems Engineer is required at Boyers, PA, Macon, GA, and Washington DC. Does this position require 3 Key Personnel (one for each location)?

Answer 112: See the revised PWS

Question 113: This position suggests that the Mid System Administrator is required at Boyers, Answer 113: See the revised PWS.

Question 114: This position suggests that the System Administrator is required at Boyers, PA, Macon, GA, and Washington DC. Does this position require 3 Key Personnel (one for each location)

Answer 114: See the revised PWS.

Question 115: This position suggests that the System Administrator is required at Boyers, PA, location)?

Answer 115: See the revised PWS.

Question 116: This position suggests that the Cloud Engineer is required at Boyers, PA, Answer 116: See the revised PWS.

Question 117: This position suggests that the Senior SQL Administrator is required at Boyers, Answer 117: See the revised PWS.

Question 118: This position suggests that the Linux Engineer is required at Boyers, PA, Answer 118: See the revised PWS.

Question 119: This position suggests that the Patching Lead is required at Boyers, PA, Macon, GA, and Washington DC. Does this position require 3 Key Personnel (one for each location)?

Answer 119: Key Personnel for this role have been removed.

Question 120: This position suggests that the Operations Support Lead is required at Boyers, Answer 120: See the revised PWS.

Question 121: This position suggests that the PKI Administrator is required at Boyers, PA, Answer 121: See the revised PWS.

Question 122: Recommend removing the table in 1.6.8 as the recommended levels conflict with the stated experience requirements of several of the government stipulated Key Personnel. Junior is currently listed as "greater than 5 years" which is generally not considered "junior." Several Senior positions outlined in the KP descriptions require 5 years of experience. Will the government please remove this table and allow offerors to propose appropriate years of experience for the LCATs included with their offer?

Answer 122: The table has been corrected.

Question 123: Where the government states, "All certifications listed should be read with an implied “or equivalent or greater." Will the government please clarify whether ALL certifications listed as required at "All experience levels" are required (equivalent or greater) for EACH resource aligned to that task area? Or is this meant to be a list of representative and relevant certifications of which a prospective staff member "should" have at least one?

Answer 123: See the Q&A answers related to certifications.

Question 124: The Government states, "The Managed Security Services Provider must be Microsoft Intelligent Security Association (MISA) member and maintain at least 1 additional Federal or DoD client." Can the Government confirm that MISA membership held by a subcontractor at time of award is sufficient?

Answer 124: See the answer to Question 33.

Question 125: Will the government confirm that the contractor does not need to include license costs associated with the Microsoft products supported as part of the Managed SOC (PWS 2.2.1) including Defender, Sentinel, and Defender for Identity?

Answer 125: Confirmed. The government handles licenses for its environment.

Question 126: The notional years of experience for the Junior career level is stated as greater than 5 years of experience, as is the mid-level. Would the government please clarify that a Junior level would have less than 5 years of experience (< 5)?

Answer 126: See the answer to Question 122.

Question 127: The contractors supporting Task Areas 2 & 3 must attain, at least 1, certifications identified in section 1.7.8.1 within 6 months of contract award and maintain certification throughout the period of performance, which will serve to fulfill the requirement for specialized training. In the table Task Area 2 states that the Certifications are “Not Applicable”. Task Area 3 lists certifications per subgroup are these in addition to the certifications referred to in 1.7.8.1? Section 1.7.8.1 is not identified in the PWS.

Answer 127: OPM expects the managed security service provider (task 2) to maintain quality and qualified staff.

Question 128: Given the annual contract size as $37M are there any restrictions on the annual revenue of the vendor?

Answer 128: The Government will do a responsibility determination prior to award in coordination with the SBA.

Question 129: Is there a need to have a past performance of a size of $37M or more?

Answer 129: The Government will accept past performance of a size of $37 or more;

however, it may or may not be determined relevant.

Question 130: Is there a current incumbent?

Answer 130: See answer to Question 1.

Question 131: Section 4: Attestation Form, is it required for only the prime contractor to sign the attestation form, or do all subcontractors also need to provide their own signatures?

Answer 131: The Attestation Form is required to be signed by the prime contractor.

Question 132: The Cover Page/Letter is limited to 1 page, Are the required SBA 8(a) verification, amendment(s), and CTA documentation excluded from the page limit? Should this documentation be included in the Cover Page document?

Answer 132: This is excluded from your page limit. It shall be a separate document.

Question 133: For Past Performance, please clarify the following statement: “No more than 10 older than the past 5 years will not be considered”. What will be the Government’s method of evaluation if no CPARS exist for a given past performance reference?

Answer 133: The Government may reach out to the POC submittal for those that are not listed in CPARS.

Question 134: This section states that “Offerors may submit past performance for subcontractors however, references shall be provided on the Prime contractor.”. Please clarify whether this means 1) Offerors may submit past performance where they were a subcontractor provided the prime contractor’s information is in the reference; or, 2) Offerors may submit past performance from their subcontractors on this effort provided the subcontractors were prime contractors on the submitted reference.

Answer 134: The prime can submit work when they were a sub as well as past performance on their subs.

Question 135: Will the Government provide the Offerors the scenarios when the demonstrations are scheduled? How much time will be provided to prepare? Will the demonstration be conducted virtually or in-person?

Answer 135: See the answer to Question 50.

Question 136: Please clarify that the LOI’s are not included in the 3-page limit for the resumes.

Answer 136: Correct LOI’s are not included in the 3 page limit for resumes.

Question 137: Are title pages, TOCs, and acronym lists excluded from the page counts for each of the documents?

Answer 137: Yes.

Question 138: Regarding the Microsoft licenses used by OPM are these licenses Government 3 (G3) or Government 5 (G5)?

Answer 138: Government 5 (G5)

Question 139: If G3 licenses are in place is the Defender for Endpoint P2 plan included?

How many endpoints have an endpoint detection and response (EDR) sensor installed?

Answer 139: See Question 138.

Question 140: Does OPM use both SentinelOne and Microsoft Defender for Endpoint?

Answer 140: OPM uses Microsoft Defender for Endpoint, minor support of DCSA’s SentinelOne environment.

Question 141: What is the distribution of EDR technology that is deployed? (SentinelOne versus Microsoft Defender)

Answer 141: See the answer to Question 140.

Question 142: What is the total inventory of workstations and servers that have an EDR agent deployed?

Answer 142: See the answer to Question 17.

Question 143: What is the total number of databases within OPM?

Answer 143: Assume greater that 5.

Question 144: What are OPM’s data retention requirements?

Answer 144: OPM is aligned to M-21-31.

Question 145: Can OPM provide any information about the incumbent contractor for the ECIOSS contract, such as their past performance or the length of their incumbency? Or is this a new contract requirement?

Answer 145: See answer to Question 1.

Question 146: Can OPM share the overall budget or funding range allocated for the ECIOSS contract?

Answer 146: See answer to Question 7.

Question 147: Can the same person fulfill the roles of ISSO and SCA, or must these be separate individuals?

Answer 147: Same person is expected to perform both functions.

Question 148: For the technical lead positions (e.g., Cloud Solutions Architect, Senior Cloud Administrator), are there specific technologies or platforms that OPM is prioritizing?

Answer 148: OPM is a Microsoft Azure environment.

Question 149: Are there any specific certifications that OPM considers more valuable than others for certain roles?

Answer 149: See all questions and answers related to certifications.

Question 150: Is there any flexibility in the clearance requirements of certain roles, especially for non-key personnel?

Answer 150: See the revised PWS and the inadvertently left off Attachment A for guidance.

Question 151: Will OPM provide any support or resources to assist the vendor in obtaining and maintaining the required clearances for personnel?

Answer 151: OPM does not understand the full breadth of what support or resources that are being requested. All contractor employees employed on this contract will go through OPM’s suitability process. OPM is hopeful that contractor employees employed have an interim or are already cleared; however, that is not a requirement.

Question 152: Can OPM provide more details on the process and timeline…