Solicitation 47QFRA22R0007_ Attachment 6 with responses Amendment 01.pdf

Attachment 6 - Vendor QA Spreadsheet

Question Number Relevant Document or PWS

Section QUESTION

RESPONSE

1 Attachment 1, Section 2 Will the government accept the DNS operation of .gov zone from pre-signed to online-signing ?

The Government cannot provide an answer for this question without additional information.

2 Attachment 1, Section 2

CISA is concurrently developing a domain name registrar, separate from this contract, that will be the interface for administrators of .gov domains to interoperate with the registry provider’s services. Would this create an OCI so that the awardee of this RFP will be prohibited from competing on the domain name registrar solution?

As stated in the PWS 6.0, "CISA is building a new .gov registrar to enable US-based government organizations to manage their domain’s registration lifecycle, DNS settings, and useful supporting services".

There is currently no "domain name registrar solution" solicitation, nor a perceived OCI for the awardee of this contract.

3 Attachment 2

Will the government renegotiate the pricing matrix, if during the contract term, the number of queries exceeds the pricing table maximum of 5T per month?

See Pricing Notes Section on the "Query Pricing" tab of Attachment

2. Specifically, "the queries assigned to each SubCLIN are not meant to indicate the number of queries over time, but rather the amount of services the Government will fund." and "SubCLINs will be billed based on actual utilization, at the stated quantity queries per million which may be billed on a monthly basis."

4 Attachment 2

Please confirm that the Service Provider will count the number of DNS resolutions per month and then invoice the government for that month based upon the associated cost per the CLIN.

See Section 6.5 of the Solicitation (italics added for emphasis):

6.5 Firm Fixed Price Invoice Requirements CLIN X002The service provider may invoice monthly on the basis of unit price under CLIN X002. Payment will be made for the number of units supported per month. The invoice shall include the period of performance covered by the invoice, and the CLIN number and title. All costs shall be reported by CLIN element. The service provider shall provide supporting information in spreadsheet form. The listing shall include separate columns and totals for the current invoice period and the project-to-date. The spreadsheet shall include the following information:

1. Number of queries supported during the invoice period and awarded price

2. Monthly and total cumulative queries supported during the period of performance

3. Backup documentation supporting the number of queries and identifying the registries supported

5 Attachment 7, FAR 52.204-21

Is the purchase/rental of racks or cages in networked data facilities considered to be an acquisition of a commercially available "off-the-shelf" item?"

If the racks or cages in the networked facilities fell under the definition of a covered contractor information system as defined in the clause then FAR 52.204-21(c) would apply as that paragraph is to ensure safeguarding responsibility at every contract level (prime or any sub). Please refer to the definition of a Commercially Available Off-The-Shelf item (COTS) as defined in FAR Part 2.101, then it would meet that criteria for being COTS when pertaining to FAR 52.204-21(c).

Attachment 7, FAR 52.212- 5(d)(3)

Under 52.212-5(d)(3) is the Service Provider required to retain customer logs (i.e. end user interactions with .gov sites) for the 3 year period? If yes, if the Service Provider provides the government with a free mechanism to pull and then store these records, and still be in compliance?

Please consult your legal counsel on proper compliance with the clause as it pertains to your business operations and record keeping. As stated in the clause, the Service Provider must retain records created in the normal course of business. The customer logs may be required for the pricing structure and billing for queries under this contract. The Government would need more information on the function and labor involved in regards to the mechanism to pull the records but regarless the appropriate records must be stored and maintained by the contractor.

7 Attachment 1 Will the Service Provider be required to develop a system to proof of eligibility to register domains?

There is no requirement in to develop a system to provide "proof of eligibility" in the PWS.

8 Attachment 1, Section 4.2.d

Is NSEC3 a mandatory requirement or will the government accept alternative NSEC implementations that are supeior to NSEC3?

The government expects to follow DNSSEC best practices, which may improve over time. Note that the NSEC3 reference is included in a non-exhaustive list of examples, but is considered a requirement.

DNSSEC RRs (in alignment with performing key management for the TLD; e.g., DNSKEY, DS, NSEC3 )

9 Attachment 1

Will the DNS provider be the exclusive provider or is a multi-provider (primary-secondary or multi-primary) setup a possibility as well?

See PWS Section 4.2 (f):

f. Use of the DNS hosting service will not be mandatory on registrants, and they may elect to manage their own DNS or use a third-party service. These registrants may elect to use the DNS hosting offering as secondary/tertiary authoritative service in order to increase resilience.

10 Attachment 1

What is the implementation / provisioning timeline for all services have to be fully onboarded on the DNS provider?

PWS Section 5.2.2 states:

"CISA desires that the service provider obtain an ATO as soon as possible following contract award."

In addition, Section 9.0 - Technical Approach states:

a. Detailed description and design of the service to be delivered which aligns with the performance objectives identified in PWS Section 4.1, Operate Secure and Resilient Authoritative Nameservers, and 4.2, Operate, Secure, and Offer Authoritative DNS Hosting for Registered .gov Domains, while considering the constraints of PWS Section 6, Constraints. The service description shall include a plan that shows a nominal timeline and descriptive rationale from contract start until authority to operate (ATO) is achieved. The offeror shall clearly delineate all functionality that will be available at time of ATO and any functionality that will be iteratively added to the service. CISA envisions an iterative approach to satisfying all requirements.

11 Attachment 1

Is there a transition period from the incumbent provider to the new Service Provider? If so, please provide a timeline for the transition. The government anticipates conducting a transition as quickly as possible after award. Key factors will include security authorization by the CISA CIO and integration with our new registrar.

Activities associated with the transition are addressed in PWS Subtask 2.3 - Operate Registry Services:

The service provider shall ensure there is a seamless transition from the incumbent contractor, with no service disruption or service degradation during and after transition. The transition may include the following, but only technically necessary to :

a. A shadow operation in which the registry services shall not be connected but shall otherwise be fully operational and shall receive all inputs received by the incumbent contractor.

b. A joint operation in which the registry services shall be being fully operational and shall function transparently.

12 Attachment 2

Can the Service Provider deliver the solution as Software as a Service and not charge for labor and be deemed as providing compliant response?

The Government cannot dictate the proposed service. Offeror's shall provide pricing for their proposed service IAW the solicitation.

13 Attachment 7

Is compliance with Section 7.2.1.2(d)(2) required if Service Provider personnel only has access to encrypted information?

Yes, and the service provider will certainly have access to unencrypted information.

14 Attachment 7

Is compliance with Section 7.2.1.2(d)(2) required if Service Provider personnel only has access to government account information only?

Yes.

15 Attachment 7

Do contractor employees with access to only encrypted sensitive information need to complete the required privacy training mentioned in Section 7.2.1.3(a)(1)?"

Yes.