DEOS_Question_and_Answer_IL6.docx

Defense Enterprise Office Solution Draft Request for Quote Question and Answer

This Draft Question and Answer provides clarification on the Impact Level 6 requirements.

Question: In the functional Requirements" document it states: The cloud service provider will be required to meet all of the requirements outlined in the DoD Cloud Computing (CC) Security Requirements Guide (SRG) for Impacts Level 5 and 6."

Does this mean that candidates must be certified for ILs 5&6 at the time of the award? If IL 5&6 certifications are required, what is the government's strategy to ensure a competitive acquisition process?

Answer: The initial statement is correct, “The Cloud Service Provider (CSP) will be required to meet all of the requirements outlined in the DoD Cloud Computing (CC) Security Requirements Guide (SRG) for Impacts Level 5 and 6." Initially, however, candidates must have a certified Impact Level 5 (IL5) offering for infrastructure, platform, or software as a service approved requirement to successfully compete. Market research indicates that there are sufficient vendors with DoD Cloud Computing (CC) Security Requirements Guide (SRG) Impact Level 5 (IL5) to facilitate competition and ensure timely delivery of the first phase of delivery – services for non-classified networks in the continental United States. It is anticipated that after award, and in parallel with non-classified services delivery, efforts will be undertaken to prepare for operations outside the continental United States and for the classified networks (IL6). Accepting less than Impact Level 5 (IL5) would unnecessarily delay delivery of capabilities. At this time we anticipate that the final RFQ will reflect that an offeror will not be required to possess IL6 at the time of the award in order to be eligible for the award.