18R0012_FAS_0001_-_AOQ_Attachment_5_Final.docx

Solicitation No. 60RRBH18R0012 Page 13 of 15 Attachment 5, Amendment A001– Answers to Potential Offerors Questions

FISMA Audit Services

A. Potential offeror questions and RRB answers are incorporated into the solicitation as follows:

1. General: How many systems in total will be the subject of this Assessment & Authorization (A&A) independence assessment?

Answer: The Railroad Retirement Board’s (RRB) information system environment consists of four systems. All four systems are subject to the independent evaluation, which does NOT include Authorization. The four systems are comprised of three major applications supporting RRB operations (although each major application has multiple component applications), and one general support system that includes both mainframe and network systems governing the three major applications and their component applications.

2. General: Are the systems in question associated with existing Authority to Operate (ATO) certificates? If so, what are the expiration dates of each ATO?

Answer: Each of the four systems have a current Authorization to Operate. The security authorizations will remain in effect as long as: (i) the vulnerabilities reported during the continuous monitoring process do not result in additional agency-level risk that is deemed unacceptable; and (ii) the system has not exceeded the maximum allowable time period between security authorization in accordance with federal or agency policy.

3. General: What are the FISMA risk impact levels for each system to be assessed?

Answer: As stated in Section III, C.1.b., the RRB’s information system environment consists of four systems, each of which has been categorized as a moderate impact system in accordance with standards and guidance promulgated by the National Institute of Standards and Technology (NIST).

4. General: Have common control providers been designated via Service Level Agreements (SLA) or other ratified agreements?

Answer: RRB’s common controls are identified as a component of the general support system, the Agency Enterprise General Information Support System (AEGIS) under the direction of the RRB’s Bureau of Information Services.

5. General: Is each system assigned a centralized ISSO or a dedicated Information Security/Information Assurance SME through which assessment observations and artifact requests will be disseminated?

Answer: Each system has an assigned responsible organization with a system owner and authorizing official. The system owners generally serve as the primary point of contact for assessment observations and artifact requests.

6. General: Being that the A&A review is approved for remote execution, how are NIST 800-53a assessment methods and objects accommodated; i.e. test, examination and interview for evidence? Will the client furnish GFE devices, secure communication channels (VPN), document repositories; to include access to stakeholders [sic] calendars, teleconference lines or webex’s?

Answer: As stated in Section III, G.1., the RRB OIG will consider various secure options for documentation transfer, including a Contractor-provided portal or VPN access to the Contractor’s network files. The Contractor may also propose other cost-effective options that the Contractor may provide. Teleconference lines are available, however access to RRB’s network document repository or stakeholders’ calendars will not be provided.

No more than one GFE laptop will be furnished.

7. General: Can the Government indicate who the incumbent for this work is?

Answer: There is no incumbent contractor for this work. RFP 60RRBH18R0012 FISMA Audit Services is a new requirement.

8. General: Does the consulting company need to be a CPA firm?

Answer: The independent evaluation must be performed in accordance with Government Auditing Standards issued by the Comptroller General of the United States (Yellow Book). Those standards do not require information system audits to be performed by a CPA firm.

9. General: Does the consulting firm need to issue an opinion, or attestation statement?

Answer: As stated in Section III, B., the Contractor must respond to specific performance indicators established each year by the Office of Management and Budget (OMB) and the Department of Homeland Security (DHS), document and provide the Contracting Officer’s Representative (COR) the metric evaluations for the Federal Information Security Modernization Act of 2014 (FISMA) CyberScope report and an annual performance audit report.

10. SF 1449: Page 1, item #10, the Government lists NAICS: 541690, Size Standard $15,000,000. Would the government consider listing other NAICS codes to open this solicitation up to other consulting firms? Maybe NAICS 541611 or 541990?

Answer: The Government cannot list other NAICs codes for this solicitation. FAR 19.102(c) states “for size standard purposes, a product or service shall be classified in only one industry, whose definition best describes the principal nature of the product or service being acquired even though for other purposes it could be classified in more than one.”

Interested offerors that can provide the requested services under a different NAICs code would not be considered ineligible for evaluation for potential award for the requested services.

11. Section IB: The Government states, 'RRB OIG seeks to procure services to assist with its annual audit of the RRB’s information systems in accordance with the Federal Information Security Modernization Act of 2014 (FISMA), as specified in Sections II and III.’ Can the Government confirm this is the audit of the RMF process under the RRB FISMA services, and not the implementation of the RMF process?

Answer: This solicitation is for the audit of the RRB’s risk management framework (RMF) process, not the implementation of the RMF process.

12. Section II: Do the five CLINS refer to the Base Year POP and each of the 4 optional year POPs?

Answer: Yes.

13. Section III.B.1: The Government states, ' The RRB OIG envisions that the majority of services will be performed offsite.' Can the Government clarify if work can be performend [SIC] anywhere within the CONUS?

Answer: Yes, the audit services can be performed anywhere within the Continental United States (CONUS).

14. Section III.C.1.a: Does RRB consider a single system review as an adequate Representative Subset of Information Systems for the contractor’s annual review?

Answer: No, reviews of the major application systems alone would not constitute a representative subset of the RRB’s information systems. Historically, RRB OIG has performed reviews of all four of the RRB’s information systems with the predominant review consisting of the general support system.

15. Section III.C.1.c: Are all four of the RRB systems mainframe based and does RRB administer the hardware themselves?

Answer: No, the RRB’s four information systems consist of both network and mainframe operations. The RRB’s general support system under the direction of the RRB’s Bureau of Information Services includes both mainframe and network systems governing the three major applications and their component applications. We will not release information concerning the administration of hardware under this RFP.

16. Section III.C.1.c: What is the size and scope of “key network devices, workstations, and mainframe operations?” Are we talking about a few routers and firewalls? How many workstations? Is there just one mainframe, or other servers (email, storage, other application servers, etc.)?

Answer: This detailed information will not be provided at this time.

17. Section III.E: After how many days does RRB expect to provide the contractor with feedback from the Draft Project and Quality Assurance Plans? It looks like there are 2 weeks built into the schedule between the Draft (09/30/18) and the Final (10/15/18) deliverables.

Answer: The RFP has been modified to remove the deliverable for a Draft Project Plan with Approach and a Draft Quality Control Plan. Instead, only a Final Project Approach, Methodology, and Management Plan and a Final Quality Control Plan will be required within 10 business days of award.

18. Section III.E: After how many days does RRB expect to provide the contractor with feedback from the First Draft Performance report? It looks like there are 4 weeks built into the schedule between the First (10/21/18) and Second (11/20/18) Draft reports.

Answer: The draft reports must go through the RRB OIG’s internal report review process, which should take approximately five to ten business days.

19. Section III.F: Which positions are defined as critical positions?

Answer: The offeror is responsible for identifying all personnel and their roles and responsibilities for contract performance.

20. Section III.D: The Government states, 'The Contractor must perform FISMA testing.' Can the Government clarify this statement? Whereas FISMA testing may refer to the independent verification & validation (IV&V) needed for systems that are considered Moderate or High according to NIST 800-137. Is this the IV&V process in RMF Step 4?

Answer: As stated in Section III, B., the Contractor must respond to specific performance indicators established each year by the Office of Management and Budget (OMB) and the Department of Homeland Security (DHS), document and provide the Contracting Officer’s Representative (COR) the metric evaluations for the Federal Information Security Modernization Act of 2014 (FISMA) CyberScope report and an annual performance audit report.

This solicitation is for the audit of the RRB’s risk management framework (RMF) process, not the implementation of the RMF process that includes an assessment of the security controls to achieve authorization to operate.

21. Section V.D.4.c.1): The Government states, 'The certifications of Certified Information Systems Auditor (CISA), Certified Information Security Manager (CISM), and Certified Information Systems Security Professional (CISSP) held by proposed key project personal should be provided.' Are all key project personal required to have all 3 certifications?

Answer: No.

22. General: Would the Government please confirm this is a General Services Administration (GSA) Schedule Order? If so, can the Government confirm that the applicable Special Item Number (SIN) for this procurement would be 520-7, Financial and Performance Audits.

Answer: This solicitation is issued as a full and open competitive procurement.

23. Section II: Would the Government please confirm that the gap between Options is intentional?

Answer: The government anticipates that the period of performance for the base year and each option year will be less than 12 months each. The government confirms that Section II, Schedule of Supplies and Services is correct as stated.

24. Section III.C: Will the Railroad Retirement Board (RRB) Office of Inspector General (OIG) disclose the overall rating RRB obtained for the seven information security metric domains during the Fiscal Year (FY) 2017 Federal Information Security Modernization Act (FISMA) audit? This will allow vendors to best estimate the level of maturity for RRB and the associated level of testing effort.

Answer: The RRB OIG fiscal year 2017 audit determined that although RRB implemented changes in the information security program for improvement, a fully effective security program that meets the requirements of FISMA has not been achieved. As a result, each of the seven OIG FISMA metric domains and the corresponding cybersecurity framework functions have been assessed as “Not Effective” when evaluated using the maturity model.

25. Section III.C: How many FISMA information systems did the OIG sample for the FY 2017 FISMA evaluation? How many systems does the OIG expect the external Certified Public Accounting (CPA) firm to evaluate (sample) in FY 2018 and future years?

Answer: See item 14 above.

26. Section III.C: Will the OIG disclose the security package (Resource Access Control Facility [RACF], Access Control Facility [ACF2], Top Secret) that RRB utilizes on its mainframe? How many production Logical Partitions (LPARs) does RRB utilize?

Answer: This detailed information will not be provided at this time.

27. Section III.C.1.b: For the purposes of estimating travel, will the OIG please clarify where the primary offices for the following Bureaus are located:

• Benefit Payment Operations

• Bureau of Information Services

• Bureau of Actuary and Research

• Bureau of Fiscal Operations.

Answer: The primary offices for the responsible parties of each of the four information systems is located at RRB Headquarters, 844 North Rush Street, Chicago, IL, 60611.

28. Section III.D.1.c: The Statement of Work (SOW) states, “c. Prior to performing any testing that requires sampling, the Contractor must provide RRB OIG with the sampling plans for review and approval.”

Testing the effectiveness of security controls traditionally involves selecting multiple samples per information system. Obtaining pre-approval for each sample selection across multiple information systems can delay the audit and increase audit inefficiencies for both the OIG and the external firm. In lieu of pre-approval for each sample selection, would the RRB OIG accept a “sampling plan” that describes the firm’s methodology for selecting a sample based on the nature of the control frequency (e.g., quarterly, monthly, weekly, daily) and the population size? If so, the updated wording in this section could be changed to the following:

“B. The Contractor must prepare and submit for RRB OIG’s review and approval an audit plan and strategy that documents the audit steps to be performed to achieve the audit objectives. This audit strategy document should include the overall sampling methodology that will be used to select samples based on the nature of the control frequency (quarterly, monthly, weekly, daily) and the population size”.

“c. Prior to performing any testing that requires sampling, the Contractor must provide RRB OIG with the sampling plans for review and approval. Further, The Contractor must provide RRB OIG with documentation supporting its analysis and rationale for selecting the representative subset of RRB systems, key network devices, workstations, and mainframe operations to be selected for testing. The Contractor must not perform any testing before RRB OIG’s review and approval.”

Answer: No changes are being made to the RFP. All sampling plans must be reviewed and approved by the RRB OIG. The full detail and content of the sampling plan is not dictated by RRB OIG, but should include the sampling strategy and methodology that will be used to select samples based on the subject matter and nature of the control frequency. At a minimum, the sampling plan must include the universe, sample size, percentage of universe represented by the sample, the sample’s test objective, and the method for selecting the sample.

29. Section III.D.3: The Statement of Work (SOW) states the external firm’s report must go through the RRB OIG’s internal report review process. To ensure sufficient completion of work, would the Government please update this section to include the completion timeframe (i.e. five business days) for the RRB OIG review process?

Answer: See items 17 and 18 above.

30. Section III.F.4: This section states, “A draft of the project management plan must be submitted with the technical and cost proposals for this SOW and used for technical proposal evaluation.”

a. Will RRB OIG please clarify its intent? Is the Government seeking a Microsoft Project Plan and proposed schedule, or is the Government seeking how the contractor plans to manage its staff and project delivery?

b. Please confirm whether the draft project management plan is to be provided as part of the technical proposal only (and not the cost proposal)

Answer: The draft Project Approach, Methodology, and Management Plan must be submitted as part of the Technical Proposal only. The RFP has been modified to use the term Project Approach, Methodology, and Management Plan consistently. As stated in Section V, D.4.a.1), the Project Approach, Methodology, and Management Plan is to be submitted with the technical proposal for evaluation and should include the roles and responsibilities of both the Contractor and the RRB and/or RRB OIG staff. As stated in Section V, B.1., all proposal documents shall be submitted in either MS Office 2010, or later, document format or Adobe PDF file format, and NOT as Microsoft Project (.mpp) files.

31. Section III.F.5: Please confirm whether the “Quality Control Plan” and “Quality Assurance Plan” are the same requirement and clarify which terminology is to be used.

Answer: The RFP has been modified to use the term Quality Control Plan consistently.

32. Section III.F.5: The bulleted requirements for the Quality Control Plan differ from the instructions and evaluation criteria (Section V, D., 4., b. and Section VI, C., 4., b)). Please clarify what is required for the Quality Control Plan that is to be submitted in the offeror’s proposal (pre-award requirement).

Answer: The Technical Proposal Submission Section V, D.4.b. provides a brief summary of the Quality Control Plan’s content, including the procedures for deficiency detection and implementation of corrective measures, including escalation procedures. The Technical Proposal Evaluation Section VI, C.4.b. includes these same items as bullet points.

33. Section III.G.2): RFP states that travel needs to be built into our Firm Fixed Price (FFP). Will the Government add a cost reimbursable Contract Line Item Number (CLIN) for approved travel so they can reimburse its selected accounting firm?

Answer: The government will not add a cost reimbursable CLIN, for the purpose of travel, to the RFP. See RFP Sections II.B and III.G.2.

34. Section IV: Please confirm the offeror is provide the applicable filled-in portions of the following sections in in the Price Volume:

• 52.212-3 Offeror Representations and Certifications--Commercial Items (Nov 2017)

• 52.209-5 Certification Regarding Responsibility Matters (Oct 2015)

Answer: The government confirms, the offeror must complete the fill-ins detailed in FAR clauses 52-212-3 Offeror Representations and Certifications-Commercial Items (Nov 2017), and 52.209-5 Certification Regarding Responsibility Matters (Oct 2015), as listed in the RFP.

35. Section V: Please confirm that there are no formatting requirements or page limitations for the offeror’s proposal.

Answer: The government confirms, the government has not set a page limitation for proposal documents for RFP 60RRBH18R0012 FISMA Audit Services. See Section V.B.1 for proposal format requirements.

36. Section V.B.2: This section refers to the “Technical Approach and Workplan section of the technical proposal.” A “workplan” is not listed as a requirement in Section V, D., 4. Is the “Technical Approach and Workplan” section the same as the offeror’s response to the Technical Factors to be Evaluated (Section V, D., 4.)? If not, please clarify.

Answer: The RFP has been modified to use the term Project Approach, Methodology, and Management Plan consistently.

37. Section V.C.1.d: The Business Proposal must include a “copy of Contractor’s completed System for Award Management (SAM) registration.” Will a screenshot of the offeror’s entity report from www.SAM.gov be acceptable to satisfy this requirement? If not, would the Government please clarify what documentation RRB will accept?

Answer: The government will not accept a screen shot of the offeror’s entity report from www.sam.gov. The offeror must provide an electronic copy of its completed SAM entity registration information, available at www.sam.gov.

38. Section V.D.3: Please confirm this separate cover for Assumptions, Conditions, or Exceptions is for the Technical Proposal only and that pricing assumptions may be included in the Business Proposal.

Answer: The government confirms, RFP Section V.D.3 refers to assumptions in reference to the Technical Proposal.

39. Sections V.D.4a.1).a.3 & VI.C.4.a.3): Please confirm the “audit objectives” referenced in these sections refer to the objectives listed in Section III, B. If not, please clarify.

Answer: Yes, the draft Project Approach, Methodology, and Management Plan discussed in Sections V, D.4.a, and VI, C.4.a, refer to the audit objectives discussed in Section III, Statement of Work.

40. Section V.D.4.d: Please confirm that the offeror is to provide a narrative of past performance projects in the proposal in addition to Attachment 4, which is to be completed/submitted by each client.

Answer: The government confirms, the offeror must submit a detailed narrative describing the offeror’s experience and that RFP Attachment 4 must be completed and submitted by a minimum of three (maximum of 5) references directly to the RRB, on behalf of the offeror.

41. Section V.D.5.c.5)-7) [sic]: Do the knowledge and experience areas required in items 5) through 7) apply to the offeror’s proposed key personnel or to the offeror as a company/organization?

Answer: As stated in the RFP, Section V.D.4.c.5)-7) refers to the “Experience, Qualifications, and Expertise of Proposed Staff”

42. Section V.D.5.d.3) [sic}: The “Past Performance/Corporate Experience” section states, “The Offeror must at a minimum, present a general audit approach demonstrating that audit methodology meets the requirements set forth in Section III and that the required reporting deadlines can be met.” This appears to be a requirement for the “Project Approach, Methodology and Management” section of the proposal. Would the Government please clarify?

Answer: The RFP has been modified to remove this clause.

43. Section VII: Please confirm Attachments 1–3 are post-award requirements and do not need to be provided with the offeror’s proposal submission.

Answer: Yes. RFP Attachments 1 – 3 are post-award requirements that must be submitted within five working days of each individual’s start date on the audit engagement.

44. Sections IV. 52.239-1 & VII Attachment 2: Several statements in the Information Privacy Certification conflict with American Institute of Certified Public Accountants (AICPA), Government Accountability Office (GAO) Yellow Book, and Virginia Society of CPA licensing requirements. As a member of the AICPA and licensed by the State of Virginia, our accounting firm must observe document retention standards and must be able to produce audit evidence and audit workpapers to satisfy AICPA and Virginia State Board peer review requirements. To satisfy these requirements, our firm may be required to disclosure these work papers as part of the peer review process if the RRB FISMA audit was selected for peer review.

Second, document retention requirements require our firm to maintain client workpapers for a period up to four (4) years before these records maybe destroyed. Further, the SOW requires the external firm to maintain working papers for “a period of eight years from the date of contract award.” (See page 36 of 43, Audit of Records)

We request that the language of the Information Privacy Certification be updates to reflect these licensing requirements for public accounting firms, as well as the SOW requirements.

(2nd bullet) Disclosure to anyone other than an officer of employee of the RRB or RRB OIG is prohibited, except where such disclosure is required by law or by regulatory body to satisfy state or AICPA licensing requirements.

(4th bullet) All data processed, captured, printed, or stored in any media format during the performance of this contract will be completely purged from any non-RRB system and no output retained after the work is no longer needed or the contract is fulfilled, whichever comes first after document retention requirements are satisfied to comply with state licensing and AICPA peer review requirements.

(6th bullet) I will provide a certificate stating that all RRB data was purged, when it was purged, and how it was purged to my RRB OIG Contracting Officer’s Representative (COR) prior to final completion of the contract when state CPA and AICPA record retention requirements have been met.

SOW - Privacy and Security Safeguards (AUG 1996)

(9) Disposal. Upon completion of the contract, the contractor shall return any RRB data. Media that was used to store RRB electronic data shall be securely purged after record retention requirements are met.

Would RRB revise the requested document destruction requirements so potential bidders (i.e. external accounting firms) may remain compliant with AICPA and state licensing requirements?

Answer: RFP Section IV, 52.239-1, Privacy and Security Safeguards (AUG 1996) and Attachment 2, FISMA Audit Services, Information Privacy Certification by RRB Contractor have been modified.

45. Section VII. Attachment 3: Will RRB please revise §I of the Nondisclosure Agreement to include the following?

I. Nondisclosure of Information

I hereby certify that I shall not release to anyone not authorized to perform on this contract any information, regardless of medium (e.g., electronic, film, tape, photos, documents, etc.), pertaining to any part of this contract unless:

1. The Contracting officer has given prior written approval;

2. The information is otherwise in the public domain before the date of release; OR

3. Otherwise required to be disclosed pursuant to law, regulation, or valid judicial order.

Answer: RFP Attachment 3, FISMA Audit Services, Office of Audit, Railroad Retirement Board, Nondisclosure Agreement has been modified.

46. Section VII. Attachment 4: Will RRB will accept Contractor Performance Assessment Reporting System (CPARS) ratings in lieu of completed past performance questionnaires (Attachment 4)?

Answer: No.

47. General: Please provide copies of last year’s FISMA report, if issued, to help properly evaluate the control environment and the scope of our work.

Answer: The RRB OIG website includes all publically available OIG reports and abstracts including those for FISMA reviews.

48. General: What was the actual level of effort for the FISMA audit by labor category for 2017? If that is not available, please provide the level of effort estimated in the contract or previous proposals for those audits.

Answer: In the past several years, the FISMA audit has averaged about 400 staff days to complete.

49. General: Please provide contract award amounts for the 2017 FISMA audit.

Answer: See answer to question number 7, above.

50. General: What is the anticipated/ estimated or budgeted level of effort required for this contract?

Answer: The government has not prepared a Government Cost Estimate for this requirement.

51. General: What was the prior contract number?

Answer: See answers to questions number 7 and 49, above.

52. General: Because this is an email submission, what is the email file size your email system will allow?

Answer: The government will not release this information. See section V.B. for proposal submission requirements.

53. General: Is there is a page limit for this submission? If so, is the proposal cover, table of contents, cover letter, or other required front matter excluded from the page limit?

Answer: See answer to question number 35, above.

54. Section III.B: Although the RRB OIG envisions the majority of the services will be performed offsite, what physical locations is the contractor expected to visit and for what duration?

Answer: The principle offices of the RRB are located at its headquarters facility in Chicago, IL. The offeror’s Project Approach, Methodology, and Management Plan should propose the solution and approach to meet the RRB OIG’s requirements, objectives, and deliverables as described in Section III, Statement of Work.

55. Section III.F.2: There is a requirement for resumes to be provided for every individual performing in a critical position of the audit. Is the term “critical position” the same as “key project personnel” mentioned on 5c(1) pg. 40?

Answer: Yes.

56. Section III.C.1.b: Please provide more specifics on the four systems mentioned to include physical location of development/test and production application and database servers, operating systems, databases, # of users and location of users.

Answer: This detailed information will not be provided at this time.

57. Section III.C.1.b: There is reference to mainframe operations. Which access control mechanism is utilized to secure this platform (e.g. CA-Top Secret, RACF, ACF2, etc.), and is operating system IBM zOS or other platform?

Answer: This detailed information will not be provided at this time.

58. General: How many systems are typically reviewed annually as part of the FISMA effort and which systems were tested during the Fy2017 FISMA examination?

Answer: Historically, RRB OIG has performed reviews of all four of the RRB’s information systems with the predominant review consisting of the general support system.

59. General: Is vulnerability assessment or penetration testing required as part of the FISMA engagement?

Answer: This detailed information will not be provided at this time.

60. Section V.D.4.d [SIC]: Please clarify what is meant by the requirement to identify any task/work steps assigned to RRB and/or RRB OIG resources and is the OIG asking for the offerors to note number of hours estimated by OIG to support audit or just general effort required?

Answer: Please refer to RFP Section V, D.4.a., which provides the Government’s requirement for this submission item.

61. General: Has the RRB fully implemented the NIST RMF before the end of fiscal year 2017? If yes, what significant changes occurred to the RRB’s information technology environment due to its RMF implementation?

Answer: This detailed information will not be provided at this time.

62. General: Was FY 2017 FISMA audit performed by an outside contractor (e.g., IPA firm) or by RRB OIG itself? If it is done by an IPA firm, do we have access to audit workpapers?

Answer: See item 7 above. The fiscal year 2017 FISMA audit was performed by the RRB OIG.

63. General: Was DISA STIG used as one of the federal guideline to assess security baselines for the four information systems listed in the SoW as part of FY 2017 FISMA audit?

Answer: This detailed information will not be provided at this time.

64. General: Other than Entrance Conference Meeting & Exit Conference Meeting, are there any other meetings that require the contractor to be onsite (e.g., RRB HQ) to perform?

Answer: The offeror’s Project Approach, Methodology, and Management Plan should propose the solution and approach to meet RRB OIG’s requirements, objectives, and deliverables as described in Section III, Statement of Work.

65. General: Would the Government please clarify whether it has any security clearance requirements for proposed personnel?

Answer: As stated in Sections IV, 52.204-9, Personal Identity Verification of Contractor Personnel (Jan 2011) and RRB.B.03, Security Provision-3.Additional Security Requirements, Contractor shall comply with agency personal identity verification procedures and indicate in their proposals a listing of the proposed staff that have previously completed the procedures required to meet required security clearances.

66. General: Would the Government please identify the incumbent?

Answer: See answers to questions number 7, 49 and 51, above.

67. General: Would the Government please provide the estimated level of effort for the audit?

Answer: The government cannot define the level of effort required by the offeror for contract performance.

68. General: Given that RRB is an authorized GSA user under GSA Order OGP 4800.2I, would the Government please consider awarding this contract under the GSA Professional Services Schedule?

Answer: See answer to question number 22, above.

69. Section II.C: Additional Pricing Information states that offerors must provide “the following price break down for each proposed CLIN’s firm-fixed price: a. Proposed labor skill levels or category, b. Offered unit pricing per labor skill levels or category, c. Proposed number of hours for each labor skill levels or category by phase (if appropriate), and d. Proposed number of staff per labor skill levels or category.” Given that the Government anticipates awarding a firm fixed price contract, would the Government please confirm that the requested labor categories and hours are for evaluation of technical understanding only?

Answer: The government will not confirm that the requested labor categories and hours are for evaluation of technical understanding only. See Sections II.C. & V.C.1.c.

70. Section III.C: Task Requirements, states that the Government’s information system environment consists of four systems. Would the Government please clarify whether these four systems are the expected system population per its inventory, or whether it has more systems?

Answer: The number of information systems present in fiscal year 2017 is not expected to change during fiscal year 2018.

71. Section III.C: Task Requirements, Would the Government please clarify the location of the four operational divisions (Bureau of Information Services, Office of Programs, Bureau of Fiscal Operations, & Bureau of the Actuary and Research)?

Answer: See answer to question number 27, above.

72. Section III.B.3: states that the audit should include follow-up of agency efforts to correct previously identified weaknesses. Would the Government please clarify the number of prior-year issues that will require follow up?

Answer: This detailed information will not be provided at this time.

73. Section III.B.4: states, “The Contractor must document and provide the COR with the results of the Contractor’s testing in an annual performance audit report that must be issued by RRB OIG.” Would the Government please clarify whether the cognizant auditor will be the contractor or the OIG? If the cognizant auditor is the contractor, would the Government please further clarify what it means when it states that the report will be issued by the RRB OIG?

Answer: The cognizant auditor is the contractor. As stated in Section III, D.3., the contractor is required to provide the RRB OIG with a draft and final metric evaluation and a draft and final performance audit report based on the results of the contractor’s audit work. The RRB OIG will prepare the FISMA CyberScope report using the contractor’s final metric evaluation submission. The RRB OIG will also obtain RRB senior executive comments and issue the final performance audit report or a publically available abstract using the contractor’s final performance audit report. The RRB OIG must determine whether the reports are sensitive in nature and should be issued as Limited Distribution pursuant to 5 U.S.C. § 552.

74. Section III.E: Deliverables and SOW Task Delivery Schedule, states that the final project plan is due within 10 business days of award. Would the Government please clarify whether it would expect the contractor to use the draft FISMA metrics to develop the final project plan if the final OIG metrics are not available at that time? In addition, if the final OIG FISMA metrics are not available until after the deliverable(s) are due, does the Government expect the Contractor to provide an updated project plan and approach as a separate deliverable?

Answer: A draft Project Approach, Methodology, and Management Plan must be submitted with the technical proposal for evaluation. A final Project Approach, Methodology, and Management Plan is required to be submitted within ten business days of award. Additionally, an audit procedures and test plan is required within 30 days of award. The existing OIG FISMA metrics developed by OMB and DHS in fiscal year 2017 are to be used until such time as those metrics may be updated or revised by OMB and DHS. Should the OIG FISMA metrics be updated or revised in a manner that affects the fiscal year 2018 FISMA reporting requirements, the necessary changes must be incorporated into a revised audit procedures and test plan to allow for complete reporting in accordance with the fiscal year 2018 FISMA reporting requirements.

75. Section III.F.4: Project Approach, Methodology, and Management Plan states, “A draft of the project management plan must be submitted with the technical and cost proposals for this SOW and used for technical proposal evaluation” (emphasis ours). Would the Government please confirm that the project management plan should be submitted as part of the technical proposal and should not be included with the cost proposal?

Answer: Yes. The draft Project Approach, Methodology, and Management Plan should be submitted as part of the technical proposal and will be evaluated with other technical proposal submission documents.

76. Section III.H: Data Rights (page 13 of 43), states, “The Contractor must return all items furnished by the Federal Government in the performance of this SOW at the end of the contract or upon the Federal Government’s request.” Would the Government please clarify whether this includes items provided to the contractor as part of the audit process that may be necessary to support working papers (e.g., policies, procedures, user listings, technical configurations)?

Answer: Yes. Please also see items 44 and 45.

77. Section III.H: Data Rights states, “The contractor shall not mark any deliverable documents pages, attachments, or addenda with their company name or proprietary markings, with the exception of a cover page.” Would the Government please clarify whether this includes the contractor’s working papers?

Answer: This section is applicable to the deliverables for the performance audit report that is referenced in Section III, E.

78. Section IV. 52.239-1 Privacy and Security Safeguards, 4. Portable/Removable Media: states that the Government does not authorize the use of portable media to store its data. Would the Government please clarify whether this means that the contractor is not allowed to conduct audit work on contractor-owned laptops without the Government’s authorization?

Answer: Use of contractor-owned laptops is allowed, but they must meet or exceed all Federal requirements for physical and logical security for RRB data as stated in the RRB Security clauses and in Federal requirements for sensitive data rated with a ‘moderate-impact’ risk rating, including encryption, and be approved in writing by the RRB’s Chief Privacy Officer.

79. Section IV 52.239-1 Privacy and Security Safeguards, 9. Disposal: states, “Upon completion of the contract, the contractor shall return any RRB data.” Would the Government please amend this statement to allow the contractor to retain data needed to support its work papers and audit conclusions, as is required to meet professional standards?

Answer: Please see item 44 above.

80. Section V.C.1.c: states, “Offerors shall… provide a firm-fixed-price break down for each CLIN… as an attachment to the proposal” (emphasis in original). Would the Government please confirm that offerors should not include a price breakdown within the body of the business proposal, and please clarify whether this attachment should be an appendix within the business proposal document or a standalone attachment in a separate file?

Answer: See answer to question number 69, above.

81. Section V.D.3, Assumptions, Conditions, or Exceptions: states, “The offeror must submit, under separate cover, all assumptions, conditions, or exceptions with any of the technical requirements of this RFP.” Would the Government please clarify whether any assumptions, conditions, or exceptions should be submitted in a separate file from the technical and cost proposals, or whether they should be included in a separate section within the technical volume?

Answer: See answer to question number 38, above.

82. Section V.D.4.c, Experience, Qualifications, and Expertise of Proposed Staff, Would the Government please confirm that offerors should only provide resumes for key proposed personnel?

Answer: See answer to question number 41, above. See Section V, D.4.c., which provides the Government’s requirement for this submission item.

83. Section V.D.4.c.1, references key project personnel. Would the Government please clarify which personnel are considered key?

Answer: The government will not determine the personnel required by the offeror for contract performance.