AMEND 0001 _ FAA Responses to Vendor Questions.pdf

Attachment L002 ‐ Question Template AMENDMENT 00001

Number SIR Section Page Question FAA Response

1 B 5 Is there an incumbet for this worK See Vendor DRAFT SIR Q_Final SIR FAA Responses (#53) 2 B 5 If there is an incumbent for this work, who is the incumbent? See response to Question 1 3 B 5 If there is an incumbent for this work, what is the contract number for the previosu award? See response to Question 1

4 B 5 If there is an incumbent for this work how long has the incumbent held the contract for this work? See response to Question 1

5 B 5 If there is an incumbent for this work, how many previous contrcats for the same work were awarded by the FAA, to whom and how long were they?

See response to Question 1

6 C 9, 10 Section C.3.1.2 refers to a requirement for providing a Program Management Plan "per Task C.3.1.2", however it appears that the correct reference would be C.3.1. Please confirm.

The correct reference is C.3.1. FAA updated the reference.

7 C 18 Are the activities in Tasks 6 and 7 limited to cybersecurity assessments or are physical security and social engineering assessment activity expected for those tasks as well?

Activities are limited to Cybersecurity Assessments only

8 C 6, 7 Can the FAA provide digital copies of the FAA policies and regulations referenced in the SOW? The URLs provided are for internal FAA networks only

FAA updated the links or provided PDF version of the documents referenced.

9 C 9 The link to the ATO Information Security Continuous Monitoring (ISCM) Plan for NAS and Mission Support (MS) Systems directs to a restricted site that requires a MyAccess account but there does not appear to have a way to Register. Please provide a copy of the ATO ISCM Plan.

See answer to Question 8.

10 C 12

C.3.2 Task 2 ‐ Independent Risk Assessment Support states "The Test method for NAS systems may be conducted in a Lab environment due to potential adverse impacts to air traffic safety and efficiency that may be attributed to security scan testing tools."

Can you clarify if the Lab environment is to be provided by the Contractor or will the FAA provide an existing Lab environment? If the Contractor, is expected to provide the Lab environment is this cost already accounted for in the Other Direct Cost estimate or should this be taken into account in the Offeror's cost volume?

FAA will provide the lab environment.

11 C 14

C.3.3.2 ‐ Vulnerability Testing Support: It is uncommon for the security assessment team to perform use‐ case‐based software testing, as this is normally the responsibility of a functionality test team, which would typically have usability expertise and a set of step‐by‐step test procedures. If the Contractor is selected to perform this task, will test procedures be provided? Or will the Contractor work with the application teams to create them?

The FAA will provide test procedures, however the FAA may request Contractor support and expertise to review and refine the Government‐provided procedures.

12 C 15

Draft RFP Question #31 received FAA's answer "The FAA will not release a list of tools currently in place.

Offerors should submit their best practices and recommendations." However, C.3.4 states "The Contractor must use standard penetration testing tools approved by the FAA." We request that this statement be amended to allow the Contractor to propose a penetration testing tool in the ROE or during the penetration testing engagement, as the appropriate penetration testing tool, and obtain FAA's approval of the tool at that time.

FAA will not amend Section C.3.4

13 C 20 C.3.8. Will overseas telecom technologies be integrated into the FNTB? Are all technologies used at overseas sites authorized after testing at FNTB?

Use of the FNTB for international assessments is determined based on the system undergoing testing.

14 C 20

C.3.8. Does FAA have insight into technologies used by foreign country partners and will foreign countries permit US Contractors to conduct security assessments on their infrastructure? If authorized, will they provided details of the system prior to site assessments so adequate assessment preparation can take place

The FAA will provide the necessary details of each international system prior to the scheduled assessment.

15 C 20 C.3.8. What foreign entities will be assessed? Is any testing done pre‐demarcation? Is vulnerability assessment and penetration testing only permitted for US FAA assets in overseas sites or will the contractor conduct such assessments on foreign technology assets?

The FAA will provide the necessary details of each international system prior to the scheduled assessment.

16 C 14

"The Contractor must provide analyses, studies, data review, and recommendations concerning cyber threats against:

o Antennas, multi‐mode millimeter wave radar, pilot night vision systems, command and control interface, electromagnetic interference, cockpit controls/displays, electromagnetic emissions (EME), communications security, processing systems, integrated systems/architectures, fault detection/diagnostics systems, and aircraft flight controls."

Will the contractor be provided with a lab/testing environment to research and test the desired equipment?

The FAA will provide the lab environment, however the Contractor may be required to support the FAA in designing, preparing, or assembling the enviroronment.

17 C 14

"The Contractor must provide SME analysis and operations support in all major areas of IA to include Computer Network Defense (CND), Software Security, Database Management, Design/Test, Hardware/Firmware, Physical Security, and aircraft Network Infrastructure."

Will the contractor be required to conduct secure code analysis of custom developed software?

Yes.

18 C 16

As directed by the COR, the Contractor must provide a sandboxing and/or simulations test environment to isolate and test untested or untrusted code, applications, or software without impact to the operational environment. This simulations test environment must also be used for Red Teaming and Blue Teaming Exercises."

Will this environment be hosted by the FAA and built out by the contractor or is it expected that the contractor will host their own environment and purchase all of the tools required for the environment?

All test environments will be Government hosted, however the Contractor must be able to support the FAA in designing, preparing, and assembling these environments.

19 C C.3.3 Pg 13 Are VM tools provided by the client? FAA will provide the VM tools

20 C C.2 Pg 8 800‐53 Rev5 was released last week. Will these controls apply? FAA references Rev4. Yes, FAA has implemented the latest version of NIST SP 800‐ 53R5. FAA updated the reference in the SIR.

21 C 9 What program magement methodology will FAA follow for this contract? Waterfall or Agile? Waterfall 22 C 14 What repositry does FAA uses for test case results? HP ALM? The FAA will not disclose this information.

23 C 14 Is it full regression testing? Yes

24 C 16 What is the team composition for the Red Team? Red Team composition is dependent on the system undergoing testing.

25 C 16 What is the team composition for the Blue Team? Blue Team composition is dependent on the system undergoing testing.

26 C 12 “Support Independent Risk Assessment planning and coordination at multiple facilities and locations nationwide.” ‐How many locations are included in this nationwide assessment? Do we have to travel to any of these locations? If so, which locations?

Location and travel requirements for cybersecurity testing is determined on an annual basis based on FAA fiscal year goals.

Offerors should assume travel to some of the locations will be required each year.

27 C 14 Can the government specify the minimum number of penetration tests required within a specified period of time?

The FAA does not have a minimum number of penetration tests within a specified time period.

28 C 14 Can the government specify what core tests are required for each penetration test? No 29 C 19 Will the government provide the licensing for toolsets mentioned in the last paragraph of C3.7. Yes

30 C 19 In addition to the toolsets listed in Section 3.7 is the contractor permitted to bring forward additional toolsets, custom scripts, and/or custom testing distributions.

Yes, with FAA approval.

31 C 10 Can the government detail approximately how many assessments, penetration, red, blue, aircarft, international, and other (specialized) testing engagements it plans to conduct per year?

No, the number and types of assessments planned each year is based on FAA fiscal year goals.

32 C 20 Can the government provide approximate location of the International locations to be tested? (Country, region, etc.)

No.

33 H 27

3.8.2‐17.d lists key personnel as Program Manager, Security Assessment Lead, and Penetration Testing Lead.

‐ Is the Security Assessment Lead equal to the qualifications for the Cyber Security Analyst I?

‐ Is the Penetration Testing Lead the equivalent for the Subject Matter Expert I?

‐ Please confirm that the expectation is 1 FTE per key personnel category.

As stated on page 28 of the SIR, the Security Assessment Lead must meet the Minimum Qualification Requirements of “Cyber Security Analyst Level I” or “Cyber Security Engineer Level I” as defined in Attachment J002 Labor Categories. The Penetration Testing Lead must meet the Minimum Qualification Requirements of “Subject Matter Expert (Penetration Testing) Level I” as defined in Attachment J002 Labor Categories. As stated in SIR Section H.1, AMS Clause 3.8.2‐17 (d), a key person may be assigned to more than one role if they are able to perform the duties of the positions to the Government’s satisfaction.

34 H 29, 54 The SOW states there are no current Facility Security requirments. If this changes during performanec of the contract will the FAA sponsor the Prime and participating subs for the Facility Clearance? If not, is a current facility clearance required to propose in response to the solicitation?

If any facility clearance is required, the FAA will provide sponsorship. An existing facility security clearance is not a requirement of this solicitation.

35 H 28 Can the government please specify what technologies and tools are in use at FAA ATO for penetration testing so that we can identify the best candidates for the Penetration Testing Lead role?

The last paragraph in Section C.3.7 provides a partial list of tools, but experience with these specific tools is not mandatory.

36 H 28 Can the government please specify what risk assessment tools (e.g. RSA Archer) are in use at FAA ATO so that we can identify the best candidates for the Security Assessment Lead role?

The last paragraph in Section C.3.7 provides a partial list of tools, but experience with these specific tools is not mandatory.

37 I 36

Section I.2, 3.1.7‐6 DISCLOSURE OF CERTAIN EMPLOYEE RELATIONSHIPS (JANUARY 2019), states that the contractor must provide to the Contracting Officer the following information with its proposal. Please clarify where in the proposal this information must be included and the page count allocated to this requirement.

It should be included in Volume II, Section 1, Sub‐Section B.

There is no page limit on this section.

38 J 12

Would the Government consider adding an allowable substitution for those positions that require a Masters Degree? We know that there are numerous candidates who could successfully perform the work required in the SIR but who may not have a Masters Degree, but do have multiple decades of relevant experience. We suggest the following: Ten (10) years of relevant experience over and above the minimum experience requirements for the position will be considered equivalent to a Master’s degree.

See updates to Attachment J002. FAA has added allowable substitutions for a Master's Degree.

39 J J001 Is there an allowable subsitution in years of experience to replace a Master's Degree? See response to Question 38

40 J Resume Template

The resume template is currently in Times New Roman. Please confirm it should be in Calibri. It should be in Calibri. FAA updated the template.

41 J J002 "A Master's degree in an appropriate discipline will be considered equivalent to two (2) years of relevant experience. A doctoral or Ph.D. degree in an appropriate discipline will be considered equivalent to four

(4) years of relevant experience." Can years of experience be substituted for a masters degree?

See response to Question 38.

42 L 82 Section J lists Attachment J005 Resume Template, which is included in the RFP documents. However, this Attachment is not referenced in the Section L requirements for submitting resumes. Please clarify whether Attachment J005 is to be used in submitting resumes in the proposal.

Use Attachment J005 to submit resumes in the proposal.

43 L 79‐80 The font in Attachment J005 is Times New Roman while the font specified for the proposal in Section L.10.1 is 10‐point Calibri. Please clarify whether the resumes submitted according to Attachment J005 are to be prepared in Calibri font and meet the font size requirements of L.10.1.

See response to Question 40.

44 L 84

Section L.12.3.1 requires the offeror to submit pricing using the Price Worksheet provided in Attachment L002, which includes the Labor Schedule as a tab. The RFP documents also include Attachment J001 Labor Schedule which says TBD at time of award, but J001 is not referenced in Section L. Please confirm that Attachment J001 does not need to be provided with the proposal.

Attachment J001 does not need to be provided with the proposal.

45 L 79‐80, 85 Please clarify whether the page allocation for the information required per Section L.13.1 is 1 page per PPQ or a total of 1 page for information on up to five PPQs

One page per PPQ. FAA updated the chart in L.10.1

46 L 79‐80 Section L.10.1 states that each Section must be a separate document. The table in this section lists PDF or XLSX next to each subsection. Please clarify whether a separate file is required for each subsection.

A separate file is NOT required for each sub‐section with the exception of Volume II, Sections 2A and 2B. The Offeror MUST submit the Excel file as a separate file.

47 L 83 Blocks 4 and 5 of Table 11.3 refer to M.3.4. It appears that the correct reference should be M.4.3. Please confirm.

That is correct. FAA corrected the reference.

48 L 83 Is the relevant experience supposed to be a 1 to 1 match of the Past Performance Questionnaire or can the Relevant experience section include other experience.

There does not need to be a one‐to‐one match, but see the fourth bullet under L.13, ""FAA will accept PPQs for work that a sub‐contractor performed but only if those PPQs relate to contracts that are cited in Volume 1, Section 3 (Relevant Experience)"

49 L 79

In Section L10.1 it states that: The Offeror’s proposal must comply with the following naming conventions:

•Each SecƟon must be a separate document.

•Each SecƟon must be enƟtled “Offeror Name ‐ Volume Number_ SecƟon [Number]_MMDDYYYY” (e.g.

“ABC Corporation ‐ Volume II_Section 1 _10122020”).

On page 80 “Labeling”:

oThe Offeror must provide a cover sheet as part of the first secƟon of each volume. The Offeror must submit the cover sheet as part of the section, rather than as a separate file. This sheet will not count against page limitations.

oThe Offeror must provide a Table of Contents and List of Acronyms as part of the first secƟon of each volume. These tables and lists will not count against page limitations.

�The cover sheet must clearly idenƟfy the volume number, solicitaƟon number, and the Offeror's name.

Can this be clarified? Is each volume a separate document with the sections identified in the table of contents?

See response to Question 46.

50 L 84 Would the Government allow providing Firm Fixed Price per asset being tested instead of Labor Hours? No.

51 L 79 In addition to tables and graphs, can charts, figures, and graphics also be 8‐point or larger Calibri? Yes.

52 L 83‐84 Table 11.3: Relevant Experience. Questions 1, 2, 3, 4, 6, 7, 8, 9 and 10 are all "Yes" or "No" check boxes.

May we provide additional information inside each of the question boxes ‐ or are we limited to only checking "yes" or "no"?

Check yes or no. Additional information should be in the narrative requested in Questions 5 and 11.

53 L 83 Table 11.3: Relevant Experience. Questions 2, 4, and 5 refer to M.3.4. Is the correct reference is M.4.3 instead of M.3.4?

See response to Question 47

54 L 83 Table 11.3: Relevant Experience. Question 4 states "If the answer to Question 4 is "No"…". Should this be "If the answer to Question 3 is "No"…"

Yes. FAA corrected the reference.

55 L

Per J002‐Labor Category Descriptions and Qualifications, penetration testers current require two certifications. Requiring two certifications for penetration testers is excessive and may negatively impact the government’s ability to access the required experienced contractor staff. Recommend the government require one certification for each penetration tester from the list provided.

FAA updated Attachment J002 to require only one of the listed certifications.

56 L 81

L.11.1. VOLUME I, SECTION 1 – MANAGEMENT APPROACH Sub‐Section A requires that we provide an approach for Schedule Management, Work Tracking, and Communications Narrative. Evaluation of that section includes a note relating to Section C, “FAA will evaluate the degree to which the Offeror’s narrative demonstrates an understanding of the scheduling, reporting, and communication requirements set forth in Section C.”

Does the FAA request that bidders address all the requirements for C.3.1 TASK 1 – PROGRAM MANAGEMENT SUPPORT in the for Schedule Management, Work Tracking, and Communications Narrative Or just address “Schedule Management, Work Tracking, and Communications" requirements?

For example is a Contract Transition (C.3.1.7.1) approach required in the Sub‐Section A?

The Offeror should address the elements of C.3.1 listed in L.11.1. This section does not require the Offeror to describe their transition approach

57 L 82 Can key personnel be located at either AC or DC Location? The Program Mgr labor category is limited to hours for the DC location.

The Program Manager must be located at the Contractor's Washington D.C. site. The Contractor may choose to have other key personnel at either the Washington D.C. or the Atlantic City, NJ site.

58 L 83

Table 11.3 "Work Performed" is limited to penetration testing and international assessments experience.

Can this section be expanded to include reference to other SOW functional areas; particularly Task 2 ‐ Independent Risk Assessment Support and Task 3 ‐ Vulnerability Assessment and Analysis of Alternatives?

No.

59 L 75 L.2.4 NAICS Code – the SIR states the NAICS code 541519 as of the January 2016 listing. Should this not be the latest NAICS code listing and not a listing from 4 years ago? Can the FAA clarify the appropriate NAICS code listing date?

January 2016 is the Clause date, not the effective date of the NAICS code

60 L 83, 85 L.11.3 Relevant Experience & L.13 Past Performance– Please confirm that Experience citations for teammates are acceptable for L.11.3. Would the FAA consider PPQs for L.13 from teammates and if so, would they be based on size, scope or some other parameter?

See the fourth bullet under L.13, "FAA will accept PPQs for work that a sub‐contractor performed but only if those PPQs relate to contracts that are cited in Volume 1, Section 3 (Relevant Experience)"

61 L 77 To allow for ample time to consider updates and questions, will the government consider a 2‐3 week extension for the proposal due date.

No.

62 L 82

Section B.II – Key Personnel Resumes and Letters of Commitment, states that the Offeror must provide resumes for the key personnel listed in Section H. However the resume template provided in the RFP (J005) does not comply with the font restrictions specified in Section L. May the Offeror change the font type and size in J005 to comply with the requirements in Section L?

See response to Question 40.

63 L 79 Section L provides specific instructions on page counts and proposal sections. The RFP does not provide page count for the Offeror to introduce the Team. Respectfully request the Government add a 2 page Executive Summary to the proposal to allow Offeror teams to introduce themselves and their solution.

FAA will not update the SIR to allow for the submission of a 2 page executive summary.

64 L 80

The table in L.10 that provides proposal sections, page limits, and delivery format lists a section 2 for Volume III, delivered in PDF format. However, this section is the PPQs, which are sent from our reference POC directly to the Government. Please Clarify that the Offeror's submission for Volume III is limited to Section 1 ‐ one page.

See response to Question 45.

65 L 77

L.2.6 3.14‐8 NON‐FAA INFORMATION SYSTEMS (JULY 2017)

lists information that offerors must disclose with their proposal. Please clarify where in the proposal this information must be placed and the page count reserved for the response.

It should be included in Volume II, Section 1, Sub‐Section B.

There is no page limit on this section.

66 L 84 L.12.2 states that Offerors must provided completed Representations and Certifications in accordance with Section K. If an Offeror's Reps and Certs are complete and accurate in SAM, may the Offeror make a statement to that effect rather than complete Section K?

No.

67 L 86 Section L calls for Past Performance Questionnaires. If a referenced contract has a CPAR, would the Government accept that CPAR instead of a PPQ?

No.

68 L 79

Section L provides specific instructions on page counts and proposal sections. The answer to question 51 on the Draft RFP, referened four documents that must be delivered as Volume I. However, the final RFP appears to require only three documents. Please verify that Volume I consists of three documents ‐ Sections 1‐3.

Per the Table in L.10 in the FINAL SIR, Volume I consists of Sections 1 ‐3.

69 M Due to the sensitive nature of this work, is a Top Secret Facility Clearance Required? Not at time of award. Also see answer to Question 34.

70 M Is ISO 9001 Certification Required? With the critical focus on quality control, the FAA would benefit from this vendor certification.

No.

71 M Is ISO 27001 Certification Required? With the critical focus on security, the FAA would benefit from this vendor certification.

No.

72 M Is CMMI Level 3 Certification Required? CMMI Level 3 enhances the expertise of the contractor support team to recruit staff and manage contract delivery.

No.

73 Other SF33 The provided PDF form for the SF33 does not contain information for any of the blocks normally completed by the Government such as the issuing office and address and Table 11. Please provide the information needed to complete the SF33

The Contracting Officer will provide a completed SF33

74 Other 12 In Attachment J002 “Labor Category Descriptions and Qualifications”, page 12 Allowable Substitutions, This section does not indicate how many years’ experience are needed to substitute for not having a Masters degree specified in Labor Category description. Can this be added?

See response to Question 38.

75 Other 13 Also in Attachment J002 “Labor Category Descriptions and Qualifications” page 13, Certification Requirements. Can GCFA (GIAC Certified Forensic Analyst) be added to Penetration Testing – Blue Teaming certifications list?

See updated to Attachment J002. FAA added the certification.

76 Other 12

Attachment J002. Labor Category Descriptions and Qualifications, Allowable Substitutions, does not include years of experience that can be substituted for the Master's degree.

Will two (2) years of relevant experience over and above the minimum experience requirements for the position be considered equivalent to a Master's degree?

Additionally, will one (1) year of relevant experience over and above the minimum experience requirements for the position be considered equivalent to a Master's degree when combined with a certification listed in Section 3 or equivalent certification not already required?

See response to Question 38.

77 Other 2 Past Performance Questionnaire: Page 2 states "Company Name or FBSS Performing Team Member...".

Should "FBSS" be "ATO Cybersecurity Testing" instead?

Yes. FAA corrected the reference.

78 Other Will the government confirm that the bidder needs to certify at time of bid that they are still a small business under the required NAICS code?

Yes.

79 Other Attach L003

In the case of a PPQ for a subcontractor team member ‐ assume that offeror would be prime contractor and performing team member would be subcontractor; is that correct?

Yes.

80 Other Based on the unknown status of potential ongoing telework due to COVID, does the FAA foresee a need for an alternate pricing worksheet to reflect telework vs the standard contractor/government site pricing worksheets?

No.

81 Other As the ongoing COVID crisis has increased the level of logistical complexity for small business to produce proposals virtually, especially proposals as complex as the Cybersecurity and Penetration Testing, would the FAA consider extending the due date to October 30, 2020?

See response to Question 61.

82 Other Are the DC based positions to be staffed at FAA HQ or will the positions be staffed at the FAA Command Center in Warrenton and/or the data repository in Mt. Weather?

See SIR Section F.3 Place of Performance. FAA has updated it for clarity.

83 Other Will a security clearance be required for any of the positions or contractor facilities in support of this effort?

No.

84 Other Att J002 ‐ The Cyber Security Analyst, Penetration Tester and Cyber Security Engineer Level 1 labor categories require a Masters Degree. Could five years of experience be an acceptable substitute for masters degree for these Level labor Categories?

See response to Question 38.

85 Other ‐ In order to ensure the government receives the best responses, we would request the government to extend the due date by two weeks.

See response to Question 61.

86 Other Who is the incumbent for this contract and what the contract number is for that past award? See response to Question 1.

87 Other Is there an incumbent on this contract? If so, please provide the incumbent name, current contract number, duration, historical level of effort and value of the contract?

See response to Question 1.

88 Other Can a Capability Statement be submitted for Large Firms? No.

89 Other Will the contracting office consider using the 541330 NACIS code? No 90 Other Will the contracting office accept IDIQ past performance? Yes.

91 Other Will the contracting office allow for an extension? See response to Question 61.

92 C 14 Are Pentesting tools provided by the client? Sounds like they are not but just want to be sure. FAA will provide the tools.

93 L 81 On Page 81 of the RFP, section L.11 Volume I. It says that. “Volume I must contain the information pertinent to technical evaluation Factors 1 through 4.”There are only 3 factors provided. Is there a factor missing or is there only 3 factors in Volume I?

There are only 3 factors. See update to the SIR.