6973GH_19_R_00106_Master_QA.pdf

6973GH-19-R-00106

CENTRALIZED NETWORK OPERATIONS CENTER/

SECURITY OPERATIONS CENTER

(NOC/SOC) & 24/7 CALL CENTER SUPPORT

QUESTIONS AND ANSWERS (Q&A)

(Any numbering information that was received with questions has been removed and replaced with the FAA’s. All other information was copied and pasted verbatim form the conveying email or attached document thereto.)

Q1. We didn’t see anything in the solicitation about new 24/7 use furniture for the RVSS, NOC/SOC, or Call Center. Is that scope of work going to be addressed with a separate RFP package, or will this entire project reuse existing furniture?

FAA RESPONSE: The only Government Furnished Property (GFP) that will be provided to the contractor will be one router to access OneNet, a Customs and Border Protection network. The contractor will be responsible for providing all facilities, tools, equipment, personnel, and any other incidentals necessary to fully perform the written requirement.

Q2. We are interested in priming this opportunity, but do not have a past performance of $30 Million size. Can we meet this requirement by using our subcontractor past performance?

FAA RESPONSE: It depends. Per the evaluation criteria under Factor 2, (SIR Paragraph 4.3), if the experience is from a subcontractor that is identified as a partner in a Joint Venture (JV) or Mentor- Protégé agreement, then yes, that subcontractor’s past performance may be used; however, it should be noted that failure to obtain FAA or SBA certification of the JV or Mentor-Protégé agreement prior to the time the FAA is ready to make a contract award, may render the proposed JV or Mentor-Protégé agreement ineligible for award. The FAA does not intend to wait for certifications to be finalized to make an award.

Q3.

Phase I SIR, Section 1.

SIR Section 5.3.4., Factor Two, Organizational Experience

Section 1 of the SIR states that this requirement is set aside 100% for small businesses UNLESS adequate competition among highly qualified small business vendors cannot be reasonably anticipated based on phase I responses. The NAICS code for this requirement is 541990 with a size standard of $15M.

Evaluation criteria in SIR Section 5.3.4 states that the standard is met when the offeror provides current, accurate, and complete information on a minimum of three (3), but no more than five (5) contracts, the offeror has performed (or is performing) that are similar in scope, complexity, and magnitude to the effort described in the SOW. Organizational Experience Forms submitted for teaming partner(s) or significant subcontractor(s) must be determined relevant in demonstrating their ability to perform the proposed effort.

The Organizational Experience Forms must clearly demonstrate the past and/or current contracts meet the following requirements:

a) All contracts submitted are similar in complexity to this requirement

b) Three (3) past and/or current contracts submitted were/are valued over $30M either performed by offeror, joint venture partner, or mentor under an FAA approved Mentor-Protégé agreement

c) Two (2) of the contracts submitted were of similar complexity and were performed directly by the offeror either as a prime or subcontractor

d) Projects submitted have been completed or underway within the last five (5) years

The SIR specifications in these sections are in conflict. How can an 8(a) or Small Disadvantaged Business (SDB) in NAICS Code 541990 and business size standard of $15M be expected to have 3 ea.

$30M Organizational Experience examples in in the past 5 years to qualify for bidding this program?

FAA RESPONSE: The size standard of the NAICS used is not related to the relative size and complexity of this requirement. Phase I SIR is utilizing a tiered evaluation because it is not currently known by the FAA if 8(a), SDVOSB, or small business single entities will be able to provide the required experience similar to the size and complexity of this requirement within their proposal. If single entities cannot provide the required experience, the FAA contemplates that it may be possible that acceptable 8(a), SDVOSB, or Small Business Joint Ventures (JV) or Mentor-Protégé agreements, in accordance with AMS T3.6.1 A(9), could provide this through the combined experience of teaming partners; however, it is also not known by the FAA if partnerships qualified to perform this requirement currently exist, will formulate for this requirement, will submit proposals, or may constitute a pool of qualified offerors large enough to consider a set-aside.

Per the Phase I SIR, Paragraph 1, If adequate competition for the first two tiers, which consists of 8(a) and SDVOSB, is not received, offers from the next sequential tier will be evaluated.

SIR Phase I Paragraph 1 has been amended as a result of this question for clarification purposes.

Q4. Question 1: Per FAA acquisition rules, since an entity need only be registered as a single entity by the date of proposal submission (i.e., single SAM registration, DUNS, CAGE Code), it should be sufficient to provide proof of a JV entity’s registrated status at the proposal due date (17 June 2019), correct?

Question 1 Reference: JV arrangements must be registered and corporately identified as a single entity (i.e. single SAM registration, DUNS, CAGE Code). (Please see Document 6973GH_19_R_00106_SIR_Phase_I (Page 2 of 13)).

FAA RESPONSE: Yes. Offerors who intend to submit proposals as Joint Ventures or Mentor-Protégé Agreements may do so with their teaming agreements in a pending status; however, evidence of that the registration process has been started is required with proposal. Failure to complete the certification process with the original partners proposed by the time of award will render any offerors proposing such teaming arrangements ineligible. 1. Acquisition Summary in the SIR has been revised to clarify this.

Q5. Question 2: For this NOC/SOC/CC competitive acquisition, the SBA rule requiring that JVs claiming 8(a), SDVOSB, or SB status need to be certified by the date of contract award (i.e., 17 August 2019) will apply, correct?

Question 2 Reference: All offeror’s claiming 8(a) or SDVOSB status, or FAA Mentor Protégé program participants, will be required to provide verification within their proposals. Verification will be demonstrated by providing the FAA with a copy of the Small Business Administration (SBA) 8(a) certification letter, proof of registration in Vets First Verification Program, or letter from the FAA Mentor Protégé Program Office, whichever is applicable. (Please see Document 6973GH_19_R_00106_SIR_Phase_I (Page 2 of 13)).

FAA RESPONSE: Yes. Offerors who intend to submit proposals as Joint Ventures or Mentor-Protégé Agreements may do so with their teaming agreements in a pending status; however, evidence of that the registration process has been started is required with proposal. Failure to complete the certification process with the original partners proposed by the time of award will render any offerors proposing such teaming arrangements ineligible. 1. Acquisition Summary in the SIR has been revised to clarify this.

Q6. Question 3: Will the agency consider lowering the number and dollar thresholds ($30M) set for the past performance by the prime offeror?

Question 3 Reference: Factor Two – Organizational Experience (Please see Document 6973GH_19_R_00106_SIR_Phase_I (Page 12 of 13).

FAA RESPONSE: No. Due to the performance risk associated with the size and complexity of this requirement and the potential impact to the US Customs and Border Protection’s mission if performance fails, the FAA is requiring offerors to demonstrate their experience and past performance in handling the initial set-up (investment), operations, financial management, and staffing concerns for requirements of similar scope and estimated relative size.

Please note that experience and past performance of partners in current, or pending, teaming arrangements intended to be used to perform this requirement may be considered.

Q7. Question: Is there any restriction on where the contractor call center location should be?

FAA RESPONSE: Yes, the location needs to be in the continental United States (CONUS).

Q8. Is it preferred to have the NOC/SOC & Call Center in a single location? Will you need a backup location?

FAA RESPONSE: Although it is preferred to be in a single location, it does not have to be. An Offeror does not need to have a backup location, as long as the service is maintained without interruption.

Q9. What are the current products and services supported in each region?

FAA RESPONSE: This is CBP sensitive information and cannot be responded to at this time.

Q10. What technologies are currently in place for CCTV’s, SNMP, Perimeter, Intrusion, Intercom, Building Automation, Fire, GPS & Access control?

FAA RESPONSE: This is CBP sensitive information and cannot be responded to at this time.

Q11. Will the procurement come under GSA IT 70 Schedule, other IDIQ, or a BPA?

FAA RESPONSE: As stated in paragraph 1 of the SIR, “The purpose of this Screening Information Request (SIR) is to evaluate and select the most qualified firms to compete for a five-year (one-year base, four one-year options) Indefinite Delivery/Indefinite Quantity contract to maintain and support the Customs and Border Protection (CBP) to include The stand-up and operation of a Network Operations Center, Security Operations Center, and Call Center (NOC/SOC/CC).”.

Q12. Can we use a call center software that we know or do you want us to use what you have now?

FAA RESPONSE: Please see Statement of Work, section 3.1, “The CC will use the Government provided trouble ticket system (currently Maximo but transitioning to BOSEC) in order to track, respond to, and report on user-reported issues.”

Q13. Is there any interest in integrating an Artificial Intelligence platform?

FAA RESPONSE: An Offeror may include an AI platform as long as it augments and addresses the objectives from the Statement of Work and RTM.

Company & Personnel:

Q14. What security clearance level will be required for the individuals?

FAA RESPONSE: Per Statement of Work, Section 6.0, “All NOC/SOC personnel must possess a completed CBP Background Investigation (BI), which specifically is a fully adjudicated CBP suitability clearance, before commencing work in the NOC/SOC/CC environments. Classified data will not be processed by the

NOC/SOC/CC.”

Q15. Will you provide a list of critical individuals you require?

FAA RESPONSE: Although no specific critical individuals are required, an Offeror would need to respond in accordance with the Statement of Work and Solicitation.

Q16. Will a company FCL be required for the prime contractor?

FAA RESPONSE: If “FCL” is referring to the Facility Security Clearance, then per Statement of Work, then

no. Section 6.0 states, “All NOC/SOC personnel must possess a completed CBP Background Investigation (BI), which specifically is a fully adjudicated CBP suitability clearance, before commencing work in the NOC/SOC/CC environments. Classified data will not be viewed or processed by the NOC/SOC/CC.”

Physical Facility:

Q17. Will a bond be required for the construction part of the contract?

FAA RESPONSE: This is not a construction requirement. The offeror’s proposed solution to providing the physical facility needs will be especially considered when assessing the performance risk of the offeror.

Q18. Will there be an Industry Day or a walk thru of the current facilities that will be taken over by the contractor?

FAA RESPONSE: This is a new requirement with no incumbent. Contractor-Owned Contractor-Operated (COCO) facilities are required for this effort. Contractor will be responsible for providing all facilities, equipment, personnel, and any and all other incidentals necessary to perform this requirement.

RADAR:

Q19. Can Thermal Radar be substituted as a continuous 360° sensor and radar system. Thermal Radar is a fusion of a 360° thermal camera and a ground Radar system that is an example of a COTS solution that is lower in price allowing for expanded deployments.

FAA RESPONSE: At this time, the FAA is seeking a solution for NOC/SOC/CC and not a revision to the current sensor suite.

Q20. I did not see anywhere in the document stating a specified distance of detection for a human or vehicle detection and surveillance. Is there a required distance of detection?

FAA RESPONSE: At this time, the FAA is seeking a solution for NOC/SOC/CC and not a revision to the current sensor suite.

Q21. Are there any specifications or criteria for false alarms from sensors?

FAA RESPONSE: No specifications, as long as the Offeror can determine it is a false alarm and resolve the situation.

Q22. Is there any interest in a drone detection and defense solution as part of the sensor set?

FAA RESPONSE: At this time, the FAA is seeking a solution for NOC/SOC/CC and not a revision to the current sensor suite. If after award, the contractor has a recommendation, the FAA will communicate with the contractor at that time.

Q23. SOW 4.2.3, pg. 24, DHS CBP Enterprise Requirements: Will the DHS/CBP Technical Reference Model (TRM) be made available to the offerors?

FAA RESPONSE: The TRM is FOR OFFICIAL USE ONLY (FOUO). It contains information exempt from public release under the Freedom of Information Act (5 U.S.C. 552). However, the Offeror may consult with the FAA on items that may be included in the TRM after award.

Q24. SOW 7.0, pg. 29, Travel: Is there an anticipated amount of meetings or seminars that the contractor would be required to travel to?

FAA RESPONSE: No. Travel is not anticipated, but may be needed on a case by case basis during the performance of the contract. Written approval from the contracting officer is required prior to any travel cost accrual. Costs shall be in accordance with the Federal Travel Regulation (FTR). A cost reimbursable travel CLIN is anticipated to be present on the resulting contract document.

Q25. Instructions 1, pg. 2, Acquisition Summary: Can the offeror propose in multiple Tiers? And if so can they choose which entity is awarded the contract?

FAA RESPONSE: Yes is the answer to the first question. It should be understood that in a tiered evaluation, when the evaluation moves from one tier to another, acceptable proposals remain in the competition pool, even if a set-aside is not established.

No is the answer to the second question. Offerors may propose as single entities or as partners in an official Joint Venture, or both. Given a scenario where if an offeror is involved in two proposals, one as a single entity and one as a JV partner, and the proposal submitted by the JV was determined to be the best value, the contract would be awarded to the JV, not the single entity. On the other hand, if the proposal determined to be the best value was submitted by the single entity, the contract would be awarded to the single entity.

The same logic applies to the Phase I evaluation for acceptability for the opportunity to participation in Phase II. If the single entity is determined acceptable and the JV is not, only the single entity will be able to participate in Phase II. If the JV is determined acceptable and the single entity is not, only the JV will be able to participate in Phase II. If both are acceptable, both may participate in Phase II.

Q26. Instructions 1, pg. 2, Acquisition Summary: If small business participation is not met, will the NAICS code be updated?

FAA RESPONSE: No. The NAICS will remain unchanged.

Q27. Instructions 1, pg. 2, Acquisition Summary: If small business participation is met in Tier 1 or 2, will the offerors be notified that they were not evaluated based on SB participation?

FAA RESPONSE: Yes.

Q28. Instructions 1, pg. 2, Acquisition Summary: Would the government consider separate due dates for each of the Tier levels?

FAA RESPONSE: No.

Q29. Will the government please consider and extension for a second round of questions after answers to these and other vendors questions are received so vendors can better respond to the government?

FAA RESPONSE: Not at this time. Phase I is a pass/fail process to establish a competition pool of offerors for Phase II with no pricing information required.

a. A 14 day extension will be quite valuable to have time to digest responses and have a follow up. This will enable better quality responses for offerors and the government.

FAA RESPONSE: At this time, an extension will not be considered.

b. Given the fact the submission date of these questions is March 27th and a response to these questions might not be published until sometime after this is received please consider an extension of the due date of responses to be 30 days after such responses are published. i. The current Proposal Due Date is April 18th at 1600 CST please extend this to allow offerors enough time to review, process and incorporate answers to all questions.

FAA RESPONSE: At this time, an extension will not be considered.

Q30. What is the estimated contract or ceiling value of this SOW/Solicitation?

FAA RESPONSE: The Independent Government Cost Estimate will not be released.

Q31. Please confirm that this is an IDIQ. a. If this is an IDIQ, is there an initial task order expected to be awarded with the award?

FAA RESPONSE: This contract award is currently contemplated to be an IDIQ. The ultimate size of the first task order at this time is unknown. Not all AORs will be supported by this contract early after award. It is estimated by the end of the first contract year, all AORs identified in the SOW will be supported by this contract.

Q32. If so, what is the expected value of the initial task order?

FAA RESPONSE: The Independent Government Cost Estimate will not be released. This is a competitive acquisition. Price will be evaluated upon receipt of Phase II proposals.

Q33. Is the government interested in technology capabilities from the vendor that are accretive to the value of the contract deliverables and at no extra cost to the government? For example our use of certain proprietary technology will enable automation of key processes that may result in faster responses to alarms and increase capability of response times of CBP. a. If yes, then is there a preferred response matrix for such capabilities?

FAA RESPONSE: See attached Requirements Traceability matrix (RTM). It is up to an Offeror on how to respond and provide a solution for this effort; all responses will be evaluated in accordance with the Statement of Work and Solicitation.

Q34. Will the government allow a NOC/SOC purposed for other government/municipal agencies also be utilized for the FAA/DHS either as a primary or backup/redundant location? a. For example if we have a NOC/SOC/CC that we use for the US Government and have additional capacity will this be acceptable or does the FAA require a dedicated facility?

FAA RESPONSE: The FAA does not require a dedicated facility, however, CBP’s OneNet system cannot be bridged with other programs or agencies.

Q35. Will the government consider dual NOC/SOC/CC so that call volumes can be routed, operational and staffing efficiencies be gained and resiliency from natural or man-made events be effectuated?

FAA RESPONSE: As long as an Offeror’s solution incorporates all aspects of the Statement of Work and solicitation, the FAA will consider this approach.

Q36. The SOW references the use of MIL-HDBK-61A(SE )which the last release is 7 February 2001.

a. Is there a more current version of configuration management that we should be referencing?

FAA RESPONSE: The February 7, 2001 version is the version that is referenced into this solicitation and should be utilized for responses.

Q37. Section2.0 references the replacement of the existing NOC/SOC/CC capability. Can the FAA let us know whom the incumbent is and what are the following capability characteristics of the existing facility?

FAA RESPONSE: CBP’s current solution to provide NOC/SOC/CC capabilities for all fielded RVSS is not centralized and encompassing all of the AORs specified in this written requirement. As such, this is considered a new requirement with no incumbent.

a. Physical size of each NOC/SOC/CC

FAA RESPONSE: It is up to each Offeror to respond with their technical approach; there is no minimum or maximum size.

b. Location–where are they currently

FAA RESPONSE: It is up to each Offeror to respond with their technical approach; there is no set location (with exception to CONUS).

c. Number of active seats/personnel on a24X7X365 basis for the existing NOC and SOC /CC’s.

i. Please break this out by personnel title/function

FAA RESPONSE: It is up to each Offeror to respond with their technical approach; there is no specific personnel / title / function stated in the Statement of Work or Solicitation.

d. For the CC and NOC–please provide the number of tickets issued and a sample of the tickets that are issued from lowest severity to the greatest or highest level.

FAA RESPONSE: This is sensitive information to CBP and For Official Use Only (FOUO); this information cannot be released at this time.

e. Will the government please provide the number of tickets on a daily/hourly/weekly/annual basis with any surge periods noted?

FAA RESPONSE: This is sensitive information to CBP and For Official Use Only (FOUO); this information cannot be released at this time.

Q38. Does the FAA require a redundant location(s)–as this draft PWS/SOW seems to indicate one location for all support?

FAA RESPONSE: An Offeror does not need to have a backup location, as long as the service is maintained without interruption.

Q39. What are the physical characteristics of the NOC/SOC that are required for resiliency?

FAA RESPONSE: This should be addressed within an Offeror’s response in accordance with the Statement of Work and solicitation.

a. For example–redundant power and full back up generators with number of days of runtime and guaranteed fueling resources?

FAA RESPONSE: This should be addressed within an Offeror’s response in accordance with the Statement of Work and solicitation.

b. Redundant fiber capabilities with alternate path, alternate providers?

FAA RESPONSE: This should be addressed within an Offeror’s response in accordance with the Statement of Work and solicitation.

c. Physical and security characteristics from which standards should apply?

FAA RESPONSE: Reference SOW section 4.2.2, Table 5, the System will meet the requirements as stated in the Government’s System Security Plan (SSP). Release of the SSP will be addressed in Phase II.

d. Wind loading, elevation, structure types etc.

FAA RESPONSE: At this time, the FAA is seeking a solution for a centralized NOC/SOC/CC capability and not a revision to the current sensor suite. If after award, the Offeror has a recommendation, the FAA will communicate with the awardee at such time.

Q40. In Section 3.2 please define secure space for “…The Contractor is responsible for providing secure space to house DHS OneNet equipment and connecting Contractor equipment to the DHS OneNet network connections.”

a. What level of security is required. EG SCI?

FAA RESPONSE: Reference SOW section 4.2.2, Table 5, the Offeror will coordinate with FAA/CBP to ensure the characteristics meet the requirements as stated in the Government’s System Security Plan (SSP).

b. Please provide the size of the space required.

FAA RESPONSE: It is up to each Offeror to respond with their technical approach; there is no minimum or maximum size.

c. Please provide power, cooling required for this equipment.

FAA RESPONSE: It is up to each Offeror to respond with their technical approach.

Q41. Is there any other required equipment or software to connect into this router? All the hardware supporting the DHS OneNet network connections, including any Customer Edge (CE) routers at the Contractor site, will be Government Furnished Equipment (GFE). This is expected to be a Cisco ISR 4451 router.

FAA RESPONSE: The Government will provide the router; all other equipment is to be supplied by the vendor for connectivity.

Q42. In section 3.2.2 3.2.2 Future Network Connections for the Test NOC/SOC Environment there is requirement “..To facilitate this requirement, a network connection is required between the Contractor’s test NOC/SOC environment and the various RVSS test beds….”We have noted Figure 6 and this appears to be incomplete for the ability to accurately quote the hardware and software as well as resources for configuration and testing, please provide a network topology as well as low level interconnectivity and specifications for this environment. For example how many servers and with type of configurations (memory, drive, GPU), what size router/switches, what software is required, what OS (Windows/Linux, Other).

FAA RESPONSE: Within CBP, there are multiple test beds per program, each with a minimum specification that will have to be coordinated post award. An Offeror should include the hardware as they deem needed within their initial solicitation response.

Q43. On page 26 the SOW/PWS states:

“For each test event execution, the Contractor must provide daily status reports to include any test procedure deviations and updates as to how well the testing proceeded. For most test events a Government Witness will be available on-site to witness the testing performed. At the end of each test event, the Contractor must produce a Quick Look and Final Test Reports.”

We would like to determine what the duration of these tests are expected to be and a sample of current testing that is relevant for this project.

Also please provide these two (2) documents as these are referenced but not observed on the FAA site or other sources.

The RTM for the functional and non-functional requirements are contained in an associated document titled Requirements Traceability Matrix (RTM), Remote Video Surveillance System (RVSS) Centralized Network Operations Center / Security Operations Center (NOC/SOC) and 24/7 Call Center Program, Document Control Number (DCN) USBP-PMO-NOCSOC-00-000001 (current version).

For additional context of the functional and non-functional requirements contained in the RTM, refer to the Functional Requirements Document, Remote Video Surveillance System (RVSS) Centralized Network Operations Center / Security Operations Center (NOC/SOC) and 24/7 Call Center Program, DCN ENT15-

NOCSOC-00-000001.

FAA RESPONSE: The Offeror will be creating the test and will determine the appropriate durations. It is estimated that the duration should be no more than 8 hours. Documents are being added as an amendment to the solicitation.

Q44. Who is providing the dedicated P2P lines in Figure 6?

a. If the vendor please provide connection points, capacity, network topology etc.

FAA RESPONSE: Per SOW section 3.2.2, the router supporting the connection will be GFE. All other system hardware requirements will be the responsibility of the Contractor. Data needed by the contractor to achieve system connectivity may be provided by the Government during the initial set-up.

Q45. In regards to Page 2 of 11: Paragraph 3.3 - Award: in the Phase 1-Screening Information Request document. Please clarify: due to the size (ie AoR) of this "procurement", will this contract award be multiple awards across the contract or a single IDIQ award?

FAA RESPONSE: No. This requirement is intended to provide a ‘centralized’ capability to cover all AORs.

Q46. If this is not a new requirement/opportunity. Please clarify the following: (1) previously, who were the incumbent(s), (2) the value of the contract(s), and the type of the contract(s); ie Cost Plus (CP), Firm Fix pricing (FFP), Time and Materials (T&M), etc?

FAA RESPONSE: This is a new requirement.

Q47. What is the Gov'ts expected "TOTAL" value of this contract?

FAA RESPONSE: The Independent Government Cost Estimate will not be released. This is a competitive acquisition. Price will be evaluated upon receipt of Phase II proposals.

Q48. At present, (1) how many Full-Time-Employees (FTEs or staffers) is/are manning the NOC/SOC, and the CC?

FAA RESPONSE: This is sensitive information to CBP and For Official Use Only (FOUO); this information cannot be released at this time.

Q49. Page 1 of the SIR states that responses are due on 4/19/2019 at 4:00 p.m. Central Time. Section 6.

Procurement Schedule on page 13 indicates that the Phase I Responses is due 04/18/2019. What is the due date of the SIR?

FAA RESPONSE: The due date is 4/19/2019. Information on Page 13 corrected.

Q50. In Section 1. Acquisition Summary on page 2, please define what constitutes “adequate competition.”

FAA RESPONSE: The sufficient number of qualified sources for “adequate competition” in Phase II shall be determined by the Source Selection Official (SSO) during the evaluation of Phase I proposals.

Q51. Section 4.2.1.c on page 6 states, “The offeror must complete an Organizational Experience Form (Attachment 3 – see Section 7 below) for a minimum of three (3), but no more than five (5), past and current contracts/subcontracts for requirements similar in size and operational and technical complexity to services described in the SOW. Offerors shall use one form per project example. Also, if applicable, include Organizational Experience Forms on a maximum of three (3) recent contracts performed by each of your teaming partners and significant subcontractors. At least two projects shall be directly performed by the offeror as either the prime or subcontractor. At least three of the projects shall be valued at over $30M either by the offeror or the teaming partner. All project examples submitted must have been completed or been underway within the last five years.” Will the Government please clarify if it is required that at least one (1), and up to three (3), Organizational Experience Forms are submitted from each teaming partner?

FAA RESPONSE: This language was corrected in the SIR document to indicate no less than 3, and no more than 5, examples shall be submitted per proposal (including experience of the prime and/or teaming partner).

Q52. Section 4.2.1.c on page 6 states, “At least three of the projects shall be valued at over $30M either by the offeror or the teaming partner.” Section 5.3.4, Factor Two – Organizational Experience, states “Three (3) past and/or current contracts submitted were/are valued over $30M either performed by offeror, joint venture partner, or mentor under an FAA approved Mentor-Protégé agreement.” There seems to be a conflict regarding the requirement for three (3) past and/or current contracts to be, or have been, valued over $30M, and how this requirement may be met. Will the Government please confirm that proposals submitted to satisfy this Organizational Experience requirement may be from the offeror and/or any teaming partner, as opposed to being limited to offeror, joint venture partner, or mentor under an FAA approved Mentor-Protégé agreement”?

FAA RESPONSE: Experience from teaming partners will be acceptable; however, the teaming arrangement must be certified by the SBA or FAA small business program offices prior to award to be eligible.

Q53. Section 5.3.4 on page 12 contains Factor One, Subfactor (e): “Ability to support additional systems as they are deployed to covered areas of responsibility.” This subfactor (e.) does not appear within the subfactors identified within the list at Section 4.2.1.b of the SIR. Will the Government please confirm whether offerors are required to address in their Phase 1, SIR proposal response the “Ability to support additional systems as they are deployed to covered areas of responsibility”?

FAA RESPONSE: SIR Paragraph 4.2.1(b) corrected.

Q54. Subfactors (c) through (e) identified within Section 5.3.5 (page 13) are not identical to the Subfactors identified within Section 4.2.1.d. (page 6). Will the Government please clarify what the required Subfactors are for Factor Three: System Design Approach and Requirements Verification?

FAA RESPONSE: SIR Paragraph 5.3.6 corrected.

SOW Questions Q55. Section 1.3 on pages 8-9: Will the Government please provide a schedule for establishing OneNet connections to the Relocatable sites at Laredo and McAllen?

FAA RESPONSE: It is estimated that OneNet will be established at the relocatable sites at Laredo and McAllen within the next two years.

Q56. Section 2.0 Objectives on Page 11 of the SOW states, “Contractor supplied NOC/SOC/CC should be highly scalable, for a phased deployment across the NB-RVSS, MDP, Arizona RVSS-U sites, Laredo and RGV AORs…” What is the Government’s expected date to begin transitioning NB-RVSS into the

NOC/SOC/CC?

FAA RESPONSE: As soon as possible, after contract award; the NB-RVSS is expected to be the first transition from this effort.

Q57. Section 3.0 Statement of Work (SOW) states “The Contractor must furnish all professional, technical and support labor, materials, supplies, management services, data, facilities, and transportation required to perform all requirements set forth within this SOW.” Will the Government please confirm whether COCO facility cost falls under supplies, general construction, or specialty construction?

FAA RESPONSE: This is not a construction requirement. Pricing information, of any kind, is not being solicited in Phase I. It is up to each offeror to provide the solution to facilities. The offeror’s solution to providing facilities will be closely reviewed to determine performance risk of that offeror to successfully stand-up this requirement and meet delivery goals indicated in the CDRLs (See paragraph 5.1 of SOW).

Q58. Section 3.0 Statement of Work (SOW) states “The Contractor must furnish all professional, technical and support labor, materials, supplies, management services, data, facilities, and transportation required to perform all requirements set forth within this SOW.” Will the Government please confirm whether software fall under services or supplies?

FAA RESPONSE: This is a support services requirement and will therefore be considered a contract for services. Deliverables to include software, reports, or other paper or electronic deliverables are considered incidental thereto.

Q59. Section 3.0 Statement of Work (SOW) states “The Contractor must furnish all professional, technical and support labor, materials, supplies, management services, data, facilities, and transportation required to perform all requirements set forth within this SOW.” Will the Government please confirm that construction of the NOC/SOC is considered special trade construction and is not general construction?

FAA RESPONSE: This is not a construction requirement. This is a service requirement for NOC/SOC/CC support. The FAA currently does not know how, where, or what the best value solution for facilities will be for this requirement. This issue will be closely evaluated with regards to the timely meeting of stand-up milestones, performance and delivery risk, and overall best value to the Government.

Q60. Section 3.0 Statement of Work (SOW) states “The Contractor must furnish all professional, technical and support labor, materials, supplies, management services, data, facilities, and transportation required to perform all requirements set forth within this SOW.” Call volume is required to determine number of operators needed to staff the call center. Will the Government please provide current call volume for NB-RVSS, MDP, RVSS-U, Relocatables, and projected call volume for CCS?

FAA RESPONSE: This is sensitive information to CBP and For Official Use Only (FOUO); this information cannot be released at this time.

Q61. Section 3.0 Statement of Work (SOW) states “The Contractor must furnish all professional, technical and support labor, materials, supplies, management services, data, facilities, and transportation required to perform all requirements set forth within this SOW.” Call duration is required to determine number of operators needed to staff the call center. Will the Government please provide current call duration for NB-RVSS, MDP, RVSS-U, Relocatables, and projected call duration for CCS?

FAA RESPONSE: This is sensitive information to CBP and For Official Use Only (FOUO); this information cannot be released at this time.

Q62. Section 3.0 Statement of Work (SOW) states “The Contractor must furnish all professional, technical and support labor, materials, supplies, management services, data, facilities, and transportation required to perform all requirements set forth within this SOW.” Call answer time is a critical metric used to determine number of operators needed to staff the call center. Will the Government please provide Threshold and Objective for call answer time?

FAA RESPONSE: This is sensitive information to CBP and For Official Use Only (FOUO); this information cannot be released at this time.

Q63. Have all systems shown in Figure 5 (Section 3.2.1) on page 14 of the SOW received authority to operate (ATO) on OneNet? If not, please confirm that the Government will be responsible for obtaining ATO on OneNet?

FAA RESPONSE: At this time, all sites with exception to the Swanton, San Diego and the future sites are operating on the OneNet System. The government will be responsible for setting up these sites that are not currently on the system and obtaining ATO on OneNet.

Q64. Are there specific NOC/SOC software tools the Government would require the supplier to use?

FAA RESPONSE: Per SOW, section 4.2.2, Table 5, the government requires “Security Test and Evaluation Network/System Scans using scanning tools compliant with current DHS policy. Currently those tools are NESSUS, Webinspect, and AppDetective.”

Q65. Section 3.2.2 on page 15 of the SOW states, “…Authority to Operate (ATO) process, which is a requirement for DHS OneNet.” Will the vendor be responsible to get systems/C2CENs to go through CBP ATO process?

FAA RESPONSE: The Government will be responsible to get Government systems through the CBP ATO process.

Q66. Will the vendor be responsible for C2CEN system tech refresh? If so, how frequently does the Government require tech refresh?

FAA RESPONSE: After award, the Government will be responsible for any Government systems tech refresh. If such Government tech refreshes affect the contractor’s system, the contractor may be entitled an economic price adjustment to provide needed system configuration changes to continue system functionality. Adjustment driven costs shall only be incurred upon coordination and the written approval by the FAA contracting officer.

Offerors should not anticipate any price adjustments after award for the initial set-up of the system. The Government fully expects the Contractor to provide a fully functional system compatible with the RVSS, in its current configuration(s), within the limitations of their awarded pricing.

Q67. Section 4.2.2 Security Document Requirements on page 23 states, “Table 5 contains security document requirements that the Contractor must complete for the NOC/SOC/CC system prior to connection to DHS OneNet.” Will the Government please confirm that the security documents listed in Table 5 – Security Document Requirements for the NOC/SOC/CC System are CDRLs?

FAA RESPONSE: These are existing documents from CBP that will need to be modified with Contractor Support as required (as shown in SOW section 4.2.2, Table 5). As these are existing documents, these are not attached as CDRLs.

Q68.

1 1-2 PHASE I FEDERAL

AVIATION

ADMINSTRATION

SCREENING

INFORMATION

REQUEST 6973GH-19-

R-00106

Tiered evaluation If a Tier IV vendor can deliver on the requirements at significantly lower cost then tiers I-III even though there are sufficient qualified vendors, would they be considered?

FAA RESPONSE: The tiered evaluation will be conducted in accordance with AMS T3.2.2 A(9) – Tiered Evaluation. Tier IV will not be evaluated unless adequate competition is not obtained from the combination of qualified offerors among all lower tiers. See Q50 for definition of ‘adequate competition’.

Q69.

2 13 SOW 3.1 "Security monitoring includes monitoring and analysis of network traffic, intrusion detection through the inclusion of Intrusion Detection Systems (IDS), and security event incident response logging."

This SOW is asking potential vendors to provide a NOC/SOC/CC without any additional solutions at their sites. Is the inclusion of IDS something that CBP wants the vendor to provide? We would need to provide IDS's at each site and manage them.

Does the government have existing intrusion detection systems at each remote site where information can be forwarded to the contractor proposed NOC/SOC/Call Center for monitoring?

Or does the government expect contractors to provide and deploy an IDS solution at each remote site?

FAA RESPONSE: Yes, the vendor would need to provide the IDS. The Government expects the Offerors to provide and deploy an IDS solution.

Q70.

3 13 SOW 3.1 "Security monitoring includes monitoring and analysis of network traffic, intrusion detection through the inclusion of Intrusion Detection Systems (IDS), and security event incident response logging."

Incident Response Logging, would CBP need log ingestion from each site to a Security Incident and Event Management (SIEM) system? If yes, we would need the make and model of all the devices that will be generating logs? Also, does each device at the site provide log aggregation or will the network carry log traffic from each individual source of logs?

FAA RESPONSE: This is sensitive information to CBP and For Official Use Only (FOUO); this information cannot be released at this time. The awardee will collaborate with the Government post-award to obtain the necessary information.

Q71.

4 13 SOW 3.1 "Additionally, it includes conducting and tracking security events, composing and distributing security alert notifications, and preemptive measures

Virus Protection...will CBP require the vendor to provide end point virus protection? If yes, we need the make and model of the end points to be AV protected? Would the vendor need to deploy in line AV protection at each site?

such as centralized logging, virus protection, and system hardening."

Currently is there GFE AV already in place and by which vendor?

FAA RESPONSE: Yes, the vendor will need to provide AV protection. This is sensitive information to CBP and For Official Use Only (FOUO); this information cannot be released at this time. The awardee will collaborate with the Government post-award to obtain the necessary information.

Q72.

5 13 SOW 3.1 "The CC provides a single point of contact that users and operators can use to report, document, track, and resolve system problems and account issues."

Since we would be required to support the CC in a 24x7 manner…can the single point of contact change with shift changes?

FAA RESPONSE: It is up to each Offeror to respond with their technical approach to suggest how the 24 x 7 will be covered.

Q73.

6 13 SOW 3.1 "The CC also handles system change requests to the system as well as to personal accounts and associated access privileges"

We are not sure which components at the site are currently under management.

What is the "system" being referred to in this requirement?

FAA RESPONSE: For this effort, the system is CBP’s RVSS system.

Q74.

7 13 SOW 3.1 "The CC will use the Government provided trouble ticket system (currently Maximo but transitioning to BOSEC) in order to track, respond to, and report on user-reported issues"

Can contractors "ebond" to the existing GFE ticketing system? An Ebond is a system to system connection, for example, creating a ticket in the contractor system would use a system to system communication to create a ticket in Maximo. “Ebond” means “Electronic Bond” which basically means linking the customer ticketing system to contractor’s ticketing system.

FAA RESPONSE: Yes, Offerors may “ebond” to the existing system, provided the Offeror is able to link their system to the GFE system.

Q75.

8 14 table 1 "Administer user system access and permission"

Would the access be requested for the components at each site?

If yes, what devices would be used? Is every component managed by a centralized element management device? If yes, what vendor and what element management system will be used?

Centralized management is a tool to make changes which in turn pushes the changes to each device under management.

Without centralized management, one would have to log into each device to make changes.

FAA RESPONSE: Yes, access will be requested for each site. The devices are dependent on each RVSS system and therefore is not managed by a centralized system.

Q76.

9 14 table 1 "Respond to password reset requests during normal business hours"

Do all devices use a single authentication system or are password supported in a distributed manner? Where the CBP authentication servers are used, will the SOC still be expected to implement password resets?

FAA RESPONSE: No, not all devices use a single authentication. The NOC will be required to reset password where they have the authority. Authority will be adjudicated and disseminated based on operational needs.

Q77.

10 14 table 1 "Manage and perform incremental and full backups"

Is CBP asking for incremental and full backups of the site devices? If yes, can CBP provide information so that sizing can be made (number and type of devices, frequency of backup and retention period of backups).

FAA RESPONSE: Yes, the vendor would provide the incremental and full backups. Information cannot be provided at this time as this is sensitive information to CBP and For Official Use Only (FOUO).

Q78.

11 14 table 1 "Monitor system configuration and status including servers, operating systems, and software applications "

We would need CBP to provide a list of the quantity of servers, OS version and applications in order to provide a proper response.

FAA RESPONSE: This is sensitive information to CBP and For Official Use Only (FOUO); this information

Q79.

12 14 table 1 "Implement security patches and configuration changes (HW and SW updates) "

Please provide a list of devices, operating systems under patch management.

FAA RESPONSE: This is sensitive information to CBP and For Official Use Only (FOUO); this information

Q80.

13 14 table 1 "Creates shift logs" Based on shared NOC/SOC environment, will it be sufficient that the vendor maintain overall shift logs or is CBP looking for more detail on when the on-shift staff is working CBP tasks?

FAA RESPONSE: Vendor will be required to maintain logs (call, activity, etc.) in accordance with CBP policies and guidelines.

Q81.

14 15 Figure 5 Is there any other traffic on the P2P circuit to each of the sites outside of the ability to confirm the connection carries, monitoring, log feeds, patching, authentication, and frame traffic?

FAA RESPONSE: Not normally, however there is a possibility that there might be (i.e.: remote-in and look at live video).

Q82.

15 15 Figure 5 CBP OneNet Image Will the workstation image and updates from the "DHS and CBP internal network resources?

FAA RESPONSE: - The workstation image and updates are CBP OneNet Images. They are categorized as Government Furnished Images (GFI).

Q83.

16 15 Figure 5 PIV auth Is it expected that CBP PIV authentication will be for the GFE ticketing system, accessing site devices and authenticating DHS/CBP internal resources? Will CBP provide individual PIV to each NOC and SOC staff member using GFE devices?

FAA RESPONSE: PIV Authentication issuance is a Security concern and typically requires a DHS Background Investigation (BI) prior to. As it stands currently, we really don’t have true PIV authentication… that includes IFT. The only use with the PIV is to unlock the workstation as an authorized user.

Q84.

17 15 Figure 5 NOC/SOC/CC Only one site is depicted in the figure…please confirm that CBP will require a redundant/fail-over facility?

FAA RESPONSE: The service must be maintained without interruption. Offerors may provide technical solutions to meet this requirement at their discretion.

Q85.

18 15 3.2.1 "The Contractor is responsible for providing secure space to house DHS OneNet equipment and connecting Contractor equipment to the DHS OneNet network connections. "

Would we be required to keep GFE separately secured away from other NOC/SOC equipment or can it be secured in the same manner? What are CBP's expectation about having access (or an agent of CBP) to service GFE's? Will we need to provide "remote hands" support for GFE?

FAA RESPONSE: The GFE equipment can be secured in the same manner as described in the Systems Security Plan. It is expected that access and support will also be addressed in the SSP.

Q86.

19 15 3.2.1 "The connection is used to send network and security status data to the centralized NOC/SOC/CC including high-definition streaming video at 30 frames per second which is required for system troubleshooting and display issue"

What type of connection will terminate the streaming video in the NOC/SOC? Will this connection also be required in the test environment?

FAA RESPONSE: This will depend upon how to remote into the web interface with a video encoder, including the test environment.

Q87.

20 16 3.2.1 "Within the DHS and CBP Internal Resources lies the PKI CRL Server which authenticates user workstations at both the AORs and Centralized

NOC/SOC/CC"

Since a shared NOC/SOC environment would create a better value for CBP, would dedicated workstations be supplied/used for CBP work that requires this authentication?

FAA RESPONSE: CBP will not supply NOC/SOC/CC workstations for this effort; the Offeror will present a solution in their technical proposal.

Q88.

21 16 3.2.1 "For authentication from RVSS Local Area Network (LAN) sites, the request is routed from the AOR via the Point-to-Point connection to the

Will the DHS OneNet GFE router be managed by the vendor NOC or another entity? Would we as the vendor have any role in this requirement?

Centralized NOC/SOC then to the PKI CRL server to via the DHS OneNet Connection to complete the request."

FAA RESPONSE: The GFE router will be managed by CBP’s OIT department; the Offeror will have a role in this requirement (i.e.: coordinate when patches are available, updates, etc.).

Q89.

22 16 3.2.2 "Test environments will be air gapped from DHS OneNet connections.