Amendment 0002 - RFP - 70RDAD22R00000001 - HSPD-12 TRP - SF 30 w QC Att.pdf

(x)

70RDAD22R00000001

x x

1 copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted ; or (c) By separate letter or telegram which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGEMENT TO BE RECEIVED AT

THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted , such change may be made by telegram or letter, provided each telegram or letter makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

x

DHS/OPO/DEPT.OPS

Washington DC 20528-0115 Dept. Operations Acquisition Div.

Office of Procurement Operations U.S. Dept. of Homeland Security

Washington DC 20528

70RDAD

Dept. Operations Acquisition Div.

Office of Procurement Operations U.S. Dept. of Homeland Security

DEPT OPS ACQ DIV(70RDAD)

03/04/20220002

13. THIS ITEM ONLY APPLIES TO MODIFICATION OF CONTRACTS/ORDERS. IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

12. ACCOUNTING AND APPROPRIATION DATA (If required) is not extended.is extended, Items 8 and 15, and returning

Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended , by one of the following methods: (a) By completing

The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offers

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

FACILITY CODE CODE

10B. DATED (SEE ITEM 13)

10A. MODIFICATION OF CONTRACT/ORDER NO.

9B. DATED (SEE ITEM 11)

9A. AMENDMENT OF SOLICITATION NO.

CODE

8. NAME AND ADDRESS OF CONTRACTOR (No., street, county, State and ZIP Code)

7. ADMINISTERED BY (If other than Item 6)CODE 6. ISSUED BY

PAGE OF PAGES

4. REQUISITION/PURCHASE REQ. NO.3. EFFECTIVE DATE2. AMENDMENT/MODIFICATION NO. 5. PROJECT NO. (If applicable)

1. CONTRACT ID CODE

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

02/22/2022

CHECK ONE A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE CONTRACT

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority) appropriation date, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(b).

E. IMPORTANT: Contractor is not, is required to sign this document and return __________________ copies to the issuing office.

ORDER NO. IN ITEM 10A.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

The purpose of this amendment is as follows:

1) Provide the Government’s responses to Questions submitted;

2) Provide a revised RFP as a result of the Government’s responses; and

3) Provide revised Attachments IV, Template for Task Order I and Attachment VI, Pricing

Template as well as new Attachments IX, Draft DD254, X, Listing of the System Roles Defined in the Existing System, and XI, Labor Category Descriptions as a result of the Government’s responses.

No other changes are made at this time.

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)15A. NAME AND TITLE OF SIGNER (Type or print)

15C. DATE SIGNED 16B. UNITED STATES OF AMERICA 15B. CONTRACTOR/OFFEROR 16C. DATE SIGNED

(Signature of person authorized to sign) (Signature of Contracting Officer)

Tanya M. Hill

STANDARD FORM 30 (REV. 10-83)

Prescribed by GSA

FAR (48 CFR) 53.243

NSN 7540-01-152-8070

Previous edition unusable

Except as provided herein, all terms and conditions of the document referenced in Item 9 A or 10A, as heretofore changed, remains unchanged and in full force and effect .

TEL: EMAIL: 202-447-5511 tanya.hill@hq.dhs.gov

Questions / Government Responses for

Technology Refresh Project

RFP: 70RDAD22R00000001

70RDAD22R00000001-0002 Page 1 of 22

Reference

RFP Section

Paragraph

No.

Page No.(s)

Question

Government’s Response

1 Section 4.2

(SCIF)

Can you please supply the accompanying DD254 for the accredited SCIF so that we fully understand the security requirements for this program?

The draft DD254 has been incorporated into the RFP as

Attachment IX. Although a DD254 is applicable, a SCIF is not required.

2 Section 5.2.1

On February 22, 2022, the Department of Homeland Security issued a Request for

Proposal RFP for the HSPD-12 Identity Management System Technology Refresh

Project. Our company is interested in pursuing this opportunity; however, we have a few areas of concern.

Evaluation Criteria for this RFP listed in Section 5.2.1 states: “The Government will evaluate the Offeror’s proof of accreditation from the Department of Homeland

Security (DHS) or another federal agency of the Offeror’s contractor owned or operated Sensitive Compartmented Information Facility (SCIF) in the Washington

Metro Area (Virginia, Maryland, and Washington, DC) for this requirement. The

Offeror will receive a pass/fail for this factor”

After reading the requirements in the RFP there is no reference as to why a SCIF would be required to meet the needs of the SOW. Additionally, most of the SCIFs in the Washington, D.C. metropolitan area are owned and operated by large companies for contract work specifically needing these requirements. As a certified small business our company does not have a SCIF and we are looking to understand why a

SCIF would be required.

We attended the initial prebidders conference and there was no mention of this requirement. Additionally, posted in the Q&A from the conference (specifically

Question 9), the Government validated the need for a Top Secret Facility Clearance only (attached is the pre proposal Q&A for reference). However, in the final solicitation it is listed as a Gate requirement on Pass/Fail basis to possess an accredited Sensitive Compartmented Information Facility.

This gate has a submittal date of March 7th, not providing enough time for a business without a SCIF to obtain accreditation from the Government. We feel that had this

Note: This response was addressed and posted under

Amendment 0001, Question 1. No change to this response.

A SCIF is not required.

The Government has revised the Phase 1 instructions and evaluation factor in the RFP Sections 4 and 5 to require a

Top-Secret Facility Clearance instead of a SCIF.

RFP: 70RDAD22R00000001

70RDAD22R00000001-0002 Page 2 of 22 been stated in the prebidders conference, small businesses like ourselves would have had time to try and achieve accreditation.

Would you be able to explain:

• Why a SCIF is required?

• If a SCIF is required, would DHS allow a company with a Top Secret Facility

Clearance to achieve the SCIF requirement post award?

• If our company partners with a company owning a SCIF, would we meet the requirements?

We think in order to allow for maximum competition and proper timelines for contract acquisition, DHS should follow what was discussed in the prebidders conference and only require a Top Secret Facility Clearance in order to pass this gate.

3 Section 5.2.1 On December 16, 2021, during the pre-bidder conference for DHS Request for

Proposal (RFP) 70RDAD22R00000001, HSPD-12 Identity Management System

Technical Refresh, DHS provided information that a Top Secret Facility Clearance

Level (FCL) would be required in order for a company to compete. On February 22, 2022, the RFP was issued with a requirement for a Sensitive Compartmented

Information Facility (SCIF) owned or operated by offerors.

The SCIF requirement is new and in order to better understand XXXX would like to know how the need for a SCIF maps to the current solicitation requirements. The solicitation requirements as written in the SOO, Task Order 1 and Task Order 2 do not point to a need for a SCIF. We are trying to understand if there will be a need for classified equipment or personnel with higher clearance levels at contract award or if these will be requirements for subsequent Task Orders.

Would the Government consider an organization that has a Top Secret FCL as successful Gate one compliance?

A SCIF is not required.

The Government has revised the Phase 1 instructions and evaluation factor in the RFP Sections 4 and 5 to require a

Top-Secret Facility Clearance instead of a SCIF.

Possession of an active Top Secret FCL would be considered successful Gate one compliance.

Factor 1 does not require proof of existing SCIF in order to continue to Phase 2. However, it does require proof of an active Top-Secret Facility Clearance.

4 Attachment VI Tab3/Tab4

Will the government please provide the total quantity of individual users with a system role for the requested system? This information will aid the offeror in developing the licensing price proposal.

There are 3,211 personnel that have user roles.

5 Attachment

VII

Requirement

Page 5 Will government please provide a listing of the system roles defined in the existing system? This information will aid the offeror in planning and gaining understanding

A listing of the system roles defined in the existing system has been incorporated into the RFP as Attachment

RFP: 70RDAD22R00000001

70RDAD22R00000001-0002 Page 3 of 22

Traceability Matrix

ITEM FRQ-

19.020 of the current user stories needed for configuration, transition, and system testing.

X.

6 In the event that contractor support was utilized in the creation of the solicitation, will the company/companies be firewalled from partnering/competing for this opportunity?

This question will be addressed prior to the Phase 1 submission due date via a subsequent amendment.

7 Evaluation Criteria for this RFP listed in Section 5.2.1 states: “The Government will evaluate the Offeror’s proof of accreditation from the Department of Homeland

Security (DHS) or another federal agency of the Offeror’s contractor owned or operated Sensitive Compartmented Information Facility (SCIF) in the Washington

Metro Area (Virginia, Maryland, and Washington, DC) for this requirement. The

Offeror will receive a pass/fail for this factor” Is it the government’s intent to amend this requirement as most companies do not have a SCIF in the Washington, D.C. area and it was not mentioned as a requirement in the preproposal conference.

See Government’s response to Question 3 above.

8 The Requirements Traceability Matrix (Attachment 7) states privileged access should use CyberArk.

a. We would need more information on how DHS’ CyberArk instance is configured and deployed.

b. There is mention of system integration with eIDMS, but does not mention enrollment officers or other operators of using Active Directory accounts/credentials or Single Sign-On.

c. This is listed as a “demonstration” as well. We request clarification on how it is expected to demonstrate these integrations. In the Q/A it is stated that demonstrations mean they should be written to. If required to demonstrate live, then is it required for the vendor to use their own CyberArk instance when performing the demonstration?

RTMs are informative, we are not asking the vendor to demonstrate CyberArk integration during the presentation. Please refer to section 4.4.1.3.3.3 in the

RFP on use cases that are required for the demonstration.

9 The Requirements Traceability Matrix (Attachment 7) states it should be integrated with DHS standard systems monitoring tools, and then lists CDM.

a. In reference to CDM, this solution should not integrate into the CDM Dashboard.

Instead, it should integrate with eIDMS to provide the necessary CRED data, which will be used to build the Master User Record (MUR). The MUR is what is provided to the CDM dashboard.

The IES and CMS platforms shall integrate with CDM to manage administrative access to the servers and write their behaviors to the MUR. The government seeks to work with the vendor to support CDM for behaviors within their applications.

10 3.4 Current Department Operations a 34 Under sub-paragraph a. DHS PIV Cards, three sub-bullets provide further detail on

DAC. Could DHS please confirm that the three sub-bullets under primary bullet a.

DHS PIV Cards, are associated with the second primary bullet b. DHS Derived

Correct, the three bullets listed under "a. DHS PIV

Cards" should be listed under "b. DHS Derived

Credentials"

RFP: 70RDAD22R00000001

70RDAD22R00000001-0002 Page 4 of 22

Credentials? Are there additional, varied sub bullets for primary bullet a. regarding

PIVs?

11 3.12.1 Credential Issuance /

Management

4 48 Will DHS provide system access to the cryptographic key material necessary to manage the existing portfolio of issued smart cards?

DHS will provide system access to the necessary cryptographic key material to manage the existing portfolio of issued smart cards.

12 4.4 Proposal Content and Submission Instructions

Factors 1 and

2 in the table

64 Will DHS exclude from page count for Phase 1 / Volume 1A: Factor 1 and Phase 2 /

Volume 1B: Factor 2, both the front and back covers, tables of contents, and transmittal letters?

Yes, DHS will exclude from the page count for Phase 1 /

Volume 1A: Factor 1 and Phase 2 / Volume 1B: Factor 2, both the front and back covers, tables of contents, and transmittal letters.

13 4.4 Proposal Content and Submission Instructions

Factors 3 and

4 in the table

64 Will DHS exclude from page count for and Phase 3 / Volume 1C: Factors 3 and 4, both the front and back covers and table of contents?

Yes, DHS will exclude from the page count for Phase 3 /

Volume 1C: Factors 3 and 4, both the front and back covers and table of contents.

14 4.4 Proposal Content and Submission Instructions

AND

4.4.1.3.2

Factor 4 – Management

Approach

Factors 3 and

4 in the table

AND

B, bullet 5

AND

Could DHS please confirm that the letters of commitment for key personnel are considered part of the resumes and therefore excluded from page count in Phase 3 /

Volume 1C: Factors 3 and 4 (Technical and Management Approach)?

DHS confirms that the letters of commitment for key personnel are considered part of the resumes and therefore excluded from page count in Phase 3 / Volume

1C: Factors 3 and 4 (Technical and Management

Approach).

15 4.4.1.3.1 Factor 3 -- Technical

Approach and Demonstrated Functionality /

Capability

1, bullet 6 67 The RFP states that "The PWS must include a Performance Requirements Summary

(PRS) that provides the following, at a minimum: …." and then describes 5 discrete criteria. Does the Government have in mind a preferred format and template for the

PRS?

DHS does not have a preferred format or template for the

PRS.

16 4.4.1.3.1 Factor 3 -- Technical

Approach and Demonstrated Functionality /

Capability

1, bullets 12-

67 The RFP states that "The PWS must also include the following plans: IMS … and

Risk Management Plan." Since the IMS and Risk Management Plan are likely to be extensive documents -- a detailed IMS may include hundreds of entries -- would the

Government consider giving Offeror's the option of including the IMS as an attachment in either Microsoft Project (.mpp) or Microsoft Excel (.xls)?

The Government will accept the Microsoft Project (.mpp) or Microsoft Excel (.xls) attachment as the IMS.

RFP: 70RDAD22R00000001

70RDAD22R00000001-0002 Page 5 of 22

17 4.4.1.3.2 Factor 4 –

Management Approach

B, bullet 6 69 Please clarify the points of contact that DHS wishes Offerors to include in the resumes for key personnel and the intent of requesting this information. Specifically, is the intent of the point of contact to verify the person's current duties as described in their resume, as would be done by a supervisor, or to verify their employment with their current employer, as would be done by a human resources representative?

DHS has removed the requirement for points of contacts to be included in the resume.

18 4.4.1.3.3.3 Oral

Presentation

Use Case 3 70 Please identify which credential types are allowed for each of IAL1, 2 and 3? In particular, IAL1.

"IAL1 = Visitor Credential (only require escorted physical access)

IAL2 = Visitor unescorted/logical access, DAC and FAC.

IAL3 = PIV and PIV-I"

19 4.4.1.3.3.3 Oral

Presentation

Use Case 5 71 Will DHS provide sample 'issued cards' to test with before the presentation? Yes, DHS will provide sample 'issued cards' to test with before the presentation if requested.

20 4.4.1.3.3.3 Oral

Presentation

Use Case 5 72 What is meant by 'managing the card's attributes' in this context? Please elaborate to support bidders' understanding of DHS' requirements.

The vendor shall demonstrate the ability to harvest card data from third party issuers, ingesting all available information into the solution for provisioning

21 4.4.2 Volume 2 -

Business/Price Proposal

2 72 The guidance in the RFP states, "Using the RFP Pricing Template (Attachment VI), the offeror shall complete Tabs 1 and 2 using fully burdened labor rates (on-site and off-site) for each labor category identified as well as any additional or alternate labor categories proposed." Would the Government provide labor category descriptions and minimum requirements (such as minimum years of experience), for the identified labor categories within Attachment VI Pricing Template?

The Government has updated the RFP to include Labor

Category Descriptions as Attachment XI.

22 4.4.2 Volume 2 -

Business/Price Proposal

4 72 The RFP states that "The Government has provided a notional labor mix and level of effort to perform sample Task Order 1. Offerors must adjust the labor mix and level of effort to reflect an accurate depiction of their solution." Does this suggest that the

Government would consider a bid that used the notional level of effort to be non-compliant? Otherwise, an aggressive Offeror could use DHS' notional level of effort as a strategy to minimize its evaluated price. To encourage Offerors to propose their most realistic estimate of labor mix and level of effort, DHS may wish to revise the wording to state "The Offeror must adjust the labor mix and level of effort to reflect an accurate depiction of their solution. An Offeror that simply uses the notional labor mix and level of effort may create a presumptive risk of delivery that will be reflected in the technical evaluation as well as the price reasonableness analysis."

The Offeror must adjust the labor mix and level of effort to reflect an accurate description of their solution. The

Government will not presume noncompliance or risk if an offeror uses the notional labor mix and level of effort.

However, the Government will examine the relationship between the proposed labor mix and level of effort and the technical proposal.”

23 Attachment_V I_-

_Pricing_Tem

Tab 1 - IDIQ

Contract -

Onsite

N/A The Offerors may be able to provide volume discounts for some products/supply/equipment in support of the Government's scalability requirements.

May the Offeror provide different pricing for products/supply/equipment based on

Yes. The RFP has been revised to allow the Offeror to propose pricing based on a Volume Discount Approach to include additional instructions as shown below:

70RDAD22R00000001-0002 Page 6 of 22 plate_- _Final_02-22-

2022.xlsx prospective quantities purchased? The Offeror may propose volume discounts in the IDIQ pricing tab (Tab 1 – IDIQ Contract – Onsite and Tab 2 –

IDIQ Contract – Off-Site). Any volume discounts proposed shall also apply to the quantities in Tab 3 –

Sample Task Order I and Tab 4 – Sample Task Order

II. Please note: DHS will not automatically apply the discounts proposed in the IDIQ pricing tab to the Sample

Task Order tabs 3 and 4. The contractor shall apply the discounts based on the quantities in those tabs.

24 Attachment_V I_-

_Pricing_Tem plate_-

_Final_02-22- 2022.xlsx

Tab 3 -

Sample Task

Order I, and

Tab 4 -

Sample Task

Order II

N/A In order to ensure that all Offerors are using a common basis of understanding for pricing, would DHS define the anticipated start date for Sample Task Order I and

Sample Task order II?

In order to ensure that all Offerors are using a common basis of understanding for pricing, the anticipated start date for Sample Task Order I is May 2022 and Sample

Task order II is February 2024.

25 Attachment_V I_-

_Pricing_Tem plate_-

_Final_02-22- 2022.xlsx

Tab 3 -

Sample Task

Order I, and

Tab 4 -

Sample Task

Order II

N/A Can the Offeror insert a column next to the labor category column (for each year) to indicate whether the resource is allocated to 'Onsite' or 'Off-site'?

Yes. The Offeror may insert a column next to the labor category column (for each year) to indicate whether the resource is allocated to onsite or offsite.

26 4.3.1 Prospective Offeror’s Questions

1 62 of 69 Given the Government has significantly updated the RFP requirements as well as added 7 attachments between the Draft and Final RFP and there is only one opportunity to ask questions related to the RFP, will the Government provide an additional 3 business days for Offerors to submit questions.

No additional time will be provided for additional questions. However, one additional day will be provided for clarification of the Government’s responses to the questions posed on this document only.

27 4.2 2 61 In Phase 1, although clearly stated, does Factor 1 actually require proof of existing

SCIF in order to continue to Phase 2?

Perhaps demonstrated proof of a TS Facility clearance could be acceptable?

If an actual SCIF is required for the award, would it be acceptable to agree to obtain such facility prior to kick-off meeting post award date?

See Government’s response to Question 2 above.

No. Factor 1 does not require proof of existing SCIF in order to continue to Phase 2. However, it does require proof of a Top-Secret Facility Clearance.

An actual SCIF is not required.

RFP: 70RDAD22R00000001

70RDAD22R00000001-0002 Page 7 of 22

28 4.4 1 64 When submitting response for Phase 1, Volume 1A: Factor 1, is there a particular form or format you wish to receive this information in? You are granting us up to a 5 page limitation for this response, but this is a relatively simple delivery. For example, a CAGE Code for TS Facility clearance (should question 1 be addressed in that manner). Would any additional introductory Offeror information in this submission be kept and evaluated in the overall award decision or would it be a waste of your time at this Phase?

Note: This question was addressed under Amendment

0001, Question 2 and revised below.

There is not a preferred format or template for Phase

1, Volume 1A: Factor 1. Phase 1, Volume 1A: Factor 1 will be evaluated only on a pass/fail basis.

Additional introductory Offeror information in this submission would not be kept and evaluated in the overall award decision.

The title for Factor 1 has been revised to read:

Factor 1, Demonstrated Proof of a Top-Secret Facility

Clearance granted by Defense Counterintelligence and

Security Agency (DCSA)

Section 4. Instructions to Offeror, Paragraph 4.4 has been revised to reflect the Factor 1 page limitation to read

2 vs 5;

Section 4. Instructions to Offeror, Paragraph 4.4.1.1

Volume 1A – Phase 1 has been revised to incorporate additional information required for submission of Phase 1 information as follows:

The Offeror is required to demonstrate their current active Facility Clearance at the Top-Secret level granted by Defense Counterintelligence and Security Agency

(DCSA).

Offerors must provide the following:

• Name of Company

• Full business address

RFP: 70RDAD22R00000001

70RDAD22R00000001-0002 Page 8 of 22

• Data Universal Numbering System (DUNS) number•

Commercial and Government Entity (CAGE) Code

• Point of Contact (Primary & Alternate) Information for Phase 1 Proposal

• Request for Proposal Number

• Date of Phase 1 Proposal Submission

• Name, title, and signature of person authorized to sign the proposal

DHS will verify whether a Quoter has an active Top-

Secret Facility by utilizing the Facility Verification

Notification from the Defense Counterintelligence and

Security Agency’s (DCSA) National Industrial Security

System.

There are no page or formatting limitations for Phase 1 proposals. However, the Government anticipates that

Phase 1 proposals should be no longer than 1-2 pages.

In addition, Section 5, Evaluation Criteria Paragraphs

5.2 and 5.2.1 has been updated accordingly.

29 4.4 1 65 For Volume 2, Phase 3: Factor 5, would it be permissible to submit optional pricing spreadsheet tab(s) that would include innovative, optional components in additional to the best cost solution? For example, existing tab for the best cost to the government for meeting the proposed technical solution for Task Order SOO & a second pricing spreadsheet tab for innovative or optional upgraded security equipment and/or services to accomplish some of the areas of innovation interest listed in the RFP (such as SATComm data encryption for mobile enrollment workstation, or high speed encryption appliances for data in transit, or centralized key management We can architect our proposal with innovative, top-of-the-line features that go beyond meeting the objectives, but don’t want to price out the solution, knowing cost is a factor in the award decision; hence, having tiered solution pricing would be helpful.

The Offeror can determine how much innovative and higher-cost products to include in their solutions pricing.

However, in accordance with section 4.3 introduction, Alternate proposals shall not be submitted and will not be considered.

30 4.4 1 65 Regarding the pricing, do you expect pricing for all new equipment and peripherals as if no infrastructure existed, or do you expect us to reuse some of the existing

The Offeror shall expect to reuse the GFE peripherals

(fingerprint scanners, etc.) where practicable. Core

RFP: 70RDAD22R00000001

70RDAD22R00000001-0002 Page 9 of 22 equipment you listed in attachment VIII? CPU/workstations need to be replaced.

31 5.2. Section Wide Page 75 Will the Government be assigning adjectival ratings to items within each factor? For example, will there be adjectival ratings for items such as PWS & Quality Assurance

Plan individually?

No. The Government will not be assigning a separate adjectival rating to items within each factor such as PWS

& Quality Assurance Plan. Components of each evaluation factor will be evaluated as a whole.

32 4.4.1.3.1 Bullets Page 67 Can the Government clarify what they mean by the “functional areas outlined in the

SOO (Section III)” by indicating which Sections in 3 the Government is constituting as “functional”?

Functional areas include Innovation, Identity Enrollment

Services, Credential Management Services and sub bullets

33 5.2.3.1 Bullet List Page 76 Can the government clarify which parts of Section 3 are requirements that will be evaluated as part of factor 3? For example, the government uses various terms such and objectives, normative objectives, informative objectives and requirements throughout the RFP.

All of Section 3 requirements will be evaluated.

34 Section 3.8.2 Whole Section

Description

Page 39 Should the vendors assume that informative objectives are for information only and not required for the response?

An objective labeled “informative” in the SOO is presented to assist the vendor scope and develop their solution. The vendor’s ability to meet all section 3 requirements will be evaluated. Proposals will need to address requirements under an informative objective, such as the ability to integrate with eIDMS

35 Pre-Proposal Conference

TRP Scope

Bullet 3

Slide 5 During the pre-proposal conference the Government included “Software Change

Requests” as part of the TRP scope. According to the FAR the definition of COTS includes an item of supply “Offered to the Government, under a contract or subcontract at any tier, without modification, in the same form in which it is sold in the commercial marketplace;” is the Government asking for modifications to the proposed COTS software?

Change is covered under 3.10.7 Change Control. There are three categories of change expected by the

Government: 1) configuration changes; 2) integration / glue code changes; and 3) vendor software changes within the product. The Government seeks 1&2 to be the majority, and 3 to be the minority, for any changes to deliver the solution.

36 Pre-Proposal Conference

TRP Scope

Bullet 3

Slide 5 During the pre-proposal conference the Government included “Software Change

Requests” as part of the TRP scope, can the Government modify the solicitation to include requirements for change requests in Section 3? Currently this language/requirement is not in the RFP.

Change is covered under 3.10.7 Change Control. There are three categories of change expected by the

Government: 1) configuration changes; 2) integration / glue code changes; and 3) vendor software changes within the product. The Government seeks 1&2 to be the majority, and 3 to be the minority, for any changes to deliver the solution.

37 4.4.1.3.3 Oral

Presentation/S

Page 69 Demonstrations at a government facility can be challenging with firewalls and access restrictions, can the government provide vendors internet access without firewall

The Government expects the vendor to bring all equipment necessary to demonstrate their solution to

RFP: 70RDAD22R00000001

70RDAD22R00000001-0002 Page 10 of 22 ystem

Demonstration restrictions to perform their demonstration or a time period for testing/troubleshooting prior to the live demonstration?

including devices allowing network access. The

Government will not provide access to the DHS network resources (i.e., internet access).

38 3.1 Bullet a Page 33 Can the government confirm that the COTS software requested will not be owned by the government?

The Government does not intend to own any software.

39 3.12.4 Bullet 3 Page 49 Can the government provide more information on high-side credentials used today.

Who is the manufacturer?

The Government intends to support HSPD-12/ICAM objectives across multiple National Security classification fabrics. This includes managing tokens to support authentication on closed systems, in which the program will follow the requirements from CNSS Policy No, 25, National Policy for Public Key Infrastructure in National

Security Systems. Further information will be provided post award and completion of personnel vetting.

40 3.12.4 Bullet 3 Page 49 Can the government provide more information on high-side credentials used today.

What is the product managing those credentials?

The Government intends to support HSPD-12/ICAM objectives across multiple National Security classification fabrics. This includes managing tokens to support authentication on closed systems, in which the program will follow the requirements from CNSS Policy No, 25, National Policy for Public Key Infrastructure in National

Security Systems. Further information will be provided post award and completion of personnel vetting.

41 3.12.4 Bullet 3 Page 49 Can the government provide more information on high-side credentials used today.

Are they PIV compliant?

The Government intends to support HSPD-12/ICAM objectives across multiple National Security classification fabrics. This includes managing tokens to support authentication on closed systems, in which the program will follow the requirements from CNSS Policy No, 25, National Policy for Public Key Infrastructure in National

Security Systems. Further information will be provided post award and completion of personnel vetting.

42 2.5 HSAR

3052.209-72

Organizational

Conflict of

Interest

Page 16 If a company worked on the PMO contract with access to proprietary information on vendors offerings, would this conflict the entire company from participating in this solicitation in any way?

Access to proprietary information in performance of another government contract could create an unfair competitive advantage. Pursuant to paragraph (c) of

HSAR 3052.209-72, an offeror with knowledge of any facts that could create an actual or potential

RFP: 70RDAD22R00000001

70RDAD22R00000001-0002 Page 11 of 22 organizational conflict of interest must represent that it has included information in its proposal, providing all current information bearing on the existence of any actual or potential organizational conflicts of interest, and has included a mitigation plan in accordance with paragraph

(d) of this provision. Information to be provided in the proposal should include any mitigation plans approved and implemented in performing the other contract under which proprietary information may have been accessed.

43 2.5 HSAR

3052.209-72

Organizational

Conflict of

Interest

Page 16 If a company is or was a US Federal Government approved certifying lab for HSPD-

12 products and services and has had access to proprietary company information from vendors in order to get various certifications, would said certifying company be conflicted out of participating in this solicitation? Access to this information would give certifying companies a clear and distinct advantage over other potential vendors.

Access to proprietary information in performance of another government contract could create an unfair competitive advantage. Pursuant to paragraph (c) of

HSAR 3052.209-72, an offeror with knowledge of any facts that could create an actual or potential organizational conflict of interest must represent that it has included information in its proposal, providing all current information bearing on the existence of any actual or potential organizational conflicts of interest, and has included a mitigation plan in accordance with paragraph

(d) of this provision. Information to be provided in the proposal should include any mitigation plans approved and implemented in performing the other contract under which proprietary information may have been accessed.

44 4.4.1.2 Bullet 3 Page 66 For requirement 4.4.1.2 #3, “demonstrate the Offeror’s prior experience integrating and supporting HSPD-12 programs as a whole”. Can the government please clarify the if “programs” (plural) is meant to be the overall experience with all its customers providing HSPD-12 experience (outside of the individual past performances)? Or if it is meant to describe the offerors general HSPD-12 experience inside the three individual past performance citations?

Experience with three (3) customers providing HSPD-12 experience similar in size, scope and complexity in the last 5 years.

45 4.4 Chart Page 64 Given that the SOO is 27 pages long, can the government expand the Factor 3 page count from 30 to 40 pages?

Yes. The Government has expanded the Factor 3 page count to 40 pages.

46 4.4 Chart Page 64 Can the government provide estimated submission dates for Factors 2-5? The estimated submission dates will be approximately 1 to 2 weeks from the issuance of the advisory down-select notice. The ACTUAL submission dates for Factors 2 – 5

RFP: 70RDAD22R00000001

70RDAD22R00000001-0002 Page 12 of 22 will be provided in the advisory down-select notice in accordance with Section 4, Paragraph 4.2 Evaluation and

Selection Process.

47 3 All Page 33-60 Will the government specify that Attachment VII, RTM is “informative”? Section 3.8

(Contract Requirements) states: “All sections (including Appendices) in this

Statement of Objectives are normative (i.e., mandatory for compliance) unless specified as informative (i.e., non-mandatory).” Accordingly, Attachment VII (RTM) is “normative”. While there is significant overlap between the SOO and RTM, there are also significant differences.

RTMs are Informative

48 Attachment

VII

Section 3

All All The SOO requirements conflict with the RTM requirements, can the government clarify by making the RTM consistent with the SOO so that there are no conflicting requirements?

The Government found no conflicts between the SOO and RTM.

49 Attachment

VII

All Page 1-43 Will the government modify the RTM to indicate which requirements are to be met by the offeror’s solution, and which are to be met by DHS in some other way? The

RTM lists 663 requirements. Some of these are clearly the responsibility of the offeror. Based on the SOO, however, several clearly are the responsibility of DHS.

(For example, the first 4 requirements in the RTM begin “The servers shall …” The

SOO and answers to questions make clear that DHS, not the offeror, is providing the hardware servers as an Azure cloud environment “Cirrus”.)

RTMs are Informative. System specific requirements will be required to meet post award.

50 Attachment

VII

All Page 1-43 [This question is only relevant if the RTM remains normative]

Will the government provide a consistent and convenient requirement numbering or naming system for the requirements in the RTM?

The RTM lists 663 requirements.

418 use a naming system that is not particularly obvious or convenient (e.g. FRQ-19-xxx-xx or NFR-19-xxx-xx). The remaining 245 requirements use no naming system at all. When using the RTM, it would be highly useful and efficient to have a short and unambiguous way to refer to each requirement.

RTM is Informative

51 Attachment

VII

All Page 1-43 [This question is only relevant if the RTM remains normative]

Will the government make the “System” column in the RTM “informative”?

If the RTM remains normative the Government is specifying the solution offerors should propose.

RTM is Informative

52 Attachment

VII

All Page 1-43 [This question is only relevant if the RTM remains normative]

Will the government make the “Sub-System” column in the RTM “informative”?

If the RTM remains normative the Government is specifying the solution offerors

RTM is Informative

RFP: 70RDAD22R00000001

70RDAD22R00000001-0002 Page 13 of 22 should propose.

53 Attachment

VII

All Page 1-43 [This question is only relevant if the RTM remains normative]

Will the government make the “Verification” column in the RTM “informative”?

The RTM lists 2 forms of verification: (Demonstration, Documentation).

Since the RTM is normative, the offeror’s solution is required to satisfy each requirement as specified.

These are not the only two possible methods of verification. Each offeror should be allowed use additional verification methods, and to use the method that makes the most sense for each requirement as satisfied by its proposed solution.

RTM is Informative

54 Attachment

VII

All Page 1-43 [This question is only relevant if the RTM remains normative]

Will the Government replace references to “FIPS 140-2” in the RTM with “FIPS

140-3”?

The RTM includes 3 references to FIPS 140-2. FIPS 140-3 was published March 22, 2019.

RTM is Informative

55 4.3.1 Prospective

Offerors Questions

Paragraph 1 Page 62 Given the nature of the phased solicitation and still unanswered questions from the

Draft RFP and Pre-Proposal Conference, would the government consider adding a

QA session after the Phase 2 down-select notification?

The RFP required Offerors to resubmit any questions submitted during the draft RFP or Pre-Proposal

Conference that have not been addressed but may still be relevant to the final RFP by the Question Due Date.

Therefore, a subsequent QA session will not be provided.

56 Attachment IV and V

All All While we understand the vendor needs to provide a solution that allows either the government or third parties to provide services in the future, should we assume for

TO1 and TO2 that the vendor is fully responsible for the complete solution, installation, and services?

The vendor is responsible for the complete solution, installation, and services identified in TO1 and TO2.

57 4.4.1.3.1 Bullet 8 Page 68 If the solution requires Microsoft Windows, which is a proprietary product of one company but can be purchased via various resellers, would the government consider this to be “sole source” or available from multiple sources?

The Government considers this to be available from multiple sources.

58 Q&A response document

Question 10 Page 2 Based on Q&A 10, can the Government confirm TO1 will required the vendor to be fully responsible for getting the system operational in the DHS environment without any DHS or third party services provided?

TOI will require the vendor to be fully responsible for getting the system operational in the DHS environment using third party integration support.

59 Q&A response document

Question 13 Page 2 The government states DHS requires the use of “COTS GFE computers for issuance workstations”, can the Government confirm it will be providing GFE computers for enrollment and issuance workstations?

The Government will not be providing GFE computers for enrollment and issuance workstations. The enrollment and issuance workstation the Offeror is required to price on Attachment VI – Pricing Template is made up of a computer, printer, camera, monitor, RFP: 70RDAD22R00000001

70RDAD22R00000001-0002 Page 14 of 22 document scanner, fingerprint scanner, and peripheral

(Keyboard, mouse, Pin Pad, SCM reader). The

Government is purchasing the workstation and retaining ownership even after the contract expires.

60 Q&A response document

Question 16 Page 3 Government states they will manage the VMS. Will the vendor be responsible for anything besides providing the VMS software license?

The Offeror must provide professional services to support integration and maintenance of the VMS in the SRIP solution.

61 Q&A response document

Question 19 Page 4 Since the ICD’s will not be provided until post-award, what development cost should be included in TO 1 since we don’t have access to the specifications to bid on?

The Offeor must provide professional services to support integration and maintenance of the SRIP solution.

62 Q&A response document, 3.10.8

Question 26, Bullet c

Page 6, Pg

Are vendors responsible for providing the HSMs? Yes, Offerors are responsible for providing the HSMs.

The SOO has been updated for clarity.

63 Q&A response document, 3.10.8

Question 26, Bullet c

Page 6, Pg

Are vendors responsible for maintaining the HSMs? Yes, Offerors are responsible for maintaining the HSMs.

The SOO has been updated for clarity.

64 Q&A response document

Question 42 Page 8 Should vendors assume the legacy system is completely out of scope and have no responsibility for that system? Will DHS and legacy vendor will be 100% responsible for legacy system and managing existing issued cards?

The vendor for the current infrastructure under the existing IDIQ will be responsible for the system through its de-commissioning.

65 4.4.1.3.2 Bullet B Page 18, 68-69

Page 18 calls for 5 key personnel, 1 PM, 2 for TO1 and 2 for TO2. Page 68 calls out

5 labor categories to be identified as key. Which is the requirement?

The requirement is for a total of 5 key personnel. Page

68 refers you back to page 18 (HSAR 3052.215-70 Key

Personnel or Facilities (DEC 2003)) which identifies who those Key Personnel need to be.

66 4.4.1.3.2 Bullet B Page 18, 68-69

Can a person be key in TO1 and also be key in TO2? If that person is a Senior Level personnel that is responsible for the SOO as well as the requirements as addressed in Problem Statements I and II, then yes. They can be Key in both TOI and TOII.

67 4.4 Table Page 64 Can an executive summary be provided in the Past Performance using the 15 pages instead of 5 pages per contract?

No. An executive summary cannot be provided in the

Past Performance using the 15 pages instead of 5 pages per contract.

68 3.12.1 4 Bullet 5 Page 48 Is there a requirement to restrict card usage based on NIST guidance based on security vulnerability of Random Number Generators (RNG) for these legacy cards and legacy card stock?

There is a requirement to restrict card usage based on

NIST guidance based on security vulnerability of

Random Number Generators (RNG) for these legacy cards and legacy card stock.

69 4.4.1 Paragraph 2

#2

Page 69 For requirement 4.4.1 #2, “where different sub-units were transitioned at different times over a multi-year period”, can the government please clarify the definition of

Vendors need to articulate through examples where the vendor had to phase in multiple applications, systems, RFP: 70RDAD22R00000001

70RDAD22R00000001-0002 Page 15 of 22 sub-units? It is the only time it is stated in the RFP. It is unclear if this is comparable to DHS Agency Components which are sub-units of DHS or it is meant to reference something different such as the subsystems of FIPS-201, PIV Front-end Subsystem, PIV Issuance and Management Subsystem, Relying Subsystems?

services, etc. during a multiyear period in support of a multilayered customer.

70 4.4.1.3.3 Oral

Presentation /

System

Demonstration

Page 69 Can the government describe the environment where the demonstrations will take place, to include internet, monitors, tables etc.?

The presentations/demonstrations/displays will be held in

Washington DC. The vendor has sole responsibility for furnishing all supplies, equipment, wireless network points (i.e., MiFi), etc., necessary to exhibit their capabilities. The Government will provide general office furniture (i.e., tables, chairs) and audio visual equipment to display presentations.

71 4.4.1.3.3.3 Use Case 1 Page 70 According to the SOO “eIDMS is the hub that drives the entire process” and the solution receives requests from eIDMS for enrollment services, this Use Case describes the offerors solution as creating the enterprise identity, can the government clarify whether the Enterprise IDMS (eIDMS) or the proposed solution creates and maintains the enterprise identity?

The eIDMS creates and maintains the enterprise identity.

The vendor should simulate the eIDMS provisioning request to IES and CMS.

72 4.4.1.3.3.3 Use Case 1 Page 70 The use case states “granted access to DHS services” can the government clarify that they are not asking offerors to connect to existing DHS services?

The offeror is to simulate their solution provisioning to external (3rd party) resources.

73 4.4.1.3.3.3 Use Case 3 Page 70 Can the government provide the IAL category their current credentials are issued at

(PIV-I, DAC, FAC, PIV-O)?

"IAL1 = Visitor Credential (only require escorted physical access)

74 4.4.1.3.3.3 Use Case 8 Page 71 Can the government clarify that the listed credentials are examples and not all required to be shown in this use case given time constraints?

Offeror must demonstrate one entry from each parenthetical title:

1. Alternate token (FIDO, 2FA. Or Yubico PIV),

2. Digital Worker (Artificial Intelligence, Machine

Learning or Robotic Process Automation)

3. MDM integrations, and ISO 18013-5 credentials for next generation mobile PIV

75 4.4.1.3.3.3 “The outline for the presentation / demonstration will be provided promptly after

Page 71 Can the government clarify what the outline of the demonstration will consist of if it is not the Use Cases provided?

Offerors shall not exceed five (5) presenters for the Oral

Presentation. No more than two non-presenting company officials may be present during the presentation. The

Government is looking to evaluate the team of professionals that shall be responsible for the management and performance of the contract and is not looking to have a “sales presentation” by a person or

RFP: 70RDAD22R00000001

70RDAD22R00000001-0002 Page 16 of 22

Phase 3 written submissions are due.”

persons who will not have a role in the performance of the contract.

During the Oral Presentation, the Government will provide several brief Technical Scenarios to assess capabilities of the Offeror’s proposed solution. The demonstrations must showcase how the purpose solution can fulfill the objectives in the 10 use cases.

76 4.4.1.3.3 Oral

Presentation /

System

Demonstration

Page 69 Will the government allow offerors access to the demonstration location at least one hour before the scheduled demonstration to facilitate equipment setup and verify connectivity?

Demonstration site location and time will be provided at a later date. Time will be allotted for setup and connectivity testing.

77 4.4.1.3.3 Oral

Presentation /

System

Demonstration

Page 69 Can the government confirm offerors will have access to unrestricted internet connectivity and have the ability to connect hardware/software brought to the government facility (i.e. not on a government network)?

The presentations/demonstrations/displays will be held in

Washington DC. The vendor has sole responsibility for furnishing all supplies, equipment, wireless network points (i.e., MiFi), etc., necessary to exhibit their capabilities.

78 Attachment VI (3.10.8)

Bullet c Page 43 Based on 3.10.8, are the HSM’s being provided? GFE Language in the pricing spreadsheet implies the offeror is responsible for providing them-can the government please clarify?

Offeror is responsible for providing the HSM. HSMs are not GFEs.

79 Section 3.9.3 Bullet 1 Page 41 Due to limitations in FIDO to prevent MITM attacks, is FIDO 2 an acceptable alternative?

FIDO 2 is an acceptable alternative providing the

Government can manage the supply chain.

80 3.12.3 Bullet b Page 50 In an effort to evaluate a complete solution would Government please provide a quantity of SRIP stations to evaluate? We would suggest 100-200 for evaluation purposes

RFP reference provided does not coincide with the question asked. Therefore, the Government is not able to respond to this question.

81 Table B Attachment

VI

Tab 3 Table B States 540 Enrollment Stations. Can the Government clarify how many of the 540 Enrollment Stations are fixed stations, how many are mobile stations?

There are 404 fixed Enrollment Stations and 136 that are mobile

82 Table B Attachment

VI

Tab 3 Language in the RFP states that GFE equipment is in good shape and in working condition, Of the 540 Enrollment Stations requested in Table B, Is Government requesting vendors to price 540 brand new enrollment stations Inclusive of the PC

Hardware and All Peripherals including but not limited to:

• Camera, plus tripod

• Printers

• Battery Back-up

The Offerors should expect to reuse the GFE peripherals

(fingerprint scanners, etc.) where practicable. Core

CPU/workstations need to be replaced.

RFP: 70RDAD22R00000001

70RDAD22R00000001-0002 Page 17 of 22

• Surge Protector

• Monitor

• Keyboard and Mouse

• PIN Pad

• SCM Card Reader

• Document Scanner

• Slap Fingerprint Scanner

• Single Fingerprint Scanner

• Backdrop

• Document Validator

• Iris Scan

83 4.4.1.3.3.3 Page 70-71 With the amount of material that needs to be in the demo, would the government consider allowing 4 hours for the oral presentation and demonstration?

Each Oral Presentation/System Demonstration will be limited to two (2) hours.

84 3.5 Paragraph 1 Page 35 Page 35 states the…