CWMS 2.0 70RTAC20R00000025_0002 Q and As.pdf

FINAL RFP 70RTAC20R00000025 – Amendment No. 0002 Questions and Answers

Question

RFQ Reference Vendor Question DHS Answer

Questions Submitted in Response to the Final RFP

1 General Is it possible to get a list of attendees from today’s conference?

No, a list of attendees will not be provided.

2 General Will the government release a list of industry day attendees?

Please see Answer to Question #1.

3 General Will contractors have a chance of submitting additional questions after the Phase-I down select?

No. There is no separate deadline for question submissions specific for Phase II.

4 General Will the government consider a short extension of a week to allow for the difficulty of meeting and scheduling during the COVID crisis?

No. The government currently has no intention to extend either the Phase I or

Phase II proposal submission date.

5 RFP Will the government confirm that Technical

Documentation is not required nor will be accepted in

Phase One, other than the Attachment 2 Document?

Correct. Only the documents listed in RFP

Section 6.1.1 should be submitted for Phase

1.

6 RFP 6.0 Can the Government clarify what Offerors are required to submit for Phase 1 item #4 “Commitment letters from carriers” located on page 8 of the solicitation?

In accordance with Attachment 1 Statement of Work (SOW) Section 2.7.3, the contractor shall demonstrate their relationship with the carriers through letters from the wireless carriers confirming an established working relationship. RFP Section 6.1.1.4 was revised by Amendment #0001 to provide additional instructions.

7 RFP 6.1.1.4 We are wanting more information on the commitment letters from carriers. What exactly are you asking for in these commitment letters?

Please see Answer to Question #6.

8 RFP 6.1.1.4 Will DHS clarify what specific information is needed on the Letters of Commitment from the carriers to satisfy this requirement.

Please see Answer to Question #6.

9 RFP 6.1.2.4 Can we use team member Past Performance or is all Past

Performance due from the Prime only? Will the government accept commercial Past Performance of similar scope and scale?

You can use your team member (or subcontractor)’s past performance and commercial past performance of similar size, scope, and complexity.

10 RFP 6.2 The instructions state that "the Offeror’s presentation time is up to 90 minutes." Given the need to provide a full overview of the offeror's management approach as well as a demonstration of the portal, please consider granting offerors up to 120 minutes of presentation time so that DHS will be better positioned to evaluate the full capabilities of offerors' portals.

No. There is no change to the time limit for oral presentations.

11 RFP 6.2.4 If the Oral Presentation is conducted online, will the 10 hardcopies of the presentation still need to be provided? If so, where should they be sent to?

No, if the Oral Presentation is conducted online, you are not required to provide a hard copy of the presentation slides.

12 RFP 25.2

Safeguarding of

Sensitive

Information (MAR

2015)

Questions #13-37 Any questions regarding the security operation center or security configuration, please review DHS 4300A, NIST 800-53 and the SOW 11.11.

13 RFP 25.2

Safeguarding of

Sensitive

Information (MAR

2015)

"Please provide detailed view of your current IT landscape

(Infrastructure -Number of Servers, OS Platforms, Endpoints, Applications, Network Components - Firewalls, Switches, Routers etc)?"

The cloud service offered by the vendor is a

Software as a Service model. DHS doesn’t instruct the vendor on infrastructure requirements. DHS only evaluates the infrastructure to ensure it meets ATO and any government regulated standard.

Performance standards are captured in the

SLA. Each vendor is free to propose infrastructure standards that will meet and scale to the level necessary to satisfy the requirements described in the SOW.

14 RFP 25.2

Safeguarding of

Sensitive

Information (MAR

2015)

"Specify the security technologies, products and tools currently used in your Security Operations Centre for the following components and others if any:

1) Vulnerability Scanning - (E.g. Nessus, Quafygaurd etc)

2) Threat Intelligence (Threat intelligence sources or database, Detecting APTs, Content inspection etc)

3) Security Analytics (Analytics and Malware analysis)

4) Security Monitoring (SIEM - Integrated Intelligence)

5) Incident Detection & Response (Root cause / forensics)

6) Any GRC tool (E.g. Archer. etc.)

Also, list any additional solution components you are using in your Security Operations Centre or are part of Security services.

Please see the following weblink:

https://www.gsa.gov/technology/technology-products-services/it-security/continuous-diagnostics-mitigation-cdm-program

DHS doesn’t instruct the vendor on which tool to use to meet the guidelines. However, during the ATO process our security officials will advise and consult with the vendor on tools that meet the guidelines, should the vendor-suggested tools do not meet security regulation.

15 RFP 25.2

Safeguarding of

Sensitive

Information (MAR

2015)

"How many IP addresses across the infrastructure landscape are covered / or expected to be a part of the scope for vulnerability scanning?

What type of vulnerability scans are currently performed? -

Internal or external?"

Although the system must meet Fed Ramp and FISMA guidelines, this procurement is a

Software as a Service model, and therefore, a proposed solution is at the vendor’s discretion.

16 RFP 25.2

Safeguarding of

Sensitive

Information (MAR

2015)

"If Threat intelligence solution is currently used, what are the sources of threat intelligence (internal / external etc)?

Is any threat analysis performed or threat reports generated on a periodic basis?"

Both internal and external.

Real-time for violation and at the discretion of the security team for report generation.

17 RFP 25.2

Safeguarding of

Sensitive

Information (MAR

2015)

If Security analytics solution is currently used, what capabilities of analytics is currently deployed? (Security data analysis, Malware Analysis - Online / Offline etc)

Each vendor will propose a solution to meet the SOW requirements.

https://www.gsa.gov/technology/technology-products-services/it-security/continuous-diagnostics-mitigation-cdm-program https://www.gsa.gov/technology/technology-products-services/it-security/continuous-diagnostics-mitigation-cdm-program https://www.gsa.gov/technology/technology-products-services/it-security/continuous-diagnostics-mitigation-cdm-program https://www.gsa.gov/technology/technology-products-services/it-security/continuous-diagnostics-mitigation-cdm-program https://www.gsa.gov/technology/technology-products-services/it-security/continuous-diagnostics-mitigation-cdm-program https://www.gsa.gov/technology/technology-products-services/it-security/continuous-diagnostics-mitigation-cdm-program

18 RFP 25.2

Safeguarding of

Sensitive

Information (MAR

2015)

Does your security organization use a SIEM (Security information and Event Management)?

If yes, then what is the number of log sources (assets) integrated to SIEM?

If not, then what is the number of log sources (assets) to be integrated to SIEM?

Each vendor will propose a solution to meet the SOW requirements. Please see the

Government’s response in #12 above.

19 RFP 25.2

Safeguarding of

Sensitive

Information (MAR

2015)

What are the monitoring baseline requirements? Is it expected to be raised/managed as per compliance standards? E.g. ISO 27K, PCI, SOX, etc.

Please see the Government’s response in #12 above.

20 RFP 25.2

Safeguarding of

Sensitive

Information (MAR

2015)

What is the current incident response process?

How often is the incident response plan tested?

Do you have an incident response team?

The vendor will develop an incident response process for DHS approval.

The vendor and DHS will agree on a response test plan during the ATO process.

The vendor will be responsible for responding to incidents.

21 RFP 25.2

Safeguarding of

Sensitive

Information (MAR

2015)

If a GRC tool is used, what are the standards integrated with the GRC tool?

Each vendor will propose a solution to meet the SOW requirements.

22 RFP 25.2

Safeguarding of

Sensitive

Information (MAR

2015)

What are the integration requirements to integrate any external / third party solutions to SIEM? (E.g. Service

Management Tools, ITSM integration with SIEM)

This will be determined at the order level.

23 RFP 25.2

Safeguarding of

Sensitive

Information (MAR

2015)

Are you tied up with third party vendors or technology partnerships to provide any of your SOC solutions? If so, what vendor support are you currently leveraging?

Per the SOW 11.11 the vendor will be responsible for responding to security events associated with the TEMS solution. Please see the Government’s response in #12 above.

24 RFP 25.2

Safeguarding of

Sensitive

How are the SOC processes currently managed?

Are there any regulatory or compliance requirements, industry standards and guidelines that the SOC or the

Per the SOW 11.11 the vendor will be responsible for responding to security events associated with the TEMS solution. Please

Information (MAR

2015) processes (E.g. information security incident reporting to

Government or to any regulatory body or authority) in SOC are expected to help comply with?

Which are those applicable regulations, compliance requirements, standards and guidelines?

see the Government’s response in #12 above.

25 RFP 25.2

Safeguarding of

Sensitive

Information (MAR

2015)

Does your firm have written and documented processes defined for your SOC program?

Please see the Government’s response in #12 above.

26 RFP 25.2

Safeguarding of

Sensitive

Information (MAR

2015)

Do you have any standard reporting requirements (due to regulatory / compliance requirements)?

Please see the Government’s response in #12 above.

27 RFP 25.2

Safeguarding of

Sensitive

Information (MAR

2015)

What security metrics are currently tracked and are expected to be met to evaluate the overall SOC performance?

Please see the Government’s response in #12 above.

28 RFP 25.2

Safeguarding of

Sensitive

Information (MAR

2015)

What are the current process improvement initiatives run within the SOC? (automation etc)

Please see the Government’s response in #12 above.

29 RFP 25.2

Safeguarding of

Sensitive

Information (MAR

2015)

How many of your staff members focus on SOC operations? Is that their only responsibility?

Are they full-time employees or contractors?

Per the SOW 11.11, the vendor will be responsible for responding to security events associated with the TEMS solution. Please see the Government’s response in #12 above.

30 RFP 25.2

Safeguarding of

Sensitive

Information (MAR

2015)

When staffing your SOC, what is the standard qualifying requirements for the SOC personnel?

Please see the Government’s response in #12 above.

31 RFP 25.2

Safeguarding of

Sensitive

Information (MAR

2015)

When it comes to your company's organizational chart, the security organization falls under which function (IT, Risk

& Compliance etc). Describe your security governance model?

Security is under the Chief Information

Security Office.

32 RFP 25.2

Safeguarding of

Sensitive

Information (MAR

2015)

How does your firm identify cybersecurity attacks? Please see the Government’s response in #12 above.

33 RFP 25.2

Safeguarding of

Sensitive

Information (MAR

2015)

What new SOC capabilities have you implemented during the last year to better protect your firm from cyber attacks?

What new capabilities are you evaluating or planning to implement in the coming year?

Per the SOW 11.11, the vendor will be responsible for responding to security events associated with the TEMS solution. Please see the Government’s response in #12 above.

34 RFP 25.2

Safeguarding of

Sensitive

Information (MAR

2015)

Does your SOC operations have any restrictions working on a Multi-Tenant model (where a single security tool is used to provide service for multiple clients)?

Please see the Government’s response in #12 above.

35 RFP 25.2

Safeguarding of

Sensitive

Information (MAR

2015)

Does our firm conduct periodic risk assessments to identify security threats and vulnerabilities that might affect our information security?

Yes.

36 RFP 25.2

Safeguarding of

Sensitive

Information (MAR

2015)

Have any independent assessments been conducted of your

IT systems, policies, and procedures?

Please see the Government’s response in #12 above.

37 RFP 25.2

Safeguarding of

Sensitive

Information (MAR

2015)

Are there any restrictions to outsource SOC services to offshore delivery centres managed by Provider?

This support service must occur within the borders of the U.S.

38 Attachment 1 SOW

1.2 Scope

Are "Components" the main service unit who will be dealing with the portal?

Yes.

39 Attachment 1 SOW

2.0 Requirements

Are DHS agencies able to issue a task order for Optional

Services without ordering the CORE services?

No. Core Services shall be provided to all

Components who issue an order under the

IDIQ.

40 Attachment 1 SOW

2.1.1, pg. 11

Does DHS require the Portal (TEM) software to have

FedRAMP Moderate or High?

Moderate.

41 Attachment 1 SOW

General

For solutions hosted in the Cloud (such as AWS or Azure), will the cloud provider’s infrastructure FedRAMP of

Moderate or High be acceptable?

a. For the cloud host-based portal, what DoD

Impact Level (IL2, IL4, IL5) is required?

Should the Portal be hosted in the GovCloud environment?

Yes.

None.

At the vendor’s discretion.

42 Attachment 1 SOW

2.1.1

Must an up-level structure exist in the portal or as a backend CRM type tool to allow creation and management of Components?

The portal should meet the requirements discussed in the SOW.

43 Attachment 1 SOW

2.1.1

Are Components required to have variable permissions, product availability, etc.

Yes, each component will specify specific permission requirements in their task order.

44 Attachment 1 SOW

2.1.1

If MDM is optional, does that make core requirements optional on mobile?

No, Core Services shall be provided to all

Components who issue an order under the

IDIQ contract.

45 Attachment 1 SOW

2.1.1

What performance are we talking about? Is this account activity performance or device performance?

Yes, both device and portal activity performance.

46 Attachment 1 SOW

2.1.1

Does this need to be part of the portal or would DHS be comfortable with email/test automated notifications?

The portal should be capable of providing automated notifications and in email form.

47 Attachment 1 SOW

2.1.1

For usage information, what needs to be shared? Is this data usage per device?

All carrier usage and costs should be available in the portal to review and run reports on.

48 Attachment 1 SOW

2.1.1

Should we automate TEM tasks like ending service for zero-usage member service plans or sending advisory messages to high-usage members?

Specific requirements will be identified at the component order level.

49 Attachment 1 SOW

2.1.1

Is TEM expected to take place solely on the portal, or do we need to be sending updates outside the portal to component managers (e.g. weekly usage summary email)

No, specific requirements will be identified at the component order level in the deliverables on updates/reporting.

50 Attachment 1 SOW

2.1.2

When DHS talks about modification and updating workflows, are they talking about T-Cetra updating their workflow or DHS having those capabilities?

Both, the vendor should be modifying the portal to meet component order requirements and some components may require the capability to perform those tasks as well.

51 Attachment 1 SOW

2.1.2

Will Components be required to have multi-level role schemas with a minimum of Manager and Member

Not required, but yes most if not, all components will have multi-level roles.

52 Attachment 1 SOW

2.1.2

Can you confirm if Managers can CRUD, define permissions, place orders, start/end service, etc. for members of a component?

Specific requirements will be identified at the component order level.

53 Attachment 1 SOW

2.1.6

What is the mode of training used for employee training? Is it through a virtual platform or online or tutor based training

Training shall include but not be limited to computer-based training, Web based training, instructor led training, and train the trainer sessions.

54 Attachment 1 SOW

2.1.6

Describe the high level contents of the training All training shall include training materials consistent with the most recent and

Component specific version of the portal.

55 Attachment 1 SOW

2.1.6

What is the frequency of the trainings conducted? Training may be required initially and throughout the lifecycle of this requirement based upon Component needs.

56 Attachment 1 SOW

2.1.6

How is the attendance recorded for this training? Attendance recording is not a requirement unless specified at the component order level.

57 Attachment 1 SOW

2.1.6

Do you keep a passing score for the trainings? Specific requirements will be identified at the component order level.

58 Attachment 1 SOW

2.1.6

How soon after joining do the new joiners need to take this training

Specific requirements will be identified at the component order level.

59 Attachment 1 SOW

2.1.6

How do you ensure that all the employees (including the new joiners) are made aware of the security policies/awareness?

Employees must sign a Rules of Behavior prior to access of any IT system. Anything specific to the portal prior to access will be identified at the component order level.

60 Attachment 1 SOW

2.1.6

Do you have industry certifications covering your

HR/training policies (iso27k etc)

No.

61 Attachment 1 SOW

2.4

The solicitation states the following: "The transition-in period at the IDIQ contract level will be sixty (60) calendar days from IDIQ contract award." Does the government intend to award a task order concurrent with the award of the IDIQ?

No.

62 Attachment 1 SOW

2.4.1.8, pg. 20

Will DHS accept ATO from other government agencies for the Portal software (TEM)? If not, will DHS sponsor the awardee for the FedRAMP Security and ATO process?

No. DHS will cover the evaluation cost. Any cost to meet ATO guidelines should be considered during the proposal phase.

63 Attachment 1 SOW

2.4.1.8, pg. 20

Will DHS pay for the ATO Processes and Accreditation?

DHS covers the cost for analysis necessary for the accreditation. However, any hardware, software, or labor required to meet ATO should be considered when proposing the Core solution.

64 Attachment 1 SOW

2.5.1

What is the average hourly, weekly and monthly call volume for the customer service, invoice/billing and help desk/support lines (broken out please)?

This is a vendor managed services, therefore the government will validate that the vendor is able to support the user community as outlined in the SOW.

65 Attachment 1 SOW

2.6.4.2.2, pg. 32

Will the contractor be responsible for paying the carriers’ monthly invoices, or will they be paid directly by DHS?

It is the vendor’s role and responsibility as part of the managed service.

66 Attachment 1 SOW

2.7.2

Do members of a Component take any action to start or end service, modify service, or request upgrades themselves on-platform - i.e. "topupnow.io" for DHS employees

No, the vendor will place orders with the carrier and component employees will make the requests.

67 Attachment 1 SOW

2.7.2

If this self-managed service isn't a requirement, is offering it a competitive advantage?

MDM is an optional service that is a requirement of the contract and specific use of the service will be identified at the order level.

68 Attachment 1 SOW

2.7.3.6 and

Attachment 4

Pricing Template –

Carrier Services

Pricing Tab

The SOW states "Access to authorized DHS Satellite

Phones will require coordination and acquisition from

Defense Information Systems Satellite Phone contracts."

Since DHS Satellite Phones are acquired through existing contracts, please confirm that offerors are only required to provide the service for satellite phones.

Commercial satellite service and devices are required under SOW section 2.7.3.6. Secure satellite services are acquired by the component under the DISA contract and may need to be tracked in the portal pending component order requirements.

69 Attachment 1 SOW

Section 2.8, pg. 39

Section 2.8, “Wireless Security,” - would DHS clarify what level of assurance is required from the carriers to meet these requirements?

What level of monitoring and management does DHS expect to receive from the Portal for this section?

This will vary depending on the customer.

Please refer to the SOW for minimum and maximum requirements.

70 Attachment 1 SOW

Section 2.12, pg. 41

In section 2.12- “Standard of Services”; Since these requirements are under the control of the carriers, what level of enforcement or support is required from the contractor?

Please refer to the SOW for all requirements.

71 Attachment 1 SOW

2.7.2

Does your organization allow BYOD? BYOD requirements will be identified at the order level.

72 Attachment 1 SOW

2.7.2

What are the measures currently implemented to secure data in personal devices of users?

This will be identified at the order level.

73 Attachment 1 SOW

2.7.2

Is VPN login is enabled? This will be identified at the order level.

74 Attachment 1 SOW

2.7.2

What are devices allowed under BYOD? This will be identified at the order level.

75 Attachment 1 SOW

2.7.2

Does access policy enforced on all mobile devices? This will be identified at the order level.

76 Attachment 1 SOW

2.7.2

How personal data and organizational data is segregated in mobile devices?

This will be identified at the order level.

77 Attachment 1 SOW

2.7.2

What are the devices which needs to be considered under mobile security?

This will be identified at the order level.

78 Attachment 1 SOW

2.7.2

Which tool should be implemented for end point protection?

This will be identified at the order level.

79 Attachment 1 SOW

2.7.2

What activity should be allowed on Mobile devices? This will be identified at the order level.

80 Attachment 1 SOW

2.7.2

Should we implement "single sign on" in mobile devices for accessing organization network and applications?

This will be identified at the order level.

81 Attachment 1 SOW

2.7.2

Should we implement two factor authentication for mobile devices?

This will be identified at the order level.

82 Attachment 1 SOW

2.7.2

Will patching of critical vulnerabilities includes mobile devices also?

Yes.

83 Attachment 1 SOW

2.7.2

Will mobile devices are also part of Vulnarability assessment practice?

Yes.

84 Attachment 1 SOW

3.11 Business

Continuity Plan

Does the customer expect Capgemini to provide BCDR for their applications & sytems for their physical locations?

The vendor’s proposed cloud solution should cover a built-in redundancy capability.

85 Attachment 1 SOW

3.11 Business

Continuity Plan

Are there any restrictions for delivering this service out of the local country?

Yes. Service are confined to within the borders of the U.S.

86 Attachment 1 SOW

3.11 Business

Continuity Plan

Does the data need to be synchronized in real time? Yes.

87 Attachment 1 SOW

3.11 Business

Continuity Plan

What kind of network connectivity is needed? Vendor’s discretion.

88 Attachment 1 SOW

3.11 Business

Continuity Plan

How many critical applications support the critical processes?

This will be identified at the order level.

89 Attachment 1 SOW

3.11 Business

Continuity Plan

What is the technology footprint to support the critical applications?

This will be identified at the order level.

90 Attachment 1 SOW

3.11 Business

Continuity Plan

What are the RTO’s and RPO’s for the critical applications?

This will be identified at the order level.

91 Attachment 1 SOW

3.11 Business

Continuity Plan

Is there a backup strategy to support this recovery objectives? If so, what is the technology?

This is a vendor managed services, therefore the government will validate that the vendor is able to respond to disaster recovery events.

92 Attachment 1 SOW

3.11 Business

Continuity Plan

What is the maintenance cycle for DR Plans This is a vendor managed services, therefore the government will validate that the vendor is able to respond to disaster recovery events.

93 Attachment 1 SOW

3.11 Business

Continuity Plan

What is the testing cycle? (How many times per year?

) Are applications to be testing all at once or broken up into smaller tests?

This is a vendor managed services, therefore the government will validate that the vendor is able to respond to disaster recovery events.

94 Attachment 1 SOW

3.11 Business

Continuity Plan

Are they using a hot, warm or cold site? This is a vendor managed services, therefore the government will validate that the vendor is able to respond to disaster recovery events.

95 Attachment 1 SOW

3.11 Business

Continuity Plan

Do they need additional plans outside of IT DR Plans? (i.e.

emergency response, Business Continuity, incident response?)

This is a vendor managed services, therefore the government will validate that the vendor is able to respond to disaster recovery events.

96 Attachment 1 SOW

3.11 Business

Continuity Plan

Do they have an existing Business Impact Analysis (BIA) that their critical applications are based on?

This will be identified at the order level.

97 Attachment 1 SOW

3.11 Business

Continuity Plan

Do they have an existing Business Continuity Plan that deals with alternate work locations for their IT personnel?

Yes.

98 Attachment 1 SOW

3.11 Business

Continuity Plan

What is the expected testing cycle? Are they expecting each type of test for each application? (related to tabletop exercises & recovery plans)

This is a vendor managed services, therefore the government will validate that the vendor is able to respond to disaster recovery events.

99 Attachment 1 SOW

3.11 Business

Continuity Plan

Is there an existing BIA (Business Impact Analysis) with

Recovery Time Objectives and Recovery Point Objectives defined for each app and broken into Tiers?

This will be identified at the order level.

100 Attachment 1 SOW

3.11 Business

Continuity Plan

If yes, how many apps in each Tier This will be identified at the order level.

101 Attachment 1 SOW

3.11 Business

Continuity Plan

If yes, which apps are to be included in the quarterly testing

This will be identified at the order level.

102 Attachment 1 SOW

3.11 Business

Continuity Plan

If yes, do they dependency mappings between critical apps and systems as well

103 Attachment 1 SOW

3.11 Business

Continuity Plan

If no, we will need to add this into the service offering

This will be identified at the order level.

104 Attachment 1 SOW

3.11 Business

Continuity Plan

Do they have existing DR Plans? This will be identified at the order level.

105 Attachment 1 SOW

3.11 Business

Continuity Plan

If yes, how many? Is there one for each app or one for a cluster of apps?

This will be identified at the order level.

106 Attachment 1 SOW

3.11 Business

Continuity Plan

If yes, do they want us to do all of the plan updating?

This will be identified at the order level.

107 Attachment 1 SOW

3.11 Business

Continuity Plan

If yes, can we see an example? Either full plan, template or just table of contents?

This will be identified at the order level.

108 Attachment 1 SOW

3.11 Business

Continuity Plan

What has been their process for DR testing in the past? This will be identified at the order level.

109 Attachment 1 SOW

3.11 Business

Continuity Plan

How many hours in duration are their tests scheduled for?

This will be identified at the order level.

110 Attachment 1 SOW

3.11 Business

Continuity Plan

Do they already have defined scope and functionality testing?

This will be identified at the order level.

111 Attachment 1 SOW

3.11 Business

Continuity Plan

Are they interested in their plans being stored in a Business

Continuity Tool?

This will be identified at the order level.

112 Attachment 1 SOW

3.11 Business

Continuity Plan

Do they want to take over management and coordinator of their entire DR footprint or just a portion of it?

This will be identified at the order level.

113 Attachment 1 SOW

6.1 and 7.2

Each "4E. Incentive/Disincentive" SLA cites CLIN X002 with the exception of 4E Incentive/Disincentive for Device

Asset Management and Call Abandonment Rate, which cite

CLIN XXXX. To allow DHS to ensure greater price clarity

All disincentive credits be on the Core

Services CLIN X001. Attachment 1 SOW has been updated.

and accuracy, please confirm that CLIN XXXX should be

CLIN X002.

114 Attachment 1 SOW

10.1.1

The SOW states that, “The Contract employees, performing work in support of this award shall have been granted at a minimum “Top Secret” security clearance from the Defense

Industrial Security Clearance Office. The contract employees will only have access to SECRET level information until Defense Security Service has granted a full TS to the Contractor Facility.” Recognizing that a TS facility is required and in order to obtain best value, please clarify whether the employees requiring TS security clearance are limited only to those individuals handling secure phones.

No. It will be at the task order level COR’s discretion.

115 Attachment 1 SOW

11.5

Will the government authorize waivers for non-US citizens working with IT data and what is that process?

No.

116 Attachment 1 SOW

11.6

What are the components which you want to get audited(Application, Security policies, Governance, etc)?

Reference NIST 800-53 w/ DHS 4300A

117 Attachment 1 SOW

11.6

Do you have document repository with you? No.

118 Attachment 1 SOW

11.6

Do you want on site or offsite audit? Reference NIST 800-53 w/ DHS 4300A

119 Attachment 1 SOW

11.6

Do you undergo any internal audit? Reference NIST 800-53 w/ DHS 4300A

120 Attachment 1 SOW

11.6

What is the frequency of internal audit? Reference NIST 800-53 w/ DHS 4300A

121 Attachment 1 SOW

11.6

Will service include Third party assessment also? Reference NIST 800-53 w/ DHS 4300A

122 Attachment 1 SOW

11.6

What audits will occur on our system Reference NIST 800-53 w/ DHS 4300A

123 Attachment 1 SOW

11.6

Does organization follow any Regulatory requirement? Yes. Reference NIST 800-53 w/ DHS

4300A

124 11.11.1 Security

Operations

What are the compliance requirements of your organization?

Reference NIST 800-53 w/ DHS 4300A

125 11.11.1 Security

Operations

What are the different levels of incident defined in your

Organization? Specify the categories that define a security event? (Eg. Whether a malicious traffic flow can be considered as security event or a breach will be considered as security event)

Reference NIST 800-53 w/ DHS 4300A

126 11.11.1 Security

Operations

Is the incident response plan defined and followed by all the departments and locations in the organization or is it restricted to a specific environment?

It applies to all organizations. However, at the order level, each component reserves the right to require a more restrictive response plan.

127 11.11.1 Security

Operations

What are the different policy frameworks used in the organization?

Reference NIST 800-53 w/ DHS 4300A.

128 11.11.1 Security

Operations

Define your organization's risk rating category Moderate.

129 Attachment 1 SOW

12.0

Is a completed VPAT required for this procurement? If so, in which volume should the VPAT be submitted?

130 Attachment 4

Pricing Template-

Carrier Services

Tab, Additional

Carrier Offerings

If the Offeror has more than 28 additional carrier offerings, should these be included on a separate attachment with similar table formatting since the pricing template attachment is locked for this tab and will not allow the inclusion of additional rows?

The Carrier Services Tab has been unlocked.

Please use purple cells for additional offerings.

131 Attachment 4

Pricing Template-

Carrier Services

Tab and Sample

Order Pricing Tab

The Carrier Services tab appears to be password protected as well as some of the yellow fields on the Sample Order

Pricing tab, will these be unlocked so that we can input data into this tab?

See the response for #130 above.

132 Attachment 4

Pricing Template-

Sample Order

Can DHS provide guidance as to how many Data Devices of the 2,300 would be MDM capable for this sample order pricing?

For the scenario only Smartphones are considered MDM capable devices and a quantity of 7,000 is provided.

Pricing, Instructions 2d

133 Attachment 4

Pricing Template-

Sample Order

Pricing, Instructions 2c

Are the average voice minutes for Smartphones and basic cell phones all to be considered “off peak” minutes for this sample order pricing? If not, how many minutes should be considered “off peak” for smartphones and basic cell phones on average?

All minutes are considered peak minutes and will contribute towards any voice pool usage.

134 Attachment 4

Pricing Template-

Sample Order

Pricing

For this sample order, are there any technical requirements that must be met for providing AT&T, Verizon or T-

Mobile cellular services? For example, does DHS want

“regular” AT&T wireless services or AT&T FirstNet services quoted? For all 3 major carriers, do they need to have the option for Wireless Priority Service (WPS)?

Yes, the technical requirements may only be met using all 3 carriers. AT&T FirstNet is considered another Carrier and not included for the purpose of this scenario.

135 Attachment 4

Pricing Template-

Sample Order

Pricing, Instructions 2c

The Sample Order Pricing instructions indicate cell phones average 23GB of data usage, this seems high but we recognize this is just an example. Did you want to use a smaller average for pricing realism?

No, please follow the scenario as written.

136 DRAFT RFQ

Questions and

Answers #17 and

Attachment 4

Pricing Template –

Licensing Pricing

Tab

The government’s answers to questions in response to the draft RFP references MobileIron as one of the MDM solutions in place at DHS, but MobileIron is not among the options in the Licensing tab of the Pricing Template. In order to ensure access to all MDM solutions being used at

DHS, please add MobileIron in the Licensing tab.

DHS will not add MobileIron to the MDM

Licensing Tab at present. Any MDM licensing products that are not listed on the

MDM licensing tab may be added as part of

ODC at the task order level, as appropriate.