Government Response to Offeror Questions.pdf

Amendment 0001 - 70VT1520R0007

Government Response to Offeror Questions

#1 Section 3.0, Paragraph 3.1 Qualified Personnel, Page 4: Since this is a small business set aside contract, expecting a contractor and all of its subs-contractors to be RS2, DMP and Digital Watchdog certified in exactly all of the same projects upon contract award may be improbable. Therefore, will the COR allow for the team that is assembled that maintain the certifications as a group to propose that upon contract award, the team members missing a certification will be scheduled to be certified if awarded to meet the requirements of the contract? This is an ideal situation not required and yes, if the ‘group’ meets all the certifications it would count as being certified.

#2 Section 1.0 General, 1.1 Background, Page 2: Since we would like to submit a proposal with an accurate budget, we need to know more about the infrastructure of the facilities and the technologies, so please respond to following questions:

#3 About the Facility Infrastructure:

• Are any of the DHS OIG facilities of historical nature? Not sure, not identified.

• Is the use of these facilities for office use? Yes, with assets rooms that have separate IDS partitions.

• How stable is the power in the facilities? Government does not have a response to this question.

• What type of walls are in the perimeter areas of your facilities? STC 45 rated (with insulation and double layer drywall and extruded metal mesh.

• What type of walls is inside the offices? generally open

• Will we need to drill between the walls, to run new cable infrastructure? Not likely. Any new installations will be an add-on to the contract.

• Are most of the existing door frames metal and/or concrete filled? Metal only.

#4 Physical Access Control System (PACS):

• Are we to assume based on the SOW that the existing RS2 Access Control Panels, Work-Stations and Server, is communicating through DHS OIG IT networks? Or is this going to be done in the future? It is now.

• Related to FICAM Policy, does is DHS OIG authenticating the CAK besides the CHUID or FASCN from the PIV or CAC Card? No

• Related to FICAM Policy, the fact the authentication of the PIV or CAC card can present major delay upon presenting the card to the readers, especially in areas such as the main entrances;

what is the maximum allowable time expected to authenticate both CAK and CHUID? Is it 3 seconds or less? Yes

• Related to FICAM Policy, does the contractor have to be certified as a HSPD-12 by GSA approved vendor? No, but new equipment install should support HSPD-12.

• Related to FICAM Policy, does the contractor have to provide certified Security ICAM Engineers as recommended by GSA? No. OIG fulfills this role.

• Related to FICAM Policy, does the existing RS2 PACS system is in full FIPS 201-2 compliance? No

• Since PACS Systems are now considered part of the IT infrastructure, does the proposed PACS

System have to comply with FISMA, RMF Requirements?

• Assuming the DHS OIG PACS is using the IT Networks, how often does the DHS OIG IT staff updates the computers and service; and how often do they scan for vulnerabilities? Government will not provide an answer to this question at this time.

• Can you provide us with an inventory of the RS2 card reader installation? That is part of the initial assessment required.

#5 CCTV:

• How many cameras are interior? Most offices have 7-9

• How many cameras are installed outside the buildings? none

• Do you have a 360-degree view in some areas? no

• Do you have installed Pan/Tilt/Zoom in the Roof of any of the buildings? No

• Is there a parking area to be viewed by any camera? If yes, please specify what type of camera?

No

• Are there any cameras installed on poles? No

• If yes, is there an existing connection to existing conduit to the poles? NA

• How much storage is needed for the CCTV Video recording? Moving forward, a minimum of 8 TB

• Can you provide us with an inventory of the CCTV System? That is part of the initial assessment

#6 Intrusion Detection:

• Are the DMP Control Panels are connected to the Mega Center? Yes

• Can you provide us an inventory for the IDS Systems? That is part of the initial assessment

#7 IT Security, Network and Cyber Security:

Is the system installed in a secure network provided by the government? PACS – Yes. IDS, CCTV will be after new installations.

How often does the contractor shall participate in Continuous Monitoring Strategy and methods or shall provide a Continuous Monitoring capability that the DHS determines acceptable. The latter

Will the hardening (applying STIGs. FISMA recommended images for the OS, etc.) of the servers will be done by the contractors? Or will it be handled by DHS IT staff? Government will not provide an answer to this question at this time.

Will the contractor have to provide an IT Security Plan for the proposed IT systems? No Does the entire system need to be compliant to FISMA? Government will not provide an answer to this question at this time.

Is it the responsibility of the security integrator to address the cyber risk of these systems? No Did the existing system demonstrated a cyber security vulnerabilities test? No – prior to this contract most systems did not resided on the DHS Network.

#8 - Can you Provide the RS2 system Dongle(s) Number? Version 6.2.0.1, SN: to be provided after contract award #9 - How many Separate RS2 System Servers are active throughout? One – resides on our servers and one on a local laptop for a special space.

#10 - Please Clarify Reader, Controller, Camera, & Intercom counts throughout all sites. Part of the initial assessment

#11 - Does the executing Security Technician Need any special clearance requirements. None other than contract required background checks.

#12 - Please specify the Wage rate needed for responding technicians, & Project Managers: Locality dependent it will be based on the Department of Labor determining wage rates for your location.

#13 - Please clarify if Software support Agreements are to be categorized under Life cycle upgrades. Yes

– all of which would be contract add-ons

For assessment and inspection calculations: With the exception of the headquarters, none of the offices have more than 7-9 cameras, 4 IDS partitions, 4 Door remote stations, and 14 card readers/strikes. At the headquarters, there are 7 cameras, 5 partitions in one IDS and a stand-alone IDS for a special space, and 60 card readers/strikes.

All life-cycle and software upgrade requirements would be add-on to the contract following the initial site assessments and funding availability.