RFI Vendor Question-Comment Summary - IA RMF RFI - v08-10-23.xlsx

XLSX spreadsheet 48 KB Posted Aug 11, 2023

Attached to: USCG Information Assurance (IA) Risk Management Framework (RMF) Services
Solicitation number: 70Z04423IESDIAB01
Issued by: Department of Homeland Security US Coast Guard

View the file

Other files

File	Type	Posted
RFI Attachment 2 - Draft_IA-RMF-IDIQ_RFP_v4_05-22-23.docx	DOCX document	May 25, 2023
RFI Attachment 1-Questionaire_RFI ESDIAB01_05-25-23.docx	DOCX document	May 25, 2023
RFI Attachment 5-Draft_IA-RMF_C5ISCTaskOrderPWS_v0.3_05-25-23.docx	DOCX document	May 25, 2023
RFI Attachment 4-Draft_IA-RMF-IDIQ_Labor Categories_V1_04-17-23.xlsx	XLSX spreadsheet	May 25, 2023
RFI Attachment 6-Question-Comment Form - v1_05-22-23.xls	XLS spreadsheet	May 25, 2023
RFI Attachment 3-Draft_IA-RMF-IDIQ_Scope of Work_20230525_v2.0.4.docx	DOCX document	May 25, 2023

On GovTribe

Work with this file

Download the original file
Contacts named in this file
Similar government files
Ask GovTribe AI about this file

Try for free Login

Text version

The file's text, extracted by GovTribe without its formatting.

General RFI Questions

Information Assurance (IA) Risk Management Framework (RMF) Support Services
RFP 70Z04423RESDIAB01
Consolidated Vendor RFI Questions Form
RFI General Comments / Recommendations & Government Responses
RFI Doc	Page No.	Section	Paragraph	Question/ Comment	Government Answer/Response/Adjudication
General	n/a	n/a	n/a	Vendor strongly encourages the USCG to use the GSA MAS Schedule with Highly Adaptive Cybersecurity Services (HACS) Special Item Number (SIN) 54151HACS.	Noted & no changes: an open market 8(a) set-aside is the chosen acquisition strategy by the Government.
General	n/a	n/a	n/a	Will the Government accept/acknowledge CPARs in lieu of the PPQs/Client Authorization Letters?	No. Past Performance Questionaires (PPQs) will be required as part of the RFP.
General	n/a	n/a	n/a	Will the contractor be responsible for creating control family plans and policy templates for NIST 800-53 R5 for all system owners to use?	No, this is not anticipated.
General	n/a	n/a	n/a	Would the government consider including criteria for CMMC or CMMI requirements to provide additional assurance?	Noted & the Government is considering this recommendation for the final RFP.
General	n/a	n/a	n/a	Will the government require letters of commitment from key personnel?	No, we do not currently plan to require letters of commitment.
General	n/a	n/a	n/a	What existing vulnerability management tools does this office leverage?	These will be specified at the Task Order level.
General	n/a	n/a	n/a	Are any of the sysetms in scope considered National Security Systems and follow CNSSI?	Yes, however due to the sensitivity of that classification we cannot share which systems (by name) carry that classification or a roll-up number of NSS systems.
General	n/a	n/a	n/a	While the Department of Defense finalizes CMMC rules, would the government award confidence points to those who have already met CMMC requirements?	Government is considering this, however a final decision has not yet been made.

draft RFP

Information Assurance (IA) Risk Management Framework (RMF) Support Services
RFP 70Z04423RESDIAB01
Consolidated Vendor RFI Questions Form
Draft RFP Comments / Recommendations & Government Responses
RFI Doc	Page No.	Section	Paragraph	Question/ Comment	Government Answer/Response/Adjudication
RFP	7	B.14	1	There are no labor or pricing rates in Attachment 4, IDIQ Pricing Rates.	The Price Schedule attachment was not included in the RFI, but will be provided in the RFP.
RFP	7	B.14	2	There are no markup percentages for Travel and ODCs (Subcontracts and Material) costs and ceiling labor rates contained in Attachment 4, IDIQ Pricing Rates.	The Price Schedule attachment was not included in the RFI, but will be provided in the RFP.
RFP	7	B.18	3	There was no Exhibit A provided.	Exhibit A attachment was not included in the RFI, but will be provided in the RFP.
RFP	32	D.	1	The list of attachments in this section do not align with the attachments listed on SAM.GOV [https://sam.gov/opp/a18c40badd6042509e0dc4ed65449c00/view]	Not all attachments were included in the RFI, but they will all be provided with the final RFP release.
RFP	33	a) Submission of offers	1	There is not an exact start date listed or no later than date.	This will be specified in the final RFP when it is released.
RFP	8	C	n/a	Suggest adding:

52.203-13	Contractor Code of Business Ethics and Conduct (Oct 2015)
52.203-14	Display of Hotline Poster(s) (Oct 2015)
52.204-21	Basic Safeguarding of Covered Contractor Information Systems (Jun 2016)
52.239-1		Privacy or Security Safeguards (Aug 1996)
52.224-1		Privacy Act Notification (Apr 1984)
52.224-2		Privacy Act (Apr 1984)
52.224-3		Privacy Training (Jan 2017) 6	These have been reviewed and are either already included in the FAR Commercial Services clauses, DHS special clauses, or have been determined to be not applicable.
	RFP	8	C	52.204-2	Security Requirements were updated March 2021	Concur - clause will be updated to the "MAR 2021" version in the final RFP.
	RFP	34	E	52.212-1(c)(1)	Are subcontractors required to have facility clearances? At what level? Will the government consider processing requests for facility clearances for the selected team members (subcontractors) assuming that the prime has the required facility clearance?	Offerors shall include a current facility clearance at a level of Secret issued by the Defense Counter Intelligence and Security Agency (DCSA) for the Prime contractor, Joint Venture, or one or more members of the partnership/proposed partnership, at the time of phase 1 proposal submission.
	RFP	35	E	52.212-1(c)(5)(iv)	Does any subcontractor or team member have to submit a example of prior experience related to this PWS. Or is the requirement actually that a team (or individual contractor) has to submit at least one.	Language on page 35, 52.212(c)(5)(iv) was revised to clarify that each individual contractor, including Prime, subcontractor, teamning partner, or members of a Joint Venture, must provide at least one prior experience example under the Prior Experience Factor.
	RFP	35	E	52.212-1(c)(5)(iv)	Would the Coast Guard consider extending this period to Five years (or longer)?	No - 3 years is our recency requirement for both Prior Experience and Past Performance factors.
	RFP	36	E	52.212-1(c)(5)(iv)(2)	Do these work efforts have to cover activities identified in (1)?	Not strictly required, but an example involving activities identified in (1) will be stronger than an example unrelated to RMF scope activities.
	RFP	38	E	52.212-2(d)(1)	If a prime has a subcontractor on their team, and the subcontractor does not have a facility clearance but the prime does, will the entire team be designated as ineligible?	Offerors shall include a current facility clearance at a level of Secret issued by the Defense Counter Intelligence and Security Agency (DCSA) for the Prime contractor, Joint Venture, or one or more members of the partnership/proposed partnership, at the time of phase 1 proposal submission.
	RFP	7	B.15 & B.17	Minimum and Maximum Quantities & Task Order Performance Period	The minimum amount to be ordered under this contract is $10M and the maximum IDIQ value is estimated at $160M. How many Task Orders does the Government envision over the five (5) year contract ordering period and can you provide the anticipated schedule for each?	We anticipate 3-6 task orders at any given time (except for initial 6-12 months of Ordering Period, when there may be less than this number). Task orders may or may not have option periods.
	RFP	34	E.c	Instructions to Offerors	We recommend the Government consider including in their Phase 1 evaluation factors a minimum of CMMI for Services Level 3 (CMMI-SVC/3) appraisal given the critical and important work of the RMF Support Services program in supporting USCG missions.

The scope of the RMF Support Services is ideally suited for a company that not only has the required cybersecurity experience, but also has taken the time and made the investments necessary to demonstrate for the Government the maturity of their processes, standards, and rigors. The Carnegie Mellon University Software Engineering Institute created the CMMI appraisal for this purpose. The CMMI model helps organizations to effectuate process improvement and develop behaviors that decrease risks in service, product, and software development. Vendors certified at Levels 1 and 2 do not have the process maturity to gain the most efficiency and effectiveness under programs such as the RMF Support Services program. Level 3 certified vendors are mature enough to realize the maximum benefits, while vendors appraised at Levels 4 and 5 have demonstrated their ability to drive down costs, increase staff retention, and continuously improve support outcomes without increasing program risk.	Under consideration.
	RFP	7	B.16	1	Recommend changing to "withing CONUS and OCONUS locations" to be consistent with the IDIQ SOW and Task Order PWS which both indicate CONUS and OCONUS support.	Language will be updated to clarify that all permanent positions are within CONUS, although some instances of travel to OCONUS locations of Alaska, Hawaii or U.S. Territories (Guam, Puerto Rico, etc.) may be required.
	RFP	35	E	52.212-1(c)(5)(iv)	Recommend the Government allow any subcontractor prior experience examples to be as a subcontractor, i.e. the subcontractor is/was not the prime contractor for the prior experience example.	Yes, subcontractor prior experience is allowable per 13 CFR 125.2 (g) Capabilities, past performance, and experience.
	RFP	38	E	52.212-2(f)	Can the Government please provide the rating scale for the confidence ratings?	Noted - Government will not provide this detail within the RFP.
	RFP	37			The evaluation of Factor 1 is confusing. Will Factor 1, prior experience, be given a qualitative score in Phase 2, or will it only be use to make advisory notifications in Phase 1?	Added clarifying language on RFP page 37 to make clear the Factor 1 rating will be combined with Factor 2-5 ratings in Phase II to arrive at final proposal evaluations.
	RFP	34	E	52.212-1(c)(2)	2)	The proposal shall be submitted in two (2) phases, and five (5) volumes.
Proposal Volumes I-III shall be submitted with Phase One proposal submission, however are not considered to be part of Phase One.	This will be clarified in the final RFP.
	RFP	8	Clauses IBR Table	52.204-2	The government may want to check the date of this clause and confirm the most recent, this one may be outdated. In another recent RFP, the date was posted as MAR 2021.	Concur - clause will be updated to the "MAR 2021" version in the final RFP.
	RFP	34	E	52.212-1(c)(2)	The table above cites eight (8) volumes. Does the government intend to have the Cover Letter, Solicitation (with Reps and Certs) and Facility Clearance all be separate volumes. We would suggest those are Supplemental and do not need to be numbered for submission. Or If numbered then this line needs to be changed to read eight (8) volumes.	Concur - changed RFP language to reflect "eight (8) volumes" for clarity.
	RFP	34	E	52.212-1(c)(2)	This is somewhat unclear. Is this to mean that Volumes I-III are not to be considered as part of the Phase One Prior Experience Factor, but are evaluated for compliance and pass/fail?	RFP language updated to clarify.
	RFP	34	E	52.212-1(c)(3)	As this currently reads, it is not clear if Volumes I-III should be included in Phase One. Please clarify with language that instructs explicitly which documents should be submitted in the email.	Language updated to clarify that Volumes I-III must be submitted in Phase One.
	RFP	35	E	52.212-1(c)(5)(iii)	We would suggest removing the requirement for a Joint Venture to provide current facility clearance issued by DCSA and replace with the requirement for all members comprising the Joint Venture to provide necessary FCL information. This is suggested per the following: Congress included Section 1629 as a provision in the 2020 National Defense Authorization Act (NDAA) that prohibits the U.S. Department of Defense (DOD) from requiring a joint venture to hold a "facility access clearance" if the parties to the joint venture hold the requisite clearance. Similarly, Section 644 of the Small Business Act states that where a small business joint venture entity lacks capabilities or past performance, the procuring agency must consider the capabilities and experience of the joint venture's members. Reinforcing these statutory provisions, the SBA revised its regulations governing joint ventures to address these legislative provisions to include the following provision:

Facility security clearances. A joint venture may be awarded a contract requiring a facility security clearance where either the joint venture itself or the individual partner(s) to the joint venture that will perform the necessary security work has (have) a facility security clearance.

13 C.F.R. 121.103, 85 Fed. Reg. 66146, 66180 (Oct. 16, 2020)	RFP language has been revised to clarify that, in the case of a Joint Venture, either the Joint Venture itself OR at least one member of the Joint Venture individually must possess an active and valid Secret FCL at the time of proposal submission.
	RFP	38	E	52.212-2(d)(1)	We suggest removing the requirement for a Joint Venture to provide current facility clearance issued by DCSA and replace with the requirement for all members comprising the Joint Venture to provide necessary FCL information. This is suggested per the following: Congress included Section 1629 as a provision in the 2020 National Defense Authorization Act (NDAA) that prohibits the U.S. Department of Defense (DOD) from requiring a joint venture to hold a "facility access clearance" if the parties to the joint venture hold the requisite clearance. Similarly, Section 644 of the Small Business Act states that where a small business joint venture entity lacks capabilities or past performance, the procuring agency must consider the capabilities and experience of the joint venture's members. Reinforcing these statutory provisions, the SBA revised its regulations governing joint ventures to address these legislative provisions to include the following provision:

13 C.F.R. 121.103, 85 Fed. Reg. 66146, 66180 (Oct. 16, 2020)	RFP language has been revised to clarify that, in the case of a Joint Venture, either the Joint Venture itself OR at least one member of the Joint Venture individually must possess an active and valid Secret FCL at the time of proposal submission.
	RFP	8	B.8	1	What will the Task Order solicitation requirements be? Will there be a technical section for each TO? Will pricing be adjusted per TO, or will rates stay the same across the IDIQ?	This will be clarified in the final RFP.
	RFP	9	B.16	1	Other areas in the draft documents mention OCONUS performance; is there the potential for OCONUS work on this IDIQ?	Language will be updated to clarify that all permanent positions are within CONUS, although some instances of travel to OCONUS locations of Alaska, Hawaii or U.S. Territories (Guam, Puerto Rico, etc.) may be required.
	RFP	41	E	52.212-1(c)(5)(iii)	Does this include subcontractors in a prime/sub relationship? Due to the wording in the PWS (team members without a Secret FCL cannot support efforts at a Secret facility), Paragone recommends requiring that all Prime contractors have at least a Secret FCL.	RFP language has been revised to clarify FCL requirements.
	RFP	41	E	52.212-1(c)(5)(iv)	Does this mean the prime and each subcontractor will need to submit at least one prior experience citation? For example - If the prime has one subcontractor on the team, the teams response will have (2) two prior experience citations? One for the prime and one for the subcontractor.	RFP language is revised to clarify. At least one (1) example from each is required.
	RFP	41	E	52.212-1(c)(5)(iv)	How may Prior Experience contracts have to come from the Prime Offeror? Vendor recommends requiring at least one Prior Experience to be from the offeror.	RFP language is revised to clarify. At least one (1) example from the Prime contractor is minimum requirement.
	RFP	42	E	52.212-1(c)(5)(vi)	Vendor recommends the scenario-based questions be addressed through a remote oral assessment, following rules similar to the ones added below.	Noted - Government has elected to require written responses.
	RFP	37	5	ix	Is the 5-page limit for a price narrative? If so, what are the requirements for such a narrative? As written, it is unclear what the page limit count is for in this line.	5 page price narrative is optional - only the completed excel Price Schedule is required.
	RFP	34		various instructions	Please provide clarify on the use of instructions for compliance on the use prior experience(s) and past performance(s) of the prime contractor's named subcontractors / partners. This will be necessary as it relates to Phase 1 Volume IV Prior Experience as well as Phase II Volume VII Past Performance	RFP language revised to clarify this.

draft IDIQ Scope

Information Assurance (IA) Risk Management Framework (RMF) Support Services
RFP 70Z04423RESDIAB01
Consolidated Vendor RFI Questions Form
IDIQ Scope Comments / Recommendations & Government Responses
RFI Doc	Page No.	Section	Paragraph	Question/ Comment	Government Answer/Response/Adjudication
IDIQ Scope	4	1.2.1	n.	Is this in lieu of conducting Incident Response tabletops and live exercises?	No. We do not call for IR tabletops or live exercises. This requirement has to do with boundary change management.
IDIQ Scope	5	1.2.3	a.	Is this referring to a security assessment plan or a different plan?	Language will be clarified in final RFP.
IDIQ Scope	8	1.3	n/a	DoD 8570.01-M: Recommend replacing with DoD 8140.03	This will be updated in final RFP.
IDIQ Scope	14	3.1	1	Is the term SBU or should it be changed to CUI – Controlled Unclassified Information?	This will be updated and clarified in final RFP.
IDIQ Scope	2	1.1 Background	2	How many Information Systems and Applications are on a traditional ATO and how many are on a ongoing ATO process?	This will be clarified at the task order level.
IDIQ Scope	4	1.2.1	r.	Are you refereeing to System Security and Privacy Plan (SSPP) here? If so suggest changing to SSPP.	This will be clarified in final RFP documents.
IDIQ Scope	4	1.2.1	u.	Note: With NIST SP 800-37 Rev. 2 There are organizational level POA&MS and system level POA&Ms. Typically at the organizational level there is a POA&M for common controls.

Suggest changing to: Manage and track all organizational level and system level POA&Ms created by the USGC….	This will be clarified in final RFP documents.
	IDIQ Scope	5 & 6	1.2.3	a., c.	Suggest removing security or adding privacy.

Either Controls Or Security and Privacy Controls

To align with the changes in naming conventions in NIST SP 800-37 Rev. 2	This will be updated in final RFP documents.
	IDIQ Scope	7	1.2.4.3	a.	Should this be Cybersecurity?

On page 2 the author states "“Cybersecurity” (which replaced the term Information Assurance [IA]) "	Will be clarified in final RFP documents.
	IDIQ Scope	2	1.1	5	These USCG responsibilities are defined in Section 2. Suggest adding a note directing the reader to the definition of the specific responsibilities of the ISSO, ISSE, and SCA? Also recommend specifying the roles and responsibilities of the Chief Security Officer to provide context for respondents. If the contents of Section 1.2.1 etc. are essentially the same as the USCG defined requirements for each role, then a simple assertion would be helpful. along with the identity of the authoritative document.	This will be updated and clarified in final RFP.
	IDIQ Scope	2	1.1	5	Can the names of the incumbent contractors be made available?	This is a new requirement aligned to formation of the U.S. Coast Guard Command, Control, Communications, Computers, Cyber and Intelligence Service Center (C5ISC). Therefore historical information of the full scope of this requirement is unavailable.
	IDIQ Scope	3	1.2	2	recommend adding "Unless otherwise specified" to the end of the last sentence of this section.	This will be updated in final RFP document.
	IDIQ Scope	5	1.2.3	General	Who is responsible for actually testing the applications, running scans, etc.?	The ISSO role, as defined in section 1.2.1 of the IDIQ Scope.
	IDIQ Scope	6	1.2.4.2	(g)	Does the Coast Guard have SOCs or their equivalent? Who manages them?	Yes, at CG Cyber Command.
	IDIQ Scope	7	1.2.4.2	(j)	What is the role of the VAT? Are they contractors or government resources? Who do they report to?	This will be clarified in final RFP documents.
	IDIQ Scope	8	1.3	General	While most of these are generated by entities outside of USCG such as OMB, DHS, and DoD, very few USCG requirement and policy documents are cited. Can they be added to the list -- even if it is a core set of documents.	The applicable releasable USCG documentation is listed at the IDIQ level and additional, as necessary, will be specified at the individual task order level.
	IDIQ Scope	11	2.1	1	Are these roles defined in any specific USCG procedure or policy document? If they are, can a citation be provided? Even if the higher level requirements are established in a DHS or DoD document, there should be a USCG policy document that codifies these and other requirements.	This will be updated and clarified in final RFP.
	IDIQ Scope	11	2.3	1	Recommend 10 business days. Most departing employees are not going to give more than 10 days notice, if that. [regarding advanced notice before replacing a Key Person]	This will be updated and clarified in final RFP.
	IDIQ Scope	22	6	1	Recommend adding an acceptance period for deliverables -- for example, 5 or 10 business days, with a corresponding requirement for the contractor to remediate any deficiencies and return the revised document to the Government within a defined period.	This will be specified at the individual task order level.
	IDIQ Scope	2	1.1	5	Background: The Security Control Assessor role (SCA), as implemented by the DoD, is usually an individual assigned by the Authorizing Official (AO) and is usually a senior official of the agency, not a contractor. Is the USCG's intention that this role be filled by the contractor?	Yes, in some cases this role is delegated to a contractor.
	IDIQ Scope	6	1.2.4.2	Title	Recommend changing this to "Scanning and Vulnerability Management" to be consistent with the sub-task in the draft Task Order, Attachment 5.	This will be updated in the final RFP documents.
	IDIQ Scope	3	1.2.1	all	Both DoD and DHS mandates, policies, standards, etc. are referenced throughout. In the event of a discrepancy, which standards will govern?	Generally speaking, the more stringent of the two is followed.
	IDIQ Scope	5	1.2.2	o	This sentence refers to assessments, which may better fit under secton 1.2.3. Can the Government provide more clarity on the intent and required deliverables under this sub-task?	Those will be specified at the individual task order level.
	IDIQ Scope	11	2.1		This paragraph states that all 8570 quals are required for contractors to begin work. This is in contradiction to the 8570, itself, which requires only that the IA baseline cert be held to begin work (with other quals required in some timeframe). Which requirement is correct?	This will be clarified in final RFP documents.
	IDIQ Scope	3	1.2		As this is an IDIQ that describes the required services,will the government provice details regarding the number of systems to be managed at the Task Order level?	This will be specified at the individual task order level.
	IDIQ Scope	3	1.2.1		As this is an IDIQ that describes the required services, will the government provice details regarding the number of systems the ISSO and alternate ISSO will be required to manage at the Task Order level?	This will be specified at the individual task order level.
	IDIQ Scope	3	1.2.1		Will the ISSO perform the initial security control assessment and continuous security control assessments?	Yes, that is an ISSO responsibility under the RMF.
	IDIQ Scope	5	1.2.3		As this is an IDIQ that describes the required services,will the government provice details regarding the number of IT systems the SCA will need to review concurrently?	This will be specified at the individual task order level.
	IDIQ Scope	6	1.2.4		Will this requirement be performed by a separate team or would this be a part of the ISSO and ISSE responsibilities?	When specified at an individual task order level, it will be up to the contractor to propose how to perform.
	IDIQ Scope	6	1.2.4.2		Will this requirement be performed by a separate team or would this be a part of the ISSE responsibilities?	When specified at an individual task order level, it will be up to the contractor to propose how to perform.
	IDIQ Scope	14	3.1	2	For all sites listed in Places of Performance, how will access to SIPR systems be provided? Will it require travel require travel?	Contractor employees who require SIPR access will need to be on at least a hybrid work schedule and located near a USCG facility with SIPR access. The Government will not reimburse travel for such an individual.
	IDIQ Scope	14	3.1	2	For all sites listed in Places of Performance, will travel be require considering all necessary functions and access?	This will be specified at the individual task order level. However some personnel are expected to be required to be located near USCG facility if their work requires routine site access.
	IDIQ Scope	3	1.2.1	c	Our A/ISSO's on other similar contracts with USCG have not generated all of these docs in the past and normally only gather and assess the following: Configuration Mgmt Plan (CMP), Incident Response Plan (IRP), Contingency Plan (CP), Hardware/Software lists, Network Topology, Network Cybersecurity Boundary Diagrams, and Data Flow Diagrams.
Will this be changing for RMF TO Services?	Revised for clarity in final RFP documents.
	IDIQ Scope	3	1.2.1	j	Our A/ISSO's on other similar contracts with USCG are not private users on any systems and cannot run SCAP. They can work with sys admins to request scans and SCAP results for validation. Will this be changing for RMF TO Services?	Revised for clarity in final RFP documents.
	IDIQ Scope	3	1.2.1	k	The requirement for contractor A/ISSO's to have ACAS accounts and scan abilities has been removed for some time on other similar contracts with the USCG. Will this be changing and a requirement for RMF TO Services? (consistent role expectations with toolsets)	Revised for clarity in final RFP documents.
	IDIQ Scope	4	1.2.1	dd	Whose responsibility is it to assist the ISSOs? "Review system audit records and intrusion detection data to assist ISSOs in identifying security incidents."	Revised for clarity in final RFP documents.
	IDIQ Scope	2	1.1	4	Does the Coast Guard currently use or plan to use Continuous ATOs rather than the traditional 3-year ATOs?	USCG uses a combination of these types.
	IDIQ Scope	3	1.2.1	(g)	What automation processes are already in place? Does the Coast Guard currently have any systems under Continuous ATO?	Currently, there is no automation in place, aside from automated STIG checks and vulnerability scans. USCG is using Traditional 3-year ATO and Ongoing Authorization. The Software Factory is currently being built in a prototype phase. Workflows and Processes are being built for the Software Factory together with roles and responsibilities to move towards a cATO option.
	IDIQ Scope	4	1.2.1	(p)	What measures are in place or expected to be in place to separate system preparation duties (ISSO) and system assessment duties (SCA) and eliminate potential conflicts of interest?	Separation of duties is maintained by government organizational structure. SCA and ISSO roles fall under different organizations.
	IDIQ Scope	5	1.2.2	(b)	Does the Coast Guard employ an Agile development approach across all development teams? Will ISSEs be expected to participate in sprints and other components of the Agile lifecycle?	This will be specified at the individual task order level.
	IDIQ Scope	5	1.2.2	(p)	Does the Coast Guard use a CI/CD approach to development? As part of their DevSecOps responsibilities, will ISSEs be expected to participate in the development of new systems?	The Software Factory is currently being built in a prototype phase. Workflows and Processes are being built for the Software Factory together with roles and responsibilities.
	IDIQ Scope	7	1.2.4.3	General	Will there be IDIQ-level Knowledge and Metrics Management? Or will this be limited to a Task Order level task?	Limited to task order level tasks.
	IDIQ Scope	8	1.2.4.6	General	How much Cross Domain support is anticipated? Will some contracts require Cross Domain specialists?	Will be specified at the inidividual task order level.
	IDIQ Scope	8	1.2 Table 1	DoD 8570.01-M	What are the DOD 9570.01-M levels for the chosen LCATS?	LCATS have been updated to reflect DoDM 8140.03 requirements.
	IDIQ Scope	11	2.1	ISSO bullet 1	Do some number of Coast Guard ISSOs/ISSEs participate in DevSecOps development processes?	Currently, no, as these Software Factory processes and roles are under development.
	IDIQ Scope	15	3.1.1.1	Tier Investigation 5	Is there any potential of Top Secret/SCI cleared individuals being required on this contract?	Top Secret/SCI is outside the scope of this requirement.
	IDIQ Scope	19	3.4	1	How much potential OCONUS work does the Coast Guard anticipate? What locations are most likely for OCONUS work? OCONUS work will be significantly different from CONUS work in terms of price; if the CG anticipates more than 1-2 OCONUS TOs, Vendor recommends including OCONUS rates or adjustments in the IDIQ pricing	This will be clarified in final RFP documents.
	IDIQ Scope	2	1.1	4	Is there a specific USCG RMF process (with exhibits, instructions, etc.) derived from the overarching RMF framework -- but distinct in unique ways?	USCG follows the NIST RMF process.
	IDIQ Scope	2	1.1	5	Details of these, including: Contract #, Scope/PWS, $ Value, Period of Performance? [regarding the "several disparate contracts" mentioned in this paragraph]	This is a new requirement aligned to formation of the U.S. Coast Guard Command, Control, Communications, Computers, Cyber and Intelligence Service Center (C5ISC). Therefore historical information of the full scope of this requirement is unavailable.
	IDIQ Scope	6	1.2.4.2	(h)	Is "Red Team" work applicable to this Scope? If so, should Red Team Operator tasks be added?	Red Team work is outside scope of this requirement.
	IDIQ Scope	7	1.2.4.2	(n)	Is there any "false-negative (FN) corollary work?	No, outside scope of this requirement.
	IDIQ Scope	8	1.2.4.6	(a)	Follow this with (CDS) as first mention, because CDS is used in last line of (c) below.	This will be updated in the final RFP documents.
	IDIQ Scope	12	2.3	1	Should Leads (ISSO, ISSE, SCA, Cyber Services) also be "Key"?	Key Personnel will be specified at the task order level.
	IDIQ Scope	12	2.4	1	An abundance of "must". 8 in one short paragraph.	Revised for clarity in final RFP documents.
	IDIQ Scope	12	2.5	2	Is this sufficient? Do we need to broaden, perhaps even to 24/7?	Reviewed and left unchanged.
	IDIQ Scope	19	3.4	1	Although it may subsequently be specified at time of TOs, what is the expectation of On Site Government, On Site Contractor, and Remote % of work. Also, notional allocation across the 7 Government locations listed?	Will be specified at the inidividual task order level.
	IDIQ Scope	19	3.5	1	Will Compressed Work Schedule (CWS), or other alternatives, be an option?	Will be specified at the inidividual task order level.
	IDIQ Scope	10	1.4	1	To ensure the service delivery quality, recommend that the Government requires CMMI-SVC ML3 and ISO 20000 and 27001 certificates from the potential offerors	Under consideration & will be clarified in final RFP documents.

draft Attch 4 Labor Categories

	Information Assurance (IA) Risk Management Framework (RMF) Support Services
	RFP 70Z04423RESDIAB01
	Consolidated Vendor RFI Questions Form
	RFI Attachment 4 - IDIQ Labor Categories Comments / Recommendations & Government Responses
	RFI Doc	Page No.	Section	Paragraph	Question/ Comment	Government Answer/Response/Adjudication
	Attch 4 - IDIQ Labor Categories				Change the program manager, and project manager to an IAT-2 level certification, PMs don’t need the depth of technical certification. Their job is to track, allocate and administer the workforce. Anything higher than IAT-2 (even that is stretching it) would be far too restrictive	Noted. Government is revising all labor categories to align with DoD 8140.03.
	Attch 4 - IDIQ Labor Categories	n/a	n/a	n/a	program analyst should start at a bachelor’s and zero experience. These are the lowest level of administration, equivalent to a project controls specialist at the entry level	Noted. Government is revising all labor categories to align with DoD 8140.03.
	Attch 4 - IDIQ Labor Categories	n/a	n/a	n/a	Security Controls Assessors certification should not be IAM-II by default. per the 8570 policy. Instead, you can use it to differentiate between Labor categories. Level I and Level II can require an IAT-2, while a Level 3 can require an IAT-3. This is in line with DISA Labor Categories for both the Risk Management Executive Assessors and the CCRI assessors for JFHQ-DoDIN	Noted. Government is revising all labor categories to align with DoD 8140.03.
	Attch 4 - IDIQ Labor Categories	n/a	n/a	n/a	Program/Project Manager: We would advise to adjust the program manager, and project manager to an IAT-2 level certification. This recommendation is based on over a decade of experience in similar projects in which PMs role to track, allocate and administer the workforce did not require such depth of technical knowledge or certification. We have also found that such a requirement makes placement extremely restrictive and greatly impacts pricing to the client.	Noted. Government is revising all labor categories to align with DoD 8140.03.
	Attch 4 - IDIQ Labor Categories	n/a	n/a	n/a	Program Analyst: Historically we have hired and trained over 50+ program analyst across multiple projects and advise this role should start at a bachelor’s level and require no experience or no bachelor’s degree and two years’ experience. Our 100% placement record has shown such administrative skills have a high retention rate at all levels regardless of experience. As we believe such entry level skills are as intuitive as a project controls specialist, it would benefit a contractor’s recruiting effort and the pricing to the client to make this adjustment.	Noted. Government is revising all labor categories to align with DoD 8140.03.
	Attch 4 - IDIQ Labor Categories	n/a	n/a	n/a	Security Controls Assessors certification: It is our recommendation that this should not be IAM-II by default per the 8570 policies. Instead, we would advise that it be used to differentiate between Labor categories. We advise a Level I and Level II can require an IAT-2, while a Level 3 can require an IAT-3. This is in line with DISA Labor Categories for both the Risk Management Executive Assessors and the CCRI assessors for JFHQ-DoDIN	Noted. Government is revising all labor categories to align with DoD 8140.03.
	Attch 4 - IDIQ Labor Categories	n/a	n/a	n/a	RFI+Attachment+4-Draft_IA-RMF-IDIQ_Labor+Categories There are no price rates listed in the RFI Attachment 4. Will these be sent out prior to RFP solicitation?	A Price Schedule attachment will be included with the RFP when it is released.
	Attch 4 - IDIQ Labor Categories	1	Row 15-32	n/a	Will the government consider equivalent work experience in lieu of a college degree?	Noted. Government is revising all labor categories to align with DoD 8140.03.
	Attch 4 - IDIQ Labor Categories	tab 1	Program Analyst	Level I	Recommend changing "Minimum Education/Training" to "Associate's degree in Computer Science, Cybersecurity, Information Systems, Engineering, or other related discipline."	Noted. Government is revising all labor categories to align with DoD 8140.03.
	Attch 4 - IDIQ Labor Categories	tab 1	Information System Security Officer	Level I	Recommend changing "Minimum Education/Training" to "Associate's degree in Computer Science, Cybersecurity, Information Systems, Engineering, or other related discipline."	Noted. Government is revising all labor categories to align with DoD 8140.03.
	Attch 4 - IDIQ Labor Categories	tab 1	Information System Security Engineer	Level III	Recommend changing "Minimum Certification" to "IASAE III."	Noted. Government is revising all labor categories to align with DoD 8140.03.
	Attch 4 - IDIQ Labor Categories	tab 1	Information System Security Engineer	Level II	Recommend changing "Minimum Certification" to "IASAE I."	Noted. Government is revising all labor categories to align with DoD 8140.03.
	Attch 4 - IDIQ Labor Categories	tab 1	Database Specialist	Level I	Recommend changing "Minimum Education/Training" to "Associate's degree in Computer Science, Cybersecurity, Information Systems, Engineering, or other related discipline."	Noted. Government is revising all labor categories to align with DoD 8140.03.
	Attch 4 - IDIQ Labor Categories	tab 1	Data
Analyst	Level I	Recommend changing "Minimum Education/Training" to "Associate's degree in Computer Science, Cybersecurity, Information Systems, Engineering, or other related discipline."	Noted. Government is revising all labor categories to align with DoD 8140.03.
	Attch 4 - IDIQ Labor Categories	tab 1	ISSO	Minimum Education/ Training	For ISSO's without the minimum educational experience, would a 5-year hands-on experience in a DoD/DHS environments be acceptable workplace training?	Noted. Government is revising all labor categories to align with DoD 8140.03.

draft C5I Task Order PWS

	Information Assurance (IA) Risk Management Framework (RMF) Support Services
	RFP 70Z04423RESDIAB01
	Consolidated Vendor RFI Questions Form
	Task Order PWS Comments / Recommendations & Government Responses
	RFI Doc	Page No.	Section	Paragraph	Question/ Comment	Government Answer/Response/Adjudication
	Task Order PWS	N/A	N/A	N/A	What revision of NIST SP 800 37 (Revision 1 or Revision 2) and what revision of NIST SP 800-53 (Revision 4 or Revision 5) are being used at USCG?	We are currently using NIST SP 800-37 Rev 2, and NIST SP 800-53 Rev 4.
	Task Order PWS	N/A	N/A	N/A	Has all of USCG Federal information systems transitioned to NIST SP 800-53 Rev. 5?	We are currently using NIST SP 800-37 Rev 2, and NIST SP 800-53 Rev 4.
	Task Order PWS	4	1.1	2	Are Coast Guard enterprise systems covered these categories? For example, HR, accounting, asset management, procurement, etc.?	Yes.
	Task Order PWS	4	1.1	3	Information Assurance (IA) is used several times in this document, specifically Sections 2.24, 4.16, and Table 11. Recommend doing a search and replace if the term has been superseded.	Final RFP documents will replace "IA" with "cybersecurity."
	Task Order PWS	5	1.2	3	Can the facilities and their incumbent contractor operators be identified in a table? What will the relationship be between the Cyber Contractor and these contractors?	This is a new requirement aligned to formation of the U.S. Coast Guard Command, Control, Communications, Computers, Cyber and Intelligence Service Center (C5ISC). Therefore historical information of the full scope of this requirement is unavailable.
	Task Order PWS	5	1.2	3	How will contractors obtain access to USCG vessels? Will they be in port and accessible?	Yes. If vessel access is required, the vessel will be in port.
	Task Order PWS	9	1.9.2	2	Please define 'PITA".	This has been clarified in the final RFP documents.
	Task Order PWS	10	2.1	(b)	Are these artifacts currently maintained in a repository such as SharePoint? If they are, who is responsible for maintaining the repository?	SharePoint and eMASS. ISSO maintains the eMASS baseline for their assigned system.
	Task Order PWS	10	2.1	(h)	Is this performed at the system level?	Yes, performed at the system level for assigned systems.
	Task Order PWS	12	2.1	(z)	Which USCG activity creates and maintains the list of POA&Ms? Who decides when a PO&M has been addressed?	POA&Ms are maintained in eMASS. The ISSO validates remediation, and CG Cyber Command closes the POA&M.
	Task Order PWS	12	2.1	(aa)	If this is a Business Continuity Plan requirement, shouldn't the mission/business owner be the lead, supported by the ISSO for the IT system portion? The ISSO has very little visibility into the business or mission side.	This requirement refers to the ISSO scheduling and witnessing a CP test with the system personnel to validate the CP is accurate and meets applicable controls.
	Task Order PWS	13	2.2.2	(b)	Is there a database or similar mechanism to store and track system status?	Yes.
	Task Order PWS	13	2.2.2	(c)	Does the Coast Guard have a SOC or the equivalent(s)?	Yes.
	Task Order PWS	14	2.2.4	(a)	Should this read "metrics" vice "matrices"? The former are measures; the latter is a mathematical array.	Yes, this will be corrected in the final RFP documents.
	Task Order PWS	15	3.2	1	Recommend that this be revised to 10 business days. While a longer period is in everyone's best interest, an individual who gives their "two week notice" as is common practice will make a 15 day notice impossible. [regarding advanced notification prior to replacing a Key Person]	Revised for clarity in final RFP documents.
	Task Order PWS	23	4.16	2	Where is the Interim Progress Review (IPR) process discussed and defined? This has no context elsewhere.	IPR requirement will be removed from the final Task Order PWS.
	Task Order PWS	24	4.16	6	Rather than having the contractor maintain records for five years after the final payment under this contract, suggest that the contractor turn over all records associated with QASP compliance to the Government for their retention.	Revised to clarify in final RFP documents.
	Task Order PWS	25	5.1	4	Are subcontractors that lack a FCL prohibited from being on a team led by a Prime that has the requisite FCL? Or is the subcontractor simply not allowed to support classified tasks -- regardless of whether they have staff resources with the appropriate clearances?	Offerors shall include a current facility clearance at a level of Secret issued by the Defense Counter Intelligence and Security Agency (DCSA) for the Prime contractor, Joint Venture, or one or more members of the partnership/proposed partnership, at the time of phase 1 proposal submission.
	Task Order PWS	35	6.4	Table 9	Will the current versions of the first three deliverables be made available to the selected contractor?	Yes.
	Task Order PWS	45	8.0	Table 11	Regarding the ISSO Services services output AQL: Is HBSS installation on devices performed by this contractor or another contractor? Does the RMF contractor have the ability to influence other contractors to meet this requirement?	HBSS installation is not within scope of this TO, and is performed by another entity.
	Task Order PWS	8	1.8	bullet 1	Believe this should be ISSO instead of AISSO. [referring to the acronym in parenthesis]	Will be corrected in final RFP documents.
	Task Order PWS	37-40	7	Table 10	How many of these systems, other than where noted, are currently Authorized to Operate?	Final RFP documents will be updated to provide this information.
	Task Order PWS	5	1.3	bullet 6	Has the USCG identified any specific tools/applications for automation? If not, is there consideration for developing or purchasing something?	No, USCG does not currently have any specific automation tools identified. Adoption of any particular tool in the future would depend on the associated business case.
	Task Order PWS	9	1.9.2	3	Are these 15 PIT System assessments in addition to the 15 listed in Section 7, Table 10? If so, what state are the PIT system listed in Section 7, Table 10 in? More specifically, have these systems been assessed and what work is remaining?	Section 1.9.2 refers to PIT, not PIT Systems. The 15 PIT identified in section 1.9.2 are in addition to the systems listed in Table 10.
	Task Order PWS	page 9	2.1	h.	Will this effort include cyber testing of all systems under development for proper hardening and if so, what about hardening of existing operational systems?	STIG assessment is within scope, however services only apply to systems assigned at the task order level.
	Task Order PWS	page 18	4.4		Where will the test baselines (development & production/operational) be located other than the list of COEs within the PWS?	Within the US, Alaska, Hawaii, and US Territories.
	Task Order PWS	page 19	4.7		Is random travel required to inspect other systems (operational) or prepare for pre-CCRI?	This type of travel is unlikely under this task order.
	Task Order PWS	pg 36-40	7	Table 10	Is it safe to assume that all of the systems covered under this effort will be standard "supported systems," and to not assume that non-standard systems within the USCG architecture will not or are not included in Table 10?	Yes, that is correct.
	Task Order PWS	page 36	7	Table 10	Will this effort also include Industrial Control Systems located on the various Coast Guard Bases or units? Not listed in PWS table 10 under Supported Systems.	No, only those supported systems specificed in the task order PWS.
	Task Order PWS	page 9	2.1	f; h; j; q; x	Will this effort require an FTE ISSO Engineer on each system IPT or will they be integrated within a Product Line not defined or specified in the PWS?	ISSOs/ISSEs are not integrated within a Product Line, but are expected to attend pertinent Product Line meetings/control gates as needed to support their assigned system(s).
	Task Order PWS	page 9	2.1	h.	Will this effort require specific cyber penetration, functional, security, and scalability testing during the IV&V phase of the SELC? Also, does this include developing specific cyber test suites, test cases, vignettes and providing implementation guidance and technical support for this process not defined or specified in the PWS?	No, only as specifically detailed in the task order PWS.
	Task Order PWS	page 7	1.7	table 3	Will the cyber security scanning tools and the cyber discrepancies/intrusion detection data repository be provided as GFE or GFI?	Yes.
	Task Order PWS	page 8	1.9.2	para 3	"The government expects a minimum of 15 PIT assessments be submitted annually." Will these assessments be completed on random operational assets or will the assessments be defined each year for the specific unit and geographical areas and is this a separate or additional task from the CCRI's?	PIT to be assessed by the contractor will be defined and prioritized by the government. The prioritized work list will be provided to the contractor, and updated as necessary (i.e., as work is completed or new work needs to be added)
	Task Order PWS	29/45	5.4		Will this contract have a Section 508 exemption? Will all systems be subjected to Section 508 Compliance if no exemption is completed (ex: shipboard; watch flloor, etc)?	No exemption. Section 508 language is provided in the RFP.
	Task Order PWS	11 8	1.8	3	What capabilities are considered "back-office" as they are not mentioned elsewhere in the PWS?	Cybersecurity Compliance and Readiness Services
	Task Order PWS	12	2.1	b	Our A/ISSO's on other similar contracts with USCG have not generated all of these docs in the past and normally only gather and assess the following: Configuration Mgmt Plan (CMP), Incident Response Plan (IRP), Contingency Plan (CP), Hardware/Software lists, Network Topology, Network Cybersecurity Boundary Diagrams, and Data Flow Diagrams.
Will this be changing for RMF TO Services?	Revised for clarity in final RFP documents.
	Task Order PWS	13	2.1	k	Our A/ISSO's on other similar contracts with USCG are not private users on any systems and cannot run SCAP. They can work with sys admins to request scans and SCAP results for validation. Will this be changing for RMF TO Services?	Revised for clarity in final RFP documents.
	Task Order PWS	13	2.1	l	The requirement for contractor A/ISSO's to have ACAS accounts and scan abilities has been removed for some time on other similar contracts with the USCG. Will this be changing and a requirement for RMF TO Services? (consistent role expectations with toolsets)	Revised for clarity in final RFP documents.
	Task order PWS	18	3.1	1	Are the Information System Security Engineer (ISSE) roles considered IASAE positions under 8570? Information System Security Engineer (ISSE) roles are not listed in 'Table 5 - Cybersecurity Certification Requirements'.	To this question, No. It will be dependent upon the actual work being performed by the roles. We do not anticipate the need for IASAE certification to perform the services being requested under this Task Order. We will be updating the documentation for further alignment with 8140.
	Task Order PWS	14	2.1	t	The ISSO does not approve/disapprove system PPS. Currently, the ISSO works with the PL to complete the documentation for the PPSM registry and submits it to the PPSM team to register. Will this be changing for RMF TO Services?	Revised for clarity in final RFP documents.
	Task Order PWS	8	1.8	bullet 1	Is this a typo - adding an A to the front of ISSO? Is this intended to be ISSO or AISSO?	This typo will be corrected in final RFP documents.
	Task Order PWS	8	1.8	bullet 1	We suggest replacing the word "positions" with "functions"	Reworded to "roles" in final RFP documents.
	Task Order PWS	4	1.0	General	How will the government solicit task orders such as this one from the IDIQ holder?

How much time will there be between TO solicitation and the beginning of the Task Order?

What information does the government expect from the IDIQ holder to justify the price for a given Task Order (Technical section, salary research, etc…)?

How many pages will the government give the contractor to provide this information?	These requirements will be specified within each individual task order Request For Proposal (RFP) based upon the individual task order requirements.
	Task Order PWS	5	1.3	bullet 6	What automation is present in the current USCG system? Will the contractor be expected to lead the implementation of new RMF approaches (for example Continuous ATO?). If so, have prototype programs been run within the Coast Guard environment?	The Software Factory is currently being built in a prototype phase. Workflows and Processes are being built for the Software Factory together with roles and responsibilities to move towards a cATO option.

This is the start of the file's text. The full file is on GovTribe.

File details come from the government source that posted it. Updated Aug 11, 2023.