QA Response - 31Aug22.xlsx
XLSX spreadsheet 13 KB Posted
- Attached to
- Logging, Reporting and SSP Development Services Federal contract opportunity
- Solicitation number
- 75H70422R00008
About this file
This document contains a question and answer file and a federal contract opportunity solicitation for logging, reporting and system security plan development services. The Q&A file provides responses to questions about the scope of work, which includes maintaining approximately 50 IT systems and assisting with the risk management framework process defined by NIST SP 800-53. On-site support is required for three labor categories including Splunk security engineering and information security compliance. Training will be conducted virtually using available platforms. Equipment will be provided by the agency. Personnel do not require facilities clearances but information security roles require relevant certification. The solicitation is a 100% small business set-aside open only to Indian small business economic enterprises for contract award. Questions regarding the solicitation were due by August 25th, 2022 but no information is provided on proposal due dates or anticipated award timing.
View the file
Other files for this federal contract opportunity
| File | Type | Posted |
|---|---|---|
| Clauses and Provisions - 31Aug22.docx | DOCX document | |
| PWS - 31Aug22.docx | DOCX document | |
| PWS - 19Aug22.docx | DOCX document | |
| Clauses and Provisions.docx | DOCX document | |
| IHS IEE Representation Form.pdf |
On GovTribe
Work with this file on GovTribe
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Sheet1
| Number | Question | Government Answer |
| 1 | Is this new or existing work? If existing, is there a current contract number? | This is a new requirement. There are no predecessor contracts/orders for this action |
| 2 | Are there defined labor categories currently? | No direct labor categories have been mandated by the solicitation requirements. As outlined below, the Government has identified three key areas of services for on-site performance which have been estimated to be one (1) FTE each. The vendor should propose a labor mix which adequately addresses the on-site performance requirements at the 5600 Fishers Lane location as well as all additional remote labor to complete PWS requirements. |
| 3 | Is there a value assigned to this effort? | There is no set value assigned to the requirement. The Government has estimated 6-7 Full-Time Equivelents (FTEs) are required based upon the quantity and type of tasks outlined within the PWS, however the vendor is responsible for proposing a labor mix and hours sufficient to meet PWS requirements and execute their technical approach. |
| 4 | The PWS mentions the NIST 800-53 6 step process. This process is designed to give senior leaders enough information to make risk decisions regarding IT systems. Does this effort require execution of all steps of RMF process including ATO and entering into Continuous Monitoring? | Step 6 is continuous monitoring and includes an annual assessment to keep compliance active. This does not include Step 4 and Step 5; IHS has a separate group to perform the independent assessment. Resources from this part are required to participate and coordinate services support to the IHS Risk and Compliance staff with their assessment activities. |
Resources will assist System Owners in responding to security findings and advise them (SOs) supporting technical security understanding to implement the control within the Risk Management Framework defined by NIST 800-53. Utilizing all security guidelines provided by NIST in NIST 800-53
| 5 | How many IT systems are included in the scope of this effort and how many ATO’s will be required to be maintained from an Operations and Maintenance perspective? | IHS currently has fifty (50) IT Systems but expects the number to grow by ~25 in the next two years. (We currently have a staff of 4 federal resources with one Federal lead who will supervise the Government team and provide quality assurance oversight of contracted services in conjunction with the COR) |
| 6 | The PWS mentions a Splunk SaaS. Is the requirement to obtain an ATO for the Splunk SaaS or is that being handled by IHS? | Splunk already has agency ATO as well as SaaS Moderate ATO through FedRAMP, and it is already included in the existing workload provided in question # 5 |
| 7 | Would IHS consider a sole-source 8(a) set aside for this opportunity? | The Government has identified at least two ISBEE firms capable of performing the work outlined within the PWS. As such this requirement was solicited as a competitive ISBEE set-aside. |
| 8 | The PWS mentions training. Is the expectation to have the training in person or remotely? Will IHS provide the software required to conduct appropriate training? | Training will be predominately virtual (Zoom, Skype, etc.) with scheduled in-person training when appropriate. |
Training is for Specific Splunk Enterprise SaaS, Splunk Enterprise Security on Splunk Enterprise SaaS, and Splunk M-21-31 operations and administration. Training software is not required; it is hands-on training for Splunk Enterprise, Splunk Enterprise Security, Splunk Enterprise Security UBA capabilities, and Splunk M-21-31 operations. For virtual training the contractor will have access to available training platform (Zoom, Skype, etc.).
| 9 | Can we use personal past performance for the prime? | The vendor can indicate specific past performance of key personnel that they propose for this work. The past performance shall be relevant to the work outlined in the Logging Resources PWS and must meet recency guidelines in the solicitation. It should be noted that this past performance (submitted under Volume II of the proposal) is separate from the corporate experience noted under 4.0 of the PWS. |
| 10 | Can we use sub past performance? | Subcontractor past performance will be considered as long as the vendor will be performing at least 10% of the work on this action |
| 11 | Can we use future merger past performance? | The past performance submitted must be based upon the prime contractor and proposed subcontractors as of the proposal submission deadline date. |
| 12 | Can all positions be remote? If not, which ones can? | Based upon the work outlined within the PWS, the Government has identified three key areas of contract performance (below) which will require on-site performance at 5600 Fishers Lane, Rockville MD. Each area has been estimated as a single FTE based upon the complexity and type of tasks outlined within the PWS. This on-site performance is to ensure agency compliance with M-21-31 objectives and the effective operation of the agency network. This also ensures the coordination of efforts between on-site federal staff and the contractor on day-to-day tasks outlined within the PWS. |
- Splunk Security Enterprise Engineering
- Information Security Compliance Assurance (Certified)
- System Security Admin (Active Directory/Linux) Other contractor support staff may be remote based upon the offerors technical approach and proposed labor mix.
| 13 | Will equipment (ie laptops) be provided for all staff whether remote or on premise? | Yes. IHS will provide the laptop and access to all resources and provide the required IHS access to systems after they get the Public Trust Level 5 clearance. The vendor shall be responsible for providing all information/documentation necessary to gain approval for equipment use. |
| 14 | Is there a requirement that the prime contractor have a facilities clearance | No facilities clearance is required |
| 15 | Do personnel that would work on the contract need any specific certifications or is expertise in the field enough? | Only those personnel providing services under Risk Management Framework PWS tasks shall possess CISSP or CISM certification as outlined under PWS paragraph 4.3. Only one individual providing on-site services, Information Security Compliance Assurance, would require this certification. |
File details come from the government source that posted it. Updated .