Mod_1_Cybersecurity_Services_Mod_and_questions.pdf

Solicitation Title: Cybersecurity Service Program Support for the National Center for Advancing Translational Sciences (NCATS)

Amendment of Solicitation no. 75N95020R00009

Amendment no.: 01

Amendment date: August 5, 2020

Due date for proposals: August 17, 2020 at 2:00 p.m. Eastern time (UNCHANGED)

Issued by:

National Center for Advancing Translational Sciences, NIH NIDA Office of Acquisition, NCATS Section 3WFN Rm 03C18, MSC 6012 301 North Stonestreet Ave.

Bethesda, MD 20892

Primary Point of Contact:

Stuart Kern, Contract Specialist Email: stuart.kern@nih.gov Phone: 301-402-3334

TO ALL OFFERORS:

The above-numbered solicitation is amended as set forth below. Offerors must acknowledge receipt of this amendment on each copy of the offer submitted. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by letter, provided each letter makes reference to the solicitation and this amendment, and is received prior to the time and date specified for receipt of proposals.

PURPOSE: to amend the RFP, and to respond to formal questions submitted in response to the solicitation.

All other terms and conditions of the RFP remain unchanged.

MODIFICATION

1. Combined Synopsis/Solicitation, Paragraph (ii), is amended to read:

The solicitation number is 75N95020R00009 and the solicitation is issued as a request for proposal (RFP).

This acquisition is for a commercial item or service and is conducted under the authority of the Federal Acquisition Regulation (FAR) Part 13 – Simplified Acquisition Procedures; FAR Subpart mailto:stuart.kern@nih.gov

NCATS Cybersecurity Services Questions and Answers 75N95020R00009

13.5 – Simplified Procedures for Certain Commercial Items; and Part 12—Acquisition of Commercial Items, and is expected to exceed the simplified acquisition threshold.

2. Article C.2.b.2.b, Reporting Requirements – Information Security and Physical Access Reporting Requirements, and Article F.2 are amended to require submission of the Roster of Positions Requiring Suitability Investigations at the time of award, not with proposals.

3. Attachment no. 1, Packaging and Delivery of Proposals for Use with the NIH electronic Contract Proposal Submission (eCPS) Website, is amended to refer to Attachment 9 Pricing Template and to increase the page limits as follows:

Technical proposal – 30 pages Task Order Proposal #1 – 20 pages Task Order Proposal #2 – 20 pages

4. Attachment no. 4, Task Order no. 2, is amended to remove the period of performance.

5. Attachment no. 9, Pricing Template, is amended to include a second sheet for Task Order no. 2 and a third sheet listing representative labor categories. Offerors are to provide fully-loaded labor rates for any categories the offeror intends to propose for this contract.

6. Section L.2.c, Business Proposal Instructions, is amended in paragraphs c.1. and c.2. to remove the references to fee.

7. Section L.2.c.8, Business Proposal Instructions - Subcontractors, is amended to remove subparagraphs d, e, and f, which related to cost-type contracts.

8. Section L.10, Instructions to Offerors – Selection of Offerors, paragraph 5 is amended to read:

The process described in FAR 15.101-1 will be employed, which permits the Government to make tradeoffs among cost or price and non-cost factors and to consider award to other than the lowest price offeror or other than the highest technically rated offeror. Comparative evaluation as authorized at FAR 13.106-2(b) may be used.

9. Section M.3, Mandatory Qualification Criteria, is removed in its entirety.

10. Section M.5, Technical Evaluation Factors, paragraph 7, is amended to read:

7. Demonstrated ability to provide security, including system design and architecture, continuous monitoring, logging, active threat management, incident response, etc., for government-hosted cloud-based systems that support collaboration among governmental and non-governmental research organizations. Provide specific examples of government-hosted cloud-based systems. Include any experience with single sign on via federated authentication models for access to the environment.

RESPONSES TO QUESTIONS

The Government has provided answers below. Note that many questions were combined, paraphrased, and/or summarized for brevity and clarity.

IMPORTANT: Offerors are reminded to preregister for the NIH electronic Contract Proposal Submission (eCPS). Creating a new account to submit may take up to three business days. Please apply for a new account early to allow enough time for the registration process. Proposals must be submitted via eCPS, and eCPS does not accept proposals after the due date and time (See Attachment no. 1, Packaging and Delivery of Proposals for Use with the NIH electronic Contract Proposal Submission (eCPS) Website).

A. GENERAL AND RFP

1. Question: Will the government consider extending the due date of Q&A or proposals?

Answer: It is the Government’s intent to award this contract as close to September 1, 2020 as possible. The Government will not extend the due date for proposals.

2. Question: who is the incumbent; please advise if this is a new effort or a re-compete on an existing contract? If an existing contract please provide the contract number.

Answer: This is a new requirement. NCATS has historically accomplished its cybersecurity requirements through in-house resources.

3. Question: Does program have an estimate for the potential value of this contract or an expected range of value?

Answer: Yes, the estimated value is not more than $6.9 million during the contract ordering period of 9/1/20 through 8/31/23. This is an acquisition using the simplified procedures at FAR Subpart 13.5, which limits non-emergency actions to $7M. Interested parties can find more information in Article B.2 of the Schedule attached to the solicitation.

4. Question: Has the timeframe for the future release of task orders been determined?

Answer: TO #1 will be awarded concurrently with award of the contract. Sample TO #2 is for response purposes only. NCATS will award additional fixed-price task orders as needs arise;

NCATS anticipates 0-3 task orders per year. The Government expects to use such task orders to have the contractor accomplish discrete cybersecurity-related projects, and has no estimate of the value of such orders at this time.

5. Question: Please provide the RFP/CSS as a standalone text-based document rather than an image-based document.

Answer: Standalone copies of the combined synopsis/solicitation and the SOW have been uploaded to beta.SAM.gov.

6. Question: Please confirm the NAICS for this acquisition.

Answer: NCATS has identified 541519 with a small business size of $30M as the appropriate NAICS for this acquisition.

7. Question: What is the clearance requirement for this contract?

Answer: There is no national security clearance required. The Government will conduct a background investigation of all contractor personnel assigned to this contract. See Article H.6. of the Schedule.

8. Question: Will a DD254 be issued upon award?

Answer: A DD254 will not be issued upon award.

9. Question: What is the estimated timeline for security protocols and suitability investigations required on this contract?

Answer: Background investigations are conducted by the NIH Division of Personnel Security and Access Control, and are expected to begin immediately upon award. The process can take up to two months for personnel not currently holding an NIH badge.

10. Question: The place of performance is listed as Rockville, Maryland. Post COVID, will all team members be expected to be on-site Mom - Fri during business hours?

Answer: See Task Order no. 1, Paragraph G, Core Hours. Post-COVID, telework is expected to be fully acceptable, but the details must be worked out with the COR to ensure adequate delivery of services.

11. Question: Must an offeror bid on both Task Orders?

Answer: Your proposal will be evaluated on your response to the SOW and to your responses to both task orders.

12. Question: Does the government plan to award task order #2 included with the solicitation?

Answer: NCATS does not intend to award sample Task Order #2. The sample task order is based on an actual SCA performed for NCATS and will be used to support an apples to apples evaluation of proposals against a known situation.

B. FORMATTING AND PROPOSAL

13. Question: Please consider increasing the page limits.

Answer: As amended above, page limits are increased as follows:

Technical Proposal: 30 pages Task Order proposals: 20 pages each.

14. Question: Please confirm that for submission, we need one Technical Proposal (which includes Task Orders 1 and 2), a Business Proposal in PDF format, and a Business Proposal in Excel format.

Answer: Correct. Note that eCPS will only allow upload of one technical proposal, one business proposal, and one Excel spreadsheet. All attachments must be included in the three files.

15. Question: The file names we are supposed to use reference the following: NIHAI2012001.

However, the solicitation number is: 75N95020R00009. Please confirm if the naming conventions for the files needs to change.

Answer: Attachment 1 – Packaging and Delivery of Proposals shows examples of file names. Use those examples as guidance for naming your files.

16. Questions related to formatting, content, and attachments:

Answer: Cover page: include a cover page on your business proposal and on your technical proposal that identifies, at a minimum, the RFP title, solicitation number, your organization, your DUNS number, and the proposal part. You may include other identifying information if you wish. You do not need to indicate whether it is an original or a copy.

Include attachments with your technical proposal unless otherwise noted.

Form NIH-2043 Proposal Summary and Data Record should be included in your business proposal.

Page counts are enforced against the technical proposal and the two task order proposals. There is no page limit to the business proposal. Resumes, letters of commitment, past performance, cover pages, cover pages, divider pages without content, etc. are not counted toward the page limits. Attachments such as the proposed management plan, transition-in plan, information security section, VPAT, Summary of Related Activities, etc. do not count against your page limits.

However, all documents must be included as attachments in your technical or business proposal.

17. Question: Section H.6.6.a, page 25, states that the Roster of Employees Requiring Suitability Investigations "shall be submitted to the COR and/or CO within fourteen (14) calendar days after the effective date of this contract". Can the Government confirm this requirement is no longer applicable since Section C.2.b.2.b, page 7, requires the Roster with proposal submission?

Answer: As amended above, the Government will request the Roster and Non-Disclosure forms at or near time of award. Do not include a Roster or the NDA with your proposal.

18. Question: What information does the Government request on the Back Page of proposals?

Answer: None.

19. Question: Will the Government restrict fonts to only Arial and Times New Roman?

Answer: No. See Attachment 1, Packaging and Delivery of Proposals for formatting instructions.

20. Question: Key personnel have not been identified in the solicitation. Is it the intent of NIH to provide key personnel? Can we propose positions that would represent key personnel? Can we provide representative resumes? Please confirm the Summary of Related Tasks is only for IDIQ Key Personnel. Please provide some job qualifications and responsibilities for the key personnel to help identify the ideal candidates for the Government. How may key personnel should we propose?

Answer: Resumes of key personnel are required to be submitted with technical proposals. The Summary of Related Tasks applies to key personnel. Proposed staffing, including qualifications of proposed key personnel, is evaluated as part of the technical evaluation.

21. Question: In the Combined Synopsis document, Page 66, #9 states: A copy of the organization’s most recent annual report must be submitted as part of the business proposal. Will a statement of our financial capability suffice?

Answer: Yes.

22. Question: Attachment 1, Page 1, Section B: Regarding submission of the “Breakdown of Proposed Estimated Costs (plus Fee)” Excel spreadsheet in the Business Proposal. Please confirm this can be provided in PDF format for the Business Proposal (and in .xls format within the “Business Document Excel.”

Answer: Yes.

23. Question: Pricing Template – Can NIH please provide an example of a completed pricing template?

Answer: No.

24. Question: The given pricing template is for the Task Order 1. The RFP documents mentions Task Order 2. Will the Government provide a pricing template for Task Order 2?

Answer: The pricing template has been amended to include Task Order 2 and a list of labor categories.

25. Question: Product Accessibility Template – What is the purpose of the template as it relates to the submission of this RFI?

Answer: Various deliverables under this contract may require Section 508 complaince.

26. Question: As the CSS is a newly created organization, does the transition out plan affect only government employees or are there one or more incumbent vendors?

Answer: Assume for purposes of the transition-in plan that all services are currently provided by the Government using in-house resources, and transition-in will not involve transition from an incumbent contractor to the new contractor.

27. Question: For Attachment 6,” Provide a statement of the level of effort to be dedicated to any resultant contract awarded to your organization for those individuals designated and cited in this proposal.” Please confirm that this should be expressed as LOE hours instead of LOE percentage.

Answer: Either is acceptable.

28. Question: Investigators. Are you referring to personnel who will be billable to the project or company oversight?

Answer: Billed to the project.

29. Question: Additional Personnel. Are these personnel working on Task Orders 1 and 2, or any work needed?

Answer: Your proposed allocation and assignment of staff should be addressed in your technical proposal.

30. Question: In the 03_Task_Order_no._1 document, there is a reference to a Task Order No. 1

SOW. No such document exists in the materials. Is there a separate document to be provided or is the Government referring to Sections 2.2 and 2.3 of the overarching SOW (02_Cybersecurity_SOW_2020-06-14)?

Answer: It is page 3 of the Task Order RFP and is captioned “Project Initiation Form.”

31. Question: In the 04_Task_Order_no._2 document, there is a reference to a Task Order No. 2 SOW. No such document seems to exist in the materials. Please provide this separate document, or identify the document in which we should be referring to.

Answer: It is page 3 of the Task Order RFP and is captioned “Project Initiation Form.”

32. Question: In “04_Task_Order_no._2”, there appears to be inconsistencies between the Task Order 2 Period of Performance and the project size on the project initiation form. Can the government clarify that it expects vendors to propose against a 1 year TO POP?

Answer: Correct; there should not be a period of performance stated in Sample Task Order no.

2. This sample task order is completion-based, not level-of-effort-based.

33. Question: The RFP instructions include the Certification of Filing and Payment of Taxes requirement. Will the Government please provide instructions for where it is to be submitted and confirm this is not included in the Technical Proposal page count limit.

Answer: This certification is made as part of your annual SAM registration.

34. Question: Since no Cost-Plus Fixed Fee Task Orders are to be awarded via the IDIQ, will the government remove the requirement in Attachment 1 for the breakdown of cost-plus fixed fee in excel spreadsheet?

Answer: Correct, this will be a fixed-price task order, and cost reimbursement-type items are not applicable. The Amended Pricing Template included with this Solicitation on Contract Opportunities does not include the cost or fee elements.

35. Question: The Technical Evaluation Factors on page 65 states “Management Approach”, however, the Section L Technical Proposal Instructions do not mention a management approach. Can this be clarified in the RFP?

Answer: The management approach is your overall approach to managing this requirement based on the totality of your response.

C. BUSINESS PROPOSAL

36. Question: On Page 62 of the RFP: Does the Business Volume requirement for pertinent contracts allow the offeror to submit more than 3 past performances?

Answer: Yes.

37. Question: Does the Technical Evaluation Factor C. Organizational Experience correspond to the offeror’s submission for section 7. Qualifications of the Offeror in the Business Proposal Volume?

Answer: They are similar but not identical.

38. Question: Please provide the estimated level of effort or describe the current NCATS Cybersecurity Service staffing level.

Answer: The Government is interested in your assessment of resources and effort necessary to perform the statement of work. Please propose a level of effort that you feel necessary to accomplish the task orders, given the Statement of Work, the requirements discussed in the sample task orders, and the inventory of systems discussed in the Technical Proposal section below.

39. Question: For 2.2.5 what is the number of tickets historically or anticipated? Is there an existing ticketing system in place and if so which one is it? If it exists please send relevant sample logs of tickets, time to resolution, time of open tickets, escalations with type and details.

Answer: NCATS service desk handles 5000-plus tickets annually. As a rough order of magnitude, maybe 100 of those are security-related.

40. Question: Should the quote include a firm fixed price for all the Cybersecurity Program support Task Areas that is requested in the SOW and a firm fixed price for the first two Task Orders?

Answer: No, your proposal should provide pricing for the task orders only.

41. Question: 1.1.2 Statement of Need and Purpose. How will NIH determine the fixed-price or time-and-materials nature of individual tasks?

Answer: NCATS intends that this work will primarily be accomplished using fixed-price task orders. Time-and-materials task orders will only be used when it is not possible to accurately estimate the extent or duration of the work.

42. Question: The instructions state the travel costs must be included for evaluation. For the purposes of IDIQ price evaluation, will the government provide a plug-in price for associated travel costs, since travel requirements are unknown for future Task Orders?

Answer: The Government does not anticipate any travel costs at this time. Use a plug figure of $0.

43. Question: In the Business Proposal, should we define and price all LCATs that will be used for the entire scope of the IDIQ to allow for T&M hourly rates?

Answer: Yes. See Sheet no. 3 of the Amended Attachment no. 9 Pricing Template.

44. Question: Please provide LCATs acceptable to the government for these positions.

Answer: See Sheet no. 3 of the Amended Attachment no. 9 Pricing Template for representative labor categories. However, the Government will evaluate your proposed staffing, to include your proposed labor categories, as part of its technical evaluation; the labor categories you propose in your technical proposal are not required to be drawn from the representative labor categories in the Pricing Template.

45. Question: The RFP states that the GFE to be provided is in listed in the SOW, Section 2.3.

However, there is no mention in that section of what the government will provide for use by the Offeror. Will the government please clarify what GFE will be provided for personnel working this program? Please confirm the Government will provide a way to perform remote connection to the NCATS environment, such as VPN or VDI.

Answer: Correct. The Government will furnish all equipment necessary for on-site contract performance, including personal computers, analytical tools, desks, chairs, etc. Systems access will be limited to Government-furnished equipment.

46. Question: Given that the proposal is to be submitted in a digital copy, please clarify what is meant by "Original copy" of the travel policy?

Answer: A digital copy meets this requirement.

47. Question: Section L.2.c.6.b requires submission of electronic funds transfer information with the offer. Given the sensitive nature of banking and financial information and the fact that the financial annual reports and banking information is in SAM, will the government consider removing this requirement?

Answer: The FAR requires solicitations to include FAR clause 52.232-38, Submission of Electronic Funds Transfer Information with Offer.

48. Question: Clarify use of the pricing template

Answer: The Business Proposal Instructions – Basic Cost/Price Information requires sufficient information to allow the Government to perform a basic analysis of the proposed cost or price of the proposal. The Amended Attachment 9, Pricing Template, includes a sheet to add fully loaded labor rates for each labor category proposed.

49. Question: The instructions of the Business Proposal say we need to include our fee and profit.

However, neither of those is calculated in the pricing template. Typically, fee and profit are only indicated if the contract has Cost Plus Fixed Fee pricing. Will the government consider removing this requirement since the Combined Synopsis (v) states, "This is anticipated to be an indefinite delivery/indefinite quantity contract using primarily fixed-price task orders, with the possibility of time-and-materials task orders if determined to be in the best interest of the Government."

and thus no cost plus fee Task Orders will be included?

Answer: The business proposal instructions were amended above to remove references to “fee.”

50. Question: Does the Government require a separate Business Proposal for each subcontractor?

Will the Government allow subcontractors to provide this cost proposal separately from the prime offeror's submission?

Answer: Offerors should include the cost of subcontracts in their own pricing proposal.

Submission of separate subcontractor cost/price/business proposals is not necessary.

D. TECHNICAL PROPOSAL

51. Question: Section 2.2 [Information Security and Privacy Group] and Section 2.3 [NCATS Cybersecurity Integration Center]. Is the expectation a synopsis of our approach, along with examples of what we have done?

Answer: The focus is on the synopsis of the approach you intend to take and that can include examples of past efforts to explain/justify the proposed course of action.

52. Question: The RFP states that the contractor managing CSS will also be responsible for providing its services to externally-facing and collaborative extramural NCATS programs such as the Rare Disease Clinical Research Network (RDCRN), the Clinical Translational Science Awards (CTSA) Program Network, and A Specialized Platform for Innovative Research Exploration (ASPIRE). In order to propose the correct level of effort in this support, can we get an estimate of the current support requirements?

Answer: The current level of effort is supporting multiple cloud environments, AWS E/W, AWS GovCloud, Azure, GCP, several SaaS solutions (Palantir, Box, etc.) and thousands of users, both internal and external to NIH.

53. Question: Response to sample task order: we assume that we will provide a short technical description of the approach to accomplish the SCA effort, describe appropriate personnel (with qualification required), and then include an ideal timeline for execution. Is that correct?

Answer: It would be beneficial to get a detailed technical description of the approach to accomplish the SCA effort while also providing the appropriate personnel, including their qualifications, and the ideal timeline for execution.

54. Question: Is NCATS hosted on a FedRAMP authorized Cloud Service Provider?

Answer: We have both FedRAMP and non-FedRAMP Cloud Service Providers in use.

55. Question: How many U.S. Government/Contractor NCATS users are their currently?

Answer: NCATS supports over 500 Government/Contractors and thousands of non-NIH extramural personnel in support of our collaborative cloud platforms.

56. Question: How many of the systems software are COTS vs. NCATS-developed in-house directly or through third parties?

Answer: We have extensive use of both COTS and NCATS-developed in-house software. Assume a 50/50 split.

57. Question: What is the rough number of new NCATS initiatives/and technology projects in-process for 2020/2021?

Answer: Over 50 and growing.

58. Question: How is the current SOC operations being delivered for NCATS?

Answer: Through existing contract and federal staff.

59. Question: ISPG Task Area 4: What are the various audits that NCATS will be engaged in? i.e.

Financial, NIH OCIO, HHS, etc?

Answer: NIH and HHS security audits primarily.

60. Question: ISPG Task Area 2a: How many systems are currently ATOd? How many in-scope NCATS systems have active Authorizations to Operate (ATOs), Interim ATOs, and ATO packages currently??

Answer: We have our GSS and G-Suite systems with an active ATO. We have 5-10 with interim ATOs and will be looking to get full authorizations for these as quickly as we can. We also have

10+ development/beta systems that will eventually require full authorizations.

61. Question: ISPG Task Area 2a: How many of those systems are cloud based?

Answer: 5-10.

62. Question: How many and what types of Cloud Services does NCATS use?

Answer: AWS, Azure, GCP, and nearly a full cadre of required services to support complex administrative an scientific systems supporting thousands of users.

63. Question: Page 82 of Combined_synopsis pdf, paragraph 2.2.2.1 ISPG Task Area 2a: What cloud service providers is currently being utilized?

Answer: AWS, Azure, GCP, and nearly a full cadre of required services to support complex administrative an scientific systems supporting thousands of users.

64. Question: What percentage of these Cloud Services currently have active Authorization to Operate under FedRAMP?

Answer: 10%

65. Question: How many co-located datacenters (with their locations) are in scope?

Answer: Two, primarily at our 9800 Medical Center Drive location in Rockville, MD and the NIH CIT supported datacenter in Sterling, VA.

66. Question: How many Interconnection Security Agreements (ISAs) are currently in place for both the externally-facing and collaborative extramural NCATS programs and managed service providers? If ISAs are not in-place for all what is the rough number of these interconnections?

Answer: We do not have ISAs in place for those as our systems are not connected to external environments, rather they are NCATS supported collaborative enclaves accessible by these parties via a NCATS-developed federated access system.

67. Question: How are configuration management inventories (including co-located datacenters, Cloud, Robotics (ISC/SCADA systems and hardware), networks (telecom, satellite, microwave and point to point RF) servers, hardware, software and firmware) currently managed across all systems within the NCATS scope of work?

Answer: In accordance with NCATS system security practices, NCATS will not disclose its current system configuration information.

68. Question: What current tools and procedures are already in place to perform network and media digital forensics, incident response, malware analysis, and advanced threat hunting across the enterprise?

Answer: In accordance with NCATS system security practices, NCATS will not disclose its current system configuration information.

69. Question: What current Application Vulnerability Scanning and Analysis tools are government provided and currently in use?

Answer: Tenable Security Center, IBM AppScan, Netsparker Enterprise

70. Question: Page 82 of Combined_synopsis pdf, paragraph 2.2.2.1 ISPG Task Area 2a: What tools are being used by NCATS for the purpose of automated A&A procedures?

71. Answer: In accordance with NCATS system security practices, NCATS will not disclose its current system configuration information.

72. Question: Page 82 of Combined_synopsis pdf, 2.2.2.1 ISPG Task Area 2a: What tools are being used by NCATS for POA&M management?

73. Answer: In accordance with NCATS system security practices, NCATS will not disclose its current system configuration information.

74. Question: Question 2. Please list the software tools NIH currently owns to support CDM, SIEM, data protection, vulnerability assessments and penetration testing?

75. Answer: In accordance with NCATS system security practices, NCATS will not disclose its current system configuration information.

76. Question: Will the government consider a Managed Detection & Response service to provide Security Operations?

Answer: See Section L.2.b, Technical Proposal Instructions.

77. Question: Page 84 of Combined_synopsis pdf, 2.2.5 ISPG Task Area 5: What tools are currently in place? i.e. Sensors, IDS/IPS, HIDS/NIDS, SIEM, etc.

78. Answer: In accordance with NCATS system security practices, NCATS will not disclose its current system configuration information.

79. Question: Question 2. 2.3.4 Task Area 4: Compliance Monitoring. What IT Service Management tool(s) are currently used to manage and track security related incidents?

Answer: The NIH provides an Incident Response Tool website.

80. Question: Is there currently an incumbent company or previous incumbent, who completed similar contract performing these services? If so - can you please provide incumbent contract number, dollar value and period of performance?

Answer: This is a new contract specific to this function, there is no prior contract.

81. Question: Specify the VLAN details how many is included in the Scope?

Answer: 15-20 VLANs.

82. Question: Can you please provide current number of infrastructure details (Physical Server, Virtual Server, Network Devices etc)? Is there any External Interface need to Pentest? If yes then please specify details?

Answer: See sample task #2 for these numbers. We currently rely on NIH OCIO to perform bi-yearly pentests and would like to add capability to this as needed.

83. Question: Are any vendor products installed for Governance, Risk, and Compliance (GRC) tracking?

Answer: BigFix Compliance, Tenable Security Center

84. Question: Are any vendor products installed for Security Incident & Event Management (SIEM)?

If yes, please provide currently used SIEM product name.

Answer: Tenable Security Center, IBM AppScan, Netsparker Enterprise

85. Question: How many Active Directory Environment domain is included in Penetration testing?

Answer: One.

86. Question: Do you want this as a red team exercise to test the SOC/NOC’s response where they will get to see the results and update their Knowledge Base (KB) afterward or Blue team where we work with the SOC/NOC and share our attacks so they can update their KB during the testing?

Answer: Could potentially be both based upon the type of test to be performed.

87. Question: How many physical locations are included in Pen testing?

Answer: One.

88. Question: Is “web application” security testing in scope? If yes, please provide number of applications, External facing (internet accessible) or Internal facing? How Many Web Application is in Scope for Pen testing? Specify if Any.

Answer: We have over 100 web applications, both internal and external and they will be within scope of any Pen Testing.

89. Question: Do you manage your own data Center, or do you utilize any 3rd-party/colocation facilities?

Answer: We manage our own data center but also use the NIH CIT datacenter in Sterling, VA to act as a redundant location for our NetApp appliance.

90. Question: T.O. #1: It reads, ATO compliance reviews for all systems on the G Suite platform?

What's the G Suite platform?

Answer: G-Suite is an enterprise instance of Google office tools in heavy use at NCATS.

91. Question: There is references to providing support of the SDLC in the solicitation. We assume support is a reference to guidance and documentation to the NCATS CSS team and there is no software development requested of our team. Is that a correct assumption?

Answer: There is no software development expected but the ability to assist with training and best practices for internal developers to follow is preferable.

92. Question: Information Security and Privacy Group (ISPG) Task Area 2: Information Security and Privacy Technical Services - Are there any current POA&Ms related to ATOs that require quick turnaround for generation or update?

Answer: Our GSS is up for renewal in March of 2021 and there are several medium and low POA&Ms to resolve before initiation of the next assessment.

93. Question: ISPG Task Area 4: Audit Management and Support - Do A&A activities for FISMA Low, Moderate, High or High Value Asset (HVA) identified categories?

Answer: Low and Medium.

94. Question: Are all cloud builds to be reviewed contained in .gov or FedRAMP space?

Answer: Mostly .gov and FedRAMP space but also the possibility of a .org.

95. Question: NCATS Cybersecurity Integration Center (NCIC) Task Area 2: Penetration Testing: Is NCIC penetration testing in addition to annual NIH OCISO annual penetration testing? What is the desired cadence: Quarterly? Bi-annually? Annual?

Answer: In addition to NIH testing and as requested to further test critical systems.

96. Question: NCIC Task Area 4: Compliance Monitoring: Is the compliance monitoring to use the NIH CISO Archer toolset or an internal risk management tool? If internal, what is the risk management tool?

Answer: The intent is to use NIH provided Archer toolset but we are also open to suggestions for internal tools.

97. Question: With regards to robotics, what are the numbers and locations of Industrial Control Systems (ICS)/Supervisory Control and Data Acquisition (SCADA) systems in scope for NCATS?

Answer: We have over 20 robots across a variety of scientific platforms, each with an equivalent SCADA system. Several of these systems also have the ability to be externally controlled by cloud-based applications.

98. Question: What is the approximate number of the following within the systems inventory:

Answer:

• Servers: 50+

• Workstations\laptops: 1000+

• Network Appliances (Firewalls, Web Application Firewalls, Load balancers, Routers, Switches, Wireless/RF hardware):

• Physical hardware, 10+, Web Application, 20+

• Web Applications: 100+

• Databases/Data warehouses: 100+/1

• Robotic devices: 20+

• Clinical biomedical devices: No clinical, but over 500 pieces of scientific instrumentation

• ISC/SCADA systems: 5-10

99. Question: TO 2: Please confirm infrastructure landscape below – are the figures accurate?

• 100 physical servers and 180 virtual servers that support the operational function(s) of NCATS will be considered in scope for the SCA;

• Approximately 300 scientific devices, many of which are networked – Only networked scientific devices that are accessible via the available scanning tools will be considered in scope for the SCA;

• Approximately 500 client devices – Only those devices that are supported by and accessible via available security scanning tools will be considered in scope for the

SCA;

• Over 1100 nodes on the network, including printers, laptops, workstations, servers, scientific devices, etc. – Only those servers, scientific devices and laptops/workstations assigned to users performing administrative tasks on the IT infrastructure will be considered in scope for the SCA. All other devices shall be reviewed/assessed by the NIH technology support team; and

• One 20-node High Performance Computing cluster – Networked components that are accessible by the available security scanning tools will be considered in scope for the SCA.

Answer: These are accurate.

E. PAST PERFORMANCE

100. Question: the RFP limits Past Performance to only those task orders and contracts that were performed by the prime offeror. We believe the Government's interests may be better served by accepting past performance examples from the entire team, as opposed to limiting it just to the small business prime. This would provide the Government a fuller understanding of the team's overall performance history and capabilities, so they may better assess risk. Will the Government modify the language in L13(1) to allow recent and relevant past performance of any team member with significant participation be considered in the Past Performance evaluation?

Answer: No, the Government does not modify the requirements related to organizational experience and past performance. This RFP requests both organizational experience and past performance information. Organizational experience, as discussed at Section M.5.C, is the experience that you as well as your partners, subcontractors, consultants, etc. bring to the contract. It counts as 20% of your technical evaluation score. Past performance information, as discussed at Sections L.13 and M.6, addresses your performance as a prime contractor as assessed by other parties (e.g. references, CPARS, etc.), and is evaluated separately from your technical evaluation.