Amendment 2 Vendor Questions- ICAM POCs Government responses.xlsx
XLSX spreadsheet 45 KB Posted
- Solicitation number
- 75N97023R00006
About this file
This document contains questions and responses related to a solicitation from the Department of Health and Human Services National Institutes of Health for proofs of concept of an Identity, Credential, and Access Management infrastructure modernization. The solicitation seeks original equipment manufacturers to participate in pilots of solutions across three capability areas: authentication services, directory services, and secure access service edge. The National Institutes of Health will evaluate proposals and select vendors to conduct the proofs of concept, which will provide an opportunity for vendors to demonstrate solution viability and integration ability. The pilots aim to assess performance and integration into the NIH environment using approximately 200 internal and 200 external users. Questions cover topics such as requirements, pricing, timelines, and capabilities of interest including multifactor authentication options, directory services, mobile device support, and application integration requirements.
View the file
Other files
Show all 11
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Questions and Responses
| Amendment 2 | Questions and Responses | |
| The Government will conduct this RFP pursuant to the Federal Acquisition Regulation (FAR) Part 15 Contracting By Negotiation. The Government reserves the right to use FAR Part 12 and/or FAR Part 13 for this requirement. | ||
| Question No. | Question | Response |
| 1 | Will deploying software on a GovCloud satisfy the FedRAMP requirements? | Deploying on FedRAMP approved infrastructure is acceptable. FedRAMP Moderate is a minimum requirement for this solicitation. |
| 2 | Does NIH prefer a bid with a complete solution or partial response as called out in Part C: Proposal? | Please refer to the Instructions (Section C and K.b.6). The government is seeking proof of concept by piloting select OEM products. Bidders may elect to provide a Quote that includes details about the work activities and Deliverables for: |
1) All three Capability Areas (Authentication, Directory Services, Secure Access Service Edge;
2) May elect to bid on an individual Capability Area
3) The bidder may elect to bid on one, all, or a combinations of Capability Areas.
| 3 | For the 2mil external CIAM users, what is the preferred MFA solution needed? (e.g. OTP, KBA, FIDO, PassKeys, Push Notifications, tokens) | NIH is open to considering MFA options that balance security and user experience. Please provide options capabilities available in your solution via your proposal. |
| 4 | For the 40k internal Workforce users, what is the alternate form required for MFA, other than PIV? (e.g. Derived PIV, Yubikey, Biometrics, RSA Tokens, etc.) | NIH is open to considering MFA options that are phishing resistant. |
| 5 | Do you have the protocols or standards for your applications? (e.g. SAML, OAUTH) | NIH supports multiple integration patterns including SAML, OAuth, header-based and LDAP authentication. |
| 6 | GEN-10 - How is authentication provided for these air-gapped networks? Do they have their own ICAM infrastructure? Solution shall minimize the impact to applications and services (hosted in an air-gap network) that must remain on-premise | Some NIH applications may have their own ICAM Infrastructure (air gapped infrastructure), however, some do not. |
| 7 | AUT-TI-19- can you elaborate on the following requirement - Solution shall support user-performed command-line authentication | An example would be Amazon Web Services (AWS) command line authentication. |
| 8 | AUT-TI-35 - What type of authentication methods are currently used for these legacy systems? Solution shall provide standardized approach for integration with legacy/homegrown applications. | NIH uses legacy systems and integration patterns such as LDAP and header based authentication (web agents). |
LDAP is an open, vendor-neutral, industry standard application protocol for accessing and maintaining distributed directory information services over an Internet Protocol network.
Web Agent is a legacy integration pattern for utilizing NIH login, where the NIH login team distributes a vendor provided Web Agent software that is installed and configured at the end application's web servers. The Web Agents populate the authenticated users data as HTTP headers to the application webservers for maintaining user sessions. The vendor has stopped providing regular upgrades to the Web Agent software, thus, owners of these applications are advised to migrate to the latest integration patterns supported by NIH login.
| 9 | DIR-TI-23 - Will the application be creating a new virtual value, what is the use case? Are you referring to an alias?Solution shall be able to configure/create a virtual attribute which can be available for the applications to write data into | The use case for a virtual attribute is that it allows the application to use an attribute, without requiring a permanent extension to the Active Directory schema. The attribute does not exist in the authoritative source/directory but it does exist in current virtual directory. |
| 10 | Can NIH provide more information about the nature of the follow-on contract? Will it just be for software? Or will it include implementation services? | 1. NIH is seeking to select enterprise solutions (e.g., product licenses, subscriptions) in the three capability areas (Authentication, Directory, SASE) that will be deployed and managed by the existing system integrator. |
2. NIH expects services needed to help standup and test PoCs to be provided by the solution provider and/or their partner.
| 11 | Can NIH provide more detail on what constitutes "qualified Offerors"? | Qualified offerors at this stage are any respondents whose products may meet the technical requirements of NIH. | |
| 12 | Would NIH entertain a multi-OEM solution that has the "capability and capacity to complete all requirements"? Or is NIH just interested in how offerings from a single OEM align to requirements? | Please refer to the answer to Question 10 above. | |
| 13 | Does NIH only want to consider Support provided directly by an OEM? Or will NIH consider offers by value added resellers (VARs) and implementers that can provide additional support above and beyond what is offered by the OEM? | It is expected that OEMs, Valued Added Resellers, and/or distribution partners can and will respond. | |
| 14 | On page 6 of the instructions, NIH indicates "completion of Milestone 1 and 2" as the exit criteria for Milestone 1. This seems unusual. Can NIH comment on why the schedule seems to get ahead of itself here? | The Instructions should indicate that completion of a Milestone is required and an agreement with the government before proceeding to the next sequential Milestone. The documentation for a completed Milestone shall include the proposed criteria for the next sequential Milestone. | |
| 15 | On page 7 of the instructions, NIH expresses interest in "interoperability." Is the desired interoperability between products from a single OEM? Or does this indicate interest in a multi-OEM solution that is interoperable across OEM products? | Ideal products should integrate and work seamlessly with other tools, systems, and applications. | |
| 16 | On page 8 of the instructions, NIH indicates interest in the "total estimated timeframe for implementation at an Enterprise level." Does NIH expect the OEM to perform the Enterprise level implementation? If not, is NIH looking for one or more OEMs to partner with an implementer that can properly estimate this level of effort? | This solicitation is for the Proofs of Concept phase only, and NIH is only seeking to pilot OEM products at this time. | |
| 17 | On page 9 of the instructions, NIH indicates that "Preference may be given to products that address multiple Capabilities." However, on page 2 of the SOO, NIH indicates that "There is no preference over offerors bidding on all Capabilities versus one Capability." Can NIH please comment on how these two statements are not in conflict with each other? | A solution which addresses multiple capabilities may best serve the technical and business requirements of NIH and may be in the best interest of the government. NIH reserves the discretion to make that determination based on its needs. However, the ability to address multiple capabilities is not a mandatory requirement. [However, see Section 6 of the Instructions regarding 'Synergy'] | |
| 18 | On page 10 of the instructions, NIH uses the phrase "SH's quote", but does not clarify anywhere else what "SH" stands for. Would NIH please clarify this acronym? | "SH" refers to General Services Administration (GSA) Schedule Holder. Since the solicitation is released under SAM.Gov any references to Schedule Holder are to be the same as "Offeror", "Bidder," or "Quoter." | |
| 19 | On page 1 of the SOO, NIH uses the phrase "OEM offerors" whereas in other places it refers to OEMs. Can NIH clarify whether it means OEMs throughout? Or can a third party be the offeror of the OEM products? | Please Refer to Question 13 above. | |
| 20 | On page 1 of the SOO, NIH uses the term "OEM vendor or its representative." Can NIH please clarify what it means by representative? What functions can the representative perform in the context of this contract? | Please Refer to Question 13 above. | |
| 21 | Would NIH please provide at least two weeks to respond to this RFP from the time it answers industry's questions? Given the lack of clarity about who "qualified Offerors" are, companies may require additional time to prepare once they have clarity on whether they are qualified to bid or not. | No, given that the acquisition is for Proofs of Concepts and requirements are clearly defined the Government is not providing an extension. | |
| 22 | To provide the best possible response to NIH CIT, would NIH CIT consider extending the due date by two weeks? | Please refer to Question 21 | |
| 22 | Roughly how many application are used amongst the 50k? | ||
| a. | How many are currently MFA enforced, how many not? | ||
| b. | How many are local, on-premise and how many are cloud hosted? | ||
| c. | Approximately how many of them on-premise, legacy solutions? As in, how many applications cannot support modern authentication protocols like SAML, Oauth, etc? | NIH is not providing detailed break down of all the apps for the POC phase. This information will be provided after Proof of Concept phase. If this question is regarding pricing please reference response to Question 60. | |
| 24 | DEM via SASE solution provides end-to-end visibility and troubleshooting of end-user performance issues for any user or application, regardless of location. This enables continuous monitoring for network, security, desktop, and helpdesk teams with insight into the end-user device, network, and application performance issues. IT teams can proactively analyze and troubleshoot user experience issues, improving business productivity and IT agility. | NIH is open to value add capabilities such as DEM that vendors believe should be part of the solution. | |
| 25 | Of the 50k in-house staff users, are they all physically located in the network? How many of them are remote, and what areas of the world do they reside in? | Not all users are located in the network. Although most users are based in the U.S., users are geographically dispersed. | |
| 26 | Is NIH willing to share supporting documentation in conjunction with the solicitation? | NIH will share additional information as needed after contract award. | |
| 27 | Of the 1.2 million external users who need to access resources in NIH, how do they currently obtain access (after VPN authentication)? | All NIH login URLs are open to internet and 1.2 million users have access through federation over internet. | |
| 28 | In the Statement of Objectives document, page 3, it is stated that, “The PoCs will demonstrate vendor solutions in one or multiple Capability Areas outlined above (Authentication Services, Directory Services, SASE).” Please confirm that if OEM desires to respond to a subset of the capabilities, for example 2 of the 3 capability areas, that is acceptable. | Please refer to the answer in Question 2. | |
| 29 | How many support groups will use the software ( Helpdesk, engineers, desktop support, others) | At this stage of PoCs, the vendors will not be engaging with these groups. If you're referring to the personnel supporting this pilot, that consists of the following at a high level: 1) Vendors, 2) Program Management Support, 3) testers, 4) System Owners, and 5) Technical Operations personnel. | |
| 30 | In the Statement of Objectives document, page 4, it is stated, “The purpose of the kickoff is to align objectives, primary contacts, timelines, and rules of engagement among the parties, planned activities, and dependencies on the government.” Will the government be providing the rules of engagement? | Yes, the government will provide rules of engagement during the Kickoff. | |
| 31 | How many remote support agents would you like for us to install? | If this question is related to pricing for an enterprise solution please refer to the answer to Question 60 below. | |
| 32 | In the Statement of Objectives document, Section 3.0 Objectives” indicates a Firm Fixed Price for each milestone. Is the government expecting a firm fixed price to include both users as well as services or just services? | Firm Fixed Price refers to submission of the required deliverables in the SOO Section 4.0 and “passing” exit criteria listed in the SOO Section 3.0. (See also Instructions) | |
| 33 | What ticketing system are you currently using? | ServiceNow | |
| 34 | It is indicated on page 2 that there are 50,000 Internal and 1.2M External users, will you need pricing for all these users or will there be a subset number of users for the POC that should be included? | Technical subject matter experts suggested conducting use cases with a sample size of approximately 200 internal and 200 external users. Please provide pricing for conducting PoCs with that user count. | |
| 35 | 28. | Do you currently have CyberArk installed on-premise? ( If yes, answer questions below) | |
| d. | How many active safes do you have ?: | ||
| e. | How many active platforms? | ||
| f. | How many Accounts are stored | ||
| g. | How many CP, CCPS are installed ? | ||
| i. | What applications are currently integrated using CP or CCP? | ||
| h. | Do you have PSM and PSMP installed? | Yes, but NIH does not wish to disclose further information regarding these details. | |
| 36 | In the Statement of Objectives document, page 7, Milestone 3 indicates that documentation will be provided via a secure communication channel. Can you provide an example of a secure communication channel? | Additional information about secure communication channels to be used during PoCs will be communicated upon award. Generally, NIH does not wish to share sensitive technical information through an unsecured channel (e.g., unencrypted email). | |
| 37 | Endpoint privilege management (EPM ) | ||
| i. | How many groups would be part of the pilot? (Helpdesk, engineers, desktop support, others) | ||
| j. | Do you want LCD capability ( CyberArk is managing privileged accounts on devices that are not often connected to the network.) | NIH is open to value-add capabilities such as Endpoint Privilege Management that vendors believe should be part of the solution. | |
| 38 | In the “Instructions to Offerors” on page 8, “Business Quote (Volume 2), Market Research Data and Information” it is suggested to include “Description of next steps including types of licensing arrangements and costs offered by the Offeror and total estimated timeframe for implementation at an enterprise level.” Is the NIH seeking to obtain pricing for both product and services for the enterprise and if so for how many users? Will it be the 50,000 Internal users and 1.2Million External Users? For how many years will there be option years? | This solicitation is for the PoC phase only. Please refer to the answer to Question 60 below in regards to pricing. | |
| 39 | Network and application performance and user experience is mentioned frequently in the SOO Appendix B PoCs ICAM User Cases document. There is not an aligned requirement listed in the ICAM SOO Appendix A Requirements Traceability Matrix. Will NIH CIT consider adding a requirement for FedRAMP authorized Digital Experience Monitoring (DEM) for SASE? | Requirements are as stated in the solicitation. | |
| 40 | NIH expects selected original equipment manufacturers (OEMs) providers to support the Proof of Concept Pilots. Does NIH require only OEMs to respond directly to the RFP or can an OEM partner respond as prime with OEM(s)? | Please refer to Question 13 above. | |
| 41 | Will NIH CIT consider FedRAMP High authorization as a requirement for the SASE solution? | Requirements are as stated in the Solicitation. | |
| 42 | How many pilots can NIH support and/or plan to support and will they be run simultaneously? | PoCs will run simultaneously. NIH does not wish to release the exact number at this time. | |
| 43 | For the mandatory technical integrations is it possible to replace the functionality of the solution to be integrated with or is it non-negotiable? | NIH needs more context to fully answer this question, however, there are cases where system changes for integration will be considered. | |
| 44 | If an OEM bids on this directly for the Proof of Concept/Pilot, can a partner of that OEM be brought in to support the award or would that partner have to be part of the Proof of Concept? | Please refer to Question 13 above. | |
| 45 | Is there a requirement for centralized SSO and MFA solution for cloud and on-prem applications? | Yes, the solution must support SSO/MFA for both on-prem and cloud-hosted applications. | |
| 46 | If a respondent does not include a Synergy section, can those 5 pages be alotted to another section? | No. Per the instructions, the section is reserved for describing benefits, synergy, and inter-operability. | |
| 47 | How many existing users per directory type? | From 5 directories NIH has 40,000 users. If this question is regarding pricing please reference response to Question 60. | |
| 48 | Are Diagrams to be included in the page count or can they be added/referenced as an appendix? | Diagrams can be added as an appendix. | |
| 49 | Do you require or integrate any Identity verification services such as license or passport verification? | We do not require additional identity verification / proofing services at this time. Please refer to integration requirements in the RTM for details on needed system integrations. | |
| 50 | Can NIH CIT provide network diagram and architecture for reference? | NIH will provide network diagrams and architecture for reference upon award. | |
| 51 | Does the MFA solution need to enforce conditional access policies across things other than applications such as endpoints, mobile devices and VPNs? | Yes, NIH would like to see proposals and best practices from the vendor community. | |
| 52 | What are the locations and expected network connectivity for the 200 internal and 200 | ||
| external users that will participate in the POC? | Internal users: United Stated |
External users: Global - locations TBD
| 53 | Is there a need to support a wide range of AuthN factors such as SMS/Biometric/FIDO 2 & QR code-passwordless AuthN? If yes, what? | NIH requires support for multiple forms of AuthN factors given the nature of the institutes’ biomedical research functions, as well as its Clinical Center (fully-operational hospital). |
| 54 | To provide the best possible response to NIH CIT, would NIH CIT consider extending the due date by two weeks (Aug 15th, 2023)? | Please refer to Question 21 above. |
| 55 | Does the solution need to provide users with direct access to on-prem and web apps without VPN? | Yes |
| 56 | Can System Implementers submit the response working with OEMs to provide the product and services for the POC? | NIH already has a system implementor. Please refer to Question 10. |
| 57 | Does the solution need to provide desktop-delivered MFA for Windows and Mac Machines? | Yes |
| 58 | Does the following statement (“Instructions to Offeror” document, page 1) only apply to the OEM solutions piloted or also to the solutions provider (System Implementer / OEM partner) managing the pilot effort? Any follow-on award(s) from this Pilot Project will be based on an award to a Prime Vendor awarded project. Vendors not included in the Pilot Project as a Prime Vendor will not be eligible for participation in a follow-on project |
NIH intends to use the Proposals from this RFP to downselect for OEM Products (not services), and those Products will become leading candidates for evaluation [through the Proof of Concept(s)]. The results from the Proofs of Concepts (PoCs) will then be used in downselection of OEM Products and decisions for the government's 'next steps' and, potentially, for a future acquisition(s) of the Products that pass the PoCs.
Resellers, System Integrators, or vendors of those selected products will have the opportunity to participate in future competitive acquisitions.
| 59 | Does the solution need to provide desktop-delivered MFA for Windows and Mac Machines? | Yes. |
| 60 | Given the pilot period of performance is 90 days, is the requirement for option year pricing relevant? If yes, what is the scope of work to be priced for the option period? “Instructions to Offeror” document, page 8, section L “Business Quote”, the requirement reads, “Pricing shall include all anticipated costs to fully perform and satisfy all objectives and requirements identified in this Proposal, including option year pricing. | At this stage vendors should only submit pricing proposals for conducting PoCs as outlined in the Statement of Objectives. The reference in the Instructions to Option Periods, and Option Year Pricing is an error. |
| 61 | Are you looking for OOTB dashboard analytics that can be easily integrated with 3rd party SIEM tools and data repositories? | Yes, we would like the solution to pull telemetry data to feed into SIEM tools. |
| 62 | Is it the NIH's intent for OEMs to respond to the RFP directly or to be teamed with a VAR or SI partner? | Please refer to Question 13 above. |
| 63 | Does the solution need to integrate with third-party SIEM tools for real-time alerting and reporting? | Yes |
| 64 | Given the short period of time between the Q&A period and the due date, would NIH consider granting vendors an extension on the RFP due date? | Please refer to question 21 above. |
| 65 | Is there a requirement for an MFA-supported method to enable self-service capabilities? Password and Account reset, Devices enrollment and unenrollment functionality" | Yes, see “Self-Service” requirements under Authentication in RTM. |
| 66 | Can NIH clarify whether vendors should respond to the "Market Research Data and Information" question as part of their Volume 2 RFP response? The question seems to suggest that it will come after the POC: "At the conclusion of the PoC vendors shall provide a report focused on next steps in the form of an Enterprise-Wide Adoption Plan." | Vendors shall not provide an Enterprise Wide Adoption Plan until PoCs have been concluded. Please do not include information about enterprise adoption as part of the Volume 2 RFP response. |
| 67 | Will you require a centralized cloud directory to support external users not being managed in AD or Azure? If so, can you discuss the use case for this audience segment? | NIH requires a solution capable of aggregating identities from multiple sources into a single view (see “Virtual Directory Services” requirements in RTM). |
| 68 | Can NIH further define what "follow on" work refers to in the statement: Any follow-on award(s) from this Pilot Project will be based on an award to a Prime Vendor awarded project. Vendors not included in the Pilot Project as a Prime Vendor will not be eligible for participation in a follow-on project. | Please refer to Question 58 above. |
| 69 | Do you currently use a Identity Proofing solution? If Yes, what is it? | For external users, NIH leverages in-house identify proofing as well as external services such as ID.me and Login.gov |
| 70 | The instructions to offerors indicates that answers to questions will be posted on ebuy and that final responses should be submitted via ebuy - will NIH consider a different method of information exchange as many OEMs do not have access to ebuy? | Please refer to Amendment 1. Instructions changed from eBuy to SAM.gov |
| 71 | Are there any external Identity Provider (IdP) Federation Services required? | Yes, as indicated in SOO Appendix A (e.g., AUT-TI-13) |
| 72 | Does this mean the contemplated contracting approach is a CIO GWAC (CIO-CS or SP3) and therefore offerors must be contract holders? | No. The solicitation is issued under SAM.gov and the process will follow FAR Part 15. |
| 73 | How many domains will be federated? | NIH currently has 5 CSPs: login.gov; AWS; Department of Commerce; InCommon and Google Cloud. |
| 74 | Given the contemplated approach of 'exercising' MS 2-4, does the Govt intend to provde Authorization to Proceed (ATPs) so acquisition processing times do not impact the overall 90 day target PoP? | Yes. The government will confirm the successful completion of each Milestone. Proposals should address Risk (schedules, dependencies, etc.) and indicate mitigation, work-arounds, etc. |
| 75 | Would you like our solution to Federate your identities in our environment or integrate with another IdP? | The solution must be able to integrate with other IdPs. |
| 76 | Notes eBuy however Solicitation is on SAM and does not appear to be on eBuy; further, solicitation notes part 15 in multiple areas, whereras eBuy is applicable to Part 8? | Please refer to Amendment 1. Instructions changed from eBuy to SAM.gov |
| 77 | Is this project for a Single Forest / Single Active Directory Domain? | NIH requires support for multiple AD forests and domains. |
| 78 | Will the Government please consider an extension to minimally provide industry a 2-week period from receipt of Q&A Answers? We believe there is significant risk tied to getting answers back to industry to ensure adequate and appropriate response(s) to the solution that will be mitigated with an extension. | Please refer to question 21 above. |
| 79 | Please describe any basic or advanced lifecycle management Provisioning required. | Identity Governance and Administration (IGA) is not in scope for this PoC. |
| 80 | How does this impact the contemplated production project award from a contracting perspective? Does NIH intend to issue a standalone contract(s) outside of existing GWAC vehicles? | The context of this question refers to the potential and future acquisition to acquire successful Products passing the PoC. Only those OEM products will be considered as an eligible solution for a long-term NIH solution(s). Regarding the contracting vehicle: the Acquisition Strategy for any future buy has not yet been determined. |
| 81 | Are your current applications hosted on-site? For example, IIS or Web Portal. (Y/N) NIH has a mixed environment of both on-prem applications and hosted in the cloud. | NIH has a mixed environment of both on-prem applications and cloud-hosted applications. |
| 82 | Does the following statement only apply to the OEM solutions piloted or also to the solutions provider managing the pilot effort? | Please refer to Questions 13 above. |
| 83 | Do you currently host any applications in the cloud? (Y/N) | Yes |
| 84 | If the Government receives multiple proposals including common OEMs, does the Government intend to evaluate the OEM technology multiple times, or will there be some sort of pre-POC down-select tied to the OEM(s)? | PoC selection will be based on the products that best fulfill NIH's technical and business requirements. NIH intends to use previous Request for Information (RFI) responses to downselect leading candidates to participate in PoCs (the scope of this work). Results from the PoCs will then be used in decisions for the 'next steps' and, potentially, future acquisitions. |
| 85 | Will end users be able to update their own profile information (mobile phone, etc.)? (Y/N) | Users should be able to update their own phone number. |
| 86 | Will NIH consider giving a one week extension on the PoC submission deadline? | Please refer to question 21 above. |
| 87 | Please list RADIUS supported applications that need MFA as part of this project. | As of recent, NIH no longer uses this protocol to support its systems and applications. |
| 88 | A successful enterprise deployment of an ICAM solution will need to account for additional support services to include training, strategic communications and change management, ideally through human centered design principles to maximize adoption and on-boarding of large enterprise applications. Will the government please confirm you would like professional services providers with experience in systems integration and identity management to address these critical requirements. If so, will the government please clarify instructions to offerors to invite systems integrators to bid as Prime, and will the government please include the evaluation of such capabilities in Section M. | The requirements are stated in the Statement of Objectives and Instructions. |
NIH is already working with a system integrator. Please refer to question 13 above.
| 89 | Will end users be able to register a new account for themselves (self-service)? (Y/N) | Dependent on IC-specific account request process, solution should provide self-service account registration. | |
| 90 | Compliance will be evaluated based | ||
| on the extent to which the SH is able to meet the requirements listed in the SOO. What is SH? | "SH" refers to General Services Administration (GSA) Schedule Holder (SH). Since the solicitation is released under SAM.Gov any references to Schedule Holder are to be the same as "Offeror". | ||
| 91 | Will end users be able to change their own password (self-service)? (Y/N) | Yes, as part of modernized solution. | |
| 92 | Not to Exceed per PoC ($220K) Offerors will be awarded to conduct each PoC proposed for up to / not to exceed $220K, payment will be according to the milestones outlined in the SOO. Would a vendor providing all three capabilities be limited to 660K? | Each Capability Area (Authentication, Directory Services, and SASE) is given a Contract Line Item Number (CLIN) which is further divided into four Sub Line Item Numbers (SLINs). A PoC can be proposed for one, two, or all three Capability Areas with Pricing provided for each. |
The government will not reimburse a contractor for any amount exceeding $220,000.00 per CLIN. It is important to understand that if an Offeror were to respond to more than one Capability area then they are entitled to their proposed and accepted Firm Fixed Price for each CLIN (not to exceed $220,000.00).
However, Offerors are cautioned against Proposals where CLINs are non-severable so that an Offeror is not eliminated where one Capability out of two or three does not evaluate well.
| 93 | Will there be a need to integrate mobile devices such as iOS and Android? (Y/N) | Yes, see requirement GEN-18. |
| 94 | In the instructions to Offerors NIH states: Any follow-on award(s) from this Pilot Project will be based on an award to a Prime Vendor awarded project. Vendors not included in the Pilot Project as a Prime Vendor will not be eligible for participation in a follow-on project. Does that mean if the government decides to do a related follow-on competitive bid then if a vendor didn’t prime on this pilot bid then that vendor can’t bid on the follow on competitive bid? For example NIH mentions the possibility of a future “NIH ICAM Architecture solicitation”. Does that mean if the vendor doesn't prime on this solicitation that vendor can’t prime on the "NIH ICAM Architecture solicitation"? Or is NIH referring to a “follow on award/project” directly related to these requirements and is not done as a competitive bid? | Please refer to Question 84 above. |
| 95 | Will users have the ability to access applications from a mobile device? (Y/N) | The solution should support mobile access, however, certain applications the solution integrates with may restrict mobile access. |
| 96 | RFP Section D states the entire Period of Performance for the RFP's requirements shall not exceed 90 days. RFP Section L - Business Quote indicates that Contractors shall include "option year pricing". What are the additional requirements and CLINs, Task Areas/Work Requirements and periods of performance for the option years and how many option years are contemplated by NIH? | Please refer to Question 60 above. |
| 97 | Will native deployment of mobile applications be required such as iOS and Android? (Y/N) | This is not a current requirement. |
| 98 | Many ICAM solutions can address requirements in both Authentication and Directory. Is the government open to addressing some requirements in directory with an authentication solution and vice-versa? | Please refer to question 2 above. |
| 99 | What can we expect as the level of participation and involvement from NIH CIT technical resources during the POC? | NIH CIT technical resources will work alongside vendors to provide additional information and resources as needed throughout the testing process. |
| 100 | Can NIH confirm if the signed SF-18 form should be be included within one of the proposal volumes or as a separate attachment? | The signed SF-18 form should be sent as a separate attachment along with the remainder of the proposal volumes. |
| 101 | Please confirm that the CLIN/SLINs in Capability 3 should be 003AA, 003AB, 003AC, 003AD | |
| Yes. The government confirms that Capability 3 should read as 003AA, 003AB, 003AC, and 003AD | ||
| 102 | Given the time it will take for the government to provide answers and the material impact it will have on the solutions that bidders will have to modify/update, will the government please grant an extension of the due date by 2 weeks, shifting it to August 14th? | Please refer to question 21 above. |
| 103 | Can NIH expand on the DLP requirement? | NIH would like to understand current DLP capabilities from leading SASE vendors to protect its sensitive biomedical information |
| 104 | The SOO states that NIH is “seeking original equipment manufacturers (OEMs) to participate in Proofs of Concept (PoCs) of modernized Identity, Credential, and Access Management (ICAM) infrastructure at NIH. The PoCs will provide OEM offerors the opportunity to showcase the viability of the original equipment manufacturers’ solutions and allow NIH to assess the performance characteristics and ability to integrate into the NIH environment.” |
| System integrators (SI) often work in partnership with OEMs on proofs of concept where 1) the OEM’s solution will eventually have to be integrated into an enterprise environment, 2) the proofs of concept may include the integration of multiple OEM products (e.g., integration of multivendor products across the 3 PoC areas, and 3) the use cases require some integration or a plan for integration within an enterprise environment. All three of these hold true for this solicitation. Can system integrators, working in partnership with OEMs, respond to this solicitation? | See question 13 above. | ||
| 105 | For DLP and others, are there offline requirements for the end users? | NIH users are required to comply with NIH/HHS policies and procedures related to the protection of NIH data. | |
| 106 | Does the following statement only apply to the OEM solutions piloted or also to the solutions provider managing the pilot effort? Any follow-on award(s) from this Pilot Project will be based on an award to a Prime Vendor awarded project. Vendors not included in the Pilot Project as a Prime Vendor will not be eligible for participation in a follow-on project. | PoC selection will be based on the products that best fulfill NIH's technical and business requirements. NIH intends to use previous RFI responses to downselect leading candidates to participate in PoCs (the scope of this work). Results from the PoCs will then be used in decisions for the 'next steps' and, potentially, future acquisitions. | |
| 107 | Is Split Tunneling required? | SASE is expected to replace tunneling functionality utilized in VPN. | |
| 108 | There are several use cases which can be demonstrated successfully without integration with NIH application/system. To be efficient with time and effort we prefer using non-NIH sample system/application if permissible. For example, Simple Authentication use case (SAML/OAuth/OIDC, Header-based); Is there expectation to integrate with NIH system/application to complete the use cases or any sample/demo application can be selected to complete the use case? | Products are expected to integrate with NIH Systems/Applications to complete use cases. | |
| 109 | For RTM requirement AUT-TI-03, please describe events-based authentication. | Events-based authentication refers to a method of authenticating to a system based on the occurrence of an event, such as a specific virtual meeting. | |
| 110 | For RTM requirement AUT-TI-04, please describe tenant-based authentication. | Tenant-based authentication refers to a method of authenticating to a system based on the tenant or NIH user who is doing the authenticating. | |
| 111 | For RTM requirement AUT-TI-16, please describe what is meant by custom integration. | Integrations to support both on-prem and cloud-hosted SharePoint sites. | |
| 112 | For RTM requirement AUT-TI-16, please describe what is meant by custom integration. | There is a typo, but SPS should read as Secure Proxy Server. A Secure Proxy Server is a server that hides a user’s IP address and encrypts the data to protect against threats. In terms of NIH authentication, NIH SPS is a core component of NIH Login. | |
| 113 | Please provide further detail about requirement AUT-CR-01. | The solution must allow non-NIH users to provide consent following authentication by any IdP. |
NIH also allows users to persist and reuse a “grant” consent choice for up to 1 year. If this consent choice is persisted, the UI must present the user to remove that choice at any time.
| 114 | For RTM requirement DIR-OP-03, please describe what ActiveRoles are? | ActiveRoles is an AD management tool. |
| 115 | For RTM requirement GEN-15 ("Solution shall expand mobile device support beyond devices enrolled in MobileIron"), is NIH asking if vendors can support unmanaged devices or if they can support devices that managed in other MDM solutions | The solution should support authentication from unmanaged mobile phones and devices managed by other MDM solutions . |
| 116 | Given the short suspense of the POC Milestones, how will this be factored in/enforced? | All Contractor employees working on the Project and needing access to NIH facilities or systems are required to be in compliance with the stated Security/training requirements. Offeror Proposals should address this as a risk and indicate mitigation activities (see Instructions). Firms with personnel already badged and trained should indicate this as such. Firms using personnel not already badged and nor having met training requirements should address this in their Milestone 1 (Startup and Mobilization) plans. |
| 117 | For RTM requirement S-TI-09, please clarify the scope of integration with MDCA | The Vendor's solution must be able to support all MCDA and the capabilities/services the applications provide. |
| 118 | For RTM requirement S-TI-04, please clarify is access TO the SASE solution being restricted or access to applications secured by the SASE solution being restricted. | Access to the applications secured by the SASE solution. |
| 119 | For RTM requirement S-CI-02, please clarify that this doesn't include necessary application connectors or other points of presence associated with on-prem, hybrid, colo, and public cloud resources leveraged by the customer. | NIH desires to minimize on-premises infrastructure and maintenance to the extent possible. Nonetheless, NIH encourages vendors to offer feasible solutions and recommendations to provide the enterprise with realistic expectations for their respective offerings. |
| 120 | For RTM requirement S-TI-12, please clarify what components require dedicated IP assignment. Please clarify that this doesn't include resources that might elastically scale to satisfy customer requirements. | The goal is that regardless of user location, their NIH-managed device should maintain a consistent IP address for security purposes. |
121 The Offeror’s Business Proposal shall be a separate Volume from the Technical Proposal.
Pricing shall include all anticipated costs to fully perform and satisfy all objectives and requirements identified in this Proposal, including option year pricing. Pricing for both the PoC and option year will require additonal information including 1). Is NIH requiring SASE for production for the option year?
-How many remote users?
-How many remote branches and expected throughput capacity per branch? Looking for peak branch bandwidth consumed vs connection physical capacity. For example, you have a 1G connection, but only use 300Mb/s.
-How many on-premise data center connections and expected throughput capacity per datacenter?
-How many public cloud data center connections and expected throughput capacity per datacenter?
-Is remote user to remote branch, remote branch to remote branch or remote user to remote user connectivity required?
-Are your users and branches OCONUS and wish to connect to local OCONUS PoPs?
| -Do you require multitenancy, specifically the administrators within a community to manage their own policy without affecting users in other communities? | The reference to Option Years was in error and is removed. | ||
| 122 | Regarding GEN-02, does the requirements to provide real-time metrics on end-user sessions, user activity and user transaction history, what is the requirement for data retention? | NIH relies on the enterprise SIEM solution for data retention needs that comply with federal requirements. |
| 123 | Regarding GEN-06, which specific NIST 800-53 Rev 5 standards and procedures and control families are mandatory as the publication is very broad in its scope? | |
| Essentially, products should be secure and demonstrate compliance with federal security standards such as FedRAMP | ||
| 124 | Regarding GEN-07, does the requirement for adhering to the NIST 800-63 standards and procedures include all 4 volumes of 800-63 including 800-63-3, 800-63-A, 800-63-B and 800-63C ? | NIH must adhere to 800-63-3 standards and guidelines. Adopted solutions should not prevent NIH from doing so. |
| 125 | Regarding GEN-11, does the requirement for adhering to EO14028 require the provider to provide a SBOM (Software bill of material) or provide a 3rd party components listing such as OSS (Open Source Software) or Third party software as part of the solution? | The Offeror should provide details of its solution (e.g., licensing, compliance with federal regulations, use of open source software, etc.). |
| 126 | Regarding GEN-11, does the requirement for adhering to EO14028 require the provider to attest to conformity with secure software development practices? | |
| Yes | ||
| 127 | Regarding S-OP-21, does the requirement extend to both internet and Private access? | |
| No | ||
| 128 | Regarding S-OP-19, can you please provide the currently co-managed firewalls in use? | Information regarding firewalls that will be necessary to perform the PoCs will be provided after award. |
| 129 | Regarding S-OP-19, is there a requirement to have a consistent traffic inspection capability between the existing co-managed firewalls and the proposed solution? |
| Yes | ||
| 130 | Regarding S-OP-03, does the requirement to provide SSL inspection include both internet and Private access? | Yes |
| 131 | Regarding S-OP-03, does the requirement to provide SSL inspection need to provide a minimum key size of 3072 or 4096 bit for SSL inspection? | Vendors should propose best practices and suggestions in their proposal. |
| 132 | Regarding SASE requirements for technical field SD-WAN, did NIH intend the requirements to be for ZTNA or FWaaS? Most if not all requirements listed appears to be requirements for ZTNA/FWAAS/SWG/VPN and not SD-WAN | It's possible that some requirements were misclassified. Responding to the requirement regardless of the category label is still necessary. |
| 133 | Regarding S-OP-23, does the requirement also require client-to-client traffic for SASE? | Please suggest best practices through your proposal. |
| 134 | Regarding S-CR-04 for TIC compliance, is the requirement to meet all 4 current use cases of Traditional, Branch Office, Remote User and Cloud? Specifically, is the Traditional and Cloud Use case in scope for SASE? | The traditional and cloud use case is in scope for SASE. |
| 135 | Regarding S-CR-04 for TIC compliance, does the solution need to meet all three security patterns for the Branch office use case? – 1. Branch office to Cloud Service Provider, 2. Branch office to the Web and 3. Branch Office to Agency campus? | Yes |
| 136 | Regarding S-CR-04 for TIC compliance, does the solution need to meet all three security patterns for the Remote User use case? – 1. Remote User to Cloud Service Provider, 2. Remote User to the Web and 3. Remote User to Agency campus? | Yes |
| 137 | Regarding S-CR-04 for TIC compliance, does the solution need to meet the TIC 3.0 Security Capabilities Catalog for both Remote User and Branch Office use case? | Yes. However, NIH does not have branch any offices so that should be excluded from proposals. |
| 138 | Regarding S-CR-04 for TIC compliance, which of the CISA’s TIC 3.0 security or PEP (policy enforcement point) capabilities are required? such as anti-virus inspection, Malware inspection, IPS, DLP etc | NIH expects vendors to demonstrate all of their SASE security capabilities. |
| 139 | Regarding S-CR-04 for TIC compliance, does the solution need to support INBOUND services (TIC 3.0 Traditional Use case) such as web servers from the internet? | Yes |
| 140 | Regarding S-Tl-12 for dedicated IP assignments, is this referring to the Remote user Client IP being dedicated or the SASE/ZTNA/SWG infrastructure Egress and or public NAT IP for both the remote user and branch office for Source IP based Control for SaaS access and other partner connections to whitelist NIH IP block? | The goal is that regardless of user location, their NIH-managed device should maintain a consistent IP address for security purposes. |
141 Regarding S-Tl-12 for dedicated IP assignments, can the IP be overlapped or shared with other US government agencies or is only dedicated per TENANT and only for NIH? The goal is that regardless of user location, their NIH-managed device should maintain a consistent IP address for security purposes.
| 142 | Regarding S-TL-13 for distributed point of presence/inspection points, is there a minimum number of required distributed point of presence? | No, there is no minimum. Please suggest best practices and options in your proposal. |
| 143 | Regarding S-TL-13 for distributed point of presence/inspection points, is there a requirement for a fedramp authorized OCONUS distributed point of presence? | If it is not listed in the RTM, then no. If a FedRAMP-compliant OCONUS Point of presence exists as part of your offering, please let NIH know in your RFP response. |
| 144 | Regarding S-TP-01 for IPv6, does the solution require IPv6 for Remote Users with native IPv6 based user termination? | Solution shall support IPv6 (Internet Protocol version 6) for communication over the network |
| 145 | Regarding S-TP-01 for IPv6, does the solution require IPv6 validation/attestation from the vendor or 3rd party such as USGv6 | Solution shall support IPv6 (Internet Protocol version 6) for communication over the network |
| 146 | Regarding S-TP-01 for IPv6, does the solution require IPv6 traffic for Private access traffic? | Solution shall support IPv6 (Internet Protocol version 6) for communication over the network |
| 147 | Regarding S-TP-01 for IPv6, does the solution require IPv6 traffic support for both TCP, UDP, ICMP for Private access traffic? | Solution shall support IPv6 (Internet Protocol version 6) for communication over the network |
| 148 | Regarding S-TP-02 for DNS capabilities, does this include support for integration with CISA Protective DNS? | Solution shall support DNS (Domain Name System) capabilities |
| 149 | Regarding the SASE requirements, do solutions SWG, ZTNA, FWAAS and VPN need to be integrated into a single (consistent) policy engine? | The requirements remain as they stand. Please suggest best practices and solutions accordingly. |
| 150 | Regarding the SASE requirements, does the SASE solution need to support NON windows or NON MAC devices that cannot support an agent such as IOT devices or IP enabled peripherals at the Branch office? | NIH will evaluate proposals and consider this capability. Nonetheless, all current requirements stand as such in the RTM. |
| 151 | Regarding the SASE requirements, is there a need for multi-tenancy? | NIH will evaluate proposals and consider this capability. Nonetheless, all current requirements stand as such in the RTM. |
| 152 | Regarding the SASE requirements, will NIH also require security inspection of Office 365 traffic? | NIH will evaluate proposals and consider this capability. Nonetheless, all current requirements stand as such in the RTM. |
| 153 | Regarding the SASE requirements, what is the total bandwidth at all branch office and datacenter locations? | NIH does not believe this information is required to conduct proof of concept testing. If this question is related to pricing for an enterprise solution please refer to the answer to Question 60 below. |
| 154 | Regarding the SASE requirements, what is the minimum bandwidth required per IPSEC tunnel to the Datacenter from each tenant via the SASE solution? | NIH does not believe this information is required to conduct proof of concept testing. |
| 155 | Regarding the SASE requirements, what is the minimum bandwidth required per IPSEC tunnel to the public cloud instances from the SASE solution? | NIH does not believe this information is required to conduct proof of concept testing. |
| 156 | Regarding the SASE requirements, how many VPN connections to public cloud instances (AWS, Azure, GCP, etc.), if any, are required? | NIH does not believe this information is required to conduct proof of concept testing. |
| 157 | Regarding the SASE requirements, is there a minimum and or maximum bandwidth per private access application? | NIH does not believe this information is required to conduct proof of concept testing. |
| 158 | Regarding the SASE requirements, will NIH have sufficient virtualization compute resources readily available for any required app connectors or app brokers to support the Private access ZTNA service? | If needed, NIH will provide on-premise compute infrastructure required to support the solution |
| 159 | Regarding the SASE requirements, please clarify if NIH or the provider be responsible for any additional on-prem virtualization compute requirements as part of the Private access ZTNA solution (app broker)? | Please refer the answer to Question 158 above. |
| 160 | Regarding the SASE requirements, can NIH confirm if compute resources/virtualization infrastructure is readily available for each app connector which may need to be deployed on all subnets where private apps reside? | Please refer the answer to Question 158 above. |
| 161 | Regarding the SASE requirements, should the cost of additional compute infrastructure such as virtualization requirements for app connectors or other on-premises virtual systems needed for the ZTNA service be included in this cost proposal? | Yes, if required to fulfill a vendor solution. |
| 162 | Regarding the SASE requirements, does the SASE solution need to support PIV/Smartcard authentication for mobile users to authenticate with the SASE solution? | Yes |
This is the start of the file's text. The full file is on GovTribe.
File details come from the government source that posted it. Updated .