75P00122R00044 QA_Rev 1_7.21.22.pdf

Solicitation:

Title:

Revised 7/21/2022

Question No.

Section # Page # Questions and/or Comments Government Answer

This information is a direct cut and paste from the PWS Section C.2 Scope; The Certificate Authorities (CA) are not in scope. The focus of the Audit will be on the Registration Authority (RA) and Management Authority processes being managed at the Department-level. This includes PCIF’s as well. The Certificate repositories are hosted and managed by the CA Vendor and are out of scope. The Credential Status Services (CSS)/Card Management System (CMS) are not located within the Shared Service Provider’s (SSPs – CA Vendor) infrastructure. It is being hosted within the Department’s infrastructure. The CMS is within scope, as it related the RA functions.

Reference to the CA and repositories have been removed from the "Description of item(s) to be acquired" (vi) and the PWS "Scope" (C.2) in the amendment 0001 of the solicitation.

2 B.5 CONTRACT

LINE ITEM

PRICING (IDIQ);

CLIN 1: Base 5-year Ordering Period

3 to 4 The solicitation appears to identify 11 audits in the first year, with perhaps less in subsequent years. Is this correct?

No, 11 Audit sites are anticipated per year, reference the pricing chart in Section B.5 quantities. However, the Government reserves the right to reduce the number of audits if needed,as stated in the PWS Section C.2 Scope.

3 C.2 SCOPE 5 Is Federal Public Key Infrastructure (FPKI) Annual Review Requirements Version 1.2, May 6, 2022, the correct reference for this guidance?

Yes

4 C.2.SCOPE 5 The PWS states that "The Auditor shall coordinate with HHS to select 11 sites (Audit Sites) per year for assessment". Can the government provide more (geographical) detail on these sites? Are there requirements on a certain geographic variation for site assessments?

The sites are located in various states throughout the united states. HHS has over 160 sites. The geographical detail can be provided after award. There are no geographic variation requirements.

Description of item(s) to be acquired” – Identifies the audit as encompassing, “operation and management of the HHS Shared Service Provider (SSP) Certification Authority (CA) Program, Registration Authority (RA), Repositories, Credential Status Services (CSS) and related security-relevant ancillary components (e.g., the Card Management System [CMS]).” The Solicitation is understood to be for RA audits. Are the CAs in scope? Are the CSSs, repositories and CMSs located with the SSP or HHS and are they in or out of scope?

HHS FPKI RA AUDIT QUESTIONS & ANSWERS

75P00122R00044 HHS FPKI RA Audit

1 SECTION A “(vi)

5 Several Places Several places

The solicitation identifies auditor independence in several places. It also asks the auditor to Document recommended remedies and expected time for remedy implementation and provide Plan of Actions and Milestones (POA&M) accordingly. Would participation in the design of the system practices be in conflict with the auditor independence?

It is expected that the draft and final audit reports will include findings noted as part of the audit. Along with the findings, it is expected that the auditor will provide high-level/best practice suggestions for resolving said findings. The auditor is not expected to participate in the specific design of system practices; maintaining their independence throughout the process.

6 Section C.7

REQUIREMENTS

FOR

GOVERNMENT

INFORMATION

PROCESSED ON

GOCO OR COCO

SYSTEMS; b.

Assessment and Authorization (A&A).

18 Identifies potential requirements for FISMA, Assessment and Authorization (A&A) and a valid ATO. All work on this effort is anticipated to occur on normal corporate workstations and laptops. Would an A&A and/or ATO be required?

Yes - No, it has been determined that an ATO will not be required; Section C.7 has been removed from the solicitation, and Section F.3 deliverables relevant to Section C.7, Assessment and Authorization (A&A) has been changed to "N".

7 L.6 INQUIRIES/

SUBMISSION

88 The Offeror shall submit one (1) electronic version of this completed SF1449 along with any exception to the terms and conditions or assumptions made in pricing the line items in a cover page to the Government. Would the government provide SF 1449?

This has been corrected; reference to the SF 1449 has been removed in amendment 0001.

8 L.8 TECHNICAL

PROPOSAL

INSTRUCTIONS

90 Would the government please consider changing the double spacing requirement to single space?

Also, please consider changing the font and spacing requirements for tables and graphics to 10 font size and single space?

The technical propasal can be single space, however 12 point font size is requested. Additoinally, the page count has been increase to 30 pages. This has been changed in the amendment 0001.

9 C.10 HHS

SECTION 508 AND

ACCESSIBILITY

STANDARDS

Factor 3: HHS Section 508 and Accessibility Standards

Page 26 to and

Page 90 to the RFP states that for each proposed product, platform, or service, a fully completed HHS Section 508 Evaluation Template [Accessibility Conformance Report (ACR) using the most current version of the Voluntary Product Accessibility Template (VPAT) at https://www.itic.org/policy/accessibility/vpat] must be submitted.

Would the government please verify/confirm if we are required to submit a response for Factor 3: HHS Section 508 and Accessibility Standards with Volume I - Technical Proposal?

If yes, please confirm this submission is outside the 15 page count.

A response to ALL factors is mandatory; failure to respond to any of the required factors will result in an unacceptable rating, reference Section M.4 Evaluation Methodology. Factor 3, VPAT/Section 508 is mandatory for all Government IT related contracts. The applicable form has been attached to amendment 0001 for your convenience; it is not part of the page count but may be included in your proposal as a Technical Appendix. this has been added to L.8 Technical Appendices section language in amendment 0001.

10 Factor 2: Technical Proposal

92 Instruction #2 states: A draft or preliminary schedule for the performance of tasks.

Would the government confirm the A draft or preliminary schedule can be submitted as Technical Appendices is not included in the page count?

The draft or preliminary schedule can be submitted as Technical Appendices, this has been added to L.8 Technical Appendices section language in amendment 0001.

11 Factor 2: Technical Proposal

92 Instruction #3 states: A sample of a Full Audit Results Report and Auditor Letter of Compliance completed in response to the same FPKI required RA audit.

Would the government confirm the Sample Report and Auditor Letter can be submitted as Technical Appendices is not included in the page count?

The Sample report and Auditor letter can be submitted as Technical Appendices, this has been added to L.8 Technical Appendices section language in amendment 0001.

12 Sections A & L.6 Pgs 2 & 88 Pages 2 and 88 have conflicting information regarding submission of questions and proposal submission. Page 2 states proposal submission by July 26, however page 88 states July 28. Will the Government allow / confirm July 28 by 2:00 PM ET is the correct submission date?

This has been corrected in amendment 0001; proposals are due 28 July 2022 by 4:00 pm ET.

13 Not Applicable Not Applicable

Will the Government state whether or not HHS has conducted this type of audit before? If yes, will the Government state whether it was conducted by the OIG or by a contracted firm and provide a link to the previous audit report?

Audits have previously been part of a larger contract that required the contract holder to source out the audit services.

This posed a conflict of interest for the contract holder, therefore the audit services were separated from that contract.

The previous audits reports are not releaseable.

14 Section L.8, Factor 2: Technical Proposal

Pg 90 Offerors are required to provide a sample audit report and letter of compliance with their technical proposal. Will the Government allow this sample to be provided as an appendix so it will not count against the 15 double space page allowance?

Yes, this has been added to L.8 Technical Appendices section language in amendment 0001.

15 Section L.8 Pg 89 Technical proposals are 15 pages, double spaced, with no less than 12 point font. Will the Government allow information in the margins, tables, graphics, and figures to be less than 12 point and single spaced?

The technical proposal can be single space, however 12 point font size is requested. Additoinally, the page count has been increase to 30 pages. This has been changed in L.8 Technical Appendices section language in amendment 0001.

16 Not Applicable Not Applicable

Will the Government provide their estimated level of effort to complete the audit?

The level of effort is defined in the PWS and includes compliance auditor(s) to complete the required audit at 11 audit sites, for an anticipated total of 11 audits per year, to be completed by the required 1 Oct due date. Please note, it is understood the first task order may not meet 1 Oct due to the lateness of the solicitation posting. Reference PWS Section C.2, C.2.1 and C.2.2.