RFP 951700-23-R-0018 A03.pdf

Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended, by one of the following methods:

(a) By completing items 8 and 15, and returning or (c) By separate letter or electronic communication which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE

RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by letter or electronic communication, provided each letter or electronic communication makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

E. IMPORTANT: Contractor is not is required to sign this document and return copies to the issuing office.

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

1. CONTRACT ID CODE

3. EFFECTIVE DATE 4. REQUISITION/PURCHASE REQUISITION NUMBER 5. PROJECT NUMBER (If applicable)

7. ADMINISTERED BY (If other than Item 6) CODE

STANDARD FORM 30 (REV. 11/2016)

Prescribed by GSA FAR (48 CFR) 53.243

FACILITY CODE

9A. AMENDMENT OF SOLICITATION NUMBER

9B. DATED (SEE ITEM 11)

10A. MODIFICATION OF CONTRACT/ORDER NUMBER

10B. DATED (SEE ITEM 13)

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offers is extended. is not extended.

12. ACCOUNTING AND APPROPRIATION DATA (If required) copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted;

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS.

IT MODIFIES THE CONTRACT/ORDER NUMBER AS DESCRIBED IN ITEM 14.

CHECK ONE A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE CONTRACT ORDER

NUMBER IN ITEM 10A.

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation data, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(b).

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority)

15C. DATE SIGNED

15A. NAME AND TITLE OF SIGNER (Type or print)

16C. DATE SIGNED

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

PAGE OF PAGES

6. ISSUED BY CODE

8. NAME AND ADDRESS OF CONTRACTOR (Number, street, county, State and ZIP Code) (X)

CODE

15B. CONTRACTOR/OFFEROR

(Signature of person authorized to sign)

16B. UNITED STATES OF AMERICA

(Signature of Contracting Officer)

Previous edition unusable

2. AMENDMENT/MODIFICATION NUMBER

A03

David P. Wallace

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

The purpose of this amendment is to provide responses to questions and requests for clarification. As a result of this amendment, the Solicitation Closing Date and Time is changed from August 25, 2023. PROPOSALS MUST BE RECEIVED ON OR BEFORE 12:00 PM ET ON September 01, 2023.

NO questions or clarifications concerning this solicitation shall be submitted after 3:00 PM ET ON 08/21/2023.

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

United States Agency for Global Media Office of Contracts 330 Independence Ave Washington, DC 20237

SEE BLOCK 6

951700-23-R-0018

1 1

08/21/2023

07/07/2023

X

INSTRUCTIONS (Back Page):

Instructions for items other than those that are self-explanatory, are as follows:

Item 1 (Contract ID Code). Insert the contract type identification code that appears in the title block of the contract being modified.

Item 3 (Effective date).

(1)

(2)

(3)

(4)

(5)

For a solicitation amendment, change order, or administrative change, the effective date shall be the issue date of the amendment, change order, or administrative change.

For a supplemental agreement, the effective date shall be the date agreed to by the contracting parties.

For a modification issued as an initial or confirming notice of termination for the convenience of the Government, the effective date and the modification number of the confirming notice shall be the same as the effective date and modification number of the initial notice.

For a modification converting a termination for default to a termination for the convenience of the Government, the effective date shall be the same as the effective date of the termination for default.

For a modification confirming the contracting officer's determination of the amount due in settlement of a contract termination, the effective date shall be the same as the effective date of the initial decision.

(a)

(b)

(c)

(d)

(e)

(f)

Item 6 (Issued By). Insert the name and address of the issuing office. If applicable, insert the appropriate issuing office code in the code block.

Item 8 (Name and Address of Contractor). For modifications to a contract or order, enter the contractor's name, address, and code as shown in the original contract or order, unless changed by this or a previous modification.

Items 9, (Amendment of Solicitation Number - Dated), and 10, (Modification of Contract/Order Number - Dated). Check the appropriate box and in the corresponding blanks insert the number and date of the original solicitation, contract, or order.

Item 12 (Accounting and Appropriation Data).

When appropriate, indicate the impact of the modification on each affected accounting classification by inserting one of the following entries:

(2) Accounting classification Net decrease $

Include subject matter or short title of solicitation/contract where feasible.

Item 16B. The contracting officer's signature is not required on solicitation amendments. The contracting officer's signature is normally affixed last on supplemental agreements.

(i)

NOTE: If there are changes to multiple accounting classifications that cannot be placed in block 12, insert an asterisk and the words "See continuation sheet".

Item 13. Check the appropriate box to indicate the type of modification. Insert in the corresponding blank the authority under which the modification is issued. Check whether or not contractor must sign this document. (See FAR 43.103.)

Item 14 (Description of Amendment/Modification).

Organize amendments or modifications under the appropriate Uniform Contract Format (UCF) section headings from the applicable solicitation or contract. The UCF table of contents, however, shall not be set forth in this document.

Indicate the impact of the modification on the overall total contract price by inserting one of the following entries:

(i) Total contract price increased by $

(ii) Total contract price decreased by $

(iii) Total contract price unchanged.

State reason for modification.

When removing, reinstating, or adding funds, identify the contract items and accounting classifications.

(g)

(h)

When the SF 30 is used to reflect a determination by the contracting officer of the amount due in settlement of a contract terminated for the convenience of the Government, the entry in Item 14 of the modification may be limited to --

(i) A reference to the letter determination; and

(ii) A statement of the net amount determined to be due in settlement of the contract.

(1)

(2)

(3)

(4)

(5)

(6)

STANDARD FORM 30 (REV. 11/2016) BACK

(1) Accounting classification Net increase $

USAGM Zero Trust Architecture Services/Zero Trust Implementation Services Page - 1 Response To Questions

Response to RFP Questions

Do we need to submit SF 1449 separately over and above the 3 Volumes?

Yes

Q2. On page 38 of the solicitation file, it's mentioned that "Each page must provide identification of the submitting Offeror in the header or footer." What does "identification" mean here? Can we provide our company logo in the header or more needs to be added? If yes, please let us know what.

Company logo in the header is acceptable

Are the cover/title page and table of contents excluded from the 5-page limit in Past Performance Volume as well (Vol. III)?

Yes

On page 40 of the solicitation file, it says, "The Offeror... shall follow the Technical Proposal format described below, referencing the paragraph and section numbers in the solicitation." Does it mean we have to cite/cross-refer the sections of solicitation we are responding to?

No, this will not be necessary. This was fixed in the RFP.

Is this considered a new requirement or is there an incumbent? If there is an incumbent, would you be able to share the vendor and contract number so that I can identify it in FPDS?

This is a new requirement, however, a contract to create a roadmap was awarded to GuidePoint earlier this year.

On Pages 40-41 of the solicitation file , the factors and sub-factors are arranged as follows:

L.7.1 Factor 1: Technical Design and Approach Sub-factor 1: Quality of the Methodology and

Fixed in RFP. The new RFP has been posted.

USAGM Zero Trust Architecture Services/Zero Trust Implementation Services Page - 2

Approach Sub-factor 2: Demonstrated experience integrating and implementing various ZTA tools Sub-factor 3: Demonstrated experience in multiple ZTA domains (Identity, Device, Network, Data, Application, Governance, Visibility and Analytics as well as Orchestration and Automation solutions)

However, on Page 46 of the solicitation file, the following order is given:

M.2.1 Factor 1: Technical Design and Approach Sub-factor 1 - Vendor has “demonstrated experience integrating and implementing a variety of ZTA tools” - Sub-factor 2 - Vendor has “demonstrated experience in multiple ZTA domains (Identity, Device, Network, Data, Application, Governance, Visibility and Analytics as well as Orchestration and Automation solutions”) – Sub-factor 3 - Quality of Proposal’s “Methodology and Approach

Can the due date for the response be extended? New due date is 9/1/2023

If the offeror does not have a CPARS record for a past performance reference, can a completed client questionnaire be submitted? If so, can USAGM post the required template to Sam.gov?

We will not provide a PPR template, offeror should include all pertinent information, including customer information, in the past performance section

USAGM Zero Trust Architecture Services/Zero Trust Implementation Services Page - 3

Will USAGM accept past performance references from core subcontractors?

In order to ensure the level of expertise and management needed, we will require that at least Two (2) references are from the prime.

In order to ensure that USAGM receives the level of expertise and management needed to ensure successful delivery, will the Government require that a minimum of two (2) references be from the Prime Contractor?

Yes, that is the requirement and has been reflected in the solicitation.

Will USAGM grant a 3-week extension on the proposal due date? With an estimated one week to return answers to questions, the current due date will leave a little more the one week to incorporate any required changes into technical responses.

We are extending the due date to 9/1

Cell C29 "Other Direct Costs" appears to be an added fee to the total labor costs. Can USAGM confirm if this is correct?

I believe this is correct

The SF 1449 states that the offer is due on 08/04/2023, but Section L.1 of the Solicitation/Instructions, Conditions, and Notices to Offerors or Respondents states the due date is 08/11/2023. Can USAGM please confirm that the due date is 08/11/2023?

Corrected

B.1 / C.7.4 Confirm key personnel as pricing spreadsheet is different than RFP

The key personnel consist of:

• Project Manager

• Lead Security Architect

• Lead Network Security Engineer

• Cloud (Cyber) Security Engineer

USAGM Zero Trust Architecture Services/Zero Trust Implementation Services Page - 4

• Solutions Architect

• Data and Application Security Engineer

• Compliance Engineer

• OCM Professional

The contractor is encouraged to add personnel roles based on their experience

C.1 Do all environments have a staging/test environment or will some prototypes have to be done directly in production?

Some in production

C.3 Will the existing roadmap be complete and ready to be provided upon the first day of the engagement?

Yes, the roadmap will be provided on the first day of the engagement.

C.3 Is a version of the roadmap ready for review and available to be referenced as part of the response?

No, we cannot provide the full roadmap. We have however added some of the maturity information to the RFP.

C.3.1

Approximately how many servers by environment type (e.g., on-prem servers, cloud infrastructure, mainframes, etc.) are in the environment? The description mentions 3,000 users and 10,000 user endpoints but does not mention total systems.

Combined in on-prem and cloud:

380 windows servers 10 Linux

No mainframe

USAGM Zero Trust Architecture Services/Zero Trust Implementation Services Page - 5

C.3.1

What percentage of the current environment is legacy systems? What types of legacy systems are in the environment at this point in time? What are considered legacy systems beyond broadcasting systems listed in the RFP?

We don’t have the answer to that, most legacy systems are in the environments of the entities. It is most likely less than 5%

C.3.1

Which countries are systems located in, and roughly what percentage of infrastructure is onshore vs overseas (e.g., used to support the approximately 24 overseas news bureaus)

Will be provided to successful offeror

C.3.1 Are there any restrictions or limitations for hardware/software in overseas settings?

Same limitations as for any system USAGM manages

C.5.1 What criteria is USAGM using within their Monthly Maturity Scorecard for Zero Trust and is any portion of the creation of the current monthly report automated?

Nothing implemented yet, we expect that the contractor make a recommendation.

L.1 Please confirm the due date of the response is August 11th.

We have extended the due date to 9/1

L.2 Can USAGM increase the technical proposal to 15 pages?

Yes, has been extended to 15 pages

L.7.1.2 What is the security baseline/system categorization for the existing USAGM system/network?

Moderate

USAGM Zero Trust Architecture Services/Zero Trust Implementation Services Page - 6

L.7.1.2 Will the Government be updating and maintaining the A&A Body of Evidence for the existing network to address the new ZT design?

Yes

Pricing Can the Government confirm that Offerors can update the labor categories and hours mentioned in the “ZTA Pricing Spreadsheet.xslx" based on their solution?

Yes

Pricing Can the Government please update the formula in the “ZTA Pricing Spreadsheet.xslx”, worksheet entitled “Services IGCE”, cell C33 to include the Base Year Total Labor Cost?

Yes

Pricing

Given the diverse range and numbers of tools being requesting in the RFP, is there additional flexibility to adjust LCATs to account for the various skillsets and specialists required to configure and operate said tools?

Yes

Pricing Can the Government please confirm that this is not a GSA pricing requirement and offerors may utilize commercial pricing methods to develop their Firm-Fixed Price?

Yes

L.3 Would the Government confirm that exceptions are due to the Contracting Officer's email by August 11th?

Due date was extended to August 25

USAGM Zero Trust Architecture Services/Zero Trust Implementation Services Page - 7

L.7.3, Factor 3

Requirements for M-22-09 and other Zero Trust related requirements are primarily within the last 2 Government fiscal years. Contracts/solicitations related to this topic have largely been executed in the last year.

As a result, most specific Zero Trust related programs do not have CPARS completed for their initial contract year of performance. Will the Government provide alternative means for evaluation of Past Performance beyond CPARS? If no CPARS exists, will the Government conduct outreach to Government Points of Contact for contract references to validate the relevance, customer satisfaction, quality, and efficacy of performance?

We will not provide a PPR template, offeror should include all pertinent information, including customer information, in the past performance section if no CPARS is available.

L.1

Will the Government allow for a 2 week extension after the release of answers to questions in order for Offerors to ensure an appropriate response to clarifications regarding ambiguity in the current Solicitation?

Yes

L.2, Format Will the Government allow font to be any derivation of the "Arial" family?

No

L.2 Will USAGM increase the page limitation for the Technical Volume from 10 pages to 20 pages to allow Offerors to provide their full technical solution?

Yes, will be extended to 15 pages

L.5

Where the solicitation states, "The assumptions and/or conditions shall be included in the area of the solicitation affected by the assumption and/or condition. The resolution for each shall be thoroughly detailed and documented." Will the Government allow for Assumptions to be addressed in an Appendix (not included within the page limitations of the response)

No

USAGM Zero Trust Architecture Services/Zero Trust Implementation Services Page - 8 with reference to the area of the solicitation affected by the assumption and/or condition?

L.7.2.1 (c)

Please confirm that the "Comprehensive Draft Project Management Plan" shall be either submitted upon award or can be included in an Appendix (not included within the overall page count restriction).

Upon award

L.7.2.1 (e)

Due to complexity of the response, will the Government allow the Project Schedule can be included in an Appendix (not included within the overall page count restriction)?

Schedule does not fall under page count and page count has been extended to 15 pages

L.7.1.3 (c)

Please confirm the "below performance metrics" are meant to reference those metrics outlined in section 7.1 under General Requirements, or are there additional metrics that the Government has defined?

For the purpose of the solicitation, the metrics in section 7.1 apply

General How many FISMA reportable systems are maintained in the USAGM portfolio?

42 FISMA reportable systems

General How many are on-premises vs. cloud-based systems?

Will be provided to successful offeror

General What is the network architecture today for USAGM?

Will be provided to successful offeror

General Does USAGM have a SASE solution implemented and mature?

No

General What are the technologies used for user identities and credentialing?

Azure AD

USAGM Zero Trust Architecture Services/Zero Trust Implementation Services Page - 9

General

Can USAGM provide the estimated number of employees located within the United States as well as the number of employees outside the contiguous United States (OCONUS)?

2,500 employees and contractors

General Will the Government provide a complete list of tools currently in place within its security stack?

Will be provided to successful offeror

M.2.1.6 (d)

Where the requirement establishes the need for information related to the hiring plan including "personnel to be hired from incumbents," will the Government please confirm if there is an existing incumbent for portions of this work, and if so, which companies are considered incumbents?

Fixed in RFP

M.2.1.6 (e)

Will the Government please clarify the applicability/relevance of the incumbent capture rate in the evaluation? Are there existing incumbents for specific portions of this work?

Fixed in RFP

4.1, 4.2, and

7.2.1 (c)

These sections refer to the CPMP with different delivery timeline requirements. Will the Government please confirm that the Draft CPMP is not due with the proposal, but the Draft is due 15 days after award and must be finalized within 30 days of award?

Yes, confirming that and fixed in RFP

Please confirm that this contract is only to be utilized for the purchase of initial licensing required in support of a prototype, but once the tools are selected for broader/enterprise implementation, they will be procured by USAGM via a different contract outside the scope of this contract.

Yes, the contract is only requiring prototype licensing

USAGM Zero Trust Architecture Services/Zero Trust Implementation Services Page - 10

7.4 and 7.2.2 (d)

In section 7.4 Key Personnel - it states that 8 specific Key Personnel are required. In section 7.2.2 (d) within instructions, it states that Key Personnel "may" include those 8 roles. Will the Government please remove any ambiguity and state whether this program requires the offeror to propose 8 Key Personnel to fill those defined roles?

Ambiguity removed in RFP

L.7.2.2 (d)

Where the Government provides a list of Key Personnel that "may" be applicable to the requirement, is there a minimum number of Key Personnel which the Government requires the offeror to provide?

No

Services IGCE

The Government provided an IGCE with 7 LCATS and the equivalent of 7 FTEs. However, the solicitation calls for 8 Key Personnel (pg 43) and "a list of ZTA SMEs." Please confirm that offerors may add LCATs and/or hours to the Pricing template to match the offerors proposed solution that includes the required Key Personnel and additional ZTA SMEs.

Corrected

L.7.2.2 (d)

Where the Government notes an "OCM Professional" in section 7.2.2, that role is not directly reflected in the Labor Categories of the Government's IGCE tab in the pricing volume. Will the Government please clarify whether this role is anticipated to be priced separately?

Corrected

Services IGCE Can USAGM confirm if the IGCE utilized in the pricing spreadsheet was used to inform the TMF estimates for which USAGM received approval for this effort?

No, used GSA Buy

3.1 For systems that USAGM (and it's collective 6 entities) "does not control," do those systems need to be brought into compliance with USAGM ZT policy? If so, We are not implementing for the entities IT groups. The entities have access to our network and our systems as well as applications that access our network. In addition, they have internal systems that their IT groups run independently. We are hoping that during

USAGM Zero Trust Architecture Services/Zero Trust Implementation Services Page - 11 does USAGM have the authority to direct external system owners to implement such policy?

the course of the project the entities will come aboard and be ready to move to ZTA, but that would be a separate opportunity.

8.5 Security

Where a minimum of a "Secret" clearance or ability to pass a "Noncritical-Sensitive" background investigation are required for personnel - can USAGM clarify if access to classified information/systems is required? If so, will a DD-254 be provided?

No classified systems. No DD-254 needed

4.2

Will the Government share a redacted version of the TMF Submission for reference to support contractor development of schedule and milestones aligned to that submission?

Will be provided to successful offeror

Will the Government share the current version of the roadmap for capability implementation of ZTA that was used to inform the TMF submission?

The TMF roadmap is OBE,because not all information was available at the time of the TMF request. The implementation will be based on the new roadmap and recommendations from the offeror.

3 Will the Government share key milestones as reflected in the approved TMF submission?

No

• Where prototype tools/licensing are in scope of this contract, will the Government clarify whether TMF funding will be used to purchase the selected tools for implementation across the USAGM Enterprise, or will this funding come from a different source?

• Will USAGM provide an estimate of the percentage of total TMF funding that is set aside specifically for Enterprise tools and/or licensing?

• We hope to use the TMF funding, but that depends on the cost of this contract.

• We will not provide an estimate of total funding that is set aside specifically for Enterprise tools and/or licensing?

For systems that USAGM (and it's collective 6 entities) "does not control," do those systems need to be brought into compliance with USAGM ZT policy? If so, does USAGM

For this contract we are not implementing the systems that are owned by the entities, which are internal systems that their IT groups run independently. However, the entities have access to our network and

USAGM Zero Trust Architecture Services/Zero Trust Implementation Services Page - 12 have the authority to direct external system owners to implement such policy?

our systems. They also have applications that access our network, which will have to be taken into consideration.

F.2

Where the Government states that "The Contractor shall perform all services solely at the Contractor's facility…," please clarify if the Government will accept that all work will be done at the Contractor facility, or designated employee location and not at a single Contractor facility location?

Yes, the contractor can perform work at multiple facilities

Reference SOW language, "The Contractor shall provide direct support to the USAGM ZTA... ZTA Pillar Leads...."

Does the USAGM have a different federal lead for each pillar of ZTA?

USAGM is a small organization, and leads are cross functional

L.7.1.1 (a)

Where the Government references "risks (including any required contract modifications)"… is this meant to refer to modifications required to the current Terms and Conditions of the RFP/SOW to support the proposed approach, or is it meant to consider modifications that may be made throughout the project delivery (i.e. mods to accommodate prospective changes in requirements)?

It is it meant to consider modifications that may be made throughout the project delivery

7.4 / Pg 15 and

“The proposal shall include resumes for any key personnel,”. However, all the other statements for the resume submission specifies all the key personnel resume are to be submitted. Can agency please clarify this statement mentioned in Section 7.4.

A resume is required for staff that is listed as key personnel.

Clarified in proposal

L.4 / Pg 39

The L.4 section specifies submission of signed SF 1449 form, can agency please specify if it is to be added in any specific Volume for the submission or as separate attachment?

Should be a separate document

USAGM Zero Trust Architecture Services/Zero Trust Implementation Services Page - 13

7.4 / Pg 15 and L.7.2.2 / Pg 43

The solicitation has specified the key personnel required, but no specific qualification requirements have been specified for any of the Key Personnel. Can the agency please specify any desired qualification for these Key Personnel.

No, expect contractor to use key personnel that fits into their proposed solution

L.7.3 / Pg 44

For the past performance submission, do we need to provide Past performances from the Prime only or Subcontractor past performance submission will be complaint.

Both prime and sub

What MDM is used for management of devices (Intune, Jamf, etc.)?

Intune

What SIEM is leveraged, if any, and is it internally hosted or cloud hosted?

Splunk (both)

How many and what type (Win, Mac, iOS, etc.) of devices are in scope for the SASE prototype? Will any devices be unmanaged?

25-50 devices in total with 25 users, Windows and Mac

What capabilities is USAGM looking to validate for the SASE prototype?

User provisioning, user remote access to agency resources

How many sites are in scope for network-based redirection for the SASE prototype?

2-3

USAGM Zero Trust Architecture Services/Zero Trust Implementation Services Page - 14

What is current peak bandwidth on the VPNs?

1 GB out of 4 GB available

How many sites do VPNs terminate to today?

Is full content inspection for VPN (RFC1918) type traffic, including malware defense and data loss prevention a requirement for the SASE solution?

Yes, full content inspection

Does the SASE solution require IPv6 traffic for private access/ZTNA traffic? Required as part of contract

What endpoint AV/XDR is currently being leveraged?

Cylance and Fireeye

Is co-mingling of customer data (i.e., a shared gateway model) acceptable or is data isolation per customer preferred for the SASE solution?

Isolation preferred

Is FedRAMP authorization required for the SASE solution?

Yes

L.7.3 Factor 3:

Past Performance

Can we include a commercial contract as one of the past performances? If yes, then can you please provide Past Performance Questionnaire (PPQ) template?

Yes, may be used, Federal, State, and Local are preferred

USAGM Zero Trust Architecture Services/Zero Trust Implementation Services Page - 15

Past Performance

General Is this a follow-on contract? If yes, please share incumbent and contract number.

No incumbent

General Does USAGM uses any of the major cloud service provider AWS, Azure or GCP? Azure

General Is there any initial assessment done for ZTA within the agency?

Yes

General Please confirm if citizenship is required for all key personnel or Permanent Residence and/or H1B is also acceptable?

Yes, US citizens only

General Please share Key Personnel requirements/Job details?

No, expect contractor to use key personnel that fits into their proposed solution

General Can we add additional LCAT to satisfy the requirements like training etc.?

Yes

General Can we use one of the past performances from a subcontractor?

1. It is difficult to scope a Firm Fixed Price for prototype/Proof of Concept engagements as deliverables, requirements, and schedules can change rapidly during performance of the contract. Will USAGM consider changing the services portion of this RFQ response to allow for Time & Materials (T&M) offers? Contractors

USAGM Zero Trust Architecture Services/Zero Trust Implementation Services Page - 16 would provide a quote based on an estimated level of effort and then bill according to the actual number of hours performed.

2. Can Contractor add lines to the “Product” section of the Goods pricing tab to reflect multiple SKUs/price points for each product type? For example, the Identity Governance Tool solution may be composed of 4-5 individual SKUs.

3. The Goods tab of the Pricing sheet does not include space to provide Option Year pricing. Will USAGM modify, or allow Contractors to modify, the price sheet to include Option Year pricing for Goods?

Yes, contractors can modify with their pricing information.

4. For Volume III Past Performance – are Contractors expected to pull the 3 most recent CPARS and submit with the bid, or will USAGM access those CPARS reports independently? Are Contractors permitted to provide additional past performance and reference information beyond CPARS?

We will not pull CPARS, the contractor is expected to provide them.

5. Will USAGM accept sample resumes for Key Personnel? Specific resources will not be identified until an award is made.

We want actual resumes, sample resumes could lead to personnel being used to be not qualified for the project at the level we want.

USAGM Zero Trust Architecture Services/Zero Trust Implementation Services Page - 17

6. Should the signed SF1449 be submitted as a separate attachment/volume, or part of Volume II Technical Proposal?

Separate document

7. How many users and endpoints will be part of the prototype solution? Will the prototype phase include all 3,500 users/10,000 endpoints as described in Section 3.1.1 or a smaller subset of those users/endpoints?

No, the prototype will not include all users/endpoints, the actual number would be determined in discussions with the winning offeror.

Would providing these advisory services create a perceived Conflict of Interest for participating in the eventual procurement of the recommended tool and licenses?

No conflict of interest, expectation is that contractor provides best tools in their solution

The pricing spreadsheet indicates 1880 hours per Labor Category. Are bidders permitted to change the number of hours to reflect multiple FTEs at that Labor Category or make any modifications to the hours on the pricing sheet?

Yes

L.7.2.2 (a)

The solicitation states that “The Offeror shall provide resumes for all SMEs.” While this is a useful tool to evaluate the offeror’s bench and contract preparedness, this requirement may make it difficult for the government to fairly evaluate offerors, as “SME” can be a subjective term with few benchmarks against which to

Resumes for key personnel and for personnel that the offeror considers to be SMEs assigned to the project.

USAGM Zero Trust Architecture Services/Zero Trust Implementation Services Page - 18 evaluate offerors, and offerors may have hundreds of SMEs with appropriate qualifications that will not be proposed on this contract.

This type of resume requirement is typically reserved for key personnel, whereas proposed SMEs may be reachback resources, or not otherwise permanently proposed resources.

That said, there is merit in listing the qualifications for potential SMEs for the contract, and also providing a comprehensive Org Chart.

To establish a fair and equitable evaluation baseline, will the government please remove the resume requirement for potential SMEs, or limit the resumes for SMEs to only those individuals proposed specifically for this effort?

N/A

The SAM.gov website and SF1449 list this proposal with a due date of 8/4, while the Solicitation PDF lists a due date of 8/11. Will the government please confirm that proposal responses are due on 8/11? WE have extended the due date to 9/1

L.7.3

Section L.7.3 states that “This assessment will consider the three (3) most recent relevant ratings available in the Offeror Performance Assessment Reporting System (CPARS) that are of similar size and scope to the work effort described in this solicitation.” This seems to indicate that only contracts with CPARS will be acceptable to use as past performance. Will the government please confirm that contracts without CPARS are also acceptable to use as past performance references?

We would accept contracts without CPARS, if they are relatively new. However, it is preferred to submit preferred.

USAGM Zero Trust Architecture Services/Zero Trust Implementation Services Page - 19

3.

The solicitation states that “Currently USAGM is performing a ZTA assessment and will create a roadmap for implementation.” Is USAGM conducting this ZT Assessment in-house (i.e., by USAGM employees) or is a contractor performing these services?

The roadmap was created by Guidepoint.

3.

If USAGM’s current ZT Assessment and Roadmap is being performed by a contractor, please provide the contracting company’s name and the contract number.

Will be provided to successful offeror

L.2; L.7

Volume II Technical Proposal is currently limited to 10 pages, but the quantity of information requested in section L.7 is vastly more than is feasible for a 10 page proposal response. Will the government expand this page count to 20 to allow Offerors to provide a comprehensive response?

Yes, changed to 15 pages

6.3

Section 6.3 Requires (optional) “Surge Support Staffing”.

Can the government please provide details, historical if available, on the level of surge support staffing estimated for this contract?

No details available

N/A The OCM (Organizational Change Management) position is not listed on the pricing spreadsheet. Please provide an updated spreadsheet.

OCM position added.

Tab 2

Given that the offeror will prototype solutions as part of this effort, and prior to the government making choices for the most desired solutions, what is the purpose of Tab 2 of the pricing spreadsheet?

For Independent Government Costs Estimate purposes

N/A

Is there a historical level of effort that the government used to determine skill sets/labor categories/personnel for this effort? If yes, please provide the rationale and/or historical data the government used.

No, which is why we allow contractors to change key personnel based on their solution

USAGM Zero Trust Architecture Services/Zero Trust Implementation Services Page - 20

General Question

Please confirm that it is the Government's intent to use this contract to purchase tools specific to cybersecurity and Zero Trust for the prototype.

Yes, we expect that the vendor will be able to get most tools for a prototype free

General Question Is this existing work? If so, who is the incumbent?

Not existing work, no incumbent

General Question

Please confirm that full enterprise level licensing will be purchased on a different contract or contract schedule after the prototype is complete and is not to be priced as part of the proposal.

Yes, that is the plan

SF 1449

The SF 1449 lists the due date as August 8, 2023.

However, the instructions list the due date of the proposal as August 11, 2023. Will the government please clarify the due date?

Changed to August 25

There are 8 Key Personnel, but 7 LCATS on the Pricing spreadsheet. Each LCAT has 1880 hours listed as the total hours for the LCAT. Is it the government's intent for the bidders to align the Key Personnel and other roles to the LCATs and alter the the number of hours per LCAT? If not, will the government please clarify its intent in regard to the hours per LCAT?

The updated LCAT has 8 positions now.

What tools are in currently in use for Identity Governance Tools?

Azure Active Directory

What tools are in currently in use for SASE Tools?

None

What tools are in currently in use for EDR Tools?

Cylance and Fireeye

USAGM Zero Trust Architecture Services/Zero Trust Implementation Services Page - 21

What tools are in currently in use for DLP Tools?

What tools are in currently in use for SSLO Encryption Tools?

On the pricing spreadsheet, Services IGCE tab, cell C22 is the total price. The ODCs table in the Base Year multiples this total by .00075. No other year has this fee.

What is this fee?

The Contract Access Fee (CAF) has now been removed.

What is the intended scope for SSL Decryption?

TBD

C.1 Background

The Background states "USAGM has started a broader Agency WAN transition to Software Defined Wide Area Network (SD WAN) technology from Multiprotocol Label Switching (MPLS) based on CISCO technology." Is the SD WAN CISCO technology or is MPLS CISCO Technology?

SD WAN

C.1 Background

With respect to EDR is there a specific tool that USAGM wants to expand deployment?

Cylance and Fireeye

C.1 Background

Which specific Ivanti product and modules are deployed for ITSM/ITAM?

ISM-Ivanti Service Manager, EPM-EndPoint Manager Module and ITAM-IT Asset Management

C.1 Background What SIEM is in place?

Splunk

C.1 Background

Is USAGM moving to TIC 3.0? What is the status of USAGM’s TIC 3.0 deployment?

Yes, we are planning on moving to TIC 3.0. We have not deployment it yet

USAGM Zero Trust Architecture Services/Zero Trust Implementation Services Page - 22

C.1 Background

How many internal users (fed and contractor) are there in USAGM? How many credentialed external users (public, other agencies, etc)?

C.1 Background

How many applications are open to the general public through anonymous access (no login required)?

Hosted externally

C.1 Background

How many applications require login? Of these, how many are restricted to only agency employees/contractors?

All applications require login, all are restricted to agency staff

C.1 Background

How many applications are not covered by PIV in the USAGM environment?

Will be discussed during discovery

C.4.2 Contractor Schedule

As stated, "Contractor shall create a Contractor Project Schedule that meets the requirements of the USAGM project schedule, which is based on the GSA Technology Modernization Fund (TMF) submission." Please provide the GSA Technology Modernization Fund (TMF) submission?

No, roadmap will be provided

C.6.1 Operations and Maintenance (O&M)

The scope states "The Contractor shall monitor the systems and provide a weekly analysis of the monitoring results." Are there specific metrics or statuses the government wants monitored in compliance with this requirement?

Will be discussed with the successful offeror based on recommendations made in proposal.

C.8.2 Place of Performance Is remote work allowed?

Yes

C.8.5 Security Please confirm the requirement for a clearance. Is this needed for all positions or certain roles or tasks only? If specific roles, please identify the roles or tasks.

There is no requirement for a secret clearance, it is either secret or "Noncritical-Sensitive" background investigation, as stated in the solicitation. The ability to pass this investigation is required for all positions.

USAGM Zero Trust Architecture Services/Zero Trust Implementation Services Page - 23

L.2 Preparation and Delivery Instructions

Will the government please consider increasing the page count to 25 pages? Given the amount of information and draft deliverables being required as part of the proposal submission, 10 pages is not enough to provide the required information.

Extended to 15 pages

L.3 Exceptions, L.4 Authorized Official and Submission of Proposal

Will the government please clarify instructions about the submission of exceptions and the SF1449? Should Volume I be a pdf consisting of these items and any supporting information for the pricing spreadsheet, with the pricing spreadsheet as an additional item to be submitted as an excel spreadsheet?

Pricing spreadsheet is separate.

L.6 Detailed Instructions - Price Proposal

Will the government please clarify what format the "supporting information" for the pricing spreadsheet should be in? Should this be a pdf document?

PDF with pricing spreadsheet

L.6 Detailed Instructions – Price Proposal

Will surge support be invoiced as T&M? Where should we record pricing for surge support?

Yes, optional CLIN

L.7.1.3 ( C) Demonstrated experience in multiple ZTA Domains Subfactor

The instructions reference "the below performance metrics". Will the government please clarify what metrics are being referenced?

The metrics in the table in section 7.1 apply

L.7.2.2 b Staffing Approach Sub- Factor

The instructions state "Key personnel positions may be:

"followed by a list of positions. Is it the government's intent for this to be a suggested list and bidders may create their own list or are these required Key Personnel positions?

Contractors can replace with their recommendation to support their solution

USAGM Zero Trust Architecture Services/Zero Trust Implementation Services Page - 24

L.7.2.1c Management Approach Subfactor

The instructions state the Draft Project Management Plan must be included in the proposal submission. Will the goverment please remove this draft deliverable from the page count?

No, will be done after project start

L.7.2 e Management Approach Subfactor

The instructions state the Draft Project Schedule must be included in the proposal submission. Will the government please remove this draft deliverable from page count?

No, will be done after project start

L.7.2.2 Staffing Approach Sub- Factor

Are the SMEs considered Key Personnel? Are there specific roles for the SMEs?

Yes, should be key

L.7.3 Past Performance

The instructions state the government will view CPARS for performance reviews of past work. If there aren't CPARS, may we provide a statement from the client or a Past Performance Questionnaire (PPQ)? If a PPQ is preferred, will the government please provide a template?

We will not provide a PPR template, offeror should include all pertinent information, including customer information, in the past performance section if no CPARS is available.

L.7.3 Past Performance

The instructions swtate "This assessment will consider the three (3) most recent relevant ratings available in the Offeror Performance Assessment Reporting System (CPARS) that are of similar size and scope to the work effort described in this solicitation." Are bidders to submit more than 3 Past Performance references and the government will choose what they deem to be the most relevant or should bidders only submit 3 references?

They are to submit references that are similar in size and scope, offerors should know which of their contracts are similar to the requirement.

M.2.1.7 How do the color adjectival evaluation relate to the points available in the Technical evaluation factors?

Points are based on color rating during review. For example, a rating of blue would be points in the top 10% of the proposal, red would be no points. Green would be top 25%, yellow 50%, and orange bottom 25%.

USAGM Zero Trust Architecture Services/Zero Trust Implementation Services Page - 25

Please confirm the proposal due date is August 11,2023 as indicated in the RFP because there is an August 4, 2023, reference in Document Number: 951700-23-R- 0018. September 1, 2023

Based on the size and scope of this contract can there be an extension of 2-weeks (August 25, 2023) for RFP response submission?

Section L.2: Will the Government allow up to 15 pages for the Technical Proposal? This would allow three pages for each of the sub-factors under the factors of Technical Design and Approach and Service Delivery, Operations and Management Approach.

15 pages

Section L.7.3: Will USAGM accept a Past Performance Questionnaire (PPQ), which includes all sections from the CPARS, with a client signature as an alternative to

CPARS?

Section L.7.2.2: Can the key personnel be reduced to a project manager and a security architect, as long the staffing plan illustrates how all other skills set will be covered?

If the offeror feels that this would cover the proposed solution fully, they can submit a lower number of key personnel. The Government may view this as a risk to the project.

We prefer a signed commitment letter for key personnel

Is there an incumbent? If so, can you provide the contract number for this work, and duration of support to the agency in this capacity?

No

Section C.3: Will the government provide an estimate for licenses required for the Prototype/POC work?

We expect these types of licenses to be provided for free in most cases

Confirm that this is a Firm Fixed Price (FFP) contract for all CLINs (including surge support, ODCs, etc.). Also

Surge support is

Final procurement is not included in this contract

USAGM Zero Trust Architecture Services/Zero Trust Implementation Services Page - 26 confirm that final software procurement will not be included in the ceiling for this contract.

Section C.3.1.1: Do all USAGM users go through a standard process for identity proofing and issuance of a PIV card?

Yes

Do you allow Bring Your Own Devices, or do you issue all equipment?

Moving away from BYOD

Section C.3: Will the Government provide the results of the current assessment created earlier this year and the roadmap? Have you adjusted this roadmap to align with version 2.0 of the CISA ZT maturity Model?

No, we cannot provide this. Maturity information was added to the

RFP.

Section C.1 Will the Government provide status on all USAGM OCIO projects underway that relate to ZT?

Will be provided to successful offeror

Section C.8.5: Are contractors allowed to work with an interim secret clearance?

Section C.7.1: Will the Government provide a copy of the Quality Assurance Surveillance Plan (QASP) for this contract?

At project start, it is not available at this point.

Based on the size, scope, and available specifics around the technology stack and requirements, would the Government consider a T&M contract for the proof of concept while migrating to FFP for the implementation.

No, T&M is only accepted for surge support

Sections 1 through 8, pp.

4-16

Will the government please confirm that Sections 1 through 8 of the solicitation are part of the Description/Specification/ Statement of Work and should be considered C.1, C.2, etc.?

USAGM Zero Trust Architecture Services/Zero Trust Implementation Services Page - 27

1, Background,

p. 4; 3.1.2, Systems, p. 7

Will the government please specify the legacy systems (name, if possible, and function/purpose) currently in use that are vulnerable?

1, Background,

p. 4; 3.1.1, Users, p. 7

How many users are located at overseas facilities and bureaus and what is the projected increase in user community size?

250/no projected increase

1, Background,

p. 5

What specific Zero Trust initiatives is USAGM currently pursuing?

PIV, Software baseline, Device Inventory

3, Scope of Work, p. 5

What changes to the existing ZTA Roadmap do you anticipate might be necessary?

We do not know at this point.

5.1, Ongoing Zero Trust Maturity Assessment, p.

What metrics are required on the monthly maturity scorecards?

Expect successful offeror to propose appropriate metrics

5.2, Zero Trust Architecture Use Case Support

What ZTA tools currently in use would USAGM like to retain? What ZTA tools would USAGM like to replace?

Expect successful offeror to recommend as part of the project

6, ZTA System Implementatio ns, p. 12

Which are the "critical systems" mentioned for ZTA system implementations?

6.1, Operations and Maintenance,

p. 13

What specifically will be the contractor's responsibility during the 12-month O&M period after ZTA tool installation?

Monitor new tools and processes, support creation of processes, train USAGM staff

USAGM Zero Trust Architecture Services/Zero Trust Implementation Services Page - 28

Sections 3 through 8, pp.

5-16; L.2, Preparation and Delivery Instructions, p.

38; L.7 Detailed Instructions – Technical Proposal and Past Performance Information,

pp. 40-44

Volume II, Technical Proposal, consisting of Technical Design and Approach, and Service Delivery and Operations and Management Approach, is limited to 10 pages. Considering that the proposal instructions require offerors to address each paragraph and subparagraph of the Statement of Work, which is 10 pages long, plus address the requirements for Factors 1 and 2, which are 3 pages long, and to provide a Draft Project Management Plan, which is typically more than 10 pages long, will the government please increase the Volume II page limit to at least 25 pages?

15 pages

L.7.1.3, Demonstrated experience in multiple ZTA Domains Subfactor, Item (c), p. 42;

Section 7.1

The referenced subfactor item states: "The Offeror shall provide a description of how the below performance metrics will be met and monitored." Will the government please confirm that the performance metrics mentioned are the metrics specified in Section 7.1?

Yes, confirmed

Sections 5 and 6, pp. 10-13;

L.7.1.2, p. 41

Is FedRAMP a requirement for the solution selection from various vendors?

Yes

L.7.1.2, p. 41

Does USAGM have an active or past proof of concept for ZTA? If yes, will the government share its position on preferred vendors' solutions they have found to be…