AAC-RFP-25-002 AAC For CMMC Level 2 Compliance Service Contract RFP Questions with Answers.pdf

RFP No. AAC-RFP-25-002

AAC-RFP-25-002 For CMMC Level 2 Compliance Service Contract

ALASKA AEROSPACE CORPORATION

Contractor’s Questions and Answers

RFP No. AAC-RFP-25-002

In accordance with AAC-RFP-25-002, Alaska Aerospace Corporation (AAC) has received questions. This document assembles all the questions as of 26JUN25 and provides the best answer that is availability and has been sent to all participating contractors along with posting it on the following website: State of Alaska Online Public Notices website.

If you have any comments or questions concerning the Contractor’s question and answers, please contact BrandinBignall.ctr@AKAerospace.com. Thank you for your participation in this solicitation.

## QUESTIONS ANSWERS

01 Has AAC completed the CMMC scoping process to formally define the boundaries of its CMMC environment?

We have an outdated document

02 Has the identification of Controlled Unclassified Information (CUI) assets been completed? If so, how many CUI assets have been identified within the defined CMMC environment?

It is not current

03 How many users and devices are currently included within the defined scope of the CMMC environment?

We have approximately 50 employees and an equal number of devices.

04 Does AAC’s CMMC certification boundary include any systems or physical media that store or process CUI, and therefore require travel for an on-site assessment?

Yes

05 Per section 4.02, does the Technical Expertise page limit include team resumes?

Resumes can be added without counting against the page limit

06 Regarding the Professional Services Agreement, are vendors allowed to include exceptions provided by our legal team within the proposal or will there be a contract negotiation period following award?

Yes and yes

07 Regarding the Professional Services Agreement, are vendors allowed to include exceptions provided by our legal team within the proposal or will there be a contract negotiation period following award?

Answered above

08 Per page 2, #10 of the certifications, respondents could be asked to provide copies of Proposer’s financial records. We can submit our current and past net fees, a summary D&B report and a letter of financial stability verification from our financial institution. Will these suffice?

Yes

09 Can you please provide the following environmental/scope information, including the number of:

o Network devices o Telephony devices o Databases with CUI o Virtual servers

Approximately:

75 network devices 100 telephony devices 3 databases 10 virtual servers 6 physical servers o Physical servers o Applications

4 applications

10 Is your CUI environment fully segregated or integrated with broader IT infrastructure?

The CUI environment is mostly segregated, but not fully

11 How many individuals require access to CUI? Approximately 25 employees, but all have the potential to need access

12 Are any cloud environments (e.g., Microsoft GCC High, AWS GovCloud) part of the assessment scope?

Yes, we have a Microsoft GCC High tenant

13 Has a previous CMMC gap analysis or NIST SP 800-171 assessment already been performed?

Yes, approximately 3-4 years ago.

14 Does the organization have an existing System Security Plan (SSP) and Plan of Action & Milestones (POA&M)?

Yes, but it is outdated

15 What is the anticipated readiness level for each of the 110 NIST 800-171 controls?

Currently, we are 10-25% ready

16 What level of hands-on remediation support is expected from the vendor (e.g., advisory only vs. full control implementation)?

We are looking for a range of support and subject matter expertise. Initially, the remediation may consist of planning, but may require implementation services based on resources available to meet our target dates

17 Will the vendor be responsible for developing and maintaining documentation (e.g., policies, procedures, system diagrams)?

This is expected to be a shared responsibility between us and the vendor

18 Is stakeholder training or coaching on compliance practices included in the scope?

Yes, as required by the NIST 800-171, but could also include value-added services

19 Are there fixed deadlines for key deliverables such as gap assessments, SSP/POA&M completion, or pre-assessment review?

A timeline for services should be developed after signing a contract with the intent of being audit-ready in 18 months.

20 What format and cadence are expected for project status reporting?

To achieve our goals, weekly or bi-weekly meetings are expected

21 What is the not-to-exceed budget or budget range (if any) for this engagement?

This has not been determined yet

22 Are there any required contract vehicles or procurement systems that must be used?

Alaska Aerospace Corporation is an agency of the State of Alaska and qualifies for government pricing

23 Is there a preference for firm-fixed pricing, time-and-materials, or milestone-based billing?

Fixed-firm pricing is preferred with time/material rates for additional services that may be available on an as needed basis

24 Define what is considered to be Controlled Unclassified Information (CUI) for this assessment.

Controlled Unclassified Information is unclassified information the United States Government creates or possesses that requires safeguarding or dissemination controls limiting its distribution to those with a lawful government purpose.

25 Describe how you store, process, and/or transmit CUI. We currently adhere to the best practices for CUI management.

More information on this will be available thru the GAP analysis.

26 Describe why you store, process, and/or transmit CUI Alaska Aerospace Corporation works with US government customers.

27 Describe how and in what capacity your business is otherwise involved in or has the ability to impact the security of CUI.

See answer above

28 Do you have Microsoft Office GCC High? Yes 29 Do you have a secure enclave? Yes 30 Do you have a CUI Data Flow Diagram? Yes 31 Also, can you tell me if everyone's questions and your answers be shared by a Q&A addendum?

Yes

32 In regard to (IRT)3.01.01: Has AAC reviewed its CUI dataflow and decided that the entire organization needs to be in scope, or has AAC considered a smaller enclave to handle CUI to save on costs? Is there a preference?

Yes, and we are considering the pros and cons of the entire organization vs. a smaller enclave. We are looking for guidance as part of this contract

33 IRT 3.01.01; How many employees will be in scope? 50 34 IRT 3.01.01; How many locations are in scope? 4 35 IRT 3.01.01; How many devices are in scope?

o Desktops o Laptops o Servers o Firewall o Mobile Devices

See answers above

36 IRT 3.01.01; If using Azure, has AAC already set up a GCC or GCC Tenant or do you need to be migrated as part of this process?

We have both a GCC High and a commercial tenant. We intend to migrate to GCC High from the commercial tenant as part of this process

37 IRT 3.01.01; What cloud service providers are currently in use? Are any of them used to store, process, or transmit CUI or Security Protection Data?

See above for tenants; yes, the GCC High tenant is currently in-use for CUI data

38 IRT 3.01.01; Do you handle physical CUI, or print CUI? Yes 39 IRT 3.01.01; Do you have any bespoke or internally developed software?

Yes, we have line of business applications that may or may not be in the scope of this effort

40 IRT 3.01.02; The following tools are required for CMMC L2. Are they already in place or should they be included in the proposal?

We have some solutions in place currently and are expecting to make changes during this process. Please provide a list of tools/vendors that you work with and licensing costs as optional add-ons to the primary contract

41 IRT 3.01.02; Do all licensing costs need to be included into Submittal Form G if they are not already owned for the devices/users in scope?

• Mobile device management, if mobile devices are in scope

• SIEM (Logging tools)

• Anti-Virus

• Vulnerability Management

• Patch Management

See answer above

42 IRT 3.01.03; The RFP mentions completing some configuration; what level or percentage of configuration/implementation will Stratus be directly responsible for implementing versus providing guidance to existing IT?

This may vary from consulting to actual implementation of services based on resources available from Alaska Aerospace.

The GAP analysis needs to be completed before we can fully answer this question.

43 IRT 3.01.04; Does AAC have an existing SSP? Yes, it is dated 44 IRT 3.01.04; Does AAC have an existing SPRS Score? Unknown at this time.

45 IRT 3.01.04; Does AAC currently have any contracts with

DFARS 7019/7020/7021?

Yes

46 IRT 3.01.04; Does AAC have CAGE code? Yes

47 IRT 3.01.05; Does AAC want the bidding organization to sit through the assessment alongside AAC?

Yes

48 IRT 3.01.06; Is the expectation for ongoing support to maintain Level 2 compliance through managerial oversight such as a Virtual CISO to oversee maintenance being completed or full managed service IT support to complete ongoing maintenance and support tasks?

AAC is expecting ongoing support for up to three years. The level of involvement will be determined after the GAP analysis and POAM is updated. It is possible that there will need to be a level of managed services as a result of the initial effort

49 IRT 3.01.06; Does AAC have current IT support? Is it in the house or external?

Yes, AAC has an IT manager and and an external MSP contract.

50 IRT 4.04.01 B; Should resumes be submitted as a separate attachment altogether or should be included after Submittal Form B in the Submittal Form PDF?

They should be included after the Submittal Form

51 IRT 4.04.01 B; Do these resume pages count against the 10 page limit?

No, please limit resumes to 1 page per person.

52 Prior CMMC/NIST SP 800-171 Work; To date, what work on NIST SP 800-171 security controls has been done?

There has been a limited effort to date

53 Prior CMMC/NIST SP 800-171 Work: On a scale of 1-100 (1 being not ready at all and 100 being fully ready), where would you rank the organization’s CMMC readiness?

10-25

54 Scope of the CMMC System: Do all Alaska Aerospace employees handle CUI?

• How many do?

Approximately half (25) of the employees currently handle CUI, but at times a greater percentage could be exposed to it.

55 Scope of the CMMC System: Do all Alaska Aerospace employees handle FCI?

• How many do?

Unknown at this time

56 Scope of the CMMC System: Where is CUI currently stored? In on-premises equipment (physical servers and computers)? Or, in cloud resources (M365, AWS, etc.)?

• If yes to cloud, are you using a USG compliant version of the clouds (GCC, GovCloud, etc.)?

CUI is stored locally and in the cloud. We currently have GCC High and commercial tenants

57 Scope of the CMMC System: Are there any physical offices (other than the protected facilities at the Pacific Spaceport Complex Alaska) where Alaska Aerospace employees handle CUI? (for example: 4300 B Street, Suite 605, Anchorage, AK?)

Yes

58 Scope of the CMMC System: How many IT administrators are in the company?

There is one employed by AAC and the current MSP has IT administration responsibilities

59 Scope of the CMMC System: How many IT Security administrators are in the company?

There is one employed by AAC and we currently have a MSP and MDR company under contract

60 Scope of the CMMC System: How many external service providers of IT and IT Security support are there?

Curerntly there are two

61 Does AAC want vendors to submit the proposal forms only, or should vendors include cover letters/pages or any additional information?

Cover pages and additional materials that highlight optional product offerings are acceptable

62 Do resumes count towards the page limit in the Technical Expertise section, or are they excluded from the page count?

Resumes are excluded, but should be limited to one page per person

63 Has AAC had this type of assessment in the past? Yes 64 Does your organization have a formal process in place for regularly assessing and mitigating cybersecurity risks?

The current process is informal

65 Are cybersecurity roles formally assigned to individuals within the IT organization?

Yes

66 Is a formal security awareness training program in place? How often is training provided to users?

Yes, it is provided annually.

67 To what degree is cybersecurity integrated into the overall business strategy or mission?

Cybersecurity is valued highly at AAC and we are committed to maturing with the growing threats to our cybersecurity

68 Does AAC have an inventory of information systems that store and process CUI?

Yes

69 Approximately how many systems are in scope for CMMC compliance?

See answers above

70 Has AAC already taken steps to align with NIST SP 800-171?

What is the maturity of these initiatives?

Yes; we are 10-25% thru the process

71 How many documented IT security policies and procedures are in place? Have these been mapped to NIST SP 800-171?

Unknown at this time

72 What level of assistance will AAC require with the implementation of technical configurations?

AAC is looking for various levels of support with the CMMC, from subject matter expertise to remote configuration

73 Are you looking for the vendor to provide recommendations and be available for consulting around their implementation?

Yes

74 Or do you expect the vendor to be involved hands-on in the implementation phase?

Yes, as needed from the GAP analysis

75 Are SSPs in place for all systems that store or process CUI? If not, how many systems will require SSPs?

No, unknown at this time.

76 Does AAC have existing templates for SSPs and POAMs that the vendor can use? Or should we expect to create all security artifacts from scratch?

There are existing documents that can be referenced, but the vendor should expect to provide a complete set of documents by the end of the project

77 Will this assessment be conducted for PSCA specifically, or for AAC as a whole?

It is for AAC as a whole

78 How many IT staff members does AAC have, and of these, how many are dedicated to cybersecurity

Currently, 1 dedicated IT staff member, with other positions supporting IT operations

79 What is AAC's budget for this project? Undetermined at this time 80 Please provide a count of systems that store, process, or transmit

CUI or FCI.

a. Include endpoints, servers, storage devices, databases, network infrastructure devices, and security devices such as firewalls?

b. Include SaaS applications that are used to handle CUI or FCI, and the number of accounts on each platform?

c. Include on premises applications that are used to handle CU or FCII, and the number of accounts on each platform?

See answers above

81 Number of end users involved with storing, processing, and transmitting CUI or FCI?

See answers above

82 Number of facilities/buildings in scope? See answers above