FINAL Master QA 8 29 12.docx

QUESTION: In Standard Form 1449, Block 10 is marked as Unrestricted, NAICS code 541512 and size standard $25.5M. Is the government planning to limit this solicitation to commercial businesses with this NAICS code 541512 and revenues below $25.5M?

GOVERNMENT RESPONSE: Thank you for bringing this to our attention. The USDA will amend the Combined Synopsis/Solicitation to add language that this is full and open.

QUESTION: Has the department decided to go full blast with BYOD, and then believing there is a need for a full MDM solution?

If PO’s have not been cut, nor purchase decisions made regarding MDM—please review below:

- compliments MDM to fill the “network access controls” that MDM doesn’t begin to touch

- The focus of this approach is to secure corporate data & user access, rather than securing the devices

- has “MDM-lite” capabilities that are sufficient for many organizations

- think of it like being able to firewall your information, your people and the devices

- role based, location aware, time/day sensitive access to applications, data, resources

- can be deployed on the wired & Wi-Fi side of the house, not just mobile access

- add in governance, compliance, enforcement & reporting to the above

- We have been recommending to our customers that they take a cloud-based approach to MDM and let market settle down so you’re not saddled with unexpected changes in the MDM market

* anticipate (along with many market analysts) that there will be a number of buy-outs, mergers, and players dropping out of the market over the coming 12-18 months

* this can be a managed service – zero capital expense, no on-site equipment, even the rollout & end-user helpdesk can be done without burdening your IT & telecom teams

GOVERNMENT RESPONSE: Please reference FBO for our mobility requirement. AG-3144-S-12-0016.

That’s what I’m looking at. Which is why I wonder if it’s too late to perhaps modify the requirements considered. The USDA is far more concerned about security than device management. And the MDM solutions—including the most progressive, powerful option—XXXXX—doesn’t have data, people, or firewalled device security. You need a fully automated network access control system for that. Only XXXXX provides that level of control. So, if we submitted a response that departs from the RFP requirements rather significantly, yet delivers what the department wants—will that response get consideration?

GOVERNMENT RESPONSE: The requirements presented by the USDA are written based on extensive market research. A proposal submitted in response the RFP must comply with the RFP as it is written regardless of solution being offered.

VENDOR QUESTION: Section 10.1.2 asks to list "Technical Experience on Same/Similar Projects." - Would the Government consider non-mobility related references within the past 2 years?

· Section 10.1.3 asks to list "Technical Accomplishments on Same/Similar Projects." - Would the Government consider non-mobility related references?

· Attachment 1, page 38 states "Past Performance Evaluation Criteria" and to complete the document and questionnaire provided - Would the Government accept past performance from a sub-contractor?

· Would the Government accept a single solution that includes multiple products and services together?

GOVERNMENT RESPONSE: The RFP states that the contractor shall demonstrate is abilities to ensure work products/deliverables are completed on Schedule and within the BPA price. The USDA will evaluate the most relevant, recent and similar past performance associated to this RFP.

Yes, the Government will accept past performance from a participating sub-contractor and the provided information is relevant, recent and similar.

A single solution that addresses all aspects of the PWS is required. If an alternative proposal is submitted in addition, it must also meet all requirements of the solicitation and such alternate proposal will evaluated with other proposals for consideration.

VENDOR QUESTION: XXXXX respectfully submits the following questions regarding the USDA Next Generation Mobility RFP:

1) As USDA’s Office365 Implementation is a private cloud with no direct Internet access, will USDA provide a detailed diagram and explanation of the private cloud network into the Microsoft hosted environment along with monthly average traffic and messaging statistics? This information will help with solution sizing and design.

GOVERNMENT RESPONSE: USDA will provide a detailed diagram and explanation of the private cloud network once a cloud based solution is selected as the overall best solution.

2) XXXXX respectfully requests a 30 day extension. Will USDA provide an extension to allow respondents to provide the best possible solutions?

GOVERNMENT RESPONSE: USDA has updated the RFP to reflect an extension to the closing date.

VENDOR QUESTION:

1. RFP-How does the government intend to evaluate and score the technical solution in relation to Past Performance and Price Section 10.3 expresses the Government's intention to evaluate both the technical solution and past performance in selecting a vendor, however, 10.3.1 states the evaluation criteria are past performance and price.

GOVERNMENT RESPONSE: Evaluation criteria as reflected in section 10.1.3 will be focused on price and past performance. Offers are to submit past performance reference based on most recent and relevant performance. The evaluation team will consider how recent, relevant and at what level of quality when establishing a confidence level for each offeror or teaming arrangement. No scoring will be accomplished and technical capabilities will be considered from a past performance perspective only.

2. Pricing-Will the government consider adding a CLIN for start-up costs separate and apart from the per device charge? Significant costs will be incurred to stand up the initial solution including costs for the labor, materials and other direct costs associated with program start up, testing, and initial implementation. This is true for the on-site solution in particular. We recommend a separate CLIN be added to account for these costs. Recommend it be a one-time set up charge. This provides the advantage of keeping the per device cost as low as possible especially as the volumes increase rather than having the vendors input the stand-up charges into the per device cost.

GOVERNMENT RESPONSE: No. Please provide CLIN pricing-price per device-ALL INCLUSIVE-of all associated costs.

3. Pricing-Will the government consider adding a CLIN for PMO costs separate and apart from the per device charge? Separate from the question above, the Program Management function is material. We recommend a separate CLIN for the PMO to provide greater transparency for evaluation purposes. Additionally, it provides for a lower per device cost so that when USDA decides to scale the per device cost will be more cost effective.

GOVERNMENT RESPONSE: No. Please provide CLIN pricing-price per device-ALL INCLUSIVE-of all associated costs.

4. General SOW-General Section C-Would the government consider making pre-deployment testing of applications for the app store a requirement? Testing applications before deployment through the app store helps improve the customer experience and reduce help desk calls by preventing deployment of defective applications. Testing before release to the app store is not currently a stated requirement. We recommend providing app testing before deployment through the app store be added as a requirement.

GOVERNMENT RESPONSE: We have considered this request and agree that it can be added as a potential addition to a MAM solution.

5. Pricing-Pricing-For an on-premise solution, is it correct to assume the government will supply hardware including servers for the proposed system?

GOVERNMENT RESPONSE: USDA will provide hardware for any on-premise solution. The vendor will provide all necessary specifications for the on-premise hardware.

8. General Requirements-Office 365 integration is a requirement. What BPOS version (e.g. S, D, F) has USDA implemented?

GOVERNMENT RESPONSE: The USDA is current utilizing BPOS-F.

10. MDM/Device Diversity - Windows 8 Support-3.1.1, 3.2.1-Microsoft is currently planning on releasing several version of Windows 8, to include Phone and RT for ARM. Which version(s) of Windows 8 is the solution required to support? The different versions of Windows 8 run on different platforms, ranging from mobile devices to desktops.

GOVERNMENT RESPONSE: The USDA’s requirement around Windows 8 is around the Windows mobile devices. The requirement includes both smartphones and tablets.

11. Security and Compliance - Remote Wipe-3.1.3-Please clarify the meaning of "remote wipe." For example, is rendering the data cryptographically inaccessible (e.g. erasing the keys) acceptable, or is a deeper erase (e.g. zeroization) required?

GOVERNMENT RESPONSE: The remote wipe feature must remove the data on the local device not just erase the encryption keys.

13. Security and Compliance / Device Administration-3.1.3, 3.1.4-"Can USDA provide your concept of operation or examples of how you intend certificate issuance and distribution to work?

GOVERNMENT RESPONSE: USDA is looking for the ability to load device and user certificates to mobile platforms that can be used for authentication purposes by applications like VPN, Web apps or in-house developed apps.

Also, would the USDA indicate the intended use for the different certificate types? For example, is S/MIME email required? What is the ""device authentication"" certificate authenticating the device to?" Additional clarity on the certificate requirements would be helpful to understand how the solution can support or if customizations are necessary.

GOVERNMENT RESPONSE: USDA, at this time is interested in using device and user certificates for authentication purposes. We may expand to include digital signing and encryption for email messages in the future.

14. Future State - Mobile User Types-1.3.2-Two options for "Basic Mobile Users" are given in this section. For "GFE MDM Option," should this user also have a container for USDA email and browser? Or is this user allowed to have USDA email that is not in a container?

GOVERNMENT RESPONSE: A “GFE MDM” will not require a container. It is required that GFE MDM Option does have a configured mail client that is not in a container.

16. App Store/MAM - Security Requirements-1.2.2-"""The MAM solution at a minimum must include the following application delivery lifecycle managed functionality; securing, deploying, updating, and removing both in-house and commercially developed applications."" Can USDA elaborate on what is meant by ""securing""? The only MAM security requirement seems to be securing MAM data in transit via minimum SSL 128 bit."

GOVERNMENT RESPONSE: Securing can be described as requiring only authenticated and authorized users to view or manage apps. In addition to that, application integrity should provide users and administrators ability to know if an app has been tampered with (i.e. md5 or similar).

18. Mobile Device Management-3.1.7 2.j-Can USDA clarify the requirement "Ability to track device information 2.j Encryption Capability" GOVERNMENT RESPONSE: The requirement is the ability for the vendor solution to identify and store if a device has the ability to be encrypted. USDA understands that not all devices have device or OS encryption and we want the ability to run reports on that information.

VENDOR QUESTION:

19. Enterprise App Store (MAM)-3.2.1 19-Can USDA clarify the requirement about the enterprise app store? Does USDA want more than one app store with a tiered enterprise structure? "19. Ability to support either a clustering of app stores with full sync capabilities and/or a centralized data store that can be shared across multiple app store instances" GOVERNMENT RESPONSE: The requirements don’t state a specific implementation; that is left open. The optimal solution requires minimal maintenance and oversight from USDA’s perspective and can also scale to the numbers that are listed in the requirements. The current requirement still stands that however it is implemented; it must support organization & management at multiple tiers.

VENDOR QUESTION:

1. 1.2 Does the government prefer bidders propose one solution or multiple solutions with different pricing?

GOVERNMENT RESPONSE: A single solution that addresses all aspects of the PWS is required. If an alternative proposal is submitted in addition, it must also meet all requirements of the solicitation and such alternate proposal will evaluated with other proposals for consideration.

2 2.1 (4) RFP states “The solutions must, at a minimum, support iOS (4.x and up), Android (2.2 and up), and Windows (8 and up when available)” Question: Does “Windows 8” refer to both x86 & ARM Tablets and Win8 phones, and would this include Windows8 x86 laptop devices?

GOVERNMENT RESPONSE: This requirement does not include laptops at this time. The requirement does however include smartphones and tablets.

3 3.2 (19) RFP states “The ability to support either a clustering of app stores with full sync capabilities and/or a centralized data store that can be shared across multiple app store instances.”

Question: Can the USDA supply a use case for this requirement?

GOVERNMENT RESPONSE: The use case for this requirement would primarily revolve around scaling of the app store. The number of users and number of apps could reach a threshold where multiple app store fronts are required. Also, having multiple app stores provides higher levels of reliability.

4 5.3 Can the government provide an organization chart showing the government organization that our staffing plan needs to align with?

GOVERNMENT RESPONSE: You can get a copy of the USDA’s International Technology Services organization chart at the following link: http://www.ocio.usda.gov/its/doc/OCIO_ITS_orgchart.pdf

5 5.3.2 Key Personnel Are key personnel to be identified in our proposal response or is this a post award requirement?

GOVERNMENT RESPONSE: Requirement stated in 5.3.2 is a post award requirement and must be met as stated “upon award of contract”.

6 Section 7, bullet 1 RFP states, “Provide a 7x24 help desk services that are staffed on -site at the Contractor facility 7AM – 9PM Eastern Time Monday through Friday, excluding Federal Holidays.”

Questions:

a. What citizenship, security, background checks are required for the help desk staff?

GOVERNMENT RESPONSE: The question presented is not based on this version of the Mobility RFP. It may address and/or reference material in the previous RFI. Please ensure you are looking at the current RFP.

7 Section 7, bullet 3 RFP states, “Issue USDA special broadcast email announcements as necessary and requested by USDA to facilitate agency and user notification and communication. These communications should include, but not limited to, service interruptions, major schedule changes and application maintenance. “ Questions:

What citizenship, security, background checks are required for the Level 2 and 3 staff?

GOVERNMENT RESPONSE: The question presented is not based on this version of the Mobility RFP. It may address and/or reference material in the previous RFI. Please ensure you are looking at the current RFP.

9 9.5 Please clarify which elements of the proposal response must be included in the 35-page limit.

GOVERNMENT RESPONSE: Proposed Solution

10 9.5 and 11 RFP states “QUOTATIONS SHALL BE DIVIDED INTO THE FOLLOWING PARTS:

Section 11 of the RFP states “The evaluation factors that will be considered include:

Question: Are Part 1, Proposed Solution, and Part 4, Vendor Information of our proposal response not considered for evaluation?

GOVERNMENT RESPONSE: Offerors “Proposed Solution” shall address now the offeror will meet the objectives reflected in sections, 2.1, 3, 4 and 5 of the PWS. Solution will be evaluated on a pass/ fail basis. This evaluation will focus on the offerors ability to meet the requirements of the PWS. This will not be an evaluation of the type of solution being offerored. RFP updated to reflect this clarification.

12 Attachment 1, Past Performance Evaluation Criteria When are the questionnaires due?

GOVERNMENT RESPONSE: To the contracting officer by the closing date and time identified within the RFP.

13 Attachment 1 Are completed questionnaires to be sent directly to the government? If so, who should receive the questionnaires?

GOVERNMENT RESPONSE: Yes. Danielle Knipper at: Danielle.knipper@ftc.usda.gov; by closing date and time identified within RFP.

14 Instructions for Completing Past Performance Questionnaire The RFP states, “This questionnaire broken into three parts, Part I, Part II and Part III….” Part III is not identified.

Could the government revise the questionnaire so that it is clear what part of the questionnaire is Part III?

GOVERNMENT RESPONSE: RFP is updated reflecting this clarification.

15 Instructions for Completing Past Performance Questionnaire The RFP states, “The government has requested that each offeror provide two (2) contact points within the client organization. It is the government's intent that each contact point provides a completed questionnaire for each contract.”

Would the government consider changing this requirement so that only one of the identified contact points completes the questionnaire?

GOVERNMENT RESPONSE: Yes. One point of contact for each is questionnaire completes the requirement.

16 Pricing Does the government have an estimated or anticipated roll-out schedule that we should use as the basis of our pricing and staffing plan?

GOVERNMENT RESPONSE: USDA is planning on rolling out approximately 3000 devices and the future numbers will be based on the future needs of the department.

17 General In order to develop a complete solution, we request a 14-day extension to the submission date.

GOVERNMENT RESPONSE: USDA has updated the RFP to reflect a change to the closing date.

18 2.4 Please define mobile services as described in the last sentence of the paragraph.

GOVERNMENT RESPONSE: The question presented is not based on this version of the Mobility RFP. It may address and/or reference material in the previous RFI. Please ensure you are looking at the current RFP.

20 5.2.1.4 bullet 8 Will USDA provide any necessary identity, encryption, digital signature certificates?

GOVERNMENT RESPONSE: Any certificate, except for the MDM device registration certificate, will be provided by USDA.

21 General Will USDA provide access to a certificates server if necessary?

GOVERNMENT RESPONSE: Yes, USDA will provide access to the USDA certificate server for issuing certificates.

22 General Will USDA provide access to help desk enterprise tools (e.g. BMC Remedy)?

GOVERNMENT RESPONSE: The USDA does not intend to provide access to the help desk ticket system or monitoring tools. The possibility is not ruled out but was not the intention of this RFP.

23 10.1.1 Please provide the number of mobile devices by OS and device type currently deployed at USDA

GOVERNMENT RESPONSE: See chart below.

24 10.1.1, bullet 7 Please describe what devices are currently supported by Sat links.

GOVERNMENT RESPONSE: At this time it is not known what phones, if any, are utilizing Satellite links. It can be assumed in the future that USDA will implement Satellite phones and expect to be managed by this solution.

25 10.1.2, bullet 9 Please describe your current USDA PKI infrastructure for device provisioning and management.

GOVERNMENT RESPONSE: Currently, USDA utilizes the McAfee EMM solution to produce and distribute any necessary certs for MDM. VeriSign certificates are used for https encryption for ActiveSync connections.

26 General Please describe any current synchronization systems (e.g. Microsoft ActiveSync, Blackberry Enterprise Server, etc.)

GOVERNMENT RESPONSE: USDA has both BES and Microsoft ActiveSync in order to sync email. BES is supported by Microsoft and the only access to those servers is by the console with limited rights.

VENDOR QUESTIONS:

Question 1

RFP Reference: Page 29, section 9.4 Mandatory Information to Be Submitted with Quotation, states “Entirety of quotation is limited to 35 pages (not including the BPA Order CLIN listing, resume(s), 508 compliance data, and Vendor Services)” and Page 31, Section 10.1.3.

Question: Since we are allowed to submit up to 10 references on Table 10.1.3a and the Evaluation factors that will be considered include Past Performance would the Government consider removing this portion of the Past Performance requirement from the 35 page limit in order to fully describe the Past Performance reference as it is an evaluation factor. Addressing each of the Functional areas on each reference could mean 2 or more pages per reference.

GOVERNMENT RESPONSE: Past Performance is NOT included in the 35 page requirement.

Question 2

RFP Reference: Page 29, Section 9.4 Mandatory Information to Be Submitted with Quotation “Entirety of quotation is limited to 35 pages (not including the BPA Order CLIN listing, resume(s), 508 compliance data, and Vendor Services)”, Page 22 Section 5.3.1 Staffing Plan, and Page 23 Section 5.3.2.

Question: The RFP states that “upon award of the contract, the vendor is required to produce a personnel plan outlining types of resources…”; however Section 9.4 states Resumes are not part of the page count…are we to assume that the reference to resumes is for “sample” resumes and if so, would that be only for proposed Key Personnel or would the government allow for “bios” as part of the Staffing Plan instead of “sample” resumes.

GOVERNMENT RESPONSE: Resumes are not required and have been removed from the RFP. Please remember that we are seeking an end solution. Particular individuals will not have an impact on award.

Question 3

RFP Reference: Attachment 1 – Past Performance Evaluation Criteria Document 1 – Past Performance Evaluation and Questionnaire

Question: Is the assumption that this questionnaire be filled out by our clients and submitted directly to the Government or are we to submit the completed questionnaire with our proposal submission. If the latter, would the government please remove this from the page count?

GOVERNMENT RESPONSE: Yes. Questionnaires are to be completed by vendor clients and submitted by the vendors to the contracting officer at: Danielle.knipper@ftc.usda.gov by the closing date and time of the RFP. We request that vendors submit in their RFP package a reference listing of customers they sent the questionnaires to.

Question 4

RFP Reference: Page 30, Section 10 RFP and Quote Submission Information for Vendors and Page 32, Section 11.0 Quote Consideration and Award Determination.

Question: As stated in the RFP, the Government will only be evaluating Past Performance and Pricing. How does the Government intend on evaluating the other required portions of the proposal response (Proposed Solution, Staffing Plan, Personnel, etc.) to ensure technical acceptability? Will the Technical proposal be evaluated and if so, how and will the Technical and Price be weighted to determine reasonableness?

GOVERNMENT RESPONSE: Offerors “Proposed Solution” shall address how the offeror will meet the objectives reflected in sections, 2.1, 3, 4 and 5 of the PWS. Solution will be evaluated on a pass/ fail basis. This evaluation will focus on the offerors ability to meet the requirements of the PWS. This will not be an evaluation of the type of solution being offered.

Question 5

RFP Reference: Page 29, Section 9.4, last paragraph states “The evaluation factors that will be considered include:”

Question: The paragraph appears to be incomplete. Would the government please provide the missing text?

GOVERNMENT RESPONSE: RFP updated.

VENDOR QUESTION:

We would like to submit the following questions in reference to the XXXXX solicitation package.

1) Should the solution proposed have an on premises component, should that component make use of a dedicated hardware appliance or virtual appliance?

GOVERNMENT RESPONSE: USDA’s preference would be to utilize virtual machines over physical hardware. Dedicated hardware can be used where it makes sense and is recommended by the vendor.

2) What is the current virtualization hypervisor and version where any virtual component of a proposed MDM solution may be installed?

GOVERNMENT RESPONSE: USDA currently uses VMWare vSphere 5.

3) Does the government currently employ any load balancing technology in their DMZ?

GOVERNMENT RESPONSE: USDA currently utilizes F5 load balancers.

4) Does the government wish to provide different policies for data and/or application access based on the ownership of the end device?

GOVERNMENT RESPONSE: The USDA would like to be as granular as possible when implementing security and access policies for mobile devices. Those policies, at a minimum, defined by user but also could include device, GFE vs BYOD, application and possibly location.

5) Does the government wish to provide http traffic inspection, or is there a solution that provides this functionality currently in place?

GOVERNMENT RESPONSE: USDA would provide inspection for any on-premise solution but the vendor must provide in a cloud based solution.

VENDORS QUESTIONS:

It is the vendor’s responsibility to inform and coordinate the acquisition of necessary MDM certificates. Please provide a further explanation/clarification of what is meant by this statement.

GOVERNMENT RESPONSE: Certificates used to register the device to the MDM software are considered part of the MDM solution and should be provided by the vendor.

Must be able to support connections and authentications to multiple Active Directory infrastructures (multiple Forests and Domains) Please clarify and further explain this requirement.

GOVERNMENT RESPONSE: USDA has 14 different user Active Directory forests. The proposed solution must utilize all the various forests for authentication and security policy assignment.

New system must pass Certification and Accreditation within 6 months. What does the USDA mean by certification and accreditation?

GOVERNMENT RESPONSE: All government computer systems must undergo Certification and Accreditation as per the Federal Information Security Management Act (FISMA) of 2002.

Integration with SCOM (on-premise solution only). What is SCOM?

GOVERNMENT RESPONSE: SCOM is Microsoft System Center Operations Manager. It is used to monitor all Microsoft based on-premise solutions. This is only a requirement if a Microsoft based OS.

Pricing-Section 1.2 (last sentence on Page 7) indicates that “USDA/ITS is seeking pricing by user or by device based on tiering.” Section 10.2.1 (Evaluation Criterion) indicates that “pricing will be evaluated by device”

Can USDA please adjust the evaluation criterion to be consistent with requirement outlined in Section 1.2?

GOVERNMENT RESPONSE: RFP has been updated. Tiering has been removed.

130,000 Users How many devices on average will a User be assigned?

GOVERNMENT RESPONSE: At this time, one device per user on average. In some instances the user may have 2 devices. Over time we project that the average will increase to 1 ½ devices per user on average.

3,000 devices How many users to device count?

GOVERNMENT RESPONSE: One device per user on average. In some instances the user may have 2 devices.

Section 3.3-The requirement in this section focuses on a specific method of resolving the underlying requirements that USDA has specified for a BYOD capability. The key statement from this section is – “USDA is seeking a solution that allows Government data to be securely isolated from personal data, will allow containerized applications to execute even when the device is in a disconnect state, and can be managed from the MDM solution.” There are solutions available on the market today that can provide this capability without utilizing a “container”.

The requirements in section 3.3.3 for Browser, SharePoint, and File Manager with bi-directional sync, all require online connections to an enterprise system to operate. This is in direct conflict with the requirement for the container to provide the ability for applications to operate offline.

Can USDA redefine this set of requirements to define the business objectives, rather than a specific implementation method, allowing for alternate methods to be proposed that can meet and/or exceed USDA’s requirements?

GOVERNMENT RESPONSE: USDA believes that the description of the container and respective requirements are clear as state in the RFP section 3.3.

When the device is disconnected, the user will still need to be able to access the container and be able to run the applications inside the container. If the application within the container requires a connection to back end data, it is understood that the application will not be able to function properly until the device is able to connect to the network. However, all applications within the container that use local storage on the device shall be able to function in a disconnected state.

The bi-directional synch will be used for eDiscovery, business continuity, and sharing of files between more than one device. The required functionality will synch the files between the container and USDA file servers when the device is able to connect to the USDA network. In a disconnected state the synchronization capability is essentially dormant, until connectivity is re-established and synchronization resumes.

Section 3.3-USDA calls out requirements for BYOD solutions. There is no mention of how personal data on the device will be protected against government access or control. The requirements focus on how USDA will manage government data on the device but do not address the abilities provided by MDM solution to access and control personal data on the device. Standard MDM capabilities, like access to phone call lists and the ability to wipe all data on the device, allow USDA access to personal information and the ability to destroy personal data without consent from the device owner.

Why is USDA not specifying requirements for the proposed solution to provide capabilities which protect access to personal information on the BYOD device?

GOVERNMENT RESPONSE: If your solution provides capabilities to protect personal data on personal devices, you are allowed to describe those features. USDA has not finalized the policy and security requirements for BYOD. At a minimum we need the requirements identified in the RFP.

Section 3.3.1-Requirement 5 requires the container to be encrypted with FIPS 140-2 certified or better level encryption.

FIPS certification is typically confirmed via the publicly published listing of certified vendors at http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140val-all.htm This requires solutions to be tested by NIST through a long, typically 18-24 months, process. Some vendors in the mobile market provide FIPS 140-2 validated solutions. These solution leverage certified encryption modules and the vendor certifies that the certified encryption module is being properly utilize so the certified encryption capabilities are not compromised.

Please clarify the USDA definition of Certified FIPS 140-2 encryption and what is required to prove that the provided solutions meet this requirement.

GOVERNMENT RESPONSE: We understand that we may chose a solution that is not yet fully FIPS 140-2 certified, however we require that certification of that solution be completed within a year of being awarded.

Section 3.3.1-Requirement 8 requires data transmission into/out of the container to be AES 256 encrypted.

Maintaining FIPS 140-2 certified encryption for the container while not providing the same level encryption for the data transmission effectively eliminates the encryption within the container as the total solution defaults to the lowest level encryption standard within the data stream.

Please clarify the purpose of having a lower level encryption standard for data in motion than the encryption standard for data at rest.

GOVERNMENT RESPONSE: The EAS 256 is a NIST approved cryptographic key length and is our minimum requirement.

Section 3.3.1-Requirement 6 specifies the ability to share files between applications in the container. Data can be shared between applications in multiple manners and it is not clear what USDA requires as a file sharing solution. Applications can share a common database, be able to read different file formats, or allow “cut and paste” operations between the applications.

Please clarify the definition of file sharing.

GOVERNMENT RESPONSE: The ability to “cut and paste” between applications, and the ability for two or more applications to view and/or update the same file.

VENDOR QUESTIONS:

1. Section 5.4 Milestones, Deliverables and Due Dates – Based on the complexity of the deliverables, and tasks required to complete the deliverables, what flexibility does USDA have regarding the phase durations stated?

GOVERNMENT RESPONSE: We ask that you follow the schedule originally proposed in the table regarding all milestones, deliverables as well as due dates.

2. Section 1.2 Scope states: Vendors are encouraged to respond to any of the following options or introduce other similar solutions that may fit the scope of this project.

What are the criteria USDA will use to determine which solution model will be selected? How will best value be determined?

GOVERNMENT RESPONSE: The criteria that the USDA will use to determine which solution to select is mentioned in Section 7 - 8, Evaluation Criteria.

3. 2.1 General Solution Requirements states: Timely (within 2 weeks) support of for new devices with supported OS. Does this 2 week period relate only to new mobile devices and mobile OS coming to market?

GOVERNMENT RESPONSE: USDA expects that within 2 weeks of a new device release it is supported by the proposed solution. This only covers supported OS versions. For example, when the iPhone 5 with iOS6 is released it is required that is supported within 2 weeks of its release.

4. Section 5.3 Staffing Plan – Is USDA looking for 5.3.1, Staffing Plan, to be responded to in the RFP response? If so, where can we get a copy of USDA’s organization, so that we can demonstrate the relationship between our staff and yours as requested?

GOVERNMENT RESPONSE: You can get a copy of the USDA’s International Technology Services organization chart at the following link: http://www.ocio.usda.gov/its/doc/OCIO_ITS_orgchart.pdf

5. Section 6 Basic Periods of Performance - Does the base period of performance end on this September 30th, 2012 as indicated?

GOVERNMENT RESPONSE: Clarification-base year will be date of award thru one calendar year. Option years will be based upon the original award date and out each year for a total of four years. Total period of performance is five (5) years.

6. 9.3 Submission of Quotes states: One (1) Completed, Proposed Solution Volume and any accompanying exhibits. Solution is to be included and within the RFP 35 page limit. Are the accompanying Proposed Solution exhibits excluded from the 35 page limit?

GOVERNMENT RESPONSE: At a minimum, please include information associated to sections 2,3,4,5 and 8 within the 35 page limit for proposed solution. Exhibits will be excluded from the 35 page limit.

7. 9.3 Submission of Quotes states: One (1) Completed, Proposed Solution Volume and any accompanying exhibits. Solution is to be included and within the RFP 35 page limit. Is the Proposed Solution Volume to be comprised of responses to Section 2 General Requirements and Section 3 Technical Requirements? Are any other Sections to be included in the Proposed Solution Volume?

GOVERNMENT RESPONSE: At a minimum, please include information associated to sections 2,3,4,5 and 8 within the 35 page limit for proposed solution. Exhibits will be excluded from the 35 page limit.

8. 9.5 Quotations shall be divided into the following parts: 1 through 4. Section 9.3 calls for Volumes. Would you prefer one document with 4 sections in the document, or prefer that we submit 4 separate document volumes?

GOVERNMENT RESPONSE: 4 separate volumes.

9. 9.5 Quotations shall be divided - calls for 4 parts (1.Proposed Solution, 2.Pricing of Services, 3.Past Performance and Experience of Same or Similar Projects, and 4.Vendor Information. Section 9.3 names 3 volumes (Proposed Solution Volume and exhibits, Pricing Volume and exhibits, Past Performance Volume). What is the Vendor Information part mentioned in 9.5? Is it Vendor Services? Would we respond to Sections 4 Required Outcomes, 5 Deliverables, 6 Periods of Performance, 7 Section 508 and 8 Security Requirements in this Part 4 or Volume 4? If not where would we respond to these Sections?

GOVERNMENT RESPONSE: Vendor services shall include all vendor, partners, and/or teaming agreements; all addresses, phone numbers and points of contacts for all vested parties; size of all companies participating in RFP. A listing of past performance submitted to vendor customers for Government reference.

10. 9.3 Submission of Quotes – includes a 35 page limit on the Proposed Solution Volume. Are there no limitations on the remaining 3 parts (volumes)?

GOVERNMENT RESPONSE: Correct. 35 page limit is associated with the proposed solution only.

11. 9.4 Mandatory Information - states: Entirety of quotation is limited to 35 pages (not including the BPA Order CLIN listing, resume(s), 508 compliance data, and Vendor Services). Pages shall be numbered sequentially. What document is the BPA Order CLIN listing? What document is Vendor Services? Does the sequential numbering indicate that all volumes are to be in one document? Where is the requirement to provide resumes and what resumes are requested?

GOVERNMENT RESPONSE: Vendor services shall include all vendor, partners, and/or teaming agreements; all addresses, phone numbers and points of contacts for all vested parties; size of all companies participating in RFP. A listing of past performance submitted to vendor customers for Government reference. Resumes are not required. The RFP has been updated to clarify this area.

12. In order to allow all bidders sufficient time to provide a thorough proposal, will the Government consider extending the due date for proposals by 2 weeks until Sept. 21, 2012?

GOVERNMENT RESPONSE: USDA has updated the RFP to reflect a change to the closing date

VENDOR QUESTIONS:

1 Section 3.1.1.3-Ability to support Windows 8 when available Please clarify that the government’s intent is to support Windows 8 Phone/RT, when available.

GOVERNMENT RESPONSE: The USDA intends to manage Windows 8 smartphones and tablets with the accepted solution. Laptops and desktops are not a requirement at this time.

2 Section 3.2.1.3-Ability to customize the tiering structure Please clarify that customization of the tiering structure is to support the government’s N-tier organizations (e.g., enterprise, department, agency, service, etc.)

GOVERNMENT RESPONSE: It is to support customization of each tier within the N-tier structure. In other words, each tier should be customizable, but also be able to share central or shared information. For instance, customization may include, but is not limited to, branding of the UI, setting app visibility, applying custom rules for deployment, white/black listing apps and custom rules for access and administration.

3 Section 3.3.2.7-Be able to support “Out-Of-Office” integration within the email client. Please clarify that the government intends for "Out-Of-Office" control to be managed by users through their mobile devices.

GOVERNMENT RESPONSE: Just as Outlook users can set their Out-of-Office the USDA requires the proposed mobile mail client have the same ability. Using OWA is does not fulfill that requirement.

Will the Government accept an email submission of the proposal (total package) to USDA prior to 5:00PM MTD Friday September 7th, 2012, with the hard copy and CD postmarked by Friday, September 7, 2012? We realize the Government has an aggressive schedule. Allowing these additional days will result in more comprehensive proposals and can facilitate a more efficient evaluation period.

GOVERNMENT RESPONSE: Clarification-base year will be date of award thru one calendar year. Option years will be based upon the original award date and out each year for a total of four years. Total period of performance is five (5) years.

Early submission of hard copies will be accepted. NO email RFPs will be accepted.

6 Section 9.3.1 and Attachment 1-Past Performance Volume in accordance with Section 10.1.1 and questionnaire instructions - attachment 1. Attachment 1 - Past Performance Evaluation Criteria does not appear to provide instructions as to submission of the completed questionnaire. Does the government prefer the client contact point send questionnaires directly to the Contracting Officer, and if so via what method and by what date?

GOVERNMENT RESPONSE: RFP has been updated to reflect clarification.

VENDOR QUESTIONS:

1. Section 2.1 states “Cloud service must be a private cloud dedicated to USDA or a cloud dedicated to Federal Government use only.” Specific to the “private cloud dedicated to USDA,” if the vendor can confirm the segregation of the physical hardware resources within a cloud (these physical resources are for USDA use only), will this meet the requirement?

GOVERNMENT RESPONSE: Yes.

2. Section 3.2.1, requirement #12 states “Ability to access the app store independent from MDM enrollment.” Is the requirement that end users can access the app store specifically from a mobile device without MDM enrollment?

GOVERNMENT RESPONSE: The requirement is to allow for app store access and usage without requiring any work from the MDM system. This is regardless of the originating device.

3. Section 3.2.1, requirement #12 states “Ability to access the app store independent from MDM enrollment.” Is the requirement that end users can access the app store from a desktop/laptop web console without MDM enrollment?

GOVERNMENT RESPONSE: See response above.

4. Section 3.2.1, requirement #12 states “Ability to access the app store independent from MDM enrollment.” How many devices or users will access the app store that are not enrolled in the MDM?

GOVERNMENT RESPONSE: The specific numbers are unknown at this point, but it will be a smaller percentage of the total numbers listed in the initial requirements.

5. The government has requested that each offeror provide two (2) contact points within the client organization and to provide completed questionnaires. It is the government's intent to receive the completed questionnaire(s) from the points of contact by September 7, 2012.

GOVERNMENT RESPONSE: One (1) point of contact is sufficient.

6. The PWS identifies the requirement for the MDM to scale from 3,000 to 100,000 devices. How many devices will require a container solution?

GOVERNMENT RESPONSE: We have no solid projections for BYOD at this time.

7. For the information required for submission, for the Proposed Solution Volume, the Government states the solution is to be included within the “RFP 35 page limit.” In the next section (9.4), the Government states the “entirety of the quotation is limited to 35 pages (no including the CLIN listings, resumes(s), 508 compliance data, and vendor services). Can the Government clarify whether the 35 page limit refers to the Proposed Solution Volume, or to the entire submission inclusive of the 3 volumes (Proposed Solution Volume, Pricing Volume, and Past Performance Volume)?

GOVERNMENT RESPONSE: 35 page limit is only associated to the proposed solution.

VENDOR QUESTIONS:

1. Section 1.2 or Exhibit 1 (Page 35)-Scope-If cloud solutions are acceptable are there any FISMA or FedRAMP requirements that need to be met? FISMA was defined in Exhibit 1 – Definitions but nowhere else. If FISMA compliance is required, is the requirement FISMA Low, Medium or High?

GOVERNMENT RESPONSE: Yes, all government computer systems must undergo Certification and Accreditation as per the Federal Information Security Management Act (FISMA) of 2002. However the level of requirement will not be known until the system is online based on the data being passed.

2. Section 1.3-7-Environment Description-Is USDA using Active Directory Federation Services to block external access?

GOVERNMENT RESPONSE: No.

3. Section 1.3-7-Environment Description-Does USDA have any plans to migrate away from on-premise Active Directory?

GOVERNMENT RESPONSE: USDA is moving toward a consolidating to a single AD forest but has no intentions at this time of moving that from off site or to the cloud.

4. Section 3.1.4 Item 4-11-Device Administration-What level of integration between potentially different solutions will be required? Meaning if separate solution providers are proposed to fulfill different aspects of this RFP will USDA require a single pane of glass interface for the management console?

GOVERNMENT RESPONSE: USDA does not require a single pane of glass to administer the MDM, MAM and Container solution.

VENDOR QUESTIONS:

9.3-29 Clarification Needed Per the RFP, “Past Performance Volume in accordance with Section 10.1.1 and Questionnaire Instructions-Attachment 1.”

When are the questionnaires due?

GOVERNMENT RESPONSE: Closing date and time of the RFP. RFP has been updated reflecting this information.

Who is responsible for submitting the PPQs? Does the Offeror submit them or does the Government?

Attachment 1 40 Clarification Needed Per the RFP, “2.This questionnaire broken into three parts, Part I, Part II and Part III and should be completed for the Blanket Purchase Agreement identified on the cover page (even if offeror has performed more than one contract).”

Could the government please clarify the above statement?

GOVERNMENT RESPONSE: Vendors customers are required to submit questionnaires-preferably via email. RFP has been updated correcting the conflicting information.

9.4 29 Clarification Needed Per the RFP, “Entirety of quotation is limited to 35 pages (not including the BPA Order CLIN listing, resume(s), 508 compliance data, and Vendor Services)”

GOVERNMENT RESPONSE: Only the proposed solution is limited to the 35 page requirement.

What section is considered “Vendor Services” specifically? (2.1 Professional Services or 10.2 Pricing Services?)

GOVERNMENT RESPONSE: Vendor services shall include all vendor, partners, and/or teaming agreements; all addresses, phone numbers and points of contacts for all vested parties; size of all companies participating in RFP. A listing of past performance submitted to vendor customers for Government reference. Resumes are not required. The RFP has been updated to clarify this area.

2.1 (1.) 9 Clarification needed Per the RFP, “Timely (within 2 weeks) support of for new devices with supported OS”

GOVERNMENT RESPONSE: USDA expects that within 2 weeks of a new device release it is supported by the proposed solution. This only covers supported OS versions. For example, when the iPhone 5 with iOS6 is released it is required that is supported within 2 weeks of its release.

Is the government willing to review the adoption methodology and process for supporting new devices and operating systems with the selected vendor, and base the adoption timeline on that agreed-upon methodology?

GOVERNMENT RESPONSE: Offers submitted in response the solicitation shall meet the requirements stipulated.

2.1 (3.) 9 Clarification needed “A thirty day pilot will be required after the solution is ready for production.”

Is the support required from the vendor during the pilot period to be any different than the support required during production services? If so, can the government please specify that desired level of support during the pilot period?

GOVERNMENT RESPONSE: Vendor support is required to meet the agreed upon support metrics laid out in the RFP.

Clarification needed In the course of designing a solution that best satisfies the full range of government requirements specified in this solicitation, we presume we are being encouraged to evaluate all technology options available. If the offeror’s solution design is ultimately based upon alternative technologies and/or platforms from the current solution, what is the required migration period? 3.1.4 (4.c.)

GOVERNMENT RESPONSE: The solution needs to be fully functional within 30 days after award and be ready to support mobile devices as specified in the RFP.

8.1 Clarification needed Does the government have a specific requirement for obtaining digital certification for remote or mobile devices? If so, can you please clarify/specify the conditions required by the offeror?

GOVERNMENT RESPONSE: The question presented is not based on this version of the Mobility RFP. It may address and/or reference material in the previous RFI. Please ensure you are looking at the current RFP.

5. Section 3.1.7; item -13-Inventory Management-This section pertains to reporting about encryption capability associated with devices. Please clarify that you are requesting the system to report on the ability of the device to perform onboard encryption along with type of encryption capability.

GOVERNMENT RESPONSE: The question presented is not based on this version of the Mobility RFP. It may address and/or reference material in the previous RFI.