FSC_IT_Infrastructure_Assessment_Corvallis_Questions_rev.docx

1. What tools and/or processes does USDA/Corvallis currently use for the deployment of Desktop Software?

Corvallis uses Microsoft System Center (SCCM) and Group Policy.

2. What tools and/or processes does USDA/Corvallis currently use for the deployment of Patches for their Desktops?

Windows Server Update Services (WSUS), SCCM, and Group Policy.

3. Does USDA/Corvallis use IEM/Bigfix, SCCM, other tools, for software and patch management?

Yes, Corvallis uses SCCM, WSUS, and Group Policy.

4. Number of physical servers in their environment?

5. Number of virtual servers in their environment?

6. Total number of users?

7. Total number of workstations (desktops/laptops)?

8. Does USDA/Corvallis use Citrix ? If so, how many users/applications?

No.

9. Total number of active desktop applications?

All systems are setup with standard administrative software including Microsoft Office, Adobe Acrobat or Adobe Reader, Java, Adobe Flash, Microsoft System Center Endpoint Protection, and Juniper Networks Junos Pulse VPN. Individual workstations may have a variety of scientific software installed.

10. What tools/processes does USDA/Corvallis currently use for vulnerability assessment and management?

Palo Alto 500 Firewall and Microsoft System Center Endpoint Protection (SCEP).

11. Does USDA/Corvallis use Tenable?

No.

12. What tools/processes does USDA/Corvallis currently use for Intrusion Detection/Prevention?

Palo Alto 500 Firewall, Cisco ASA 5520, Cisco ASA 5510, and Microsoft System Center Endpoint Protection (SCEP).

13. What tools/processes does USDA/Corvallis currently use for two-factor authentication?

ActivClient 7.0.2.x and Windows Active Directory.

14. What tools/processes does USDA/Corvallis currently use for IT Hardware and Software Asset Management?

Windows Active Directory and SCCM.

15. What COTS applications are USDA/Corvallis currently using?

Microsoft Office, SAS, JMP, Adobe Acrobat Standard & Professional, Windows 7 Ultimate & Enterprise, Windows Server 2012, Microsoft SCCM & SCEP.

16. There are 87 remote sites, does each one need to be inspected for:

USDA ARS has 87 remote sites across the United States, only the Forage Seed and Cereal Research Unit, the Horticultural Crops Research Unit, and the National Clonal Germplasm Repository (NCGR) are will be assessed for this project.

Discover and document the locations network infrastructure.

This includes, but not limited to; copper cabling, fiber optic cabling, network switches, hubs, repeaters, storage area networks. Active Directory Domains and any other networking equipment currently installed at the sites location.

There is a virtual network diagram available but no building diagrams of IT infrastructure.

17. There are 87 remote sites, does each one need to be inspected for:

· Perimeter Fencing Yes

· Exterior Monitoring (Alarm, Video, etc.)

Yes

· Physical Access Control systems Yes

· Interior compartmentalization Yes

· Interior monitoring (Alarm, Video, etc.)

Yes

18. There are 87 remote sites, does each one need to be inspected for:

We have all of this information on hand however it is part of the bill of work.

· Telephone system Identification Yes

· Manufacturer Yes

· Model Number Yes

· Estimated Age Yes

· Services Yes

19. The Contractor shall participate with the ARS in one or more planning sessions to be scheduled by the ARS Office of the Chief Information Officer (OCIO) at time of award. Where is the CIO’s location for this meeting?

The meeting with OCIO will be conducted via teleconference.

20. Will the USDA be supplying computers with MS Office, MS Project and MS Visio?

No.

21. Can or will the some of the regular update meeting’s take place via conference call?

Yes.

22. Is there an estimated period of performance?

Must be completed by end of fiscal year 2016 (September 30, 2016), or sooner.

23. Item 14.0 states: Information about USDA networks and/or the security posture of any USDA information assets gathered or created under this SOW is sensitive but unclassified information. It is anticipated that this information will be gathered, created, stored within the primary Government work location.

Will remote work be allowed?

No.

24. What sort of change control process and related documentation will need to be followed/provided regarding the installation of additional monitoring/scanning tools (if required)?

OCIO must be informed and approve of installation of any monitoring/scanning tools.

25. Are there requirements for Security Clearances?

Yes. A background check will be required.

26. Is there a specific format the USDA wants the proposal?

Line costs for any recommended enhancements.

27. How many locations, network connections between locations, number of users/devices per location?

1 Location, 3 Units, 7 Buildings, 9 Greenhouses, 1 network connection between HCRU and FSCRU, 1 network connection out of FSCRU, 1 network connection out of NCGR, 1 network connection between NCGR and the North Farm building.

For the site Forage Seed and Cereal Research

· What are the hours of operation of this facility?

8:00am – 5:00pm

· What type of access controls are in place to the entrance of the building?

Physical key locked doors, secretary watching door, badges issued to visitors, visitor sign in/out.

For the site National Clonal Germplasm Repository

· Does the physical security analysis cover the entire location including the green houses?

Yes.

· What are the hours of operation of this facility?

8:00am – 5:00pm For the site Horticultural Crops Research

· Does the physical security analysis cover the entire location including the green houses?

Yes however there is no network infrastructure within the greenhouses.

· What are the hours of operation of this facility?

8:00am – 5:00pm