ASH-IV SIR Q and A_Posted.pdf

ASH-IV Questions & Answers for SIR 693KA9-24-R 00004

Q# QUESTION ANSWER

Section C.5.6.2, p. C-15, Can the FAA provide more details on the systems envisioned for migration to the cloud, in terms of their current architecture, software versions, dependencies on other systems, and operating system?

Refer to C.6.1 and C.6.2 for information regarding current systems, products and technologies in use today

C.5.7 (p.C-17)

C.5.7 states "Application/Product and Technology Attachment C.7.1 includes the list of major ASH web applications that the contractor will be required to support.

There is no C.7.1 attachment. Should this be C.6.1 and C.6.2?

Yes, refer to C.6.1 and C.6.2 for information regarding current systems, products and technologies in use today

SECTION C - DESCRIPTION/SPECIFICATION/STATEMENT OF WORK

C.5.7 SECURITY SOLUTIONS DEVELOPMENT SUPPORT SERVICES

5.7.2. Cloud Services Development and Transition Support

5.6.3. System Testing and Quality Assurance

5.7.4. System Implementation

Would the government confirm that System Testing and Quality Assurance should be 5.7.3?

Confirmed, paragraph number 5.6.3 is a typo and should read 5.7.3.

SECTION F DELIVERIES OR PERFORMANCE - F.4 PLACE OF PERFORMANCE

Services required under this contract must be performed at the Contractor's facility, FAA sites, or other Government locations as directed by the Contracting Officer. FAA facilities include but are not limited to the following: HQ FAA Building, all Regional Offices, the MMAC, WJHTC, and contractor offsite facilities, as needed.

Will the government provide a listing of all FAA facilities and the number of FTE labor category per site by which will require on site contractor support?

No, this information will be provided to the awarded offeror.

SECTION G - CONTRACT ADMINISTRATION DATA

G.6 ACCOUNTING AND APPROPRIATION DATA

N/A. There is no language under this heading.

Did the government intend for there to be additional content in this Section?

This information will be populated upon award.

SECTION H - SPECIAL CONTRACT REQUIREMENTS

H.2 AMS Clauses in Full Text

AMS 3.8.2-17 Key Personnel and Facilities (July 2019), page 6 (d) The key personnel and/or facilities under this contract are:

Labor Category

• Senior Program Manager

• Software Architect

• Senior Database Administrator

Would the government confirm that the first key personnel Labor Category should read "Program Manager" in Section H.2 to align with the Labor Category description in Section

J.1 LABOR CATEGORY AND SKILL DESCRIPTIONS?

The first key personnel Labor Category of "Senior Program Manager" in Section H.2 aligns with the "Program Manager" Labor Category description in Section J.1

LABOR CATEGORY AND SKILL

DESCRIPTIONS

SECTION H - SPECIAL CONTRACT REQUIREMENTS

H.8 Small/Small Disadvantaged Business/Women-Owned/Service-Disabled Veteran Owned and HUBZone Small Business Subcontracting Goals

Work shall be allocated at least twenty-five (25) percent of the contract dollar value to small businesses over the full life of the contract. This twenty-five percent of the contract dollar value for small businesses is further broken down and allocated as follows: (14) percent to Small Disadvantaged Businesses (SDB), five (5) percent to Socially and Economically Disadvantaged Business (SEDB) 8(a), three (3) percent to Service-Disabled Veteran-Owned Small Business (SDVOSB), two (2) percent to Women-Owned Small Business (WOSB) firms, and/or Economically Disadvantaged Women-Owned Small Business (EDWOSB) firms or a small business if no SEDB 8(a), SDVOSB, HUBZone small businesses and one (1) percent to Historically Underutilized Business Zone (HUBZone) small businesses.

The end of the sentence includes the following: "and/or Economically Disadvantaged Women-Owned Small Business (EDWOSB) firms or a small business if no SEDB 8(a), SDVOSB, HUBZone small businesses and one (1) percent to Historically Underutilized Business Zone (HUBZone) small businesses."

Please confirm that the government intended to allow vendors to work with any of the specified small business designations in order to satisfy the small business subcontracting requirements.

See Amendment 0001 for updated language at H.8.

SECTION H - SPECIAL CONTRACT REQUIREMENTS - H.16 Contractor Personnel

e. Personnel Security Requirements

All contractors working with ASH systems, resources or information must meet the background investigation requirements of FAA Order 1600.1, Personnel Security Program and FAA Order 1600.72, Industrial Security Program. Given the sensitive nature of work performed by ASH, all contractor positions are considered high risk positions. Consequently, all contractor personnel must be willing to submit to a FAA background investigation and complete the following forms: Form SF- 85P, Questionnaire for Public Trust; Form FD-258, FBI Fingerprint Chart; and DOT Form 1631, Disclosure and Authorization Pertaining to Consumer Reports Pursuant to the Fair Credit Report Act.

In addition, the contractor personnel supporting ASH classified functional areas, operations or facilities will be required to complete SF86 forms to obtain a national security clearance. The contractor company will require a Top-Secret facility security clearance.

To ensure that offerors put forward the most appropriate pricing and management approach, would the government please provide (for each SOW area), the labor categories anticipate and the number of cleared individuals and clearance level required for each individual needed? For example, the offeror needs 4 Junior Cloud Application Developers - in Service Area G, what are the personnel security clearances levels needed for each FTE

The contractor is only required to hold a Secret Facility Clearance.

FAA/ASH will process all contractors on this contract for Public Trust background investigations. If necessary, ASH will coordinate through established processes with the DOD National Industrial Security Program for any required security clearance background investigations and/or clearances.

SECTION H - SPECIAL CONTRACT REQUIREMENTS - H.16 Contractor Personnel

e. Personnel Security Requirements

All contractors working with ASH systems, resources or information must meet the background investigation requirements of FAA Order 1600.1, Personnel Security Program and FAA Order 1600.72, Industrial Security Program.

Given the sensitive nature of work performed by ASH, all contractor positions are considered high risk positions. Consequently, all contractor personnel must be willing to submit to a FAA background investigation and complete the following forms: Form SF-85P, Questionnaire for Public Trust; Form FD-258, FBI Fingerprint Chart; and DOT Form 1631, Disclosure and Authorization Pertaining to Consumer Reports Pursuant to the Fair Credit Report Act.

In addition, the contractor personnel supporting ASH classified functional areas, operations or facilities will be required to complete SF86 forms to obtain a national security clearance. The contractor company will require a Top-Secret facility security clearance.

Would the government confirm each role that WILL require a Top Secret/ Sensitive Compartmented Information (TS/SCI) for this work?

AND/OR as it relates to incumbent personnel capture, a list of roles that were previously TS/SCI required that are now optional or TS no longer required?

(Alternative question: If TS/SCI is not a requirement for certain positions, will the government confirm the roles that COULD support a candidate with a TS/SCI clearance if the individual wanted to maintain an active TS throughout their time on this program?)

Will the government please confirm the security clearance level required for each labor category listed in Section J-1?

The contractor is only required to hold a Secret Facility Clearance.

There are no Top Secret requirements on this contract.

SECTION H - SPECIAL CONTRACT REQUIREMENTS

H.16 Contractor Personnel, e. Personnel Security Requirements, paragraph 3

The contractor company will require a Top-Secret facility security clearance. Section M.4.1 Volume I Minimum Capability Qualification indicates that "The FAA will evaluate whether the offeror demonstrated that it has a Facility Security Clearance Level of Secret as of the release date of this

SIR."

Would the government confirm that a Facility Security Clearance Level of Top Secret is required as of the release date of this SIR?

The contractor is only required to hold a Secret Facility Clearance as of the release date of this SIR. There are no Top Secret requirements on this contract.

H.20 (p. H-12)

Hence, The FAA has a requirement to comply with the provisions of SECTION 508 of the Rehabilitation Act as amended (as of June 21, 2001) and requires the contractor to provide any information as to their capacity to comply with requirement along with your technical and proposal.

There is no mention of where to address capacity in SIR Sections L&M. Please clarify if this is required in the proposal, and, if so, in which volume should we provide this information.

The provisions of Section 508 will be listed for the offerors in Section H of the SIR.

SECTION I - CONTRACT CLAUSES

I.2 Clauses In Full Text

AMS 3.8.9-7 Federal Acquisition Supply Chain Security Act Orders, page 17 [The Contracting Officer must select either “yes” or “no” for each of the following types of FASCSA orders:]

Is this contract subject to one or more of the listed FASCSA orders?

No. Offerors are not required to address this in their proposals.

AMS 3.8.2-17 (p. H-6)

J.1 (p. J-2) (d) The key personnel and/or facilities under this contract are Labor Category

• Senior Program Manager.

The key personnel labor categories for this contract are listed below:

• Program Manager (1).

The SIR includes references to key personnel positions “Program Manager” and “Senior Program Manager”.

Section AMS 3.8.2-17 refers to that labor category as “Senior Program Manager”.

Section J-1 refers to the labor category as “Program Manager”.

Please clarify that “Program Manager” and “Senior Program Manager” are the same labor category and not separate roles.

Please clarify the title of that key personnel position.

The first key personnel Labor Category of "Senior Program Manager" in Section H.2 aligns with the "Program Manager" Labor Category description in Section J.1

LABOR CATEGORY AND SKILL

DESCRIPTIONS

J.1 (p.J-2 and p.J-10)

On p. J-2 Qualifications for the Program Manager and Technical Project Manager labor categories, Project Management Professional (PMP), Portfolio Management Professional (PfMP), Program Management Professional (PgMP) or equivalent project or program management certification is required.

On page J-10, the labor category description for Program Manager (key personnel) does not indicate a requirement for a PMP, PfMP, PgMP or equivalent certification.

Please confirm the certification requirement for the Program Manager (key personnel) labor category.

The Program Manager (Key Personnel) Labor Category requires Project Management Professional (PMP), Portfolio Management Professional (PfMP), Program Management Professional (PgMP) or equivalent project or program management certification.

J.1 (p.J-2 thru J-16), J.2 (p.J17 thru J-27), and L.2 Price Model

J.1 Management Services Paragraphs A and B identifies Project Control Analyst, Technical Project Manager, Administrative Project Manager, and Task Leader as labor categories. J.2 and L.2 Price Model also include these labor categories.

However, J.1 does not include labor category descriptions for these four LCATS.

Will the FAA provide labor category descriptions in J.1 for Project Control Analyst, Technical Project Manager, Administrative Project Manager, and Task Leader?

Refer to Section J.1, "Management Services" section on Page J-2 for the descriptions of these labor categories.

J.1 LABOR CATEGORY AND SKILL DESCRIPTIONS

Software Architect (Key Personnel) The labor category requirements for Software Architect requires MCAD or equivalent certification. Based on the labor category description, this role appears to be an architecture-focused role vs. a developer-focused role.

Would the government confirm that equiavlent certifications to MCAD include SAFe 6 Agilist, Certified Scrum Master, AWS Certified Architect, or Security + (CompTIA)?

MCAD certification has been retired by Microsoft. It is no longer a requirement for the "Software Architect" or "Senior Software Engineer" labor categories in Section J.1

J.1.B (p.J-2)

J.1 B. Qualifications states 1. The educational requirement is identical to the non-support series in the functional area that are designated as primary labor categories.

Will the FAA clarify and provide additional information that describes the "non-support series in the functional area? This statement is not clear and may be related to efast.

There is no additional explanation in the SIR regarding the "non-support series".

Section J.1, "Management Services" section, paragraph B.1 on page J-2 is deleted

Section J.1, p. J-6, also Section J.1, pp. J-12 and J-13

Would the Government confirm which certifications are valid for the MCDBA certification or adjust to "or equivalent certification"? Microsoft currently only provides a Azure Database Administrator Associate certification and no MCDBA certification.

Would the Government provide what certifications are equivalent to the MCAD certification? Microsoft no longer offers the MCAD certification.

Requirement for MCAD and MCDBA certifications is deleted, as it has been retired by Microsoft. It is no longer a requirement for "Senior Database Administrator" and "Mid-level Database Administrator" labor catergories in Section J.1.

L.2 TIME, DATE, PLACE, AND SUBMISSION OF PROPOSALS - L.2.2

Questions must be submitted to the Contracting Officer, Ms. Elisa Brown in writing not later than April 24, 2024, 5:00 pm EDT.

When does the government expect to return questions?

When the answers are approved, they will be posted.

L.2 TIME, DATE, PLACE, AND SUBMISSION OF PROPOSALS - L.2.3

Time and Date Proposals must be received by the Contracting Officer no later than 5:00 pm Eastern Daylight Time on May 24, 2024.

Would the government extend the submission deadline to allow vendors more time to adjust their proposals based on the answers to the questions?

Proposal due date has been extended to 5 pm Eastern Daylight Time on Friday, May 31.

Section L.2.5, p. L-4, L.2.5 mentions past performance questionnaires, but L.17 says CPARS will be used to evaluate past performance.

Does CPARS supersede any need for past performance questionnaires? If not, can the Government provide the past performance questionnaire template?

Refer to M.7. Government reserves the right to obtain additional past-performance information for any prime Offeror and any proposed subcontractors from CPARS.

Information from CPARS may be considered in the evaluation of an Offeror’s past performance. It will be used in conjunction with the Past Performance Questionnaire responses.

The Past Performance Questionnaire Template was provided in Section L- 19, Attachment L-1.

L.10.1 (p. L-5)

The Offeror may use oversize pages (which must be 17” x 11”)

May offerors submit oversize pages in both portrait (11"x17") and landscape (17"x11") orientation?

Proposals must be provided in standard letter size 8-1/2 by 11-inch format. The Offeror may use oversize pages (which may be either 11" x 17" or 17" x 11") where appropriate to contain complex or extensive graphic presentations. Oversize pages count as 2 pages and margin and font size requirements apply to all oversize pages. Refer to L.10. for submission instructions.

L.10.1 (p. L-5)

Proposals must be provided in standard letter size 8-1/2 by 11-inch format.

May offerors submit letter-size pages in both portrait (8.5" x 11") and landscape (11" x 8.5") orientation?

No. Proposals must be provided in standard letter size 8-1/2 by 11-inch format. Refer to L.10. for submission instructions.

Section L.10.1, p. L-5, Will the FAA confirm that tables fall under this font size requirement: "The font for graphics, illustrations, and charts must be eight point or larger."

Yes. Tables are considered the same as graphics, illustrations, charts.

L.11.2.1 (L-7)

L.16.2 (L-11) The Prime Vendor must demonstrate that the personnel proposed for the key personnel labor category positions meet the minimum requirements for those categories. Offerors must provide a resume.

(b) Offerors must complete the T&M Rate Buildup in Tab C of Attachment L.2. The Offerors must propose a single fully burdened ceiling labor rate for each labor category inclusive of all contract periods, utilizing the labor category descriptions within Attachment J-1, Labor Category and Skill Descriptions.

Tab A- TEP Summary of Attachment L-2 indicates that we should price two FTEs for the Software Architect labor category.

Please confirm that we are only required to submit one resume for the Software Architect key personnel position.

Yes, only one resume is required for the Software Architect key personnel position. Refer to Section M.4.1., Factor 5-Key Personnel.

Section H.16, (H-11)

Section L.11.2.1 (L-7) The contractor company will require a Top-Secret facility security clearance demonstrating that it has a minimum Facility Security Clearance Level of Secret as of the release date of this SIR.

Section H indicates a Top-Secret Security Clearance is required but the instructions in Section L Volume I, Factor 4 indicates that a Secret Security Clearance is required.

Please clarify the requirements.

The contractor is only required to hold a Secret Facility Clearance as of the release date of this SIR. There are no Top Secret requirements on this contract.

SECTION L - INSTRUCTIONS, CONDITIONS, AND NOTICES TO OFFERORS

L.11.2 Proposal Organization

The Volume VI Bid Model must be submitted in Microsoft Excel format.

Would the government confirm that this language refers to the Attachment L.2 Price Model file?

Yes, it refers to Attachment L.2 Price Model.

SECTION L - INSTRUCTIONS, CONDITIONS, AND NOTICES TO OFFERORS

L.11.2.1 Volume 1: Minimum Capability Qualification - FACTOR 2 – Financial Resources

Prime vendors must demonstrate a line of credit of at least $4 million by submitting a certified letter of credit from a financial institution. Prime vendor must maintain the line of credit during the performance period of the contract.

Would the government confirm that a certified letter of credit dated within calendar year 2024 will meet this requirement?

Yes.

Section, L.11.2.1 Volume 1: Minimum Capability Qualification, Factor 3–Software Capability Maturity Model Rating, Page, L-7, There are two types of CMMI certificates, CMMI for Services and CMMI for Development.

Since the contract requires both services and development, is it safe to assume that for this contract the FAA requires the company to have both CMMI Level 3 for Services, and CMMI Level 3 for Development?

Please confirm.

"CMMI Level 3 for Development" is only required for the Prime vendor or the entity (subcontractor or teaming partner) that will be responsible for software development efforts under this contract.

Section, L.11.2.1 Volume 1: Minimum Capability Qualification, Factor-3–Software Capability Maturity Model Rating, Page L-7, Since CMMI is the official appraisal name of the CMMI institute, please confirm that the FAA is using CMM (Capability Maturity Model) and CMMI (Capability Maturity Model Integration) interchangeably?

Yes, CMMI and CMM are being used interchangeably.

L.12 VOLUME II: Sample Tasks

Note that the current products and technologies in the ASH operating environment are listed in Section C.6. The major ASH web applications in use today are listed in Section C.6.1 and C.6.2.

Would the government share the current systems/application architecture and technical architecture for the environments currently supported, or anticipated to be supported, under this IDIQ?

No. Refer to C.6.1 and C.6.2 for information regarding current systems, products and technologies in use today. In accordance with Section L.12 and Section M.4.2, vendors can identify "Key assumptions" made as part of their responses in the "Problem Understanding" sections for Sample Tasks 1-4

L.12 VOLUME II: Sample Tasks

Note that the current products and technologies in the ASH operating environment are listed in Section C.6. The major ASH web applications in use today are listed in Section C.6.1 and C.6.2.

If there are security concerns, would the government share redacted versions of the current systems/application architecture and technical architecture for the environments currently supported, or anticipated to be supported, under this IDIQ?

No. Refer to C.6.1 and C.6.2 for information regarding current systems, products and technologies in use today. In accordance with Section L.12 and Section M.4.2, vendors can identify "Key assumptions" made as part of their responses in the "Problem Understanding" sections for Sample Tasks 1-4

L.12 VOLUME II: Sample Tasks

Note that the current products and technologies in the ASH operating environment are listed in Section C.6. The major ASH web applications in use today are listed in Section C.6.1 and C.6.2.

If there are security concerns, would the government facilitate a reading room for vendors to review the current systems/application architecture and technical architecture for secured systems currently supported, or anticipated to be supported, under this IDIQ?

No. Refer to C.6.1 and C.6.2 for information regarding current systems, products and technologies in use today. In accordance with Section L.12 and Section M.4.2, vendors can identify "Key assumptions" made as part of their responses in the "Problem Understanding" sections for Sample Tasks 1-4

L.12 Volume II: Sample Tasks SIR Section L

Can the government provide any assumed start dates and/or end dates for the sample tasks?

Assume the start and end dates for the sample tasks are the same as the performance period of the contract

L.12 Volume II: Sample Tasks, Sample Task 1 SIR Section L

ASH manages the FAA physical security risk management process that evaluates the threats and consequences of the Interagency Security Committee’s undesirable events to NAS critical operations infrastructure.

Does FAA hold a current inventory of installed Electronic Security Equipment and countermeasures for all of its facilities?

If FAA does not hold a current inventory of its installed Electronic Security Equipment and countermeasures (ESS&M), how current is the existing inventory and how complete is it?

Yes, FAA has a current and consolidated inventory of countermeasures at all its facilities.

However, our inventory of the Electronic Security Equipment is localized at each facility level, and outside of ASH’s direct control.

L.12 Volume II: Sample Tasks, Sample Task 1 SIR Section L

ASH manages the FAA physical security risk management process that evaluates the threats and consequences of the Interagency Security Committee’s undesirable events to NAS critical operations infrastructure.

Does FAA participate with DHS Federal Protective Service in the Risk Management Process?

If FAA participates in the DHS FPS RMP, will those Facility Security Assessments (FSAs) and data be available to the awarded bidder?

No, FAA does not participate with DHS Federal Protective Service in the Risk Management Process. FAA executes its own Risk Management Program and conducts its own Facility Security Assessments utilizing guidance from the Interagency Security Committee. The data from FAA internal FSA’s will be made available to the awarded bidder.

L.12 Volume II: Sample Tasks, Sample Task 2 SIR Section L

In order to streamline and standardize the process of personnel vetting, the federal government is transforming the personnel vetting process, called Trusted Workforce 2.0. What technical changes (if any) should be considered for FAA systems related to personnel vetting, Security Executive Agent Directive 3, and PIV card issuance and activation to comply with Trusted Workforce 2.0?

Can the government provide a status on FAA's compliance to date with Trusted Workforce 1.0, 1.5, and 2.0?

FAA is in compliance with requirements in Phase 2B (current phase) of implementation of Trusted Workforce 2.0. In addition, FAA is in compliance with the Trusted Workforce 1.25 and 1.5 guidelines for continuous vetting for the FAA workforce as well.

L.12 Volume II: Sample Tasks, Sample Task 3

ASH operates and maintains Commercial-Off-the-Shelf (COTS) software, custom web applications and databases to support Personal Identity Verification (PIV) cards issuance and activation for all modes within DOT (including FAA). This PIV card data is exchanged with numerous FAA systems to support logical and physical access for FAA workforce.

We understand there have been previous versions of a cloud migration plan. Can FAA share this plan, or key goals/milestones with offerors?

We have currently migrated approximately 77% of our legacy applications to FAA GovCloud. We plan to migrate the remaining applications in FY25 that relate to ITS and IDMS group of applications which have an external dependency on a COTS card management system used by FAA.

L.12 Volume II: Sample Tasks, Sample Task 3

ASH operates and maintains Commercial-Off-the-Shelf (COTS) software, custom web applications and databases to support Personal Identity Verification (PIV) cards issuance and activation for all modes within DOT (including FAA). This PIV card data is exchanged with numerous FAA systems to support logical and physical access for FAA workforce.

How far along is FAA in its cloud migration journey (e.g., key milestones completed, upcoming milestones/targets?)

We have currently migrated approximately 77% of our legacy applications to FAA GovCloud. We plan to migrate the remaining applications in FY25 that relate to ITS and IDMS group of applications which have an external dependency on a COTS card management system used by FAA.

L.12 Volume II: Sample Tasks, Sample Task 3

ASH operates and maintains Commercial-Off-the-Shelf (COTS) software, custom web applications and databases to support Personal Identity Verification (PIV) cards issuance and activation for all modes within DOT (including FAA). This PIV card data is exchanged with numerous FAA systems to support logical and physical access for FAA workforce.

What are the FAA's goals in migrating the PIV applications to operate in an Infrastructure-as-a-Service (IAAS) within the FAA GovCloud that operates in Amazon Web Services

(AWS)?

Our goal is to provide a secure, resilient, highly-available environment for all applications listed in C.6.1.

L.12 Volume II: Sample Tasks, Sample Task 3

ASH operates and maintains Commercial-Off-the-Shelf (COTS) software, custom web applications and databases to support Personal Identity Verification (PIV) cards issuance and activation for all modes within DOT (including FAA). This PIV card data is exchanged with numerous FAA systems to support logical and physical access for FAA workforce.

Has the FAA identified the grouping/categories of applications that need to be migrated?

If so, can the government please share the approach and method.

We have currently migrated approximately 77% of our legacy applications to FAA GovCloud. We plan to migrate the remaining applications in FY25 that relate to ITS and IDMS group of applications which have an external dependency on a COTS card management system used by FAA.

L.12 Volume II: Sample Tasks, Sample Task 3

ASH operates and maintains Commercial-Off-the-Shelf (COTS) software, custom web applications and databases to support Personal Identity Verification (PIV) cards issuance and activation for all modes within DOT (including FAA). This PIV card data is exchanged with numerous FAA systems to support logical and physical access for FAA workforce.

What are the current operational pain points that FAA has related to this sample task?

Our goal is to provide a secure, resilient, highly-available environment for all applications listed in C.6.1.

L.12 Volume II: Sample Tasks, Sample Task 3 SIR Section L

ASH operates and maintains Commercial-Off-the-Shelf (COTS) software, custom web applications and databases to support Personal Identity Verification (PIV) cards issuance and activation for all modes within DOT (including FAA). This PIV card data is exchanged with numerous FAA systems to support logical and physical access for FAA workforce.

A) What factors will you consider to migrate the PIV applications to operate in an Infrastructure-as-a- Service (IAAS) within the FAA GovCloud that operates in Amazon Web Services (AWS)?

B) What will be your technical approach and plan for this migration?

C) What operational changs will you recommend to minimize hosting costs for ASH in FAA GovCloud?

Please confirm what the shared services or common data sources that will also require migration and maintenance / support / updating?

Refer to C.6.1 for a listing of all ASH applications that will be migrated to FAA GovCloud. FAA shared services (e.g., cloud services, telecommunications services, network services) are provided by AIT and are not part of this contract.

L.12 Volume II: Sample Tasks, Sample Task 4

ASH operates and maintains secure web applications and databases to support ASH security program areas. These applications are hosted as an Infrastructure-as-a-Service (IAAS) within the FAA GovCloud that operates in Amazon Web Services (AWS) using Microsoft and Linux operating systems. (A) How would you design a solution to provide high availability for ASH applications across multiple availability zones and regions?

How many different user traffic locations are in scope?

How are they regionally distributed?

ASH application users are located primarily at Headquarters, all regional offices, MMAC, and WJHTC.

In addition, PIV card applications are used by all modes within DOT (including FAA). Vendor can propose a solution of availability zones and regions that supports all ASH applications and users.

L.12 Volume II: Sample Tasks, Sample Task 4

ASH operates and maintains secure web applications and databases to support ASH security program areas. These applications are hosted as an Infrastructure-as-a-Service (IAAS) within the FAA GovCloud that operates in Amazon Web Services (AWS) using Microsoft and Linux operating systems. (B) How would you automate security compliance for these cloud systems?

How does FAA ASH define "security compliance" for this sample task and what related factors should be considered?

FAA Order 1370.121 identifies information security and privacy compliance requirements for FAA systems.

L.12 Volume II: Sample Tasks, Sample Task 4 SIR Section L

ASH operates and maintains secure web applications and databases to support ASH security program areas. These applications are hosted as an Infrastructure-as-a-Service (IAAS) within the FAA GovCloud that operates in Amazon Web Services (AWS) using Microsoft and Linux operating systems.

Does the Authorizing Official for ASH applications reside in AXM or anywhere else in ASH?

Will additional coordination and time be required to work with that resource because they operate outside of ASH?

The System Owner and the Authorizing Official for all systems listed in C.6.1 and products/technologies listed in C.6.2.

resides in AXM. Minimum one week review time is recommended for any products/reports to be reviewed by the System Owner or the Authorizing Official.

L.12 Volume II: Sample Tasks, Sample Task 4 SIR Section L

ASH operates and maintains secure web applications and databases to support ASH security program areas. These applications are hosted as an Infrastructure-as-a-Service (IAAS) within the FAA GovCloud that operates in Amazon Web Services (AWS) using Microsoft and Linux operating systems.

Is OpenSCAP currently used by ASH on their existing environment?

No, ASH does not currently use OpenSCAP.

Section L.12, p. L-9, Can the FAA provide clarification regarding what is meant by "multiple domains" in Sample Task 4, question C?

Currently, ASH systems listed in C.6.1 are managed within 4 Active Directory domains. Once cloud migration is complete, ASH expects to consolidate from 4 to 2 Active Directory domains.

Section L.12, pp. L-8 and L-9, What ASH applications are currently deployed in the FAA AWS cloud environment?

We have currently migrated approximately 77% of our legacy applications to FAA GovCloud. We plan to migrate the remaining applications in FY25 that relate to ITS and IDMS group of applications which have an external dependency on a COTS card management system used by FAA.

SECTION L - INSTRUCTIONS, CONDITIONS, AND NOTICES TO OFFERORS

L.13 Volume III: Corporate Experience

Offerors must provide at least three (3) and no more than seven (7) Corporate Experience references (no more than one for each SOW Section C.5 tasks 1-7). The instructions note that offerors must provide at least three (3) and no more than seven (7) Corporate Experience references (no more than one for each SOW Section C.5 tasks 1-7).

Please confirm that the Government is expecting one and only one corporate experience example for each SOW task.

No. Offerors must provide at least three (3) and no more than seven (7) Corporate Experience references.

L.13 (p.L-9)

Offerors must provide at least three (3) and no more than seven (7) Corporate Experience references (no more than one for each SOW Section C.5 tasks 1-7).

Is the government's intent to ensure that the combined corporate experience covers all 7 SOW tasks?

Yes.

Section L.13, p. L-9, For Volume III, Section L states that "If the Offeror proposes to subcontract more than 20% of the work, or proposes a Teaming arrangement, at least one (1) Corporate Experience reference must be submitted for the proposed member or subcontractor" and Section M states "greater weight will be given to the experience of the Prime contractor Offeror than to that of any proposed subcontractor."

This approach would force any bidder that subcontracts 20% or uses a teaming agreement to use a lower weighted subcontractor reference.

As the FAA is requiring use of subcontractor references in these cases, would the FAA consider giving similar weight to Prime and Subcontractor references, given the Prime has to submit at least one?

No.

L.14 Volume IV: Management Approach C. Internal purchasing system or process for ODC/material and equipment purchasing.

SIR Section L - Internal purchasing system or process for ODC/material and equipment purchasing.

Explain how the vendor uses policies, procedures, and controls to ensure continual use of quality materials at fair and reasonable prices over the life of the contract.

Please confirm the offeror will be responsible for the receipt and storage of equipment and material purchases.

Yes. The Purchase Coordinator receives and stores purchased equipment and supplies at the Headquarters Office.

L.14 Volume IV: Management Approach C. Internal purchasing system or process for ODC/material and equipment purchasing.

SIR Section L - Internal purchasing system or process for ODC/material and equipment purchasing.

Explain how the vendor uses policies, procedures, and controls to ensure continual use of quality materials at fair and reasonable prices over the life of the contract.

Please confirm the offeror will NOT be involved in the following aspects of the end-to-end logistics life cycle? I.E., shipment to badging sites, RMA (Return Merchandising Authorization), Cardstock management, Enterprise Network Management (ENM) -approval to use equipment on FAA network.

Refer to C.5.3.3 for Purchasing Services Support requirements on this contract. Purchase Coordinator typically works to solicit funding approval from requiring offices, obtains vendor quotes, coordinates purchases with COR or purchase cardholder, receives deliveries, coordinates returns if-needed, and ensures that only approved purchasing methods are used. This includes shipping any PIV products or accessories to the badging sites.

L.16 VOLUME VI: Price Proposal L.16.2 Price Proposal Bid Model

b) Offerors must complete the T&M Rate Buildup in Tab C of Attachment L.2. The Offerors must propose a single fully burdened ceiling labor rate for each labor category inclusive of all contract periods, utilizing the labor category descriptions within Attachment J-1, Labor Category and Skill Descriptions. The fully burdened labor rates must include all direct labor and indirect costs applicable to that direct labor (such as fringe benefits; overhead; cost of money, if applicable; and G&A), and profit.

As this is not a Cost Type contract, would the Government be willing to amend the Section L pricing instructions and Attachment L.2 to only require a single Labor Category (LCAT) rates for each LCAT, and eliminate the Fringe, OH and G&A breakouts?

See Amendment 0001 for updated language at L.16.

L.16 VOLUME VI: Price Proposal L.16.3 Price Proposal Narrative

a) The Offeror and subcontractors must provide a narrative that addresses the following areas:

Rationale used for development of the proposed fully burdened Labor Rates. Offerors must clearly explain the rationale and methodologies used to buildup and develop the rates, including blended rates, if applicable. The information provided must address the direct labor and the indirect rates separately. The Offerors must identify all proposed indirect rates, to include allocation bases, and describe the company’s accounting practices for application of the rates.

In order to reduce administrative burden and in keeping with the intent of a Time & Materials (T&M) contract, would the Government be willing to allow Offerors to propose a single LCAT rate that will apply to the Prime and any Subcontractors delivering on this effort, as opposed to having separate build-ups?

language at L.16.

L.16 VOLUME VI: Price Proposal, Part (b) (L-11)

(a) The pricing instructions are applicable to the prime contractor and all subcontractors.

(b) Proposed subcontractors may submit price volumes directly to the Contracting Officer, following these same instructions.

If a subcontractor submits directly to the CO, it must identify the Prime Offeror the subcontract offer relates to on each copy of the proposal submitted.

The subcontractor proposals must be submitted in accordance with the instructions outlined in Section L.11.

The offeror remains responsible for the submission of all required information, and information from the offeror will take precedence over any conflicting information from the proposed subcontractor.

Please clarify if it is necessary for the Subcontractors to submit pricing proposals with their rate build-up information in support of the Prime Offeror’s proposal. That requirement is typically seen in FAA SIRs for CPFF/CPAF type contracts.

Can this requirement be deleted from the SIR since this is an IDIQ - Fixed Price with Material (T&M) and Cost Reimbursement CLINs (for ODCs/Travel)?

See Amendment 0001 for updated language at L.16.

SECTION L - INSTRUCTIONS, CONDITIONS, AND NOTICES TO OFFERORS

L.16.3 Price Proposal Narrative

The Offeror and subcontractors must provide a narrative that addresses the following areas:

• Rationale used for development of the proposed fully burdened Labor Rates. Offerors must clearly explain the rationale and methodologies used to buildup and develop the rates, including blended rates, if applicable. The information provided must address the direct labor and the indirect rates separately. The Offerors must identify all proposed indirect rates, to include allocation bases, and describe the company’s accounting practices for application of the rates.

Would the government confirm that only the Offeror must provide the methodology used to build and develop rates and that while the subcontractors involved will discuss the rationale for their price in the form of a narrative, they are not required to provide the same detailed methodologies as the Offeror?

language at L.16.

Section L.16.2, p. L-11, Will the FAA identify the associated clearance level (e.g., Secret, Public Trust) for each labor category or position for proper pricing responses?

No. FAA/ASH will process all contractors on this contract for Public Trust background investigations. If necessary, ASH will coordinate through established processes with the DOD National Industrial Security Program for any required security clearance background investigations and/or clearances

ASH-IV_Attachment_L.2_Price_Model_Posted.xlsx - Tab A - TEP Summary - Total Labor Price formula (cell H109)

Will the government please update the Total Labor Price formula (cell H109) to include the Service Area D Total (cell H46)?

The FAA has updated the formula in cell H109 to include Service Area D Total.

ASH-IV_Attachment_L.2_Price_Model_Posted.xlsx - Tab A - TEP Summary - Total Labor Price formula (cell M109)

Will the government please update the Total Labor Price formula (cell M109) to include the Service Area D Total (cell M46)?

The FAA has updated the formula in cell M109 to include Service Area D Total.

ASH-IV_Attachment_L.2_Price_Model_Posted.xlsx - Tab A - TEP Summary - Total Labor Price formula (cell R109)

Will the government please update the Total Labor Price formula (cell R109) to include the Service Area D Total (cell R46)?

The FAA has updated the formula in cell R109 to include Service Area D Total.

ASH-IV_Attachment_L.2_Price_Model_Posted.xlsx - Tab A - TEP Summary - Total Labor Price formula (cell W109)

Will the government please update the Total Labor Price formula (cell W109) to include the Service Area D Total (cell W46)?

The FAA has updated the formula in cell W109 to include Service Area D Total.

ASH-IV_Attachment_L.2_Price_Model_Posted.xlsx - Tab A - TEP Summary - Total Labor Price formula (cell AB109)

Will the government please update the Total Labor Price formula (cell AB109) to include the Service Area D Total (cell AB46)?

The FAA has updated the formula in cell AB109 to include Service Area D Total.

ASH-IV_Attachment_L.2_Price_Model_Posted.xlsx - Tab A - TEP Summary - Total Labor Price formula (cell AE126)

Will the government please update the TOTAL PRICE formula (cell AE126) to include the Not-to-Exceed Transition In fixed price of $10,000 and the Not-to-Exceed Transition Out fixed price of $10,000 - a total of $20,000?

The FAA has updated the formula in cell AE126 to include Transition In/Out.

Questions by SIR Section