ATTACHMENT I (QA).pdf

ATTACHMENT I

A. The following industry questions and answers are provided:

1. Can the government provide a full inventory of equipment for all buildings?

See the attached Software /Hardware List

2. Does the government expect any replacement material to be covered in the firm fixed pricing or will there be an ODC CLIN?

Replacement material should be included in the firm fixed pricing.

3. Does the government expect labor for corrective work to be in the firm fixed pricing or will there be a separate labor CLIN with labor rates as other DLA contracts are structured?

Corrective work will be included in the firm fixed pricing.

4. Are all of the buildings listed in the section 2.2 currently connected to the same Lenel system?

No. Bldg. 45 is on the newer system.

5. Are all of the building listed in section 2.2 currently connected to the same Milestone system?

No. Bldg. 45 is on the newer system.

6. Can the Government provide system ID / SLC numbers for all access control and video systems? What versions/instances of the system software are currently being run? Would you provide us with the Dongle ID for all systems to be covered under this contract?

See the attached Software /Hardware List

7. How does the Government plan to furnish the migration of the other buildings onto the central Lenel system? Will this be prices as a separate job or is the contractor expected to include that in this pricing?

The migration task will be priced separately as the optional task clin.

8. Does the Government currently have drawings for all of the buildings that the contractor can work from to keep up to date or is the contractor expected to complete a CAD package?

There are drawings of all the buildings.

9. According to 2.2 Scope, Is the contractor responsible for cybersecurity support for Bldg. 45 ESS (including SCIF) only and not needed for Bldg. (s) 2B, 2C, 3, 4C/D, 5A, 5B/C. 5D, 6, 7A/B, 26 and 27?

Once the older buildings are brought online with the new system, cybersecurity is required for all DLA buildings. Currently, the Contractor is responsible for cybersecurity of all DLA networked systems which includes Bldg. 45.

10. What components does the contractor have responsibility for conducting STIGs and ACAS scans? (GFE, Contractor-provided)

The Contractor is directly responsible for application STIG/SRG. ACAS scans will be provided for all items on the network domain e.g., currently, Bldg. 45

11. What components does the contractor have responsibility for conducting IAVA Patching? (GFE, Contractor-provided)

All DLA network systems e.g., Bldg. 45 currently

12. Will DLA provide a template for the initial configuration audit in the required DoD Risk Management Framework (RMF) format?

Templates are available upon request.

13. According to Section 2.4.1.h, the contractor shall provide a complete list of ports, protocols and services required. Since this is a maintenance contract, are additional ports, protocols and services required for continual operations of the current system?

There is a current list of PPSM. The maintenance vendor shall maintain the PPSM.

14. According to Section 2.5.9, the contractor shall provide a System Security Plan.

Since this is a maintenance contract, does a System Security Plan already exist for the current system? If so, is the contractor responsible for updating the current artifacts that are included with that System Security Plan or developing a new System Security Plan to include new artifacts?

There are currently several security artifacts which the maintenance vendor is expected to update and maintain.

15. Has the system already completed RMF Steps 1-5 and is now in RMF Step 6

– Continuous Monitoring?

Currently the system is authorized using a local cybersecurity assess only. RMF artifacts may be required. Templates are available upon request.

16. According to Section 2.5.4.3, the contractor shall support continuous assessment of the implemented controls and prepare assessments of the cybersecurity posture. What is the frequency of the continuous assessments (monthly, quarterly, etc.)?

It's a continuous cycle of quarterly reviews; taking 25% of the controls is recommended.

17. Will DLA provide eMASS accounts for contractors to submit artifacts?

DLA ISSMs will submit artifacts. eMASS accounts are not required at this time.

18. Can you define cyclically as stated in Section 2.5.4.5 regarding continuous monitoring of implemented controls?

It's a continuous cycle of quarterly reviews; taking 25% of the controls is recommended.

18. GHX Data Subscription. We are unclear what this means, please clarify.

All reference to GHX Data Subscription is deleted.

19. When does the Government expect to make an award?

The Government expects to make the award by 04/30/2022

20. "The contractor shall provide all personnel, transportation, equipment, tools, materials, supervision, and other items and services necessary to perform the Pest Control Services as defined in this Performance Work Statement (PWS)." We assume the Government did not mean to include Pest Control Services as part of this Scope and we recommend removal of this specific service.

Amendment 0001 was issued which removed the term Pest Control.

21. Please advise what, if any attestion or certification is the Offeror required to provide to address this element in its proposal?

There are no certifications or attestion however, any software/hardware must be Section 508 compliant.

22. Can the Government provide a list of ESS equipment, by make and model number, for each building?

Available documentation shall be provided post award

23. How many corrective maintenance calls during regular business hours did the Government have during the last 12-month period?

Between 20 – 30 in the last 12 months

24. How many corrective maintenance calls after normal working hours did the Government have during the last 12-month period?

None

25. Will the Government provide GFE, e.g., work space, electrical, other utilities, for the Offeror's onsite personnel?

GFE will not be provided for onsite personnel

26. Will the Government provide storage space for tools and other supplies required to execute the requirements of this contract?

Storage space for tools and other supplies required will not be provided.

27. Item Numbers 0001, 1001, 1002 require a Monthly Unit Price and a total annual price as a Firm Fixed Price value. Should this value also include the costs for Operating System and Application Software Upgrades?

The Operating System is maintained by DLA. The Application Software Upgrades should be included in the firm fixed price.

28. Item Numbers 0001, 1001, 1002 require a Monthly Unit Price and a total annual price as a Firm Fixed Price value. Should this value also include the costs for replacement equipment found defective during scheduled PM or unscheduled Corrective Maintenance services?

The costs for replacement equipment found defective during scheduled PM or unscheduled Corrective Maintenance services should be included in the firm fixed pricing.

29. What version of Lenel is the Government currently using in Building 45?

OnGuard 7.6 version 7.6.382.271

30. What version of Lenel is the Government using in all other buildings?

OnGuard 2013 version 6.6.415

31. What is the expiration date of the current Lenel software support agreement for Building 45 and all other Buildings?

This information is not available to DLA as the buildings are currently on the Navy’s Lenel system.

32. Government requests a Masters degree, can offeror substitute Bachelors Degree and appropriate number of years experience in lieu of the Masters Degree.

Masters not required

Minimum Experience:

• Two (2) years relevant experience

Required Skills:

• Must possess IT-II security clearance or have a current National Agency Check with Local Agency Check and Credit Check (NACLC) at time of proposal submission.

• Relevant certification from a nationally recognized technical authority.

• DoD Approved 8570 Baseline Certification: Category IAT Level I

Applications programmer shall be considered at the minimum level of requirements as stated above

33. When does the government anticipate that that the ESS/EKC systems will be migrated from a Navy Network to a DLA network?

Within the next 18 months.

34. Section 2.3.1 states that the contractor will be required to provide mechanical parts, spares, mechanical hardware, batteries, software, firmware, and licenses. If the contractor will be required to provide this on an FFP basis, will the government clarify the number of devices at each building and provide refresh and migration deadlines for each type of device? Additionally, will the government provide a separate CLIN for the purchase of devices and licenses to allow for more transparent pricing?

A hardware/software inventory list is provided. The refresh and migration deadlines cannot be determined at this time, however, the Government is providing the hardware software inventory list for all devices.

35. The government states that the contractor will be required to provide for all server and workstation hardware and software requirements. Will the government modify the RFQ to provide GFE toward the execution of this task as this will alleviate concerns of government sensitive information being stored off of the government network, particularly documentation for Building 45? GFE with direct access to the DLA LAN will also increase the efficiency of cybersecurity and RMF work to be performed on this contract. If not, will the government provide a separate CLIN for the pricing of hardware/software requirements?

DLA shall furnish all server and laptop/workstation hardware as required.

36. The government states that the contractor is required to “provide all required support for tasks listed under this PWS,” and the performance criteria indicates that a satisfactory rating will result if there are two (2) or fewer violations. We are concerned that this places undue risk on the Offeror because the term :violations" is not defined.

This requirement is inherent to the contractor’s acceptance of an FFP award.

Additionally, it is also covered under the government’s “Work/Task Product Activities” evaluation area in Section 6.3. Will the government remove or redefine this performance evaluation criteria?

A Violation could be defined as falsification of documentation, negligence or poor workmanship. The Government will not be removing the performance evaluation criteria.

37. The Project Plan/Schedule, 8570 certifications, 8570 spreadsheet, and cybersecurity deliverables are due within a short period of time after contract award, but the remainder of deliverables are due after contract start. Will the government modify the submission requirements for these deliverables so that they can be submitted after contract start?

The details needed for the Project Plan/Schedule and Cybersecurity deliverables in particular, will not be available to the contractor until work starts.

The submission requirements for these deliverables as specified in the RFQ is amended to reflect 30 days after contract award.

38. Additional qualifications: The government states that the Cybersecurity Analyst and Applications Programmer must have direct experience working with ESS, EKC, and intercom support. The Cybersecurity Analyst is an Information Assurance (IA), Cybersecurity, and RMF expert, and it is likely that the government will gain equal or greater benefit from RMF accreditation experience with a variety of network/IT components. Additionally, the professional skills of the Application Programmer and Cybersecurity Specialist translate easily between a variety of IT tools/systems supported. Finally, the direct experience and expertise with ESS/EKC systems is provided by the Lenel touch labor who will be directly supporting system maintenance, upgrades, etc. They can/will inform the work completed by the Application Programmer and Cybersecurity Specialist. Will the government remove the requirement for these two LCATs to have direct experience with ESS, EKC, and intercom support?

The requirement for the Cybersecurity Specialist to have ESS experience is removed.

39. The government states that work is unclassified, but a security clearance and additional access requirements may be required for the SCIF. Will the government please clarify the clearance and access requirements for Lenel support to Bldg. 45 as this may affect all vendor pricing?

The IT Level’s of the system dictate the access requirements. IT2 = T3 investigation. This is in the DLAI governing computer access and IT Levels

40. The government states that the Applications Programmer is required to have a Top Secret clearance, and the Cybersecurity Analyst is required to have a Secret clearance. As the work is defined as Unclassified in the PWS, will the government be issuing a DD254 to support the maintenance of the required clearances?

Any person with admin rights and programming must have IT1 which yes requires a TS. Again, it is in the DLAI. Since, this is not a classified contract, there is no requirement for a DD254. Just because there is no DD 254 does not mitigate the current regulations regarding security clearances.

B. In addition, the CLIN’s structure are changed to read as follows:

Notes: Proposal will be evaluated based on the total price for all items for all periods of performance (12-Month Base period and Two (2) 12-Month Option Periods).

CLIN SERVICES QUANTITY UNIT OF ISSUE UNIT PRICE TOTAL PRICE

0001 ECC Maintenance

Access Controls 12 Months $ $

0002 Optional Task - Migration

1 Lot $ $

1001 ECC Maintenance Access Controls

12 Months $ $

1002 Optional Task - Migration

1 Lot $ $

2001 ECC Maintenance Access Controls

12 Months $ $

2002 Optional Task - Migration

1 Lot $ $