Amendment 001.pdf

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

PAGE OF PAGES

3. EFF. DATE 5. PROJECT NO. (If applicable)2. AMENDMENT/MODIFICATION NO.

7. ADMINISTERED BY (If other than Item 6) CODE

FACILITY CODECODE

6. ISSUED BY CODE

8. NAME AND ADDRESS OF CONTRACTOR (No., street, county, State and Zip Code)

10B. DATED (SEE ITEM 13)

10A. MODIFICATION OF CONTRACT/ORDER NO.

9B. DATED (SEE ITEM 11)

9A. AMENDMENT OF SOLICITATION NO.

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

NSN 7540-01-152-8070

PREVIOUS EDITION UNUSABLE

STANDARD FORM 30 (REV. 10-83)

Prescribed by GSA FAR (48 CFR) 53.243

1. CONTRACT ID CODE

16B. UNITED STATES OF AMERICA 16C. DATE

SIGNED

15B. CONTRACTOR/OFFEROR 15C. DATE

SIGNED BY

(Signature of Contracting Officer)(Signature of person authorized to sign)

15A NAME AND TITLE OF SIGNER (Type or print) 16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offers extended. Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended, by one of the following methods:

is not

(a) By completing Items 8 and 15, and returning copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted; or (c) By separate letter or telegram which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGEMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by telegram or letter, provided each telegram or letter makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

12. ACCOUNTING AND APPROPRIATION DATA (If required)

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS,

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (Such as changes in paying office, appropriation date, etc. ) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103 (b).

E. IMPORTANT: Contractor is not is required to sign this document and return

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE CONTRACT

ORDER NO. IN ITEM 10A.

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority) is extended, copies to issuing office.

4. REQUISITION/PURCHASE REQ. NO.

1 13

0001 08/11/2010 11001

Comptroller of the Currency Acquisition Management, FM-4 250 E Street, SW

Washington DC 20219-0001

Comptroller of the Currency

X CC-10-HQ-R-0053

07/29/2010

X X

***** See Continuation Page*****

Nellisha Ramdass

Solicitation CC-10-HQ-R-0053 Amendment 1 08/11/10

This amendment is issued to effect the following changes to Solicitation CC-10-HQ-R- 0053:

(1) Provide responses to questions received.

(2) Section 4.1, PWS (p. 6, paragraph 4) is revised to read as follows: Technical

Exhibit (TE) 1 of this PWS provides the performance metrics that the OCC recognizes as pertinent to this contract, identifies what will be measured to assess program and Contractor performance, and traces performance to IRM objectives.

(3) Section L.2 (p. 54) of the RFP is revised to reflect that all proposals shall be submitted to:

Andrea Katz, Contract Specialist Comptroller of the Currency

250 E Street, SW, Mail Stop FM-4 Washington, DC 20219-0001

Solicitation Number: CC-10-HQ-R-0053

(4) Section L.2 (p. 54) of the RFP is revised to reflect that all CDs or electronic media shall be compatible with MS Office 2003.

(5) Section L.2 (p.55) of the RFP is revised to reflect 35 pages as the maximum number of pages allowed for an Offeror’s Technical Proposal.

(6) Section L.2 (p.56) of the RFP is revised to include the following: Offerors shall submit a transition plan as part of its technical approach. The transition plan shall describe a comprehensive transition approach, which facilitates a near-seamless transition from the current operating environment to the new operating environment envisioned under the CIRC program, to ensure continuity of operations and minimize disruption to the existing operations.

(7) Section M.2, Factor 4 (p. 65) of the RFP is revised to remove the last paragraph, which reads: The Government will evaluate the Offeror's use of the proposed labor categories and rates in their response. The Government will evaluate the fairness and reasonableness of the labor rates as compared to industry norms such as the GSA Federal Supply Schedule or other government wide acquisition contracts.

(8) Section M.2.4, Factor 1 (p.64) of the RFP is revised to include the following: The

Government will evaluate the Offeror’s approach to providing a near-seamless transition from the current operating environment to the new operating environment under the CIRC program. The Government will evaluate the Offeror’s approach to transitioning initial services to itself from incumbent contractor, while ensuring continuity of operations, and minimizing disruption to the existing operations.

Industry Questions OCC Responses

1. I noticed in the Hours of Operation section of the PWS that you are asking for a contractor staff member to be on-site at all times within the designated time range – you then state that one contractor staff member shall be located at the NOC as well. I’m unclear what this means because in the solicitation there are Four (4) locations listed. Does this mean that you want a minimum of one staff member at each of the four sites during Core Service Hours, PLUS, one staff member for the NOC?

The four (4) locations referenced in the solicitation (PWS p.4) refers to the OCC district offices.

The hours of operations in Section 9 of the PWS is indicative of the minimum requirements for coverage. Offerors are encouraged to propose the appropriate number of personnel to ensure the full scope of requirements outlined in the PWS is successfully accomplished. The OCC has identified the minimum number of key personnel required for this effort.

2. The other question I had was regarding the CLINs you are requesting pricing on. You have three (3) required CLINS, two (2) optional ones, and then one (1) for travel.

Since things might change between the start of the base year of the contract and the following option years – is the option year pricing we submit open to negotiation before the option years are exercised?

Prior to exercising the option year, the OCC will make a determination on whether the option price is the best price or most advantageous offer to the Government.

3. How many FTEs currently provide the services indicated in the RFP per CLIN?

Offerors are encouraged to propose the appropriate number of personnel to ensure the full scope of requirements outlined in the PWS is successfully accomplished. The OCC has identified the minimum number of key personnel required for this effort.

4. In order for Offerors to build adequate Firm Fixed Price offers, please provide the number of FTEs and hours required to complete each task.

Offerors are encouraged to propose the appropriate number of personnel to ensure the full scope of requirements outlined in the PWS is successfully accomplished. The OCC has identified the minimum number of key personnel required for this effort.

5. What are the qualifications for the key personnel?

Offerors are encouraged to propose the appropriate qualifications for those positions identified as key personnel in order to ensure the tasks and requirements of the OCC are accomplished successfully. Refer to Sections 6.2 and 6.3 of Attachment 1.

6. Did the incumbent contractor build the CALM database?

The CALM database was developed for the government by the current contractor, who is a subcontractor to Ironshield.

7. Given the 30-page limit and details required by the RFP (responses to 34 subtasks, procurement objectives, past performances, Quality Assurance Plan, etc.), would the Government consider extending the page limit to 50 pages so that Offerors can provide adequate details for the Government’s evaluation of proposals?

The page limit is increased to 35 pages.

8. The PWS does not indicate the Government’s need to outsource any third-party services.

Why are Offerors required to complete the Information Security Self-Assessment?

OCC requires that any service provider entrusted with OCC sensitive information that maybe processed, transmitted or stored outside of OCC facilities undergo a security review

9. We are wondering who the incumbent is, and if they can bid on the subject RFP?

The incumbent contractor is Iron Shield, Inc. The company can actively participate in this procurement.

10. Also if more metrics will be issued to assist in calculating cost.

The OCC does not anticipate issuing any further information to assist in calculating costs.

11. Is there currently an incumbent (if so, who is it)?

The incumbent contractor is Iron Shield, Inc. The company can actively participate in this procurement.

12. Is the incumbent eligible to bid on this contract?

See response to Question 11.

13. Were you satisfied with the incumbent's work?

The incumbent vendor has demonstrated acceptable past performance.

14. How many Key Personnel will you need to fulfill this workload? Will there be more than just a Program Manager and a Senior Security Engineer? Can you identify how many people you require?

Offerors are encouraged to propose the appropriate number of personnel to ensure the full scope of requirements outlined in the PWS is successfully accomplished. The OCC has identified the minimum number of key personnel required for this effort.

15. Is the Network Operations Center (NOC) located at your Headquarters or is this an additional location to be staffed?

The NOC is located at the OCC’s data center in Landover, MD approximately 12 miles from the

OCC HQ.

16. Is this a follow-on contract? If so, is the current incumbent precluded from competing?

If so, what is the current staffing level of this contract?

Yes. The incumbent contractor is Iron Shield, Inc. The company can actively participate in this procurement.

17. If the Awardee is unable to respond in the time allotted to a declared incident, is there a penalty assessed?

The Contractor shall provide support in accordance with their proposed response time. Failure to abide by this requirement may result in penalties assessed to the Contractor.

18. How many incidents require forensic investigations in the past year?

Approximately 25

19. What is the average severity of incidents that occur?

Category 3

20. What is the current length of time it takes to identify an issue regarding an incident?

This is sensitive information and not releasable.

21. What is the current length of time it takes to respond to an issue?

This is sensitive information and not releasable.

22. How are security activities prioritized to ensure the most severe issues are dealt with first?

This is based on US CERT requirements

23. What is the base skill level of all individuals involved in information security (including both physical and digital)?

The skill level relating to the OCC’s Information Risk Management staff comprises of a mix of CISSPs, CISA, GSEC and IT specialists. Physical Security not in scope.

24. What portion of the existing security practice is performed off-site?

Approximately one-third of the existing security practices is performed off-site.

25. What are the percentage of events that occur on comparison to average for this (these) facilities

– (ie 10% more than report, 50% less)?

This information is not currently tracked.

26. What are the worst types of attacks that occur? This is sensitive information and not releasable.

27. Have any attack vectors or attempts been successful in the last 5 years?

This is sensitive information and not releasable.

28. If so, what problems still remain that could Please refer to the PWS for the allow the issue again? full scope of existing requirements.

29. How much data traffic occurs on a daily basis on the network (in total Gb of throughput)?

Internet - approximately 1,260 GB per week; LAN-unknown at this time.

30. How much traffic is from unknown, unrelated, or unauthorized sites?

This is sensitive information and not releasable.

31. What are the frequencies of the following various attempts on the system?

‐ Intrusion (these are based on attempts not successful- approximately 21,000) ‐ Virus (approx 1,300) ‐ Spyware (included in Virus count) ‐ Social Networking (unknown ) ‐ Physical Break In - Sensitive – not for release ‐ Information Theft- Sensitive – not for release ‐ Internal Breach- Sensitive – not for release

The monthly average is highlighted in bold for each item.

In some instances, this is sensitive information and not releasable

32. Will this be a single award, or multiple awards?

This is a single award contract.

33. Does the Government or OCC have existing software/hardware they prefer for use in forensics?

Yes.

34. What are the tools that the OCC or the Incumbent currently use for these services described in the RFP

Please see TE #6

35. What is the expertise level of the OCC internal support staff?

The OCC’s Information Risk Management staff comprises of a mix of CISSPs, CISA, GSEC and IT Specialists.

36. How often do the internal OCC staff receive the type of training described in the RFP under the current contract?

Currently, OCC staff do not receive any training from the

CIRC.

37. What are the current rough number of incidents daily/weekly/monthly?

There are approximately 40 incidents per month.

38. Has the number of incidents increased or decreased over the past 4 years?

Increased

39. Are all Bidders required to complete and include the Self Assessment Form in its Proposal, or is that Form only for the successful Bidder to complete after Award?

All Offerors responding to this solicitation are required to complete the Self Assessment form as part of proposal submission.

40. Is the work described in the RFP a new The PWS reflects the OCC’s requirement? existing requirements.

41. Is the work described in the RFP a follow on to a current contract?

The PWS reflects the OCC’s existing requirements.

42. Who is the incumbent? The incumbent contractor is Iron Shield, Inc.

43. What is the contract number for the Incumbent contract?

Tcc-08-HQ-C-0076

44. What is the length/term of the Incumbent contract

The contract expires on 9/30/2010.

45. What is the value of the Incumbent contract? $4,399,418.28

46. When does the Incumbent’s contract expire? The contract expires on 9/30/2010.

47. Is the incumbent an 8(a) company? Yes

48. Can the Incumbent bid on the subject RFP? Yes

49. Will more metrics describing the current state of the OCC be issued to assist in calculating cost?

No

50. Due to the strict SLA requirements in the RFP, the Firm, Fixed Price contract type, can the Government provide the historical level of effort used to deliver these required services?

No, however Offerors are encouraged to propose the appropriate qualifications for those positions identified as key personnel in order to ensure the tasks and requirements of the OCC are accomplished successfully. Refer to Sections

6.2 and 6.3 of Attachment 1.

51. The PWS has reference to an attachment titled TE 6, however this wasn’t included as part of the RFP. Can this be provided?

TE #6 was included in the PWS and RFP. A copy can be obtained via the FBO web site.

52. Section L requires the CD contain files in Office v6 or higher. Do you mean MS Word/Excel 2003 or higher? Are PDF files acceptable?

The OCC is currently using MS Office 2003; therefore, all electronic media shall be compatible with this version.

53. The OCC has incorporated FAR Clause 52.246-4: Inspection of Services—Fixed Price into the contract. Will the OCC clarify how acceptance/completion of services will be evaluated such that a mutual understanding of the services to be performed can be developed?

The OCC will develop a Quality Assurance Surveillance Plan utilizing the vendor’s proposed QAP to monitor the services performed on the contract.

54. Page 6 of the PWS, Section 4.1, paragraph 4 states, “The metrics do not include specific

Offerors shall propose the Metric/Performance Standards, target values to be obtained or baseline values from which expected improvements can be measured. Offerors shall propose target values and expected improvement percentages appropriate for each metric in their Technical Approaches.” Later in the paragraph, the PWS states, “The Contractor shall recommend specific target values to IRM within 120 days of contract commencement and, upon IRM approval, shall incorporate them into its quality control plan and processes.” Please confirm that proposed target values and improvement objectives provided in the proposal Quality Assurance Plan are notional and that specific actual values will be set after contract award.

Acceptable Quality Levels, and Surveillance Method as appropriate for each Performance Objective. Offerors shall submit a Quality Assurance Plan (QAP) that covers all tasks required for this contract and addresses the Performance Requirements Summary (Technical Exhibit 1) and the methods used to ensure and achieve these requirements.

The RFP is amended accordingly.

55. Pages 6-7 of the PWS, Section 4.1, paragraphs 5 and 6 state, “TE2 presents the OCC’s best estimate of expected workload using data available at the time this PWS was developed. The figures presented in TE2 are estimates only, based on the most current information available.” Later in the same paragraph the PWS states, “The contractor is advised that the estimated value of each workload factor is not a guarantee of future workload.” In addition, the specific tasks described in Section 5, including their sub-bullets, do not include the quantity and frequency with which they must be performed. The OCC has requested a Firm Fixed Price for each specific task in this effort; however, the total scope of work to be performed is not sufficiently bounded to enable a quote. How will OCC bound these tasks to determine if future work is out of scope?

The information contained in the RFP is representative of the OCC’s requirements. Offerors shall propose accordingly based on their knowledge, capabilities and experience in providing similar support.

56. Page 13 of the PWS, Section 11, paragraph 1 states, “There will be a requirement for travel outside of the Washington D.C. metropolitan area during the performance of this contract.

It is anticipated that there will be up to twelve

(12) trips to outlying District and Field Offices or OCC service provider sites each year of this contract.” In Section B of the Solicitation, the OCC has requested a Firm

An average trip is approximately 3 days but no longer than 5 days for one resource.

Fixed Price NTE for travel for this effort.

Please provide details on the number of persons expected to travel, the duration of the trips, and the location of the trips with sufficient detail to enable pricing of this component.

57. Is there an incumbent? If so, can you provide the name of that company?

The incumbent contractor is Iron Shield, Inc.

58. Will the OCC provide detail on the current level of effort (hours, labor categories/types) being provided to satisfy the requirements in the PWS, itemizing that effort by the specific tasks detailed in Section 5?

No, however Offerors are encouraged to propose the appropriate personnel in order to ensure the tasks and requirements of the OCC are accomplished successfully.

59. PWS – Page 8 - Section 5.2 9 states the contractor must “Train IRM staff in the event of significant updates to supported tools and technologies.” How many staff are expected to be trained and where are they located? Is there an anticipated number of training sessions? Is this training formal?

Up to 3 but no more than 5 for supported tools and technologies.

No, there is no anticipated number of training sessions planned at this time; training may or may not be formal based on complexity and criticality of the technology.

60. PWS – Page 13 – Section 9 includes hours of operation, as follows, “Core Service Hours under this contract are between the hours of 6:30am and 12:00am (midnight) Eastern Standard Time, Monday through Friday, excluding Federal holidays. At least one Contractor staff member shall be on-site at all times from 6:30am to 6:00pm; at least one Contractor staff member shall be immediately available on-call between the hours of 6:00pm and 12:00am EST; one Contractor staff member shall be located at the Network Operations Center during Core Service Hours.

The Contractor shall have one staff member on-call outside of Core Service Hours.” For the on-call support component, please provide the estimated number of instances (on call support), and the estimated number of hours spent on on-call service outside of core hours.

There are less than 25 instances per year. Call times range from less than 5 minutes up to 3 hours.

61. Will the OCC grant at least a two week extension to the due date for the proposal?

No.

62. Are there a minimum or maximum number of past performance citations required for Volume II?

As stated in Section L.2. (p.56), Offerors shall describe its experience on no more that three directly related or similar contracts.

63. Currently, the Past Performance Questionnaire is due at the same time as the proposal. In order to give time for Government customers to respond and mail the questionnaire to OCC, would OCC extend the deadline 7 days beyond the proposal due date?

No.

64. PWS Section 5.1 requires the contractor to, “Detect the presence of cyber threats within the OCC enterprise infrastructure within 15minutes of occurrence.” What event starts the clock for this requirement? Is it expected that the contractor will detect all occurrences of cyber threats, no matter how surreptitious, or is this requirement to respond to existing security alerts?

This is based on the existing technologies identified in TE #6 and the skill of the analysts / engineers. Offerors have flexibility to draw on their past experience and technology expertise to provide a proposed methodology and practice for meeting this requirement.

65. Are existing monitoring and security tools integrated and automated with Remedy?

What is level of automation between Remedy and security tools?

There are no existing monitoring and security tools integrated and automated with Remedy; there is no level of automation between the two.

66. Are all security threats and intrusions logged as incidents?

No

67. Is there a Configuration process and CMDB to audit configuration items for compliance?

Yes, however there is no formal

CMDB.

68. Is there a patch management process in place?

If so, can you provide details on the process?

Yes. We use Microsoft System Center Configuration Manager

69. What version of Remedy is running in environment?

We use Remedy 7.0

70. Does incident management differentiate the types of security threats and intrusions?

Yes, this is based on US CERT categories.

71. What other Remedy modules are running? Web Remedy

72. Is there an access control process in place to enforce confidentiality?

This question is unclear. There is an access control process in use at the OCC.

73. What other business processes are integrated with security management?

This question is unclear.

74. Is there an incumbent, it yes, who is it and what is there current contract number?

The incumbent contractor is Iron Shield, Inc.

75. Can you please provide the Government cost estimate?

No

76. What is the funding ceiling for the contract? This information is not releasable.

77. Do you have a list of recommended labor No categories?

78. What is the expect start date? The expected start date is on or around 11/1/2010.

79. What is the security clearance requirement? Section H of the RFP provides information on the required security information for contractor personnel

80. Are resumes required for non-key personnel? No

81. Can your please reconsider excluding Past

Performance from the page count? To provide a complete understanding of your requirement may require a few additional page.

Past Performance Questionnaires are not included in the page count.

82. Is the current security environment such as encryption and PKI compliant to NIST requirements? For example, are the audit logs secured with restricted access and encryption;

or perhaps such areas are out of scope for this effort?

Yes. The OCC utilizes encryption modules that are certified to be FIPS 140-2 compliant.

83. The current environment seems to consist of a variety of tools for incident detection, analysis and response. Can the contractor propose new or additional technologies or approaches as part of the assessment of the solution? Also, for a given function, are the same tools used consistently across the environments? For example, is AppDetective used for all databases/apps and CALM use for all environments?

New approaches and suggestions are welcome. The tools listed in the PWS are GFE and any new tool would have to be factored into existing budget constraints.

Regarding the example for App- Detective and CALM, CIRC is the only unit that uses these tools.

84. TE 2 states that there is a projected increase of current DB ten folds over next year. Is there a projection for increase in numbers of servers and client workstations/laptops (TE2 Table 1)?

Not known at this time. The DB is being migrated to SQL 2008; as part of the migration OCC will determine what the optimal hardware configuration will be.

85. Could you provide a list of systems/platforms such as for databases, servers and workstations?

The OCC has standardized on Microsoft Windows technology.

HP laptops and workstations running XP SP2 (SP3 upgrade in process); server 2003 and 2008;

SQL 2005 and 2008.

86. Can you provide us any general information on the current number of personnel supporting the security infrastructure for your environment?

No, however Offerors are encouraged to propose the appropriate personnel in order to ensure the tasks and requirements of the OCC are accomplished successfully.

87. Will the contractor require any level of security clearances to perform work stated in the RFP/PWS?

Section H of the RFP provides information on the required security information for contractor personnel.

88. Is there already an incumbent providing these services? If so, who is that incumbent?

The incumbent contractor is Iron Shield, Inc.

89. Does the OCC require a Management Approach Section in Volume 2 of this Response?

Section L of the RFP outlines the requirements for each Volume of an Offeror’s response.

90. Should a Project Management Plan be included in Volume 2 of the Response?

Section L of the RFP outlines the requirements for each Volume of an Offeror’s response.

91. Should a Program Management Plan be included in Volume 2 of the Response?

Section L of the RFP outlines the requirements for each Volume of an Offeror’s response.

92. Is this contract being performed by another vendor currently? Which company? If yes, should a Transition Plan be included in Volume 2 of the Response?

The incumbent contractor is Iron Shield, Inc. The RFP is amended to include a requirement for a Transition Plan.

93. RFP Page 65 states that the Government will evaluate the Offer's use of the proposed labor categories and rate. RFP Page 2 stated that the proposed prices must be firm fixed price.

Please clarify if the price evaluation is based on the firm fixed price for each line item or based on the labor categories and rate.

Price evaluation will be based on the firm fixed price for each line item. However, Offerors shall provide insight into how these prices were derived. The RFP is amended to cite accordingly.

94. In light of the request for proposals to “address the full performance objectives outlined in the PWS,” as well as “evaluate the Offer's use of the proposed labor categories and rate", can the OCC give more quantitative information on the current Level of Effort (number of FTE’s, estimated workload/labor hours) on each Task in the SOW?

No, however Offerors are encouraged to propose the appropriate personnel in order to ensure the tasks and requirements of the OCC are accomplished successfully.

95. Is the OCC currently using any proprietary or open source client agents to collect and feed audit logs to the central oracle audit log database? If so, please explain or clarify that syslog and WMI are being used to push logs without agents.

No. OCC uses custom Windows services to provide versatility in how logs are processed, and the types of conversions that are possible. All logs to be loaded into CALM are saved as flat (.txt) files. The structure, delimitation, and complexity of these files vary. The customized Database Loader is a Windows service, which has been created to automatically detect, open, process, load, and store these flat files.

96. The RFP states the contractor will be required to furnish all personnel and materials, is it expected that the contractor will furnish software and hardware appliances for the managing security operations?

It is not expected that the contractor will furnish software and hardware appliances for managing security operations given that all hardware and software currently supporting the CIRC have been purchased by the OCC and are owned by the government.

However, the OCC is open to new approaches and suggestions are welcome. Any new tool or service would have to be factored into existing budget constraints.

Any new HW/SW purchased by the OCC would then become

GFE.

97. Please provide information on the number of firewall devices the OCC has deployed.

This information is not releasable.

Firewall management is out of scope of the CIRC’s area of responsibility.

98. If the OCC is currently using any agent based technology for monitoring and reporting, please provide the number of agents deployed and name of vendor.

The OCC uses client-side Symantec agent technology on approximately 4,600 workstations. Specific information is identified in TE #6

99. How many site visits per year (page 8)? No more than 12 visits per year.

100. How often do the following groups meet:

ECCB, ERG, and SEOG.

These groups meet on a weekly and biweekly

101. Table 1 identifies devices, can you also provide the number of databases the OCC currently operates and monitors.

Approximately 1,500.