The file's text, extracted by GovTribe without its formatting.
RFP CC16HQR0001
Attachment 11: Vendor Questions / Government Responses
Questions and Answers Matrix: Managed Enterprise E-mail Services
| # |
| RFQ Section or Attachment |
| Question |
| Response |
| Change to RFQ? |
| Description of Change |
| Technical/ Contractual |
Page: 68
| Will the Government allow 8 point Times New Roman for illustrations since fonts larger than 10 point are exceedingly difficult to accommodate in illustrations? |
| The Government will allow use of 8- point, Times New Roman font for illustrations. |
| Yes; Section L.2.3 |
Page: 68
| Sentence revised to read: “For any captions or illustrations, responses should utilize Times New Roman text in a font size no smaller than 8-point font.” |
| Contractual |
Page: 70
| L.2.3.I.3 mentions an incumbent Contractor for the legacy email system. Who is that incumbent Contractor? |
| The incumbent Contractor for the legacy e-mail system is Hewlett-Packard Enterprise Services (HPES). |
| No |
| N/A |
| Contractual |
| 3 |
| PWS Section A. Introduction |
Page: 3
| Section A states that the OCC has Headquarters in Washington, D.C., four district offices and over 60 field offices. Are there firewalls between any of these field offices? |
| No, there are no firewalls between these offices. |
| No |
| N/A |
| Technical |
| What version of Microsoft Office is OCC currently using (Professional 2010, Professional 2013)? Are there any plans to upgrade the Microsoft Office version in the near future? |
| The OCC is currently using Microsoft Office 2010. Rollout of Office 2013 is planned for the second quarter of fiscal year 2016. |
| No |
| N/A |
| Technical |
Page: 7
| OCC states that the “OCC email service hardware and software suite will be due for a major technology refresh in approximately 18 to 24 months.” What does that include? If the OCC is on Office 2010, and have to have the PIV requirement, then passive authentication is not supported in 2010. |
| The OCC is currently using Microsoft Office 2010. Rollout of Office 2013 is planned for the second quarter of fiscal year 2016. |
| No |
| N/A |
| Technical |
Page: 6
| Will all 14 Blackberry Enterprise Servers (BES) located at the primary and the secondary/DR email production sites be decommissioned prior to the start of email migrations? |
| Yes |
| No |
| N/A |
| Technical |
Page: 6
| How do Citrix XenDesktop/XenApp users access email today? |
| Citrix XenDesktop/XenApp is used for remote access to OCC email, the Microsoft Office suite, and other OCC applications. Using Citrix Receiver, OCC employees are able to access email, the Microsoft Office suite, and other applications using non-OCC issued computers. |
| No |
| N/A |
| Technical |
| 8 |
| PWS B.1.19 and C.2.17.d |
Pages: 7 and 17
| Does OCC plan to continue using their existing electronic document system (currently an OpenText/eDoc solution) or are they open to moving to cloud archiving/SharePoint? |
| Currently there is no plan to replace Open Text/eDocs. |
| No |
| N/A |
| Technical |
Page: 14
| Does OCC want/need to continue having an on-premises Skype for Business solution, or could they use Skype for Business Online? |
| The OCC will continue to use on-premises Skype for Business. |
| No |
| N/A |
| Technical |
Page: 14
| Does OCC currently limit OWA access to users who are currently using GFE and on the OCC network or using VPN? If not, how do would they mandate use of PIV card and PIN for OWA access? |
| There is no limitation to access OWA. Non-GFE computers will use PIV authentication that utilizes card readers. |
| No |
| N/A |
| Technical |
Page: 17
| Instead of “daily incremental and weekly full” backups, would OCC consider the use of cloud storage distributed between multiple geographically-disbursed perform datacenters? |
| The OCC wishes to ensure that agency emails can always be recovered in the event of a data loss. That is currently accomplished by means of daily incremental and weekly full backups. Offerors may propose alternative means of storing emails as long as those methods ensure ready recovery of emails in the event of data loss. It is the responsibility of offerors to demonstrate how their technical solution fully addresses the OCC’s business needs. |
| No |
| N/A |
| Technical |
Page; 17
| What version of Microsoft System Center is currently used? |
| SCOM 2007 is currently used; the OCC plans to upgrade to SCOM 2012 by early 2016 |
| No |
| N/A |
| Technical |
Page: 17
| What product and version of Intel/McAfee Security Information Event Management (SIEM) is currently used? |
| Intel/McAfee SIEM infrastructure is Version 9.5.0 MR7. |
| No |
| N/A |
| Technical |
Page: 14
| Are there any plans to implement an Enterprise Mobility Management (EMM) service to manage GFE and BYOD Android and iOS devices? |
| Yes, but the OCC does not have any specific details regarding the proposed implementation that it can share at this time. |
| No |
| N/A |
| Technical |
Page: 33
| The third deliverable under “Required Content for Offeror’s Proposal” references the System Security Plan (SSP). Please confirm that this is only referenced for context and that the SSP itself is not due with the proposal. |
| The description of the third deliverable reads: “Proposed deviations from (add/change/delete) the current FedRAMP and/or agency-issued ATO artifacts (including customer responsibility matrix and System Security Plan).” The deliverable is the list of deviations from the FedRAMP and/or agency-issued ATO artifacts, including deviations from the customer responsibility matrix and SSP. Offerors are being asked to identify deviations from the SSP, not submit the SSP itself. |
| No |
| N/A |
| Technical |
| 16 |
| Attachment 3-Appendix A. Requirements Traceability Matrix (RTM) |
Page: 1 The RTM states “In the attached matrix, the key architecture requirements of the MDM solution are identified”
The RFP is geared toward a Managed Enterprise E-mail service, which is far more robust than an MDM solution unaccompanied; what is the rationale for specifically identifying MDM in the leading paragraph?
| This sentence incorrectly references an MDM solution. It has been removed from the RTM. |
| Yes |
| Remove this sentence in the prefatory language accompanying the RTM. |
| Technical |
C.2.1.b
Page: 5
| The RTM states “Proposed email solution shall apply known techniques to ensure that attachments and hyperlinks are safe to open”; what constitutes “known techniques”? |
| The proposed email hygiene technology should utilize industry-standard techniques for preventing and blocking malicious attachments and URL links. |
| No |
| N/A |
| Technical |
| 18 |
| Attachment 1 Section D.7 |
| Would the Government consider revising the Contract Award Date (T) to equal the Contract Kick-off date since it might take several days to get the necessary teams, Government and contractor, in the same meeting to review the contract award and expectations? |
| Yes, the “T” date will be modified to represent the date of the contract kickoff meeting. |
| Yes |
| Modify the PWS to define the “T” date as the Contract Kickoff Date |
| Technical |
| 19 |
| Attachment 1 PWS, Section D.7 Page 33 |
| In the “Required Content for Offeror’s Proposal” table, item 4 requires that the FedRAMP 3PAO “as part of Offeror’s Proposed delivery team”. If Option 1 is proposed, is OCC requiring that the 3PAO company be a subcontractor on the vendor team? |
| The offeror is ultimately responsible for delivering to the OCC the third-party assessment services and work products. If that delivery can be accomplished through another relationship besides that of a subcontractor, the offeror is welcome to avail itself of that type of relationship. |
| No |
Technical
| 20 |
| Pricing |
| Would the Government consider procuring this under GSA IT Schedule 70 providing the Government pre-negotiated pricing by GSA considered fair and reasonable? |
| No, the Government will not procure this effort under GSA Schedule 70. This effort will be competed on the Open Market via FedBizOpps (www.fbo.gov). However, at their own discretion, vendors may choose to offer pricing that is in line with their Schedule 70 contracts. |
| No |
| N/A |
| Contractual |
Att 3. RTM (all) The numbering of the PWS does not match the RTM, which introduces a significant risk of errors when comparing the two. Will the Government consider updating the RTM to match the PWS?
Also, we have identified several discrepancies between the PWS and RTM. Can the Government please clarify based on the list of discrepancies below?
- PWS C.2.6 – not in RTM at all
- PWS C.2.7 – not in RTM at all
- PWS C.2.11 – does not match RTM
- PWS C.2.13 – does not match RTM
- PWS C.2.19 – not in RTM at all
- PWS C.2.20 – not in RTM at all
- PWS C.3 – entire section not in RTM
- PWS C.4.6 – not in RTM at all
- RTM C.3.2 – no Pilot in PWS
- RTM C.3.3 – deliverable not in PWS
| The RTM has been updated to correct the discrepancies and omissions identified by this question. |
| Yes |
| Revise the RTM to do the following: |
1) Include only those solution requirements identified in Sections C.2 – C.4 of the PWS. (Requirements related to how the offeror provides its services are no longer included in the RTM, although they need to be addressed in an offeror’s technical approach.)
2) Ensure that all requirements are correctly numbered and include the same requirements descriptions as appear in the PWS.
Technical
| 22 |
| n/a |
| Will the OCC permit bidders to submit cross reference matrices with their proposals, to be excluded from the page count? |
| No, the OCC believes its page count is sufficient for Offerors to successfully describe their technical response. |
| No |
| N/A |
| Contractual |
| The OCC has provided ample time and explicit information within the Managed Email Services RFP to achieve submission within the stated timeframe and deadline. Will the OCC please confirm that the submission date and time will remain unchanged as 11/2/2015 at 8:00 am EST? |
| The submission date and time remains unchanged (November 2, 2015 at 8:00 AM EST). However, a second round of Vendor Questions / Government Responses is available to all interested vendors. The due date and time for all follow-up questions is October 19, 2015 at 5:00 PM EST. |
| Yes; Section L.2.1 |
Page: 68
| A new paragraph has been added: Follow-up Questions Regarding the RFP: After release of the initial Vendor Questions / Government Responses (Attachment 11) and the updated solicitation package, the Government will allow a second round of questions to follow. All questions shall be submitted by e-mail to ManagedEmail@occ.treas.gov by October 19, 2015, at 5:00 PM EST. Please label this e-mail as “RFP CC16HQR0001 – <Insert Vendor Name Here> Questions”. |
| Contractual |
| 24 |
| L.2.3 Small Business Subcontracting plan |
| The RFP states, “All other-than-small (large) businesses are required to submit a small business subcontracting plan in compliance with the requirements of FAR 19.704.” There were no Small Business Goals stated in the RFP. Please provide Small Business goals and clarify whether these percentage goals are to be based on total subcontracted dollars or total contract value. |
| As defined in 52.219-9 (ALT II) of the solicitation, vendors have the option of submitting an individual contract plan, a master plan, or a commercial plan. In this particular effort, the OCC is not providing any specific small business (SB) goal percentages. As such, vendors shall adjust their SB subcontracting plan submissions accordingly. FAR 52.219-9 and FAR 19.704 provide additional information, definitions, and requirements regarding the aforementioned terms and further instructions. |
| No |
| N/A |
| Contractual |
| 25 |
| Section C.2, pg15, Item 6r |
| Please be more explicit about the requirement definition for “media vault storage?” |
| The purpose of this requirement is to inform offerors that the OCC wishes: 1) to know the physical location where its email data is stored, and 2) to confirm that the location is appropriately secured. If the proposed solution does not include housing the storage media containing email data in a vault, offerors should clearly explain in their technical how and where the email data is securely stored. |
| No |
| N/A |
| Technical |
| 26 |
| Section C.2, pg21 Item 21 |
| Please be more explicit with regard to migrating data from local drives during non-business hours? For example, how will access to such data be enabled? |
| The migration of the OCC’s mailboxes should be performed during non-business hours (e.g. evenings and weekends). Migration of PST files on local or shared drives should occur after mailbox migration and should be coordinated with PST file owners. |
| Yes |
| Requirement C.2.28 now reads: “The Offeror shall migrate all existing individual, executive, and shared mailbox content, calendar content, directories, and PST files on shared or local hard drives into the new email solution without any service interruptions. The Offeror shall perform mailbox migration work during non-business hours (i.e., weekdays from 9 PM through 6 AM, on weekends, and during Federal holidays) to minimize the impact to users. Migration of PST files on local or shared drives should occur after mailbox migration and should be coordinated with PST file owners.” |
| Technical |
| 27 |
| Section C.2, Page 21, Item 25n. |
| Please be more explicit about the requirement “Contractors shall only use wireless internet connections to connect with non-OCC networks”. |
| When accessing the internet, the Offeror should utilize its own wireless connection rather than the OCC network. |
| No |
| N/A |
| Technical |
| 28 |
| Section D.2 Document Review Process |
| In the first paragraph, the last sentence, “Table 2 specifies the documents that will undergo the document review process.” Please clarify the location of Table 2 in the PWS? |
| The table in Section D.7 on pages 33 – 35 is the table being referenced. It is currently captioned as “Table 1,” but the caption has been updated to read “Table 2.” |
| Yes |
| Change the caption of the table on pages 33 – 35 (in Section D.7) to read “Table 2.” |
| Technical |
| 29 |
| Attachment 3 RTM, ID C.4.4 |
| The government references Table 1 in the Requirement Description. Would the government please provide this table or provide the location of the table within the RFP? |
| Table 1 is on page 11 of the PWS. It describes the implementation options. |
| No |
| N/A |
| Technical |
| 30 |
| Attachment 1 - PWS Page 25 - C.4 Requirement 8 |
| What environmentally sound EPA equipment sanitization guidelines should be followed? Does NIST 800-88 meet these guidelines? |
| Both EPA sanitization guidelines and NITS 800-88 should be followed. |
| Yes |
| The last sentence of C.4.8 now reads: “All equipment sanitization procedures must be environmentally sound, as outlined by the U.S. Environmental Protection Agency (EPA), and NITS 800-88 should be followed.” |
Technical
| 31 |
| Attachment 1 - PWS Page 21 - C.2 Requirement 27 |
| Can you provide an estimate on the number of PSTs to be migrated and GB of PST data? |
| The estimated number of PST files is 120,000. The estimated storage amount is 480GB. Please note that these figures are only estimates; the actual figures may vary. |
| 32 |
| Attachment 1 - PWS Page 17 - C.2 Requirement 17b |
| How does OCC currently journal Skype for Business on-premises Instant Messages? |
| Skype for Business is not currently journaled. |
| No |
| N/A |
| Technical |
| 33 |
| C.1 Table 1 |
| For cloud-based services, the FEDRAMP authorization is for the service and for data centers. For cloud-based services there is no defined primary or secondary data center, you may not know which of their data centers will contain your data. |
| Thank you for this clarification. In identifying a primary and a secondary data center, the OCC was attempting to express its need for a secondary source of email data in the event the primary source became unavailable. However, in a fully redundant cloud solution, there would be no need to failover from the primary to the secondary source. This is acceptable to the OCC as its desire is simply to have access to its email data within the timeframes specified in the SLA. |
Therefore, having no defined primary or secondary data center should not prevent the Offeror from meeting the OCC’s requirements. The Offeror’s technical approach should, nevertheless, clearly explain how the proposed solution will ensure the availability of OCC’s email data in the event of an emergency or disaster event.
| 34 |
| C.2.4. |
| Mailboxes in Office 365 are provided at a standard size. It is not possible to provide smaller mailboxes. |
| The mailbox sizes stated in the PWS are minimum sizes. The PWS has been modified to reflect this fact. |
| Yes |
| Revise the requirement to indicate that the mailbox sizes are minimums. |
| Technical |
| 35 |
| C.2.6.a & q and C.2.16 |
| Backup Software and its configuration is handled by the Cloud Service Provider (CSP), and is outside of the control of the reseller and the government. Additional information on the service levels provided can be found in the CSP’s Terms of Service, SLA’s and other documentation. |
| The Offeror’s proposal should clearly state which party (i.e., the reseller or the CSP) is responsible for the Infrastructure as a Service (IaaS) and the Software as a Service (SaaS) components of the solution. In situations where a given industry standard results in the CSP and/or reseller failing to satisfy an OCC requirement as written, the Offeror should clearly describe the specific standard and explain why it is sufficient to meet the OCC’s stated business needs. |
| No |
| N/A |
| Technical |
| 36 |
| C.2.6.a & q and C.2.16 |
| Backup Software and its configuration is handled by the Cloud Service Provider (CSP), and is outside of the control of the reseller and the government. Additional information on the service levels provided can be found in the CSP’s Terms of Service, SLA’s and other documentation. |
| The Offeror’s proposal should clearly state which party (i.e., the reseller or the CSP) is responsible for the Infrastructure as a Service (IaaS) and the Software as a Service (SaaS) components of the solution. In situations where a given industry standard results in the CSP and/or reseller failing to satisfy an OCC requirement as written, the Offeror should clearly describe the specific standard and explain why it is sufficient to meet the OCC’s stated business needs. |
| No |
| N/A |
| Technical |
| 37 |
| C.2.6.n |
| New features are rolled out regularly by the CSP as part of a continuous innovation process. In some cases, the CSP’s will make new features available in a test mode, but this is not always the case. While we can certainly provide for testing of new features, it may or may not be possible to test new features in advance of their deployment into production. |
| Thank you for this clarification. The OCC understands that some new features are deployed in production by vendors (such as Microsoft) without consulting resellers. Offerors proposing a cloud solution should describe, to the extent possible, the types of new features that would be available for testing before production release, versus those types of features that cannot be tested prior to release (because they are deployed by the vendor directly into production). This information should be included in the Offeror’s technical approach. |
| No |
| N/A |
| Technical |
| 38 |
| C.2.6.r |
| Media vault storage does not apply to a CSP solution. |
| The Offeror’s proposal should describe the type of storage that is used in lieu of media vault storage. Please also explain why this type of storage will be sufficient to meet the OCC’s business needs. |
| No |
| N/A |
| Technical |
| 39 |
| C.2.8 |
| Most cloud based email providers (including Microsoft) provide SLA’s of 99.9% although they typically exceed that. There is no mechanism to increase this. |
| Thank you for this clarification. The OCC has modified this requirement, as well as the SLA in the Quality Assurance Surveillance Plan (QASP), to reflect the 99.9% threshold. |
| Yes |
| Change PRS in QASP to reflect 99.9% (instead of 99.9%). Ditto for this requirement in the PWS and RTM. |
| Technical |
| 40 |
| C.2.9 |
| Microsoft Office 365 does not provide the capability to measure and validate the average response time. For a cloud based solution, the validation of this time is impacted by many factors that are outside the CSP’s control, such as the internet connection speed and the OCC's TIC infrastructure, time to traverse the internet, etc. |
| If a cloud-based solution does not have the built-in capability to measure and validate the average response time, the Offeror may propose an additional tool that can be integrated with the cloud solution to provide this functionality. In consideration of this fact, the OCC has modified this requirement to remove the reference to “built-in” tools or techniques. |
| Yes |
| Remove the reference to “built-in” tools in this requirement, both in the PWS and the RTM. |
| Technical |
| 41 |
| C.2.13 |
| Office 365 provides easy integration with multiple mobile devices and scales to very large capacity. However, Microsoft provides their own certificates for SSL communication and cannot use the Treasury/OCC issued certificates. |
| Thank you for this clarification. The OCC has modified this requirement to indicate that for cloud-based solutions that issue their own certificates (in lieu of using a Treasury- or OCC-issued certificate), the certificate must have a trusted root and the client must be configured to trust only the authorized certificates. |
| Yes |
| Modify this requirement in both the PWS and RTM to state: “For cloud-based solutions that issue their own certificates (in lieu of using a Treasury- or OCC-issued certificate), the certificate must have a trusted root and the client must be configured to trust only the authorized certificates.” |
| Technical |
| 42 |
| C.2.15 |
| Office 365 provides various reports and some capability to integrate with SCOM via the Office 365 Management Pack for Microsoft System Center 2012 R2. However, integration with SCOM, McAfee and other monitoring tools may or may not be possible depending on what is required, software versions, etc. |
| This statement suggests that the integration with SCOM, McAfee, and other monitoring tools “may or may not be possible depending on what is required. . .” The OCC’s requirement is stated as providing “automated, continuous monitoring using Microsoft System Center Operations Manager (SCOM), as well as a real-time data feeds of email security or hygiene events to the OCC’s McAfee Security Information and Event Management (SIEM) tool to capture, record, analyze, and report point-in-time snapshots, as well as trends over time, of the following aspects of system health and performance status: |
a. Number of email users logged on
b. Messages received and messages sent per second
c. Mailbox delivery queue size
d. Mailbox, Client Access, Hub Transport, and Edge servers health and utilization
e. LDAP search time
f. Average sent latency
g. Average receive latency.”
The Offeror’s technical approach should explain how it will address the requirement as stated above.
| 43 |
| C.2.26 |
| CSP’s regularly upgrade the hardware and software that provides the basis for their solution, but not on a fixed schedule. Typically, though, the upgrades occur much more rapidly than for on premise solutions. |
| The Offeror’s proposal should specify the industry-standard timeframes for upgrading the key hardware and software components of the proposed solution. The OCC has modified this requirement to indicate that technology refreshes should occur every three years or according to the industry-standard timeframes established for each component type. |
| Yes |
| Revise the requirement in both the PWS and RTM to state that if the industry-standard refresh cycle for a given HW/SW component is longer than 36 months, that will be considered acceptable. |
| Technical |
| 44 |
| C.3 |
| Disaster Recovery is inherent in the design of cloud based Email solution and is handled by the CSP. The resulting service levels are document in the CSP’s SLAs, terms of service and other documentation. These requirements would not apply to a CSP. |
| The OCC’s DR requirements need to be satisfied. However, the OCC has not dictated how the Offeror should satisfy them. If DR is “inherent in the design of cloud-based email solutions,” then the Offeror should be able to articulate how that design satisfies the business needs implicit in the five requirements outlined in Section C.3. |
| No |
| N/A |
| Technical |
| 45 |
| C.4.1.a&c |
| Microsoft Office 365 and other cloud email providers do not use commercial-off-the-shelf anti-malware, anti-spam, etc. software. These CSP’s have large teams of security professionals developing and constantly enhancing state of the art, proprietary security and email hygiene software. |
| The PWS has been modified to state that COTS tools, or a functional equivalent, can be proposed to meet Requirement C.4.1. a. No change will be made to C.4.1.c as that requirement discusses “best-practice techniques” rather than COTs software. |
| Yes |
| Update C.4.1.a in the PWS to reference “functionally equivalent” tools as well as COTS tools. Make the same change in the RTM. |
| Technical |
| 46 |
| C.4.1.b |
| Office 365 provides various reports and some capability to integrate with SCOM via the Office 365 Management Pack for Microsoft System Center 2012 R2. However, integration with SCOM, McAfee and other monitoring tools may or may not be possible depending on what is required, software versions, etc. |
| This statement suggests that the integration with SCOM, McAfee, and other monitoring tools “may or may not be possible depending on what is required. . .” The OCC’s requirement states that the proposed solution shall “integrate with, and provide real-time feed to, the OCC Microsoft System Center Operations Manager (SCOM) and the OCC Security Information Event Management solution (SIEM, currently a McAfee solution) for triggered event reporting.” The Offeror’s technical approach should explain how it will address the requirement as stated above. |
| No |
| N/A |
| Technical |
| 47 |
| C.4.2 |
| Internal routing back to an on premise implementation of Zixmail would not be possible with OWA, but would be doable with Outlook. In addition, other encryption solutions available might provide better integration with Office 365. |
| The PWS states that “the proposed solution shall provide secure email transmissions using ZixMail and Transport Layer Security (TLS).” While other encryption solutions may provide “better integration,” the OCC desires a solution that can support both of the stated encryption types. |
| No |
| N/A |
| Technical |
| 48 |
| C.4.6 |
| CSP’s perform regular scanning of their infrastructure and their internal security processes are documented in their security documentation. |
| The OCC’s requirement states that “the proposed solution shall provide weekly email server vulnerability scanning and reporting and remediate all identified vulnerabilities.” If a CSP’s “regular scanning” is more frequent than once a week, that will be acceptable to the OCC. If the scans occur less frequently (e.g., biweekly or monthly), the Offeror’s proposal should explain why that frequency is sufficient to address the OCC’s business needs. |
| No |
| N/A |
| Technical |
*Note: Offeror only needs to fill out the highlighted columns: Company, RFP Section (please include the section, paragraph, and page number that your question refers to), and Question. Offeror may add additional rows, if necessary. Furthermore, while the company name is needed by the OCC to identify the source of each question, this information will not be included in the list of answers provided publicly by the OCC in response to the questions. Finally, please do not add/remove columns or change column width. Please keep this document format in MS Word.