QUESTIONS_FOR_SOLICITATION__2.docx

QUESTIONS FOR SOLICITATION #CCR-14-0001

Questions #2

1. Does the Combined Synopsis/Solicitation under solicitation number CCR140001 contain requirements similar to a current contract? If possible, please provide the current contract number. Or, is this a new requirement for the government?

This is a new requirement for the government.it combines two previous requirements into one contract.

2. How many IT systems does USCCR have?

The Commission has 1 internal system.

3. How many IT systems are in-house and how many are maintained by a third party?

The Commission has 2 external systems.

4. Does the FISMA audit scope include testing a sample of 800-53 controls for select USCCR systems plus the OIG’s cyberscope questions or just the OIG’s cyberscope questions?

All categories in the OIG Cyberscope Reporting areas are required only for the CyberScope Report. The scanning should include reporting on 18 control families in accordance with NIST SP800-53 Rev1.

5. If the FISMA scope includes testing in addition to the OIG cyberscope questions, how many systems and or controls does USCCR expect the auditor to select for testing?

The contractor should determine the appropriate systems to test and appropriate numbers and provide the Commission the information in their proposal to meet the requirements of the SOW.

6. Can USCCR provide us with the FY2013 levels of effort for the financial statement and FISMA audits? Hours and dollars?

We have already stated the previous year contrast fees. See responses to question #1.

7. Is travel outside of the DC area required for the financial statement or FISMA audit?

No travel is required outside of the DC area

8. Section 2.3.2 Contractor Personnel – Does the agency expect the staffing mix to include all key personnel identified in this section or can we provide a staffing mix that include some but not all personnel identified?

Yes we expect a mixture of staff to include Key Personnel. All key personnel must be identified and resumes must be provided in the proposal package.

9. Section 2.3.2.2 IT Staff Auditor – Will the agency consider removing the minimum one year of IT audit experience from the IT Staff auditor.

No, we will not remove the minimum requirement.

10. Are the past performances included in the 25 page limit?

No, the past performances are not include in the 25 page limit

11. Since the work is at the government site, who provides the security tools for network scanning the government or contractor?

The contractor awarded the contract may use Nessus Scanning Tools which is available for free to contractors.