CORHQ-26-R-0394 A0002 Questions and Answers.pdf

AMENDMENT OF SOLICITATION/MODIFICATION OF AWARD

1. CONTRACT ID CODE

2. AMENDMENT/MODIFICATION NO. 3. EFFECTIVE DATE 4. REQUISITION/PURCHASE REQ. NO. 5. PROJECT NO. (If applicble)

7. ADMINISTERED BY (If other than Item 6) CODE

FDIC 3700/56 (3-08)

FACILITY CODE

9A. AMENDMENT OF SOLICIATION NO.

9B. DATED (SEE ITEM 11)

10A. MODIFICATION OF CONTRACT/ORDER NO.

10B. DATED (SEE ITEM 11)

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offers is extended, is not extended.

Offer must acknowledge receipt of this amendment by signing in Block 15b below and including the signed amendment with the offeror's proposal.

12. N/A

13. THIS ITEM ONLY APPLIES TO MODIFICATION OF CONTRACTS/ORDERS.

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

CHECK ONE A. THIS CHANGE ORDER IS ISSUED PURSUANT TO THE CHANGE ORDERS CLAUSE

B. THIS MODIFICATION IS ENTERED INTO PURSUANT TO THE AUTHORITY OF THE FDIC CONTRACTING OFFICER

C. THIS MODIFICATION IS ENTERED INTO PURSUANT TO MUTUAL AGREEMENT OF THE PARTIES

D. OTHER (Specify type of modification and authority)

E. IMPORTANT: Contractor is not, is required to sign this document and return copies to the issuing office.

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remain unchanged and in full force and effect.

15C. DATE SIGNED

15A. NAME AND TITLE OF SIGNER (Type or print)

16C. DATE SIGNED

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

14. DESCRIPTION OF AMENDMENT/MODIFICATION

PAGE OF PAGES

6. ISSUED BY CODE

8. NAME AND ADDRESS OF CONTRACTOR (No., street, county, State and ZIP Code) (X)

CODE

15B. CONTRACTOR/OFFEROR

(Signature of person authorized to sign)

16B. UNITED STATES OF AMERICA

(Signature of Contracting Officer)

CORHQ-26-R-0394 / 0002

NONPUBLIC//FDIC INTERNAL ONLY#

Attachment / Document Page or Section Question Response

RFP CORHQ-26-R-0394 Section L, 7.3.2-09 and 7.3.2-15, pages 62 to

The solicitation sets a 10 page maximum for Factor A but does not state the page size, page margins, font type, minimum font size or line spacing. What page size, margins, font and minimum font size, and line spacing does FDIC require for Volume I and Volume III?

The page format is 8.5 X 11. The margins are no less than .5 inch. The Font is no less than 12 point size in block letters

RFP CORHQ-26-R-0394 Section L, 7.3.2-09(e), page 63 Do tables, charts and graphics count toward the page limits, and is a smaller font size (for example 8 point) permitted for text inside tables, figures and graphics?

Yes. Tables, charts and graphics count toward the page limits, and a smaller font size no less than 8 point font is permitted for text inside tables, figures and graphics.

RFP CORHQ-26-R-0394 Section L, 7.3.2-24(a)(15), page 67; SOO 3.6.1, SOO 3.6.1 requires a vulnerability report for the Appendix A test images as part of the technical proposal. Does that report count toward the 10 page limit for Volume I, or may it be submitted as an appendix or a separate file outside the page count? Does FDIC require a particular report format (for example scanner output in JSON, or a PDF summary)?

Appendix A test images does not count toward the 10 page limit for Volume I. This report may be submitted as an appendix and not a a separate file. Yes, the FDIC requires a particular report format for a scanner output in PDF format.

RFP CORHQ-26-R-0394 Section L, 7.3.2-09(c), 7.3.2-15 and 7.3.2-24, pages 62 to 67

Clause 7.3.2-09(c) names Volume I 'Technical Approach', 7.3.2-15 names it 'Mission Capability' and organizes it by Sub-factors 1 to 3, and 7.3.2-24(a) lists fifteen elements the technical approach must include. Should Volume I be organized by the three sub-factors with the fifteen elements mapped under them, and do all fifteen elements fall inside the single 10 page limit?

Yes. Offoror's proposal must address all elements under the Technical Approach and must within the 10 page limit.

RFP CORHQ-26-R-0394 Section L, 7.3.2-09(c), 7.3.1-06, 7.3.2-47 and 7.1.2-03(b), pages 60 to 63

Clause 7.3.2-09(c) names Volume IV 'SCRM Information'. Clause 7.3.1-06 says exceptions, additional past performance information and the Representations and Certifications 'shall be submitted as Volume IV - Additional Information', and 7.3.2-47, 7.1.3-01 and 7.3.2-09(f) also refer to an 'Additional Information' volume. What volume number and title should offerors use for (a) the SCRM information, which 7.1.2-03(b) requires in a separate volume, and (b) the Additional Information (Section K, exceptions and certifications)?

Volume IV is SCRM Information. Volume V - Additional Information will be added to provison 7.3.2-09 - General Proposal Instructions.

7.3.1-06 Identification and Delivery of Proposals has been revised to say "Volume V - Additional Information"

RFP CORHQ-26-R-0394 Section L, 7.3.1-06 item (b), page 61 In which volume should the Software License, Maintenance and Support Agreements be placed, and are they excluded from any page limit?

Software License, Maintenance and Support Agreements should be in Volume V - Additional Information. They do not have a page limit.

RFP CORHQ-26-R-0394 Section L, 7.3.2-16(b) to (e), pages 64 and 65 Does the limit of two pages per example contract cover the paragraph (c) information and the paragraph (d) narrative together, and are copies of CPARS evaluations outside that limit? Paragraph (c) asks for 'a separate completed form for each example contract'; is there an FDIC form for this, or may offerors use their own layout?

CPARs and PPQs are not included in the page limit for Past Performance. PPQs will not be accepted after the proposal due date.

RFP CORHQ-26-R-0394 Section L, 7.3.2-16(e), pages 65 and 66 Paragraph (e) requires a Past Performance Questionnaire (PPQ) from each customer unless a CPARS evaluation is available. (a) Please confirm that, for a federal example contract with a CPARS evaluation, the CPARS copy is accepted in place of the past performance questionnaire and the reference need take no action. (b) The link given is FDIC's general acquisition page; which form, by number or title, is the PPQ? (c) With eleven calendar days between issue and closing, will FDIC accept a PPQ that a customer returns shortly after the proposal due date?

Paragraph (e) states that "…offerors must ask each customer indentified by the offeror in paragraph (c) to complete a Past Performance Questionnaire (PPQ). The PPQ form can be found under the "Past Performance" section on the FDIC's general acquisition page.

RFP CORHQ-26-R-0394 Section L, 7.3.2-16(a) and (b), page 64; Section M, 7.3.2-20(f), page 70

Paragraph (b) asks for at least three example contracts. May example contracts performed by a proposed subcontractor or by the product manufacturer count toward the three, and will a proposal with fewer than three recent and relevant example contracts still be evaluated under 7.3.2-20?

7.3.2-16(a) states "…information is required for both the offeror and for subcontractors and joint venture partners that the offeror considers critical to its future overall successful performance of this solicited requirement. The Contracting Officer will review any and all past performance information submitted under Volume III - Past Performance.

RFP CORHQ-26-R-0394 Section L, 7.3.1-06, page 61 Proposals are submitted by email to the Contracting Officer. Please confirm (a) the file format required for each volume (PDF or Word, with the Price Schedule and the SCRM workbook in Excel), (b) any file naming convention, (c) the file size cap per email on FDIC's mail system, and whether a proposal may be sent as several emails or as a compressed file, and (d) whether FDIC will confirm receipt by email.

(a) The file format should be PDF equivalent and must render in Microsoft Office and/or Adobe acrobat. (b) Each Volume must be labeled (for example; Volume_I Technical Approach). (c ) The FDIC inbound email file size is 35MB. If the response is greater than 35MB, please contact the contracting officer to use the FDIC Secure File Transfer called GlobalScape

RFP CORHQ-26-R-0394 Section K, 7.3.2-45 and 7.3.2-47, pages 45 and

Clause 7.3.2-45 says the signature on FDIC form 3700/55 constitutes the making of the representations and certifications, and 7.3.2-47 says to 'complete and return the signed original'. Is a completed PDF of the Section K pages with an electronic or scanned signature acceptable, and is a signature needed on Section K in addition to Block 30 of the form?

Completed PDF of the Section K pages with an electronic or scanned signature is acceptable. A signature on Block 30 indicates that the offeror accepts everything in the solicitation, including completed Section K pages.

RFP CORHQ-26-R-0394 FDIC 3700/55, page 1, Blocks 20, 23 and 24 The form instructs the offeror to complete Blocks 12, 17, 23, 24 and 30, and Block 20 says the Section B Price Schedule is for reference only. Should Blocks 23 and 24 carry the contract total from the Excel Price Schedule, or be left blank with a reference to that attachment?

Complete Excel Price Sheet attachment. Disreguard instructions for Blocks 12, 17, 23, 24 and 30. The price schedule that is part of the solicitation itself is for reference only.

Questions and Answers for CORHQ-26-R-0394

RFP CORHQ-26-R-0394 Section L, 7.3.2-06, page 62 Questions and answers will be posted as an amendment on SAM.gov. On what date does FDIC expect to post the amendment, must offerors acknowledge it with the proposal, and will FDIC extend the response date if the amendment is posted fewer than five business days before October 9, 2026, so that all interested parties can reflect the answers?

The RFP has been extended until October 16, 2027. An Amendment regarding the extension was posted on SAM.gov on 10/7.

RFP CORHQ-26-R-0394 Section L, 7.3.1-06, page 61; FDIC 3700/55 Blocks 6 and 8

The solicitation was issued on September 28, 2026 and proposals are due on October 9, 2026. The proposal must include a vulnerability report on the Appendix A images, questionnaires returned by past performance customers and three years of financial statements. Will FDIC consider extending the proposal due date by two weeks?

The RFP has been extended until October 16, 2027. An Amendment regarding the extension was posted on SAM.gov on 10/7. Financial statements are not necessary. The Contracting Officer will conduct their own checks on finanical capabiliity.

RFP CORHQ-26-R-0394 Sections C and L (no provision found) The solicitation does not address artificial intelligence. Is the use of AI-assisted tools (for example GitHub Copilot, Claude Code and similar) permitted in preparing the proposal and in performing the work, including image build automation, vulnerability triage and documentation, and does FDIC require any disclosure of that use?

The vendor may use AI tools to assist in preparing the proposal.

Using AI for performing the work will adhere to the use of the AI tools made available in the FDIC environment.

SAM.gov notice Description; SOO header marking, pages 6 to

The notice states 'The RFP is non-transferable, unless approved in advance by the Contracting Officer', and the Statement of Objectives is marked 'NONPUBLIC//FDIC INTERNAL ONLY'. May an offeror share the solicitation and the Statement of Objectives with its proposed subcontractors and suppliers to prepare the proposal without separate approval?

Yes

RFP CORHQ-26-R-0394 Section L, 7.3.2-11(d), page 63; Section M, 7.3.2-23, page 71

Paragraph (d) requires a bank reference and certified financial statements prepared by an independent auditor for the current and two preceding fiscal years, 'or an acceptable equivalent'. For a small business whose statements are not audited, what does FDIC accept as an equivalent (for example statements prepared by a certified public accountant, or federal tax returns for those years)? What form should the bank reference take, and in which volume do these documents belong?

7.3.2-11(d) states that "If the offeror cannot provide these statements, explain why, and provide other sutable proof of the offeror's financial responsibility." Bank reference, certified financial statements, and other suitable proof of the offeror's financial responsibility shall be submitted under Volume V - Additional Information.

RFP CORHQ-26-R-0394 FDIC 3700/55 Block 10; Section K, 7.3.2-49, Please confirm that this acquisition is full and open with no set-aside and no socio-economic eligibility requirement, that the $47 million size standard applies to the small business representation, and whether small business or Small Disadvantaged Business status receives any consideration in the evaluation.

The FDIC is not subject to the Federal Acquisition Regulation (FAR).This acquistion is IAW with FDIC's acquisition procedures and policy. No set-asides will be used for this acqusition.

RFP CORHQ-26-R-0394 Section L, 7.1.2-03(a), pages 59 and 60 An offeror must state its status as Original Equipment Manufacturer, Aftermarket Manufacturer or Authorized Supplier. Where the offeror itself builds, hardens, signs and maintains the container images from upstream open source projects (for example Alpine, NGINX, Tomcat and Spring Boot in Appendix A), is the offeror the Original Equipment Manufacturer of the delivered images for this purpose, and what should be entered as 'Name and Address(es) of Manufacturer' for the upstream open source components?

The FDIC expects to purchase the capability to purchase up to 50 images regardless of the manufacturer. It is expected that the Name and Address of the Manufacturer is the provider of the software.

Attachment J-1, Pre-Award SCRM (Excel)

Worksheet 'Line Items 0001-0017', rows 2 to

The workbook has one entry column and its worksheet is titled 'Line Items 0001-0017', while this solicitation has line items 0001 to 0003.

Does FDIC expect one entry per Price Schedule line item or one per container image, and how should Part Number and Model or Version be completed when SOO 3.12.1 asks that the fifty images not be named in advance?

The FDIC expects to purchase the capability to purchase up to 50 images and therefore expects a part number to represent a quantity of 50 for purchase

RFP CORHQ-26-R-0394 Section H, 7.3.2-78 paragraph 1.A, page 21;

SOO Scope of Work item 1, page 7

Must the image catalog and management portal be commercially available at the time of proposal submission, or is a solution that will be available in time to meet delivery on January 6, 2027, consistent with paragraph 1.A(2) of clause 7.3.2-78, acceptable? Is there a minimum catalog size beyond the fifty licensed images?

Yes, the image catalog and management portal must be commerically available in time to meet delivery on January 6, 2027.

There is no minimum catlog size beyong the 50 licensed images.

RFP CORHQ-26-R-0394 Section I, 7.5.6-04, page 38; Section M, 7.3.2- 18(c), page 69

Clause 7.3.2-18(c) says FDIC will evaluate the offeror's subcontracting information, and 7.5.6-04 lists the approved subcontractors as 'None'. In which volume should an offeror present the 7.5.6-04 items (1) to (6) for a proposed subcontractor, does that content count toward the Volume I page limit, and will subcontractors named in the proposal be approved at award?

Provision 7.5.6-04 will be changed from "None" to "TBD."

Subcontracting information will not count toward the Volume I page limit. Subcontractor named in the proposal may be approved at award.

Attachment C-1, Statement of Objectives

3.1.1, page 7 SOO 3.1.1 requires 'support for DoD IL5/IL6 environments' and images 'suitable for classified' environments. Does FDIC operate or plan an IL5, IL6 or classified environment under this contract? What evidence satisfies this mandatory requirement (for example image alignment with the DISA STIGs and CIS benchmarks), and is any facility or personnel security clearance required of the contractor?

No. The FDIC does not plan an IL5, IL6 or classified environment. The FDIC operates with DISA and STIG security requirements.

For contractor personnel, they will need to be subjected to the FDIC Background Clearance. An existing facility or personnel security clearance is not acceptable

Attachment C-1, Statement of Objectives

3.1.1, page 7, and 4.2.1 note, page 12; RFP Section H, 7.4.2-02, page 25

SOO 3.1.1 calls for images that comply with FedRAMP Moderate, and the note in 4.2.1 says FDIC 'does not require the vendor solution to obtain FedRamp status'. Please confirm (a) that the vendor-hosted registry and management portal need no FedRAMP authorization, or, if FDIC prefers one, the impact level and whether a FedRAMP High Ready or FedRAMP 20x Marketplace listing is accepted; (b) where the authorization boundary sits, that is, whether the vendor registry and portal stay outside the FDIC boundary with images pulled into FDIC's JFrog repositories and Azure Container Registry; and (c) whether any FDIC information will be stored in the vendor system, so that clause 7.4.2-02 applies.

(a) The Vendor-hosted registry and management portal need to be FedRamp at least at the medium level.

(b) The FDIC will pull the images from the vendor. The authorization boundary is expected to be the vendor boundary -(c ) No FDIC information will be stored in the vendor system

Attachment C-1, Statement of Objectives

3.1.2, page 7; 4.1.1 last bullet and 4.2.1, page

How many Authority to Operate control statements and NIST SP 800-53 Revision 5 questions should the contractor expect to answer, in what format and on what schedule, and can FDIC release the customized control set before proposals are due so that the effort can be priced? Do any existing system POA&M items or open findings on FDIC's current container platform transfer to the new contractor?

This information is not available until the product is procured

Attachment C-1, Statement of Objectives

3.3.1 to 3.3.4, page 8 SOO 3.3 sets remediation times for vulnerabilities but no support service levels. What support SLAs does FDIC require: help desk hours, response and resolution times for support requests, and uptime for the vendor registry and portal? Will the SLAs the offeror provides under 3.3.2 to 3.3.4 be incorporated into the contract, and do service credits or other remedies apply when a remediation time is missed?

The SLA's are as follows: Help desk hours: 7A-7PM Eastern Time Zone Monday-Friday Response time: Severity 1: Production down issue with no workaround: 30 minutes / Severity 2: Major impairment of functionality 2 business hours / Severity 3: limited impact 4 business hours.

Resolution times: Severity 1: Maintain vendor and customer engagement until work around or repair is implemented continuously / Severity 2: Within 12 business hours / Severity 3:

Within 7 business days.

The SLAs will not be incorporated into the contract. Their are no service credits or other remedies apply when a remediation time is missed.

Attachment C-1, Statement of Objectives

3.3.1 to 3.3.4, page 8 SOO 3.3.1 requires updated images within 48 hours of public disclosure of a zero-day vulnerability, while 3.3.2 to 3.3.4 run from the date the upstream maintainer's patch is available. Where no upstream patch exists within 48 hours of disclosure, what does FDIC accept as meeting 3.3.1 (for example removal or disabling of the affected package, a mitigation, or a published advisory with a VEX statement)?

Which source sets the critical, high and medium ratings: the NVD CVSS score, the upstream maintainer's rating, or another?

3.3.1 is clarified as follows: Vendors shall provide the patch within 48 hours of being notified that the upstream patch is available.

The NVD CVSS Score sets the critical, high and medium ratings

Attachment C-1, Statement of Objectives

3.7 to 3.13, pages 10 and 11; RFP Section L, 7.3.2-24(a)(9) to (15), pages 66 and 67

SOO 3.7 says the capabilities that follow are not mandatory, and 3.8 to 3.13 follow it. Clause 7.3.2-24(a) uses 'should' for items (9) to (13) and 'must' for item (14), Technical Architecture (SOO 3.13). Are SOO 3.13.1 to 3.13.4 mandatory requirements evaluated under Sub-factor A.1, or additional capabilities evaluated under Sub-factor A.3? Items (6) and (15) both address SOO 3.6.1; is one response sufficient?

3.13.1 and 3.13.4 are mandatory requirements evaluated under sub-factor A.1

Attachment C-1, Statement of Objectives

Appendix A, page 13; 3.13.1, page 11 Please give the versions and tags of the five Appendix A test images (for example which Red Hat base image and release, and the Tomcat, NGINX and Java versions for Spring Boot), and the scanner FDIC will use to compare the reports. SOO 3.13.1 asks for an underlying image based on GLIBC, and Alpine is based on musl libc; for the Alpine entry, does FDIC want the Alpine image hardened as is, or a minimal GLIBC-based equivalent?

The FDIC expects to have the capability to pull the current generally available image. As of 9/30/26, the versions are listed below:

Alpine: Version 3.24.2 Red Hat: Version 9 NGINX: Version 1.31.6 TomCat: Version 10.1.6.0 Spring boot: Version 4.1.1

Attachment C-1, Statement of Objectives

3.12.1, page 11; Price Schedule line 0001 How is an image counted against the quantity of fifty: by image name, by version stream or tag, by architecture (AMD64 and ARM64), and do the FIPS and development variants of one image count separately? May FDIC exchange images within the fifty during a performance period?

Image name. The FIPS and development variants do not count separately. The FDIC may exchange image within the fifty during a performance period.

Attachment B-1, Price Schedule (Excel)

Worksheet FFP, line 0002, rows 6, 12, 17, 22 and 27

What does line 0002, Software Maintenance (quantity 1), cover that line 0001 does not, given that daily rebuilds and CVE remediation are part of the container image subscription? May an offeror whose subscription price includes maintenance enter $0.00 on line 0002?

Yes, but the vendor should specify in the written response that the software maintenance is included and what is included in the software maintenance.

Attachment B-1, Price Schedule (Excel)

Worksheet FFP, cells G8 and A23 The Base Total formula in cell G8 is SUM(G6:G7) and leaves out line 0001 in G5, so the Contract Total would omit the base period container images. The Option Period 3 total in row 23 has no label. Will FDIC issue a corrected workbook, or should offerors correct the formula themselves?

The FDIC will correct and provide the updated Price Schedule in the Q&A Amendment.

Attachment B-1, Price Schedule (Excel)

Worksheet FFP, columns C, D and F; SAM.gov notice, Product Service Code 7A21

The notice carries Product Service Code 7A21, perpetual license software, while the Price Schedule prices five twelve month periods.

Please confirm that an annual subscription is the intended license model and that the line 0001 unit price is per image per twelve month period. What should an offeror that manufactures the images enter in the Manufacturer and Part # columns?

The FDIC expect the annual subscription and line 0001 is the unit price per image for the 12 month period. For the offeror that manufacturers the images, they can enter their company name and manufacturer generated part number or add not applicable.

Attachment B-1, Price Schedule (Excel)

Worksheet FFP, line 0003; SOO Scope of Work item 6, page 7, and Section 4, pages 11 and 12

Line 0003, Professional Services, appears in the Initial Performance Period only, while the scope includes 'ongoing support'. To price line 0003 as firm fixed price, please state (a) the expected duration of the implementation and whether FDIC Change Control Board approval ends it; (b) whether FDIC wants the labor categories and hours for the Technical Consultant and the Security Control Specialist shown in Volume II, and FDIC's estimate of the hours for each; (c) the deliverables and acceptance criteria for line 0003; and (d) whether professional services needed in the option periods are to be priced inside line 0002 or ordered separately.

(a) Expected implementation is nine months from project kick off.

The kick off does not start until all resources have obtained clearance and demonstrated login success with the FDIC provided equipment. (b) Due to the firm fixed price nature of the contract, the FDIC does not need the labor categories and hours for the Technical Consultant and Security Control specialist. The FDIC estimate of hours is 200 hours for the Technical Consultant and 100 hours for the Security Control Specialist. (c) The deliverables are listed in section 4.1 Technical Integration Services and 4.2 Security and Compliance Services. (d) Professional services is not needed in the option periods and therefore are not priced inside line 0002 or ordered separately.

RFP CORHQ-26-R-0394 Section L, 7.3.2-11(b), page 63; Section I, 7.5.13-09, page 30; SOO 4.1.1, page 12

Travel is not reimbursed and must be inside the fixed price, and SOO 4.1.1 includes hands-on training 'in a virtual and/or on-premise environment'. How many on-site trips and training sessions, at which location and for how many attendees, should the price include?

Are there other direct costs (ODCs) the contractor must carry, and does FDIC hold the licensing for JFrog, GitHub Enterprise Server, CrowdStrike, Trivy, Splunk and Azure, so that the contractor's price covers its own solution only?

One on-site trip or virtual training session is expected for less than 20 people. The location is the FDIC office in Arlington, VA. There are no other ODC's for the contractor. The FDIC holds licensing for JFrog, GitHub Enterprise Server, CrowdStrike, Trivy, Splunk and Azure

RFP CORHQ-26-R-0394 Section F, 7.3.1-10, page 16; SAM.gov notice, Place of Performance; SOO 4.1.1, page 12

Clause 7.3.1-10 gives the place of performance as 'Remote', the notice lists Arlington, VA 22226, and SOO 4.1.1 mentions on-premise training. Will the professional services be performed remotely at contractor facilities, or is any work required on-site at the Government facility in Arlington? For on-site work, who furnishes workspace and badges?

The professional services can be performed remotely or if the vendor prefers they can work on site. If the resource is on site, the FDIC will furnish a workspace. Regardless of the location, the FDIC will provide a badge and government furnished equipment as a virtual desktop.

RFP CORHQ-26-R-0394 Section H, 7.5.1-03 and 7.5.2-08, pages 27 and

The consultants need access to FDIC security tools, documentation and systems. Will FDIC provide laptops, accounts, remote access and tokens as government furnished equipment and information, or must contractor personnel use contractor equipment?

The FDIC will provide a virtual desktop that invokes on a vendor provided laptop. The vendor will need to use a laptop at their expense. The FDIC will provide accounts, remote access and if appropriate tokens.

RFP CORHQ-26-R-0394 Section H, 7.5.2-08, page 28; Section I, 7.5.6- 04 item (3), page 38; SOO 4.1.1 and 4.2.1

Clause 7.5.2-08 designates one functional responsibility, 'Senior Consultant', at Moderate risk, the SOO names a Technical Consultant and a Security Control Specialist, and 7.5.6-04 cites a Key Personnel clause 7.3.2-43 that is not in the solicitation. (a) Are the Technical Consultant and the Security Control Specialist designated key personnel? (b) Are resumes required with the proposal, in which volume, and are they outside the page limit? (c) Are there minimum qualifications, certifications or years of experience for either role? (d) Does the Moderate risk designation apply to both roles, so that there is no U.S. citizenship requirement, and how long does the background investigation take before work may begin?

(a) The Technical consultant and Security Control Specialist are not designated key personnel. (b) Resumes are not required. The vendor is tasked with providing the resources to deliver the solution and is responsible for the human resource administration component

Attachment C-1, Statement of Objectives

Section 1, page 6; scope diagram, page 7 Is this a new requirement or a follow-on to an existing contract? If a follow-on, please provide the incumbent contractor name, the contract number and the current contract value, and identify the product that now supplies hardened base images to the 'External Source Repository for Harden Base image', which the diagram labels 'TBD'.

This is a new requirement.

Attachment C-1, Statement of Objectives

Section 4, pages 11 and 12; RFP Section F, 7.3.1-12, page 16

Is there a transition or phase-in period before January 6, 2027? Is an incumbent or the current platform contractor funded and required to provide knowledge transfer on the existing JFrog and GitHub Actions pipeline to the awardee during the phase-in period?

There is no transition or phase-in period before January 6, 2027. The FDIC expects to start the implementation after January 6, 2027.

existing DAUXs vendor, VivSoft has the knowledge of JFrog and GitHub actions. ViVSoft does not have any responsibility for the Container Supply Chain software, but will provide knowledge transfer on existing JFrog and GitHub actions.

Attachment C-1, Statement of Objectives

Scope diagram, page 7; Appendix B, page 14;

3.5.8, page 9; 4.1.1, page 11

The scope diagram on page 7 and the Appendix B diagram differ: Appendix B adds the workload build and workload promotion actions and the fdic-workload-ci repository. Which diagram governs? Both show GitHub Actions on GHES doing the pull, build, scan and publish steps; does SOO 3.5.8, 'Integrate with the JFROG pipeline', mean configuring the vendor registry as a remote repository in JFrog Artifactory, or integration with the JFrog Pipelines product? Is FDIC's JFrog instance self-hosted or SaaS, and which version? SOO 4.1.1 refers to 'pipeline infrastructure listed in Appendix A', and Appendix A lists container images; should that reference read Appendix B?

Appendix B governs the workload build and workload promotion.

For the integration with the JFROG pipeline the configuration is done with JFROG. FDIC JFROG is self-hosted in Azure and is version

7.161.29 . The pipeline infrastructure listed in Appendix A, should be Appendix B

Attachment C-1, Statement of Objectives

Scope diagram, page 7; 3.3.5, page 8; 3.5.4, Will FDIC's JFrog and GitHub Enterprise Server environments have outbound internet access to pull from the vendor-hosted registry, or must the solution also deliver images into an environment without outbound access (for example by an offline bundle or a mirror hosted in FDIC's Azure tenant)?

JFROG and GitHub Enterprise server have outbound internet access to pull from the vendor hosted registry. This access will traverse the FDIC firewall infrastructure

Attachment C-1, Statement of Objectives

3.5.1 to 3.5.3, page 9 How many portal users and how many distinct roles should the solution support? Does single sign-on through Azure Entra ID (SAML 2.0 or OpenID Connect) satisfy 3.5.1, or does FDIC also require a direct integration with on-premises Active Directory?

Portal users will be 20.

Roles should 3 Single Sign-on through Azure Entra ID satisfies 3.5.1

Attachment C-1, Statement of Objectives

3.13.3 and 3.13.4, page 11 What integration does FDIC expect with CrowdStrike, Trivy and Splunk: that the images and their SBOMs scan accurately with CrowdStrike and Trivy and that portal audit events and vulnerability notifications are forwarded to Splunk, or a product connector for each tool? Is Splunk deployed as Splunk Enterprise or Splunk Cloud?

Once the image is retrieved from the vendor, the image will enter the FDIC pipeline for scanning via CrowdStrike and Trivy. The log files from CrowdStrike and Trivy will be written to Splunk Cloud. The reports from the pipeline scan are sent to ServiceNow.

RFP CORHQ-26-R-0394 Section I, 7.5.8-01 and 7.5.8-02, pages 38 and

Clause 7.5.8-01 requires liability insurance of $5,000,000 per occurrence and automobile coverage, and 7.5.8-02 asks that the certificate 'reference the BOA and task order number'. For a commercial software subscription performed remotely with no vehicles used, which coverages and limits apply to this contract? Please confirm that the certificate is due ten days after contract execution and that nothing is required with the proposal.

7.5.8-02 - Certificate of Insurance, references to BOA and task order number will be replaced with "Contract number." Certificate of Insurance is due no later than 10 business days after date of execution of award. Coverages referenced in 7.5.8-01 still apply for this requirement.

RFP CORHQ-26-R-0394 Section I, 7.5.3-01, page 37 Does FDIC require an Accessibility Conformance Report for the management portal with the proposal, and if so, in which volume? Yes. Tables, charts and graphics count toward the page limits, and a smaller font size no less than 8 point font is permitted for text inside tables, figures and graphics. These items shall be submitted under Volume I.

RFP CORHQ-26-R-0394 Section L, 7.3.2-09(a), page 62; Section M, 7.3.2-18, page 68

Clause 7.3.2-09(a) mentions an oral presentation. Does FDIC plan oral presentations or a product demonstration as part of the evaluation, and if so, when and in what format?

There are no oral presentation or oral presentation clauses in this RFP. 7.3.2-09(a) mentions oral presentation as an example of this solicitation not committing the FDIC to award any contract, to pay any cost incurred related to proposal submission, including oral presentations. That is standard lanaguage for this provision.

RFP CORHQ-26-R-0394 Section F, 7.3.1-12, page 16; Section L, 7.3.2-

13, page 63 What is the anticipated award date, given the period of performance start of January 6, 2027? The anticipated award date is prior to 12/31/26 and the implementation date will start in January of 2027

RFP CORHQ-26-R-0394 Section C, 7.3.2-21, page 5; Section L, 7.3.2-01, Clauses 7.3.2-21 and 7.3.2-01 refer to a Statement of Work, and the attachment is a Statement of Objectives. Does FDIC expect the offeror to submit a Performance Work Statement in response, and if so, does it count toward the 10 page limit and will it be incorporated into the contract?

The attachment has been updated from "Statement of Objectives" to the "Statement of Work." Performance Work Statement is not required for this requirement.

1. Attachment B-1, Price Schedule – Base Total formula The Base Total cell (G8) uses the formula =SUM(G6:G7), which excludes CLIN 0001 Container Images (G5). The option period totals include all CLINs. Please confirm that the Base Total should include CLIN 0001, and whether offerors should correct the formula (to =SUM(G5:G7)) in their submission.

Base Period does include CLIN 0001. The formula will be updated and a revised spreadsheet will be provided with the Amendment to pvoide Q&As.

2. Attachment B-1, Price Schedule – CLIN 0002 Software Maintenance For subscription-based offerings where maintenance and updates are included in the subscription price, may offerors price CLIN 0002 at $0.00 with a note stating that maintenance is included in CLIN 0001? Yes

3. Volume numbering and contents Clause 7.3.2-09(c) identifies Volume IV as "SCRM Information," while clause 7.3.1-06 identifies Volume IV as "Additional Information" (exceptions, additional past performance information, and Representations & Certifications).

Please confirm the volume structure and identify where offerors should submit (a) Section K Representations & Certifications, (b) exceptions to terms and conditions, (c) software license, maintenance, and support agreements, and

(d) the Pre-Award SCRM information (Attachment J-1).

Section K Reps and Certs should be in Volume V - Additional Information. Volume IV should be "SCRM Information" the solictation will be updated to reflect this.

4. Volume I title Clause 7.3.2-09 refers to "Volume I – Technical Approach," and clause 7.3.2-15 refers to "Volume 1 – Mission Capability." Please confirm these are the same volume and subject to the 10-page limit for Factor A.

It is the same volume. Mission Capabliity refers to the overall framework that Technical Approach is under.

5. SOO 3.6.1 / Clause 7.3.2-24(a)(15) – Vulnerability scan report Will the FDIC allow the vulnerability scan report for the Appendix A images to be submitted as an attachment that is excluded from the 10-page limit for Factor A?

Appendix A test images does not count toward the 10 page limit for Volume I. This report may be submitted as an appendix and not a a separate file. Yes, the FDIC requires a particular report format for a scanner output in PDF format.

6. SOO 3.6.1 / Appendix A – Test images Please clarify whether offerors should provide scan results for (a) their hardened equivalent of each Appendix A image,

(b) the upstream public image, or (c) a side-by-side comparison of both. Please also identify the specific versions/tags of each image (e.g., Alpine, Red Hat OS/UBI version, NGINX, Tomcat, Spring Boot/Java runtime version), and whether the FDIC has a preferred scanning tool (e.g., Trivy, which is referenced in SOO 3.13.3).

The scan results should include the hardened equivalent of each Appendix A image. You can use 2 examples of Alpine and Redhat to share the report. The FDIC scanning tool is CrowdStrike

7. SOO Section 4 / Attachment B-1 – Professional Services in option periods CLIN 0003 Professional Services appears only in the Initial Performance Period. Please confirm that no professional services (Technical Consultant or Security Control Specialist) are required during Option Periods 1–4.

It is confirmed the FDIC does not require professional services (Technical Consultant or Security Control Specialist) for option periods 1-4

8. SOO 4.1.1 – Training location SOO 4.1.1 calls for hands-on training "in a virtual and/or on-premise environment," and clause 7.3.1-10 states the place of performance is Remote. Please confirm whether the FDIC expects any on-site training and, if so, the location and number of sessions so offerors can include travel in the firm-fixed price.

The FDIC does not expect on-site training. The training can be conducted virtually.

9. Clause 7.3.2-16 – May offerors include past performance examples from a major subcontractor among the three (3) to five (5) example contracts? Yes

10. Clause 7.3.2-11(d) – Financial statements For offerors whose financial statements are reviewed rather than audited, will the FDIC accept CPA-reviewed financial statements as an "acceptable equivalent"? Yes

60 3.12.1

Beyond the five Appendix A test images (Alpine, Red Hat OS, NGINX, TomCat, Spring Boot), how many total container images does FDIC expect to onboard under the 50-image license referenced in SOO 3.12.1, and can that number be exceeded within the same contract? 50 images for now

61 Appendix B What existing CI/CD pipeline stages (within the GHES → JFrog → Azure ACR flow shown in Appendix B) is the awarded contractor expected to modify versus simply integrate with as-is?

A) The proposed solution should be able to integrate with JFROG to pull the images from the provider. B)The awarded contractor is expected to integrate with JFROG with the as-is environment. Any changes to JFROG will be coordinated and executed by the vendor responsible for JFROG outside of this procurement.

62 3.3.1 Given the referenced two calendar day turnaround for Section 3.3.1, could FDIC clarify if they are expecting after hours support (e.g. weekend support as-needed to meet 2 calendar day requirement)?

Yes. The FDIC would required weekend support to meet the two calendar day requirement

63 3.1 Given the IL5/IL6 environment, could FDIC clarify if the solution requires FedRAMP Moderate or High? At minimum FedRamp Moderate

FedRAMP Requirement Does the proposed solution itself need to hold an existing FedRAMP Moderate authorization at the time of proposal submission, or may an offeror propose a solution hosted on a FedRAMP-authorized platform while completing any required product-level authorization after award? Yes. Minimum Moderate FedRamp authorized solutions

Container Image Scope Please clarify whether FDIC expects the contractor to provide and maintain a pre-hardened catalog of container images, harden FDIC-provided/base images, or support both approaches.

Expecation is to support/Provide Harden Open source/COTS and FDIC Custom images. Support is needed for 50 container images.

Existing Tool Integration Is the contractor expected to integrate with FDIC’s existing JFrog environment and CI/CD pipelines as currently configured, or should offerors include proposed changes to the existing toolchain where those changes would improve software supply-chain security?

The contractor is expected to integrate with existing JFROG and existing tools CI/CD pipeline. The implementation of the tool and any future changes to JFROG will be coordinated with the vendor responsible for JFROG. The selected vendor for this procurement is not expected to manage JFROG

Identity Integration For Active Directory and Microsoft Entra ID integration, does FDIC expect the solution to support role-based access control, service principals/workload identities, privileged-access controls, and automated user/group provisioning?

The FDIC does not expect the solution to support role based access control, service principlas/workload identifies, privileged-acces controls, and automated user/group provisioning. The FDIC owns the CI/CD pipeline and tools that are already integrated with Entra ID

Software Bill of Materials Is generation, ingestion, validation, and continuous monitoring of SBOMs required as part of the solution? If so, does FDIC have a preferred standard or format, such as SPDX or CycloneDX?

Yes. The FDIC expects generation, ingestion, validation, and continuous monitoring of SBOMs required as part of the solution.

The FDIC follows DISA/STIG guideline and the SBOM is expected to meet that guideline. The FDIC can accept either SPDX and/or CycloneDX.

Vulnerability Remediation SLA Does FDIC have defined remediation timeframes for critical, high, medium, and low vulnerabilities, or should offerors propose severity-based remediation SLAs?

The FDIC has defined remediation timeframes for critical, high, medium and low vulnerabilities. The vendor does not need to propose severity based remediation SLAs

Supply-Chain Risk Management For the required Pre-Award Supply Chain Risk Management submission, is FDIC primarily evaluating the offeror’s internal supply-chain controls, the proposed software/product supply chain, or both? TheFDIC is evaluating the proposed software/product supply chain

Subcontracting / Teaming May an offeror satisfy specialized capabilities such as FedRAMP-authorized hosting, hardened-image services, or advanced container-security functionality through subcontractors or technology partners, provided the prime contractor retains responsibility for overall performance? Yes

Proof of Capability / Demonstration Will FDIC require a technical demonstration, proof of concept, or product evaluation as part of the source-selection process? If so, will additional instructions be provided after proposal submission? No

Licensing and Pricing Structure Should pricing include all software licensing, implementation, integration, maintenance, technical support, and optional professional services for the entire anticipated period of performance, or should any of these elements be priced separately?

Pricing should include all software licensing, implementation, integration, maintenance, technical support, and optional professional services for the entire anticipated period of performance

Transition / Implementation Period Does FDIC have a desired implementation or production-readiness timeframe following contract award? Expected implementation is nine months from project kick off.

Incumbent Environment Is there an incumbent software supply-chain security solution currently supporting this environment? If so, can FDIC identify the current solution or provide information regarding expected transition responsibilities?

There is no incumbent software supply-chain security solution currently supporting this environment. This is a new requirement and new contract that has never been awarded before

DOA/ASB

3501 Fairfax Drive Arlington, VA 22226 hamjackson@fdic.gov

(703) 562-6134 hamjackson@fdic.gov

1. Provide questions and answers regarding the solicitation.

2. Update the solicitation in response to questions and answers.

Questions and Answers regarding the solicitation begins on page 2 of this Amendment.