PWS_Questions_Answers_from_Industry.pdf

PWS

Page

PWS Section/ Paragraph Questions/Comments/Recommendations Answers

1 Section 3 - First paragraph

Can you please explain what the current "identity management system" is? Does this include AD LDS and Purebred?

Users are configured through AD LDS for email access.

DoD PKI Purebred Derived Credential solution is installed in the mobile device.

Section 3 -

DMUC

capabilities

What solution is DISA using for Mobile Endpoint Protection (MEP)? Government has not selected a MEP as of this PWS.

Section 3 -

DMUC

capabilities

1) What mobile application vetting tool does DMUC currently use and will the contractor need to continue to support it or will a new vetting tool be considered?

2) Are only Enterprise applications being vetted or are all applications including personally installed applications?

1) The app vetting capability is provided by the current Integrator. A new vetting tool will be considered.

2) All applications have a security analysis (vetted) performed.

2 5 DISA ES - How is DMUC currently supporting Conferencing for EVoIP, Chatting, and Video Conferencing. DMUC is currently not supporting this.

2 6 MCM- How is DMUC currently supporting DEOS when it has not been released? Please clarify how this is an existing capability DMUC is currently not supporting this.

2 8 What is the current VPN solution for the Mobility Gateways for DMUC Cisco AnyConnect mobile application and ASA

2 11 Can you please define what Health and Monitoring Systems means and what is the current solution? Log collection to Splunk.

2 12 Can you please define what Event Management Systems means and what is the current solution today?

Alerts collection to Splunk that DISA Global Operations Command (DGOC) then manages into their events/trouble ticketing tool.

2 Background Bullet 7 PKI: There is a reference to "o Next generation behavioral/Artificial Intelligence (AI) identity management" Question: What platform for AI IDAM is currently being used? DMUC is currently not supporting this.

3 1 You state new capabilities, is there a current list of new capabilities? If not how will the PMO prevent scope creep on ever evolving mobility requirements?

New capabilities will be integrated in priority and will not go beyond the scope at the time. Cost, schedule, and performance are the metrics used to keep the scope intact.

3 3 How will the PMO track potential surge? What will occur if surge begins to increase above 45%

Surge will not increase above the % indicated in the final

PWS.

3 PWS 6.para 3

Last Para in 6 Performance Requirements, states: "The contractor’s solution shall comply with appropriate DoD-approved architectures, programs, standards and guidelines, such as Defense Information Infrastructure (DII), Security Technical Implementation Guidance (STIG), DII Common Operating Environment (COE), DoDIN, and Shared Data Environment (SHADE)."

Question: Are SHADE and DII COE still applicable Architectures/Programs to this MES-U effort?

DII Common Operating Environment (COE), and Shared Data Environment (SHADE) have been replaced by Net- Centric Environment and DoD Instruction 8320.02, Sharing Data, Information, and Information Technology (IT) Services in the Department of Defense, August 5, 2013 respectively. These are still applicable where required based on the data and where applicable IAW the instructions.

4 PWS 6.1.1.para

Within the detailed list of contents for the TOMP, there are multiple entries that under ITIL, PMBOK and CMMI-SVC definitions address aspects of the same activity or planning process. For example, Organization typically includes addressing resources, personnel management, management structure/control (by name), labor execution plan, and subject matter expert (SME) support are most commonly represented in a detailed organizational chart with descriptions. Similarly, we do not understand the distinction being made between "execution plan" and "implementation plan," both of which are typically presented by the development of a detailed work breakdown structure and an Integrated Master Plan and Schedule (IMP/IMS), according to guidelines as defined by the Defense Acquisition Guidebook and the Office of the Undersecretary of Defense (OUSD)'s Integrated Master Plan and Integrated Master Schedule Preparation and Use Guide.

Question: Would the government please provide further clarity in these instructions?

The Government has outlined what should be included and the contractor shall propose to the requirement.

5 PWS 6.1.1.para

PWS States: "The TOMP shall also include a Transition Implementation Plan (TIP), outlining activities and timeline required for the contractor to transition support services identified in this PWS to a new contractor as required. The Contractor shall support concurrent network operations services and receive all mobility operational support services from the incumbent Contractor. "

Question: As written, the requirements for creation of a Transition Implementation Plan (TIP) are unclear as whether this is a transition-in plan, a transition-out plan, or both. Would the Government please clarify the intent of the creation of this TIP?

The requirement will be revised in the final PWS. There will be a TIP required for current work to transition as the outgoing/incumbent contractor. The incumbent will be required to continue operations while in "transition mode."

6 PWS 6.1.1.para

The PWS indicates that: "The Contractor shall provide all mandatory Government Standard Operating Procedures (SOPs) and Concept of Operations (CONOPS)" and includes a list of documentations as part of this work.

Question: Would the government define the available SOPs and CONOPS in place today? Which must be created vs which must be updated?

Examples provided in PWS, minor language in paragraph updated.

6 PWS 6.1.2.para

The requirements for the TOMP described in Section 6.1.1 address most of the elements inherent in an IMP/IMS, which is based on creation of a WBS as defined in Section 6.1.2.

Question: Would the Government clarify this relationship and eliminate the potential redundancy inherent in Sections 6.1.1 and 6.1.2?

TOMP should describe how the contractor will manage the work outlined in the PWS as described in the requirement. The WBS is a deliverable oriented hierarchical decomposition of the work to be executed by the project team; a more detailed execution plan.

7 PWS 6.1.3

Similarly there is a lack of clarity in the broad requirements for the TOMP in Section 6.1.1 and the requirement to create an IMS in Section 6.1.3.

Question: Would the Government please clarify this relationship and eliminate the potential redundancy inherent in Section 6.1.1 and 6.1.3?

No redundancy. See above.

8 PWS 6.1.4

Section 6.1.1 states most requirements related to personnel (e.g., organization, key personnel, SMEs) yet the requirement to inform the Government of any changes in key personnel is included in Section 6.1.4. We recommend that the Government make all requirements, including notification of changes/additions to key personnel, part of Section 6.1.1.

Noted.

8 PWS 6.2.para 1

6.2 Systems Engineering (SE), states: "The Contractor shall propose and provide an engineering solution that aligns with DoD Reliability, Availability, and Maintainability

(RAM) "

Question: The "DOD GUIDE FOR ACHIEVING RELIABILITY, AVAILABILITY, AND MAINTAINABILITY" published 26 Aug 2006, is 266 pages and is mostly focused on RAM for Platform Systems Development (Ships, Aircraft, Tanks, etc.). Will the Government please specify which type of RAM Modeling is applicable to the MES-U? Is the Government suggesting that the contractor should use RAM Models on the integration of COTS products in MES-U?

Government needs to conduct further analysis on what parts of DOD GUIDE FOR ACHIEVING RELIABILITY, AVAILABILITY, AND MAINTAINABILITY would be applicable such as Industry Best RAM Practices for IT systems.

10 &11 PWS 6.2.3

Services related to providing "Capability Integration" and those related to providing "Architecture Support" have the same section numbers; 6.2.3.

Question: Would the Government please correct the numbering to facilitate effective compliance tracking?

Noted. This is a draft and corrective actions will be reflected in final documents if applicable.

11 Section 6.2.3.1 -

MCM

1) Has DISA chosen a SaaS MCM service provider?

2) How does DISA handle authentication to the SaaS MCM solution?

3) Will federation be used?

To Be Determined.

11 Section 6.2.3.1 Does the current "Mobile Endpoint Protection" integrate with the current DMUC MDM solution, MobileIron? DMUC is not supporting a selected MEP at this time.

11 6.2.3.1

Mobile Content Management, Question: Is the intent to provide Mobile Content Management or Enterprise Content Management? The difference being that ECM allow as user to gain access to any data stored in the ECM from any end user device, this includes desktops, laptops, and thin clients. MCM only provides the ability to gain access to data from a CMD.

Government intent is MCM

14 PWS 6.2.4.para

For the requirement to build, design and, deliver a virtualized testing environment(s) to be used at JITC, will the Government or the contractor be responsible for acquiring any specialized equipment and/or software to be included in the testing environment?

Government Furnished Property will be used in the lab.

14 PWS 6.2.4

While not specifically stated, the paragraph implies that the contractor should establish and maintain its own testing facility to mirror the facility to be maintained at JITC. Would the Government clarify the need for a contractor testing facility?

A contractor testing facility is not a Government requirement.

14 PWS 6.2.4.para

The PWS states that "The Contractor shall be responsible for providing the latest approved mobile devices and, at the Government’s direction, providing non-approved devices for specific testing as applicable."

Question: Please verify that the Contractor will be required to acquire, as an ODC billable expense, all devices to be tested. (Again, this is an important factor in building the pricing structure.)

Requirement is correct, no further elaboration is required by Government.

14 6.2.4 Testing: Question: Implementing a cloud solution in JITC is not feasible. Will the use of the proposed cloud solution and NIAP Approved test devices the EMM manages meet the virtualized requirement?

The use of a test proposed cloud solution and NIAP approved test devices the EMM manages will be required to be separate and isolated from the operational system.

The isolated system must have all of the operational characteristics, features, capabilities and sub-system interfaces to contractor support systems as well as Government support systems as may be required.

Additionally, per the Cloud SRG, the isolated system must be at the same DoD Impact Level as the operational system. However, the operational and virtual test system can utilize the same Secure Cloud Computing Architecture Cloud Access Point (SCCA/CAP) connection for access.

16 PWS 6.2.5.para

6.2.5 Deployment states: "The Contractor shall leverage the Lab for maintaining the baselines and performing final testing."

Question: The term leverage typically applies to existing resources. Is the "Lab" referenced in the statement an existing Government-owned Lab or a Contractor-established Lab?

Government lab

17 6.3 Does the program privacy assessment imply the need for a privacy impact analysis?

Yes. Privacy assessments are required due to the possibility of personal data residing on DISA managed mobile devices and infrastructure.

17 6.3

You reference NIST SP800-53AR1: Guide for Assessing the Security Controls in Federal Information Systems and Organizations, June 2010.

However, the more updated version of the same standard is - NIST SP800-53AR4, Dec, 2014.

The one referenced in DPWS is no longer valid as per NIST. Will you replace the old references to the current references?

Yes. We should update wording to read the 'most current' Guide for Assessing the Security Controls in Federal Information Systems and Organizations….NIST SP800-53AR4, Dec, 2014

17 6.3 NIST SP800-37R1: Guide for Applying the RMF to the Federal Information System, February, 2010. Will you update to the new version of the same standard - NIST SP800- 37R4, Dec 2018?

Yes. We should update wording to read the 'most current' Guide for Applying the RMF to the Federal….NIST SP800-37R4

18 PWS 6.3.para 3 (on page 18)

6.3 Cyber Security Engineering A&A (FFP). States on page 18, 3rd para, "For technical matters, the contractor shall use standard testing tools such as Fortify for static code review and BURP for dynamic web testing."

Question: Are the "standard testing tools such as Fortify for static code review and BURP for dynamic web testing" to be provided as GFE?

The contractor is responsible for delivering code/capability free of errors and vulnerabilities.

18 PWS 6.3.para 5 (on page 18)

6.3 Cyber Security Engineering A&A (FFP). States on page 18, 5th para, "The contractor shall assist the Government Cybersecurity Lead (or their delegate) and respective System Administrators (SA) to implement the cybersecurity compliance, as required, in accordance with the below time line.

a. For IAVM compliance –IAVA/Bulletin (Alert/Bulletin) – must be fixed/corrected within 21 days from the date of IAVM release

b. For Suspense from US Cyber Command (USCC) – must be fixed/corrected no later than 1 working day prior to USCC suspense date.

c. For POA&M on IAVA/B of Cat I and II – must be submitted within 3 days prior to the IAVM suspense date.

Command Center (DCC) or CYBERCOM direction."

Question: Is it the Government's intent to hold the contractor responsible for meeting the metrics in bullets "a." through "e." above? Since the contractor is only to "assist the Government Cybersecurity Lead..." from a FPP perspective there may be things beyond the contractor's control that effect meeting these metrics.

Yes. In the event that the metric is not met due to uncontrollable dependencies, the GOVT Cybersecurity Lead and/or internal PMO leadership will provide concurrence and the proper POAM procedures will be followed before suspense date expiration in accordance to DISA guidelines.

The contractor is responsible for delivering the requirements in the PWS. Circumstances outside of the contractors control would be considered for meeting the requirement but does not negate the responsibility of the contractor for the requirement.

18 PWS 6.3.para 6 (on page 18)

6.3 Cyber Security Engineering A&A. (FFP) States on page 18, last para, "The Contractor shall assist the Government Cybersecurity lead (or his/her delegate) to generate and prepare necessary artifacts to support Cybersecurity milestone decisions and governance/control boards. This includes but is not limited to... "

Question: Can the Government please quantify the meaning of "assist" and "but not limited to" in this paragraph? From a FFP perspective, these statements could mean many things and in order for the contractor to give the Government its best estimation on level of effort and price, this needs to be further defined.

The contractor is responsible for delivering the requirements of the PWS. The deliverables are stated.

18 6.3 Is it possible to expand more on what is expected as it pertains to Continuous Monitoring and Risk Scoring (CMRS) for Risk Scoring and process, in terms of resources?

Unable to quantify the level due to asset inclusions and depletions within the enclave boundaries. Tech refresh target is to be done annually and as required per vendor releases and released vulnerabilities.

CMRS is a tool.

19 PWS 6.4.para 1

6.4 Operations Support. (FFP) states: "Contractor shall support all device offerings the PMO currently provides as enterprise solutions, all device offerings PMO is currently testing and piloting as well as the lifecycle replacement devices of the current offerings."

Question: Will the Government please provide a list of, and numbers of, "all device offerings" that the contractor is to support? This will enable contractors to propose their best estimations on level of effort and price required to support this FFP task.

Mobility PMO can provide the latest Mobile Device Memorandum which list current devices. The memorandum also lists supported and no longer supported devices. In regards to quantity, the number of devices supported continues to grow monthly. Current values can be provided. Devices supported in the future will be those that get NIAP certified and are supportable by the deployed EMM.

19 PWS 6.4.1.para

6.4.1 Asset Management. 1st paragraph states: "The Contractor shall maintain all assets of the Mobility unclassified program."

Question: Will the Government please provide a list of, and numbers of, "all assets" that the contractor is to maintain? This will enable contractors to propose their best estimations on level of effort and price required to support this FFP task.

PWS will be updated to reflect this.

19 PWS 6.4.1.para

6.4.1 Asset Management. 2nd paragraph states: "The Contractor shall provide asset inventory and asset tracking services for all GFE, reported quarterly."

Question: Does the Government have an existing asset tracking system in use and if so what is it?

The government does not provide the contractor the method in which to track GFE, that is the contractor's responsibility.

19 6.4

Operations Support. In December 2017, DISA distributed a Sources Sought Announcement for a Mobile Telephone Expense Management solution. Suggest that those same requirements be included in this Mobile Enterprise Services - Unclassified (MEC-U) PWS. Our view is that by combining the requirements into a single solicitation will better ensure that DISA receives a cohesive and efficient mobility solution.

Noted.

19 6.4.1 Asset Management. Does this include negotiating with carriers for devices and services to provide low cost, best value pricing and SLAs to DISA customers? No

20 PWS 6.4.1.para

6.4.1 Asset Management. 4th paragraph states: "The Contractor shall provide all hardware and software procurements, installations, configurations and follow-on support for all MES-U equipment."

Question: For this FFP task, to assist contractors in providing the Government with a best and accurate level of effort and price, will the Government please provide definitions (numbers machines, software, etc.)

for "all hardware and software procurements, installations..."?

PWS has been updated.

20 PWS 6.4.2.para

6.4.2 Lab Support states: "The Contractor shall support multiple operational unclassified laboratories. The labs must be capable of hosting multiple test events for various capabilities while sharing physical hardware. The lab must be staffed and ready to provide quick turn around on ad-hoc and planned test events. Must be able to expand or contract the lab based on the Government’s request."

Questions:

1) How many labs are required in support of this contract?

2) Will the labs be Government-owned or Contractor-owned?

3) Are the locations of these labs expected to be on Government Site or Contractor Site?

4) Is this the same as the "Government Primary Lab" referenced in paragraph two?

1) One physical lab located at FTM.

2) The lab is Government-owned.

3) Lab is located at FTM.

4) Yes, this is the same as the Govt Primary Lab.

20 6.4.1

Since only the Government can order DISA capacity services, will the Government change "The Contractor shall use but not limited to the DISA Capacity Services to procure all computing, networking, and support services…" to "The Contractor shall assist the Government use DISA Capacity Services to procure all computing, networking, and support services when applicable"?

Noted.

20 6.4.1

This section discusses use of DISA Capacity services when required to "procure all computing, networking, and support services" however the paragraph above the Capacity Services reference indicates the Contractor "shall provide all hardware and software procurements". Can the Government clarify the types of hardware and software the contractor will be required to procure over and above those purchased via Capacity Services?

Government can provide the current Capacity Services hardware and software list as well of those DMUC items currently deployed that are not Capacity Services procured to provide some level of "types of hardware and software" utilized. But the Government cannot forecast purchase requirements as new capabilities are deployed.

20 6.4.2

Paragraph states "The Contractor shall ensure the MES-U architecture in the Lab is exactly like the deployment architecture..." The following paragraph states "The Contractor shall be responsible for ensuring the instances and architecture in the Lab is a sufficient replica of the production environment..." Can the Government clarify whether the lab needs to be exactly like the deployment architecture or a sufficient replica of the production environment?

This will be GFE and should be sufficient replica as 100% identical will be very difficult to maintain.

20 6.4.2

Can the Government clarify what "Lab is exactly like the deployment architecture" and "Lab is sufficient replica of the production environment" means? Will the contractor be responsible for providing "production-like" test environments only for the capabilities under the program office's purview or those plus all the enterprise services the DMUC interacts with (e.g., DEE), which would be an significant undertaking?

Some testing will require a sufficient replica of other enterprise services. Functionality to allow test environments of different programs to connect to each other within the lab is expected to be available in the future.

21 PWS 6.4.5.para

6.4.5 DISA Storefront Order Management Processing. 1st paragraph states: "The contractor will support but not limited to supporting current process, enhance the process for automation with EMM and LDAP Directory, enhancing DMUC Storefront user ordering, and troubleshooting issues. The Contractor shall work with DSF and other elements of DISA as well as any other applicable systems that support the unclassified Mobility service ordering process. Request Fulfillment requirements from time of DSF order approval by Mission Partner to Mission Partner Tier I being able to issue PIN is:

Threshold= 24 hours, Objective=Real time to less than 1 hour."

Question:

For this FFP task will the Government please further define "contractor will support but not limited to..."?

This will enable contractors to propose their best estimations on level of effort and price required to support this FFP task.

PWS has been updated.

22 PWS 6.4.5; para

6.4.5 DISA Storefront Order Management Processing states, "Request Fulfillment requirements from time of DSF order approval by Mission Partner to Mission Partner Tier I being able to issue PIN is: Threshold= 24 hours, Objective=Real time to less than 1 hour."

Question: For this FFP task, is it the Government's intent that the contractor will be responsible for the Tier 1 fulfillment times referenced when the contractor doesn't have sole control of the process?

Threshold and Objective times are realistic times required to support mission partners

25 Section 6.6 - First paragraph

Does "Commercial cloud-based infrastructure" referenced in this section also include MilCloud 2.0, or service provider data centers?

Can include MilCloud 2.0 as well a service provider commercial cloud data centers that are DoD Impact Level 4/5 approved. The required DoD Impact Level will be dependent upon the information stored in the cloud EMM per the guidelines of the DoD Cloud SRG Section 3:

INFORMATION SECURITY OBJECTIVES / IMPACT

LEVELS

25 PWS 6.5.para 5

6.5 Tier III Support states: "Tier I and Tier II escalation points are outside of scope of this contract." However, Section 6.1.1 Contract Management states, "System monitoring requirements in order to facilitate a seamless transition and assure minimum service disruption of the current on-site administration support, Service Desk Tier I and Tier II responsibilities and Program Office Tier III responsibilities" and Section 6.4.4 PKI/PKE Identity Management states, "The contractor shall support the DoD Derived Credential capability (currently Purebred) installation process updates to include EMM support, documentation generation (setup user guides, training and troubleshooting procedures for Users, Tier I & II) for both Agent and devices, mobile applications Purebred utilization, as well as associated areas that provide or increase the DMUC User Experience with Purebred."

Question: Can the Government please confirm that Tier I and II support is outside the scope of this contract?

Correct as written

25 6.6 Is it the Government's intent to request pricing for Task Area 6, Mobility Cloud Hosting Capability, which is listed as optional? Pricing may be a consideration in this Task Area.

25 6.6 If pricing is requested, should it be included as part of the initial RFP response or post award? To be provided if Task Area is executed.

25 6.6 Will the Government better define all optional tasks, and when they will be required for the contract? Tasks are clearly written

25 6.5 "The Contractor shall use the Government designated ticketing and other system tools to provide Tier III level support" Will the Government supply the tool list for all tiers of support?

Contractor will use Government ticketing system which is Remedy for Tier II and Tier III.

26 Section 6.7 - First paragraph

This section states "The EMM instantiation shall provide support for iOS, Android, and Windows 10 smartphones and tablets". Does DISA also plan to look at MacOS management in future EMM capabilities?

Yes

26 Section 6.7 First Paragraph

Should DISA migrate to a future EMM solution, is re-enrolling all production managed devices (over 130k) an acceptable course of action? Government is open to options provided by EMM vendor.

26 Section 6.7 If the Government chooses to exercise CLIN 6.7, which mechanism for procurement will be used i.e., is there a plan for funding in-pace via contract vehicle, contractor ODCs or otherwise?

The acquisition strategy has not been determined.

26 Section 6.7 If the Government and contractor awardee decides to implement a new EMM solution, will a period of coexistence with the incumbent solution be required? If so, for how long?

That should be detailed in the vendors transition plan and agreed by the government.

26 Section 6.7 If a new EMM solution is implemented, and an "on premise" architecture is selected, does the Government intend to use the existing Data Center hosting services via Capacity Services for computing and operations?

Government will evaluate at time of selection

26 Section 6.7 If a new EMM solution is implemented, does the Government intend to utilize existing Data Center resources/personnel for Tier II support operations? If so, will vendor training/support be considered to supplement contractor responsibilities?

Government will evaluate at time of selection

26 Section 6.7 Is the Government considering an enhanced Identity Management(IM) solution as part of DMUC beyond derived credentials, i.e., a true IDaaS solution to complement EMM and provided SSO, conditional access, an enhanced user/device posture capabilities?

Not at this time. Whatever deployed must meet current security/PKI requirements and deployment conditions.

26 Section 6.7 Will the Government confirm that auditing/reporting requirements are primarily derived from CSfC Capability Packages? CSfC is for Classified

26 Section 6.7 Does the Government intend to develop or augment an automated device provisioning process?

Government supports improvements to provisioning process

26 6.7 5th bullet: Question: If there is a an ECM employed as part of the MES U, does there need to be an MCM for the SaaS EMM? Government is not deploying an ECM as part of MES-U.

27 6.7 7th bullet on page: Question: Is this implying that the SaaS EMM be a multi-tenant platform? If so, recommend this sentence be re-structured to imply a multi-tenant SaaS solution.

Section 6.7 is DMUC Next Generation EMM wherein "multi-tenant" is independent whether it is On-Premise in a DoD Data Center or in a SaaS cloud. Will include the "multi-tenant" designation for clarity.

28 Section 6.7 Can DISA explain what they mean by "A more comprehensive Role-Based Access Control Structure"? Multiple levels of configurable access

29 PWS 9

While it is clear that most work will be performed at the DISA Fort Meade facilities, it appears that work may also be performed at other Government sites and at contractor facilities. Would the Government please clarify what work will be performed at which sites, and how many available seats are at each site for contractor use?

All work is at Ft. Meade.

How many DISA GTMS tickets is the incumbent contractor receiving per month? How many at Tier III?

Incumbent contractor supports Tier 3, average 4-6 tickets a month

What is the NIST security rating for the information system solution - Confidentiality, Integrity, Availability - example, NIST, MMM, or HHH?

DMUC is evaluated using the DoD Risk Management Framework.

Since the CMDs are used OCONUS, is DISA going to make references to any requirements associated to General Data Protection Regulation (GDPR)? Need to refer to Office of the General Counsel

Is GDPR an issue the US Government has to consider since the MES-U service and employees are paid for with US Dollars and not affected by the European Unions GDPR regulations?

Need to refer to Office of the General Counsel

Is this opportunity going to be a total small business set-aside? If so, is there a preferred socio-economic category to be used?

To Be Determined. The Acquisition team is currently working to determine the acquisition strategy.

Mobile Content Management: Is the intent for desktops/laptops/tablets/CMD access the data stored in the MCM, or only the management CMD access the data? To Be Determined.

European Union General Data Protection Regulation: Is this something DISA is paying attention to and will compliance be a requirement for this opportunity?

DISA plans on studying this question more. Currently our systems are on sovereign US soil based military installations. We need to better understand how procured secured mobile devices have to comply with this.

Draft RFP does not request a solution replacement, how will a new solution/product be selected?

To Be Determined. Requirements for an EMM will be finalized and market research will be completed.

Acquisition will be competed.

Why is Credentialed Mobile Device Security Professional (CMDSP) not a required certification?

Mobility PMO needs to research this certification more.

Will need to look at the authenticity to see if this is a professional and notable certification solution.

In reference to the application vetting requirement for App Store Submissions, will DISA require source code from the apps?

No, we require the AKP and the IPA. Unmanaged apps do not process government information (such as Southwest app, etc.). Managed apps process government information up to the FOUO/government workflow apps. Government wants to focus on quantitative app processing results with clear understanding of why an app fails the process.

Overall

Overall

Overall

Overall

Overall

Overall

Overall

Overall

Overall

Is there any prohibition if any OEM uses a non-US based NIAP lab (e.g. EWA-Canada, BAE instead of a US based NIAP lab (e.g. BAH, Gossamer, etc.)?

As long as the lab is accredited by NIAP and has the US NIAP protection profile, using an outside accredited lab is fine. Common criteria does not cover all aspects of the NIAP test core. Common criteria tests are not accepted by NIAP.

What is the timeframe for the anticipated award date?

Anticipated release of the RFP is 4QFY19 and anticipated award is 1QFY20 however these dates are still to be determined.

Will a draft RFP be released? To be determined.

When will the Q&A be published to FBO? April 17th or sooner.

Why is the future capabilities listed in the optional area of the PWS? Future capabilities are based on the Government's preference as it aligns with MES-U

Overall Overall

Overall

Q&A