Amendment 0002_SF 30.pdf

Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended, by one of the following methods:

(a) By completing items 8 and 15, and returning or (c) By separate letter or telegram which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN REJECTION OF YOUR OFFER. If by virtue of this amendment your desire to change an offer already submitted, such change may be made by telegram or letter, provided each telegram or letter makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

E. IMPORTANT: Contractor is not, is required to sign this document and return copies to the issuing office.

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT 1. CONTRACT ID CODE

2. AMENDMENT/MODIFICATION NO. 3. EFFECTIVE DATE 4. REQUISITION/PURCHASE REQ. NO. 5. PROJECT NO. (If applicable)

7. ADMINISTERED BY (If other than Item 6) CODE

(SF-30) FAA Template No. 11 (8/97)

FACILITY CODE

9A. AMENDMENT OF SOLICITATION

NO.

9B. DATED (SEE ITEM 11)

10A. MODIFICATION OF CONTRACT/ORDER NO.

10B. DATED (SEE ITEM 13)

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offers is extended, is not extended.

12. ACCOUNTING AND APPROPRIATION DATA (If required) copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted;

13. THIS ITEM ONLY APPLIES TO MODIFICATION OF CONTRACTS/ORDERS.

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

CHECK ONE A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE CONTRACT ORDER NO.

IN ITEM 10A.

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation date, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(b).

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority)

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15C. DATE SIGNED

15A. NAME AND TITLE OF SIGNER (Type or print)

16C. DATE SIGNED

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

PAGE OF PAGES

6. ISSUED BY CODE

8. NAME AND ADDRESS OF CONTRACTOR (No., street, county, State and ZIP Code) (X)

CODE

15B. CONTRACTOR/OFFEROR

(Signature of person authorized to sign)

16B. UNITED STATES OF AMERICA

(Signature of Contracting Officer)

OMB Control No. 2120-0595

p. 1

# Question RFP Section /SOW Reference

RFP

Page #

1 What is the correct NAICS code? Section B refers to 541513; Section L.8.3 refers to 541519.

B.1/L.8.3 2 & 75

Response:

The correct NAICS is 541513; Section L.8.3 is revised accordingly.

2 Please define the type of forensic tools or activities that are required based on previous incident types.

C.3.1.1.2 15

Response:

Refer to Attachment J-1, Job Descriptions (Rev 1)

3 What are the resources providing Cyber Security Services supposed to accomplish?

C.3.1.2.1 17

Response:

The Cyber Security Services resources provide vulnerability security scanning. The contractor shall perform the responsibilities and possess the qualifications as noted in Attachment J-1, Job Descriptions (Rev 1) ( Job Category 8 and Job Category 9).

4 Please provide a listing of the security operations software and tools utilized in support of the FAA, to include firewall, IDPS, SIEM, Vulnerability Scanning, Analytics, and Deep Packet Inspection.

C.3.1.2.2 17

Response:

See Response to Question #2 above.

5 Please identify the ITSM Platform and version utilized by the FAA. C.3.1.2.2 17

Response:

See Response to Question #2 above.

6 In terms of programmer support can it be assumed that innovation and automation could be applied to support accuracy in incident identification, mitigation, and reporting?

C.3.1.2.2 17

Response:

Yes, the contractor shall perform the responsibilities and possess the qualifications as noted in Attachment J-1 (Rev 1). (Job Category 10)

DTFACT-16-R-00004 Amendment 0002 Page 2

7 Please provide a listing of the database types and specific versions. Does the FAA have a specific development process or methodology that incorporates developer security testing to address flaw remediation in database technologies? If so, please provide.

C.3.1.2.3 17,18

Response:

See Response to Question #2 above. The FAA utilizes a test environment to address security issues for security testing to address flaws.

8 Please define response activity types for sensor maintenance. C.3.1.3.2 19-20

Response:

See Response to Question #2 above.

9 Does FAA provide the test environment where the Contractor shall evaluate and test all upgrades and patches prior to deployment in production?

C.3.1.3.2 19

Response:

Yes – the SOC has a TEST bed where all upgrades and patches are tested prior to deployment.

10 Which vendors/products are deployed as SOC monitor sensors? C.3.1.3.2 19

Response:

See Response to Question #2 above.

11 There is a requirement for a Government-issued Top Secret Facilities Clearance (at least). Does this apply to every member of the team, or only to the Prime?

L.8.2 Annex #2 -

GO/NO-GO

Response:

In accordance with AMS clause 3.14-1, all subcontracts under the contract which would involve access to classified information shall comply with the requirements of the DD254 for Facilities Clearance. For clarification purposes, the level of facility clearance (FCL) (e.g. Top Secret) is based on that company’s employees requiring access to Top Secret information (thus they would need to have Top Secret personnel security clearances.) That is at the prime level. For subcontracts, the prime contractor determines what the subcontract would entail, i.e. the same level of FCL as the prime if the subcontractor employees also require Top Secret personnel security clearances for access, or the subcontract may only require Secret classified access (areas/information, etc.) in which case a Secret FCL and Secret subcontract would suffice.

12 How will the Gov’t monitor the Large Business meeting its list Small Business subcontracting plan?

L.8.3 Annex #3 75

DTFACT-16-R-00004 Amendment 0002 Page 3

Response:

The Government will monitor the Large Businesses via "Electronic Subcontracting Reporting System (eSRS)" in accordance with Section I AMS 3.6.1-4 Alternate I Small, Small Disadvantaged, Women-Owned and Service- Disabled Veteran Owned Small Business Subcontracting Plan.

13 What credentials and certifications are required for key personnel? M.2 86

Response:

See Response to Question #2 above.

14 Does the Government desire submission of a list of all relevant Past Performance for the prime contractor only, or must the list include all relevant subcontractor Past Performance within a five year period as well?

L.9.2 77

Response:

Prime Contractor only

15 Does the Government desire submission of a maximum of three Past Performance Evaluation Data forms (Attachment J-8) in Factor 2, or should additional forms be submitted if more than three citations are referenced by the offeror in Factor 1, Corporate Experience?

L.9.2 77

Response:

Offerors may submit more than three Past Performance Evaluation Data forms provided they meet the requirements as set forth in the RFP.

16 Reference Section L.9.4 instruction: “State if the planned transition will impact other contracts, what the impact would be (if applicable), and the contractor's plan to manage and mitigate that impact.” Please clarify whether the Government wishes offerors to limit their responses to addressing the potential impact on other ongoing FAA programs exclusively, to other non-FAA government programs, or to any other unrelated programs currently supported by the offeror?

L.9.4 80

Response:

Other ongoing FAA programs exclusively

17 Job Category 4 – Associate Monitoring Analyst: Can the FAA provide the reference for the years of experience noted as being required for this position. GSA schedules, EAGLE II and other federal contract vehicles typically list an associate position as the lowest position grade. For Job Category 4, the FAA has listed a requirement of a minimum of six years of

Job Category 4 J-1

DTFACT-16-R-00004 Amendment 0002 Page 4

IT experience with at least three years of experience in the role of security analyst. It would appear that this position is not an associate, but more of an Intermediate range position. We reference Job Category 12 where the FAA has listed the position as an Intermediate position requiring the same number of years of experience.

Response:

The requirement was based on a mix of GSA and eFAST schedules, and has been determined to be the Government’s minimum requirement.

18 Job Category 7 – Associate Technical Writer: Can the FAA provide the reference for the years of experience noted as being required for this position. GSA schedules, EAGLE II and other federal contract vehicles typically list an associate position as the lowest position grade. For Job Category 7, the FAA has listed a requirement of a minimum of six years of IT experience with at least three years of experience in the role of technical writer. It would appear that this position is not an associate, but more of a mid-range position. We reference Job Category 12 where the FAA has listed the position as an Intermediate position requiring the same number of years of experience.

Job Category 7 J-1

See Response to Question #17 above.

19 The Technical Writer job description details skills that are commensurate with industry tech writers, however, the job qualifications, i.e. bachelors degree in computer science or information systems, are atypical with industry standards. Market surveys show a technical writer typically possesses a Bachelors degree in English, Literature, Communication or a related field and has 1

To optimize the price and performance on this project, will the government consider education and experience requirements aligned with industry standards for this position. Suggest the referenced requirement be re-stated to require a more general degree, i.e. a Bachelors degree in English, Literature, Communication or a related field and 1 to 3 years of experience.

to 3 years of experience.

Attachment J-1 Job Category 7 Assoc.

Technical Writer

The Government has determined that Attachment J-1, Job Descriptions (Rev 1) contains the necessary minimum requirements.

DTFACT-16-R-00004 Amendment 0002 Page 5

20 The Job Cat 7 description states the Associate Technical Writer is a “member of the SOC Operations Support Branch.” Section C page 21 C.3.1.3.6 Technical Writer section implies the position supports the overall SOC – not just the Operations Support Branch. Please clarify.

J-1 Job Cat

Response:

The Associate Technical Writer reports to the Operations Support Branch and does provide support to the entire

SOC.

21 Job Category 16 – Junior System Administrator: Can the FAA provide the reference for the years of experience noted as being required for this position. GSA schedules, EAGLE II and other federal contract vehicles typically list a junior position as the lowest position grade. For Job Category 16, the FAA has listed a requirement of a minimum of five years of IT experience with at least three years of experience administering RED Hat Linux and Windows Server 2008/2013. It would appear that this position is not an associate, but more of a mid-range position. We reference Job Category 15 which requires the same number of years as a Red Hat Linux and Windows Server 2008/2013, albeit with other responsibilities, as the Infrastructure Team Lead.

Job Category 16 J-1

See Response to Question #17 above.

22 The RFP states: “it is anticipated that a transition period (not to exceed 30 days) will occur.”

Does the government anticipate being able to successfully adjudicate and badge all project personal within 30 days?

RFP Section B.3

TIME AND

MATERIALS

(T&M) CONTRACT

LINE ITEM

NUMBERS (CLINS)

Response:

Yes.

23 The RFP states: “if it becomes necessary to temporarily relocate to a selected alternate site for emergency or test scenarios, the Contractor must be able to support, and extend normal SOC operations to that remote location.”

Will the government add additional ODC/Travel dollars to the task order (currently only $20k per year) in support of this activity?

Does the government anticipate the alternate sites being a government or

RFP Section C.3

REQUIREMENTS

DTFACT-16-R-00004 Amendment 0002 Page 6 contractor location?

Will the government provide a list/location of potential alternate sites?

Response:

The alternative location could be another Government facility or could be a commercial facility, and will be provided by the Government at a later date if it becomes necessary. The Government doesn’t anticipate the need for additional ODC/Travel funds at this time; however, will address it in the future if requirements change.

24 The RFP states that for SOC operations roles, backfills of absent staff are required for all period of scheduled and unscheduled leave.

Please confirm that this requirement is only intended for extended, multi-day leave?

PART I SECTION C,

C 3.1.1.1, C.3.1.1.2, C.3.1.1.3, C.3.1.1.4, C.3.1.1.5

14, 15, and 16

The RFP states all periods of scheduled and unscheduled leave.

25 The RFP states: “The Contractor must maintain configuration control of all signatures and test them before being deployed in the operational environment.”

Please confirm that the government will provide a test lab/equipment for testing purposes.

RFP Section C.3.1.3.2: Sensor Maintenance Support

The SOC has a TEST Bed where it can test equipment and software.

26 The RFP states: “No task order will exceed a one (1) year period of performance.”

Since no task order will exceed a one (1) year period of performance, will the government re-issue task order requests or utilize option periods on a task order by task order basis?

F.6 TASK ORDERS 31

Response:

As stated (in part) in Section B.2 Minimum Ordering Obligation and Maximum Ceiling, “The minimum ordering obligation under this contract is $10,000.00 and this amount will be obligated on Task Order No. 0001.

The Government has no obligation to order additional services or issue additional orders to the Contractor beyond the minimum ordering obligation specified.

The total not-to-exceed (NTE) contract ceiling amount is To Be Determined (TBD) and will be determined based on the total value of all hours 453,080 total hours and estimated travel and ODC values identified in Section B.4. Orders are anticipated to be placed on a yearly basis and incrementally funded in accordance with contract Acquisition Management System (AMS) clause 3.3.1-39…”

DTFACT-16-R-00004 Amendment 0002 Page 7

Therefore, the Indefinite Delivery Indefinite Quantity (IDIQ) contract will not contain options. The Government anticipates placing Task Orders on a yearly basis, however, as stated in B.2, the Government has no obligation to issue additional orders beyond the minimum ordering obligation specified.

27 The RFP states: “The Offeror should provide support for its proposed rates by including the makeup of the proposed rates, to include the percentage in each proposed rate of offeror and subcontractors, and the elements of cost (direct and indirect rates) for each component (offeror and subcontractors) that make up each component’s hourly rate. This will provide the support for the composite rates used in your pricing.”

The requirement for submitting “the percentage in each proposed rate of offeror and subcontractors, and the elements of cost (direct and indirect rates) for each component (offeror and subcontractors) that make up each component’s hourly rate” would necessitate the disclosure of proprietary information. Is it acceptable to have subcontractors submit sealed packages with the requested information?

L.9.5 FACTOR V –

PRICE/COST

Response:

For clarification purposes, Subcontractors may submit the requested pricing support via a separate electronic transmission in accordance with the General Proposal Instructions in Section L.1. The submission must be clearly marked with the SIR/RFP number, the subcontractor’s contact information and the name of the prime contractor for whose offer it is being submitted under. Section L.9.5 is revised accordingly.

28 The Offeror is required to submit labor rate buildup which includes proprietary data from the prime and the subcontractors. Since the submission is through email and the data are sensitive, will the Government provide a method for the subcontractors submitting their labor rate buildup directly to the FAA.

L.9.5 81

See Response to Question #27 above.

29 Section L.9.5 the offeror is asked to provide support for its proposed rates by including the makeup of the proposed rates, to include the percentage in each proposed rate of offeror and subcontractors, and the elements of cost (direct and indirect rates) for each component (offeror and subcontractors) that make up each component’s hourly rate. Can the subcontractors provide this sensitive information directly to the Government upon request?

C.4.1.3 25 25

Response:

DTFACT-16-R-00004 Amendment 0002 Page 8

30 Section L.9.5 reads, in part “The Offeror should provide support for its proposed rates by including elements of cost (direct and indirect rates) for each component (offeror and subcontractors) that make up each component’s hourly rates. Are Subcontractors required to submit un-sanitized rates in the form of a sealed package? If yes, will the Government please provide clarification into the specific elements, delivery method, and instructions required (i.e., specific template?, deliver-to POC information (name, phone, e-mail, date etc.), steps to ensure submissions are connected with Prime’s proposal)?

Section L.9.5 Factor V – Price/Cost

31 The Offeror should provide support for its proposed rates by including the makeup of the proposed rates, to include the percentage in each proposed rate of offeror and subcontractors, and the elements of cost (direct and indirect rates) for each component (offeror and subcontractors) that make up each component’s hourly rate. This will provide the support for the composite rates used in your pricing.

Can the government clarify that the cost detail (indirect and direct labor rates) is only required from the Prime Offeror and not the subcontractors?

L.9.5 FACTOR V –

PRICE/COST

32 The Offeror should provide General & Administrative Handling Rate percentage in Attachment J-6 and in Section L.9.5 stated the indirect rate has to be consistent with the contractor’s most recent Defense Contract Audit Agency (DCAA) report.

Question: If the Offeror has different ways of loading indirect rates for Travel and ODCs, will FAA allow the Offeror changing the Attachment J-6 to reflect two different indirect rates for Travel and ODCs so they are compliant to our Disclosure Statement with DCAA?

Attachment J-6 and L.9.5

Response:

Yes

DTFACT-16-R-00004 Amendment 0002 Page 9

33 What prime contractor was the prime incumbent on the SOC requirement, and how many years the incumbent has been on this contract effort.

SRA International, Inc. (SRA), CAGE 6R517, DTFAWA-08-C-00142 awarded in September 2008

34 Please confirm that the Small Business Subcontracting Goal is meant to be calculated as 45% of the total planned subcontracted dollars.

L.8.3 75

Response:

Yes

35 Are screenshots of Letters of Intent acceptable in Annex #3 or are attachments of the letters required?

L.8.3 76

Screenshots are acceptable provided they meet the requirements of the RFP and are signed and legible.

36 AMS 3.6.1.9 Mentor Protégé Program, 3.6.1-11 Mentor Requirements and Evaluation and 3.6.1-10 Evaluation of Contractor Participation in the FAA Mentor Protégé Program are cited in Section I and M. The SIR does not identify any Evaluation Factors or Criteria associated with these requirements. How, if at all, will offerors be evaluated and what is the relative weight in comparison to the existing Evaluation Factors?

I.1

M.7

Response:

In accordance with AMS 3.6.1-10, the FAA will not be considering Mentor Protégé Participation as part of the best value evaluation. It will be reviewed for proposed participation and extent of developmental assistance to be provided by mentor firms to protégé firms as an approved mentor firm in the FAA Mentor-Protégé Program.

37 RFP stated: The contractor shall propose fully burdened onsite and offsite labor (if applicable) hour rates as identified in the Pricing Schedule contained in Section B.4.

Question: Section B.4 as well as Attachment J-6 did not address if the labor rates proposed are onsite or offsite. Will the Government allow the Offeror making changes to Attachment J-6 by notating the proposed rates are onsite labor rate?

B.3 and Attachment J-6

Response:

The rates are to be proposed as on-site rates in accordance with Section F.6 Place of Performance. Attachment J-6 has been revised to clarify.

DTFACT-16-R-00004 Amendment 0002 Page 10

38 Article H.8 states that the Contractor shall obtain the agreement of the CO prior to the employment of any subcontractor. However, Offerors will be identifying their initial set of subcontractors in Annex 3 of their proposals.

For the ultimately successful offeror, will those subcontractors identified in Annex 3 be considered to be automatically accepted by the CO?

H.8 and L.8.3 42 and

Response:

For clarification purposes, for subcontractors proposed as part of the offeror’s initial proposal submission, the CO approval will be in accordance with RFP Section H.8 Subcontractors, Section I AMS Clause 3.10.2-2, and AMS Policy Procurement Guidance T.3.10.2 Subcontracting Policies, and will be performed prior to award of the contract.

39 Section H.8, Subcontractors, requires advance Contracting Officer consent for any subcontractor. Section I.12, 3.10.2-2 Subcontracts does not include any special instructions in subparagraph (e). Request the Government clarify if the Contracting Officer consent for subcontractors is required if the Contractor’s purchasing system has been approved.

Sections H.8 and I.12 42 and

Response:

See Response to Question #38 above. Additionally, as stated in AMS Policy Procurement Guidance T.3.10.2 Subcontracting Policies, “Contractors or offerors that have approved purchasing systems should not require subcontractor consent because their purchasing systems have already been reviewed and determined acceptable under a contractor's procurement system review (CPSR).” However, as stated in the Procurement Guidance, there are certain circumstances where consent may still be required.

40 The required shift hours are called out for 10 hour periods. Is there any variation allowed?

C.3.1.1.1 14

Response:

A minimum of two Incident Handlers must staff each of the (0600-1600, EST\EDT) & (1400-0000, EST\EDT) required shifts (4 total Incident Handlers). A minimum of one Incident Handler must staff the (2200-0800, EST\EDT) required shift. Variations for the remaining Incident Handler staff members may be proposed.

41 The transition Plan Due date currently reads, “As directed by the Contracting Officer, within thirty (30) calendar days to forty (45) calendar days of the end of contract period of performance.”

Questions: Can the government please confirm the desired window of delivery for the transition plan as being either within 30 – 40 days or 30 – 45 days?

C.4.1.3.1 23

DTFACT-16-R-00004 Amendment 0002 Page 11

The referenced portion of SOW paragraph C.4.1.3.1 is corrected to read “within thirty (30) calendar days to forty (40) calendar days…”

42 In the Deliverables table in C.4.1.3.1, on the row for the Transition Plan, the deliverable description in the first column indicates that the required plan is for Transition In activities (“The Contractor shall discuss activities and schedule for the transition of support from the previous contract to this one”). However, the due-date in the second column appears to be for Transition Out activities (“As directed by the Contracting Officer, within thirty (30) calendar days to forty (45) calendar days of the end of contract period of performance”). Will the Government please reconcile this difference?

C.4.1.3.1 Deliverables (Transition Plan)

SIR p 23

Response:

See Response to Question #41 above

43 Job Category 1 Incident Handler is 24 x 7 x 365 at 18,800 hours. Can the FAA provide an estimated LOE by shift, including weekends?

J-1 1

Response:

Incident Handler staffing may adjusted to accommodate workload. For example, the SOC anticipates that the (2200-0800, EST\EDT) required overnight shift, weekend shifts and holiday shifts will only require one Incident Handler.

44 The Program Manager job description states support is to be provided to three branches: Risk Analysis & Response Branch. There were no references to supporting this branch in Section C while there were references to the other two branches (Cyber Security Services Branch and Operations Support Branch). Please clarify which SOW sections and Job Categories support Risk Analysis & Response Branch.

J-1 Job Cat

SOW sections C.3.1.1 and Job Categories 1-6 support Risk Analysis & Response Branch.

45 C.3.1.1.5 Security Analytics Content Lead states the hours of performance are between 0500-0000. J-1 Security Analytics Content Lead Job Category 6 states the hours are between 0600-1800. Please clarify.

C 16

Response:

C.3.1.1.5 Security Analytics Content Lead must provide coverage and maintain a presence in the SOC eight (8) hours per day, five (5) days per week, Monday – Friday, within the hours given. For example 0600-1400, 0800- 1600 and 1000-1800 are three examples of (8) hour periods of coverage within the range 0600-1800.

DTFACT-16-R-00004 Amendment 0002 Page 12

46 How does this staffing mix compare to what is currently under contract?

What are the current LCATS and numbers respectively?

H-3

3.1.9-1

Response:

The staffing mix under the current contract is not relevant to this follow-on RFP as the requirements have changed.

47 Will special projects support be within the existing labor hours, or will additional funds/hours be allocated for special projects?

C.5.1 27

Special projects support will be within the existing labor hours and funding.

48 Will the government allow 11X17 foldout pages and if so, what page count will they allot per 11X17 page?

General

No. RFP Section L.6 has been revised to include the following statement: “Proposals should be formatted using the Page Layout size setting of Letter 8.5” x 11”.

49 Is Attachment J-7 Business Declaration Form required of each team member (including subcontractors) or just the Prime offeror?

Attachment J-7

The Business Declaration Form is required to be submitted for the Prime Contractor/Offeror.

50 Question: There are 6 FTE for the Focused Operations staff and 3 FTE for the Senior Monitoring Analyst staff. Each of these two job categories have 2 key positions, respectively. What distinguishes the key positions from the non-key positions in each category? (For example, skill / experience level or work schedule?)

C.3.1.1.2 and C.3.1.1.3

15-16

Response:

The key positions require individual resume submittals for proposal, require written notice of substitution in accordance with H.3 AMS 3.8.2-17, and are part of the best value evaluation in accordance with Sections L and M of the RFP.

51 The place of performance in paragraph F.6 is showing only onsite in Leesburg, VA. Does the FAA anticipate staffing a COOP hot site with staff either permanently or for an extended period of time as indicated in

B.1, F.6 2, 32

DTFACT-16-R-00004 Amendment 0002 Page 13 paragraph B.1?

No. The FAA does not anticipate staffing a COOP hot site at this time with staff either permanently or for an extended period of time. The narrative in paragraph B.1 referring to COOP represents a contingency.

Alternative sites will be provided by the Government at a later date if it becomes necessary.

52 The description of the SOC duties is vague concerning the relationship of the SOC to the NAS Cyber Operations (NCO) center. Please define the relationship of the SOC to the NCO, i.e., is it a peer organization? Does the SOC operate, monitor and report on any of the NCO systems? What are the differences in roles and responsibilities? Does the SOC have any historical surge demands driven by the NCO?

C.1 Background, NAS references

SIR p 12-13

The Background (C.1) and Mission/Objectives/Goals (C.2) are outlined in the SOW.

53 The coverage required for this position is stated in C.3.1.1.2 as “twelve (8) hours a day, five (5) days a week, fifty two (52) weeks per year” but the required shift under the low/guarded risk level (0800-1700 ET) has a 9-hour duration. Will the Government please reconcile this difference?

C.3.1.1.2 Focused Operations

SIR p15

The requirement is to be within the time ranges provided. For example, 0800-1600 and 0900-1700 are examples of (8) hour periods of coverage within the range 0800-1700 ET.

54 The coverage required for these positions is stated in C.3.1.1.4 and C.3.1.1.5 as “eight (8) hours per day, five (5) days per week” but the required shift in the SOW (0500-0000 ET for both positions) has a 7-hour duration, and the required shift in Attachment J-1 for the Security Analytics Content Lead (0600-1800 ET) has a 12-hour duration. Will the Government please reconcile these differences?

C.3.1.1.4 Security Information and Event Management Content Lead, C.3.1.1.5 Security Analytics Content Lead

SIR p16

Response:

The positions stated in C.3.1.1.4 ( Security Information and Event Management Content Lead) and C.3.1.1.5 (Security Analytics Content Lead) must provide coverage and maintain a presence in the SOC eight (8) hours per day, five (5) days per week, Monday – Friday, within the time ranges provided. For example, 0500-1300, 0800-1600 and 1600-0000 are all examples of (8) hour periods of coverage within the range 0500-0000, whereas 0600-1400, 0800-1600 and 1000-1800 are all examples of (8) hour periods of coverage within the range 0600- 1800.

55 The coverage required for these positions is stated in C.3.1.2.2 and C.3.1.2.3 as “eight (8) hours per day, five (5) days per week” but the required shift (0600-1800 ET) has a 12-hour duration. Will the Government please confirm

C.3.1.2.2 Incident Tracking Tool Programmer, SIR p17-

DTFACT-16-R-00004 Amendment 0002 Page 14 that the coverage required for this position is actually “twelve (12) hours a day, five (5) days a week”?

C.3.1.2.3 Database Support

Response:

These positions must provide coverage eight (8) hours per day, five (5) days per week, Monday - Friday within the (0600-1800, EST\EDT) time range. For example, 0600-1400, 0800-1600 and 1000-1800 are all examples of

(8) hour periods of coverage within the range 0600-1800.

56 The coverage required for the PM is stated in C.3.1.3.1 as “eight (8) hours per day, five (5) days per week” but the required shift (0500-0000 ET) has a 7-hour duration. Will the Government please reconcile this difference?

C.3.1.3.1 Program Management Support

SIR p 18

Response:

The range of 0500-0000 spans 19 hours, not 7 hours. The PM must provide coverage eight (8) hours per day, five (5) days per week, Monday - Friday within the (0500-0000, EST\EDT) time range. For example, 0500- 1300, 0800-1600 and 1600-0000 are all examples of (8) hour periods of coverage within the range 0500-0000.

57 The coverage required for these positions is stated in C.3.1.3.2-C.3.1.3.6 as “eight (8) hours per day, five (5) days per week” but the required shift (0600- 1800 ET) has a 12-hour duration. Will the Government please confirm that the coverage required for these positions is actually “twelve (12) hours a day, five (5) days a week”?

C.3.1.3.2 Sensor Maintenance Support, C.3.1.3.3 Security Information and Event Management Engineer Support, C.3.1.3.4 Security Analytics System Engineer Support, C.3.1.3.5 System and Network Support, C.3.1.3.6 Technical Writer Support

SIR p19-

Response:

These job categories provide coverage eight (8) hours per day, five (5) days per week, Monday - Friday within the time ranges provided. For example, 0600-1400, 0800-1600 and 1000-1800 are all examples of (8) hour periods of coverage within the range 0600-1800, whereas 0500-1300, 0800-1600 and 1600-0000 are all examples of (8) hour periods of coverage within the range 0500-0000.

58 Will the Government please provide additional details on resources (e.g., tools and processes) in the existing environment that are available for supporting this service level requirement (mean time to detect intrusion less than 48 hours)?

C.4.1.3.1 Deliverables (Mean time to detect intrusion less than 48 hours)

SIR p25

DTFACT-16-R-00004 Amendment 0002 Page 15

See Response to Question #2 above.

59 Please clarify what specific Contractor deliverables are required to support the work flow assessments performed by the Government as referenced in the last sentence of C.5.2.1: “From time to time, SOC Management will be required to assess work flow as the SOC expands coverage of services to their internal and external customers.”

C.5.2.1 Deliverables (last sentence)

SIR p 27

Response:

The SOC utilized documentation that outlines process and procedures for operations within the SOC. The processes and procedures receive periodic reviews. There may be changes to the process or procedure where the workflow associated in process or procedure documentation will require updating.

60 Is it the Government’s intent that OCI information, if any, is to be provided in Annex #1, item 4? If not, where does the Government want this information?

Section I.2 3.1.7-6 Disclosure of Certain Employee Relationships

SIR p 47

Yes, any OCI information in accordance with Section I.2 AMS Clause 3.1.7-6 should be included as part of Annex #1, item 4, Contract Documentation.

61 Is the offeror to submit Section K, page 65-71 of the RFP and a copy of the Representations and Certifications from the System for Award Management?

Part IV - Section K, clause K.5, 3.2.2.3-35 Annual Representations and Certifications

SIR p 65

Response:

In accordance with Section L.8, Offerors should submit signed Representations, Certifications and Acknowledgements (Sec K) of the RFP. It is not necessary to submit a copy of the Representations and Certifications from the System for Award Management.

62 The SIR states “Electronic submissions must not exceed 10 megabytes (MB) in total.” Will the Government please consider 10 MB per file? Files with embedded documents (e.g., the Small Business Plan that is to include signed letters of agreements with all proposed subcontractors) can quickly exceed 10 MB and a submission with 8 annexes/volumes will certainly exceed 10

MB.

L.1 (c)General Proposal Instructions

SIR p 72

Response:

Sections L.1 and L.6 have been revised as follows: Electronic submissions may be provided via multiple emails, provided the email submissions are clearly marked with the offeror’s name, the RFP number, and the content of the email. Each email submission must not exceed 10 megabytes (MB) per email.

DTFACT-16-R-00004 Amendment 0002 Page 16

63 Offeror assumes that the electronic submission limitation of not to exceed 10 megabytes (MB) is a limitation of the file size per email and that multiple emails may be submitted as long as each email does not exceed 10 MB.

Please confirm.

L.1 ( c ), L.6 72, 74

See Response to Question #62 above.

64 Electronic submissions must not exceed 10 megabytes (MB) in total.

Compressed files (i.e. zip files) have the potential to be rejected by the FAA system.” It is likely the totality of an Offeror’s final proposal files will exceed 10 MB in total. Are offerors permitted to send multiple submission emails that are less than 10 MB each?

Part IV-Section L.1, (c)

65 The referenced paragraph limits submissions to 10 MB in total. With graphics and spreadsheets, the 3 annexes and 5 volumes will be difficult to fit inside the 10 MB limit.

Suggest the 10 MB limit be applied to each email with proposal annexes or volumes rather than the total proposal.

L.1 (c)

66 The SIR states that: "Electronic submissions must not exceed 10 megabytes (MB) in total." Given the size constraints, can we submit our proposal in multiple emails (i.e., email 1 of 3, 2 of 3...)

General Proposal Instructions - L.1 (c)

67 The Government has stated for the Offeror to “Also, describe the extent to which the Offeror and the Offeror’s subcontractors/team members have worked with Government program teams and Government contracting teams, including the FAA. For each example, include the contract number and title of the program, and dates under which the experience was gained.”

L.9.2 Factor II – Past Performance

SIR p 77

DTFACT-16-R-00004 Amendment 0002 Page 17

How does the FAA define Government program teams and Government contracting teams?

Response:

For guidance purposes only, a Government program team is made up of Government personnel working on an integrated product/service team in support of a contract effort as part of the program organization, and the Government contracting team is made up of Government personnel working on an integrated product/service team in support of a contract effort as part of the acquisition organization.

68 The Government has stated for the Offeror to “Also, describe the extent to which the Offeror and the Offeror’s subcontractors/team members have worked with Government program teams and Government contracting teams, including the FAA. For each example, include the contract number and title of the program, and dates under which the experience was gained.”

Is it the Government’s intent that the work described be work that pertains to Security Operations Center-type work only? Listing all Government contracts for the past 5 years could become a lengthy list for most large business primes. If we are to list all Government contracts, will the Government please increase the page count of this section to a total of 15 pages?

L.9.2 Factor II – Past Performance

L.9.1 Factor I – Corporate Experience

SIR p 77

Response:

For clarification purposes, the above question was incorrectly referenced from the Past Performance Factor. The quote referenced pertains to the Corporate Experience Factor, RFP Section L.9.1, which states (in part), “The Offeror shall provide information for at least three (3) recent relevant experiences that describes the Offeror’s, and all of the Offeror’s proposed subcontractors’ experience similar to that for the Federal Aviation Administration (FAA) Security Operations Center (SOC) Support requirement performed within the last five (5) years and identify these by contract number” (emphasis added). Therefore, the page count remains the same. Refer to Response to Question #83 in reference to the term “subcontractor.”

69 This paragraph states “The degree to which the Offeror can demonstrate that it has successfully applied continuous systemic improvement to resolve past performance problems will be evaluated.” On page 87, the Past Performance paragraph states that a Performance Confidence Assessment Rating will be addressed on an Offeror’s ability to perform the required effort successfully based on our “relevant past performance and systemic improvement.” Is it the Government’s intent that we address systemic improvement as it pertains to resolving any past performance problems, or shall we address systemic improvement in general?

Section M.3.2, third paragraph

SIR p 87 and 88

Response:

Systemic improvement will be evaluated as part of the Past Performance factor as it pertains to resolution of past performance problems as stated in RFP section M.2 and M.3.2. If the offeror chooses to address systemic

DTFACT-16-R-00004 Amendment 0002 Page 18 improvement in general as part of its proposal as it may apply in another area, that is to be determined by the offeror.

70 Under Section L.9.2, Factor II, Past Performance, Business Relations/Integrity/Effective Management, the text states: "The offeror should detail its business relations with the customer on previous contracts . .

Please confirm that the phrase "on previous contracts" should be stricken.

Presumably, we are required to discuss the topic in relation to the contract being cited, not some previous contract.

L.9.2 78

Response:

For clarification purposes, RFP Section L.9.2 Business Relations/Integrity/ Effective Management has been revised to remove the phrase “on previous contracts.”

71 Under Section L.9.2, Factor II, Past Performance, Ability to Manage Cost/Control Cost, the text states: "The offeror should describe past efforts to control costs under previous contracts."

Please confirm that the phrase "under previous contracts" should be stricken. Presumably, we are required to discuss the topic in relation to the contract being cited, not some previous contract.

L.92. 78

Response:

For clarification purposes, RFP Section L.9.2 Ability to Manage Cost/Control Cost has been revised to remove the phrase “under previous contracts.”

72 Job Category 10. Please validate years of experience in the role of programmer/scripting specialist with PERL and SQL scripting. Is it three or 4 years?

J-1 Job Cat

Response:

This is a typo, Job Category 10 experience in the J-1 is revised to read, “Must have three (3) years experience in the role of programmer/scripting specialist with PERL and SQL scripting. “

73 In the area of Job Qualifications-Experience, the third bullet states “Must have three (4) years experience in the role of programmer/scripting specialist with PERL and SQL scripting.” Request clarification if this position is required to have 3 or 4 years of experience.

Attachment J-1, Job Category 10, Incident Tracking Tool Programmer

DTFACT-16-R-00004 Amendment 0002 Page 19

This is a typo Job Category 10 experience in the J-1 is revised to read “Must have three (3) years experience in

74 J-1, Job Category 10 “Programmer Incident Tracking Tool Programmer” for Education it says …OR Minimum six (10) years of relevant professional experience. Did the Government intend for this to be 6 or 10 years? Then again in experience it states “must have three (4) years’ experience in the role”… Did the government intend for this to be 3 or 4 years?

Attachment J-1

Response:

This is a typo Job Category 10 education experience in the J-1 is revised to read “Minimum six (6) years of relevant professional experience. “

This is a typo Job Category 10 experience in the J-1 is revised to read “Must have three (3) years experience in

75 Section L.9.4 - Factor IV - Technical under Program Management/Transition Plan that Contractor must state "if planned Transition will impact other contracts, what the impact would be …" Please validate whether the FAA is referring to Contractor's contracts or FAA contracts.

L.9.4 80

Response:

RFP section L.9.4 is revised to change the 4th bullet to read as follows: “State if the planned transition will impact other FAA contracts, what the impact would be (if applicable), and the contractor's plan to manage and mitigate that impact.”

76 "Under Section C.4.1.3, SOC Support, the text reads ""Contractor shall ensure intrusions are detected within forty eight (48) hours. Time shall be determined from first sign of intrusion as recorded by Packet Capture, system logs, file creation time, or other artifact.""

Please clarify as to whether the government is asking that intrusions are detected via human within 48 hours from first sign of intrusion?"

C.4.1.3 25

Response:

The government’s intent is that field responders, customer point of contacts, system owners and other stakeholders receive reports of intrusions in a timely manner. Unless the contractor develops automation that can reliably identify, document, and deliver the reports to Incident Handlers, intrusions must be detected by a human analyst. Raw, unprocessed data (i.e. a log or an alert) does not constitute detection of an intrusion.

DTFACT-16-R-00004 Amendment 0002 Page 20

77 Paragraph b states: "In the event such keys, PIV Cards, or vehicle decals are lost, stolen, or not returned, the contractor understands and agrees that the Government may, in addition to any other withholding provision of the contract, withhold an amount to be determined by CO

Will the government consider either putting a "not to exceed" value or opening this up to a mediated settlement by a third party? for each key, PIV Card, and vehicle decal lost, stolen, or not returned."

I.16 3.14-4

Response:

The term “may” in the above statement indicates a permissive condition, and the Government does not anticipate major future issues with the above as is.

78 Holiday Support under the severe risk level.

Please confirm that the requirement to work Federal Holidays does not apply to the Focused Operations team under the severe risk level.

C.3.1.1.2 Focused Operations

The requirement to work Federal Holidays applies to the Focused Operations team under the severe risk level.

79 "When this activity requires a gap in the normal hours of coverage… the Contractor will notify the COR and must not fill the schedule gap."

Suggest the word NOT be removed to require contractors fill schedule gaps to ensure sufficient coverage to support the SOC.

C.3.1.2.1 Cyber Security Services

Correct, the referenced sentence from SOW paragraph C.3.1.2.1 is revised to read; “When this activity requires a gap in the normal hour coverage (0600 – 1800, EST/EDT), the Contractor will notify the COR and must fill the schedule gap.”

80 Paragraph C.3.1.5 states: "For each issued order under this contract, the Contractor must utilize ordered hours for the Security Analytics Content Lead to provide coverage and maintain a presence in the SOC eight (8) hours per day, five (5) days per week, Monday - Friday between the hours of (0500-

0000, EST\EDT) ."

Please confirm the hours per day and coverage time.

C.3.1.5 Security Analytics Content Lead

Section C.3.1.1.5 describes the Security Analytics Content Lead. The Security Analytics Content Lead must provide coverage and maintain a presence in the SOC eight (8) hours per day, five (5) days per week, Monday - Friday within the (0600-1800, EST\EDT) time range . For example, 0600-1400, 0800-1600 and 1000-1800 are all examples of (8) hour periods of coverage within the range 0600-1800.

DTFACT-16-R-00004 Amendment 0002 Page 21

81 Evaluation of Mentor Protégé participation

How will Mentor Protégé participation by contractors be scored?

M.7 3.6.1-10

EVALUATION OF

CONTRACTOR

PARTICIPATION

IN THE FAA

MENTOR

PROTEGE

PROGRAM

(January 1999)

See Response to Question #36 above.

82 Is there an incumbent or vehicle such as E-fast that your planning to use

See Response to Question #33 above. Additionally, a pre-existing agency vehicle, such as eFAST, has not been determined to be utilized for this open competition.

83 What constitutes a “principal” subcontractor?

L, Section L.9.1, L.9.2, M.3.1, Paragraph 1

The RFP is revised to remove the term “principal” as it pertains to subcontractor.

84 “These contracts must include but are not limited to the same contracts as identified in the Corporate Experience section.” Does “these contracts must include” refer to the “list” of all relevant past performance or to the 3 contracts to be submitted using Attachment J-8?

L, Section L.9.2, Paragraph 2

It refers to the “three (3) most recent relevant contracts and/or subcontracts awarded” as referenced in RFP Section L.9.2.

85 The table states Volume Number III, Factor III – Key Personnel, 3 pages per key personnel resume. Are commitment letters included in the 3 (three) page limit or in addition to the 3 page written resume?

Part IV, Section L.5

See RFP Section L.6 for exclusions to page count limitations.

DTFACT-16-R-00004 Amendment 0002 Page 22

86 Are Offerors permitted to use 11x17 landscape orientation fold out pages, and if so do they count as 1(one) or 2 (two) pages?

Part IV-Section L.6 Proposal Content, Paragraph 1

See Response to Question #48 above.

87 The RFP lists Base Year 1 as “one year from date of award” and current contract ends 8/30/16 with a 3 months option period ending 11/30/16. What is the expected start date for Base Year 1?

Sect. B.4 5

See RFP Section B.3.

88 Does the government allow bidders to bid substitute Labor Categories to the ones provided in Section B? If yes, will the government modify the evaluation criteria in Section M to evaluate bidder’s optimal allocation of resources for the SOC?

Section B

Response:

No

89 Certain statement of work areas require non-standard shift work, including Federal government holidays. Does the government anticipate any premium compensation (e.g. shift differential, holiday pay, etc.)? If so, will the government modify Attachment J-6, Section B Pricing Spreadsheet to include rates for the types of premium compensation anticipated.

Section C 11

Response:

No, in the event that Overtime may be necessary to meet urgent or unforeseen program needs, the contractor shall submit written requests for overtime in advance of incurring any costs to the COR and CO. Overtime will be paid as straight time and must be preapproved by the COR and CO. Additionally, the Government will not pay shift differentials.

90 It is required that all personnel serving under this contract have a minimum of a Secret clearance? It is unlikely that bidders’ corporate indirect support staff (i.e., HR, Project Control, etc.) will require access to classified information. Request that the Government clarify if this requirement applies to indirect support staff as defined by the offeror’s disclosed accounting practices.

Section H.11.1 44

DTFACT-16-R-00004 Amendment 0002 Page 23

Section H.11.1 (d) of the RFP is revised to clarify that indirect support staff not being directly billed would not require Secret Clearance.

91 Organizational Conflicts of Interest

Would Mischel Kwon & Associates (MKA), the firm currently supporting the SOC in redesign of the organization and toolsets, have a Conflict of Interest as a prime bidder or as a…