ED-CIO-13-Q-0011_Amend_0001_-_Q A.pdf

NSN 7540-01-152-8070 STANDARD FORM 30. (Rev. 10-83) Previous Edition unusable Prescribed by GSA FAR (48 CFR) 53.243

Page of Pages AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT 1. Contract ID Code

2. AMENDMENT MODIFICATION NO. 3. EFFECTIVE DATE 4. REQUISITION/PURCHASE REQ. NO. 5. PROJECT NO. (if applicable)

6. ISSUED BY CODE 7. ADMINISTERED BY (If other than item 6) CODE

(x) 9A. AMENDMENT OF SOLICITATION NO.

9B. DATED (SEE ITEM 11)

10A. MODIFICATION OF CONTRACT/ORDER NO.

8. NAME AND ADDRESS OF CONTRACTOR (NO., Street, Country, State and ZIP Code)

CODE FACILITY CODE

10B. DATED (SEE ITEM 13)

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

The above numbered solicitation is amended as set forth in item 14. The hour and date specified for receipt of offers is extended, is not extended.

Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended, by one of the following methods:

(a) By completing items 8 and 15, and returning ______ copies of amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted;

or (c) By separate letter or telegram which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OR OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN REJECTION OF YOUR OFFER. If by virtue of this amendment your desire to change an offer already submitted, such change may be made by telegram or letter, provided each telegram or letter makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

12. ACCOUNTING AND APPROPRIATION DATA (If required)

13. THIS ITEM ONLY APPLIES TO MODIFICATION OF CONTRACTS/ORDERS. IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

Check One

A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE

CONTRACT ORDER NO. IN ITEM 10A.

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation date, etc) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(b).

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority)

E. IMPORTANT: Contractor is not, is required to sign this document and return _______ copies to the issuing office.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible)

Except as provided herein, all terms and conditions of the document referenced in item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER (Type or print)

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

15B. CONTRACTOR/OFFEROR 16B. UNITED STATES OF AMERICA

(Signature of person authorized to sign)

15C. DATE SIGNED

(Signature of Contracting Officer)

16C. DATE SIGNED

Attachment Page

PAGE 2 OF 13 ED-CIO-13-Q-0011/0001

1. Question-Can subcontractor past performance be used?

Response: Per the solicitation, subcontractor past performance will not count as past performance for the Prime.

2. Question-Who is the incumbent contractor for Cyber Security Support Services?

Response: None. The current function is provided by a Managed Security Service Provider through an Inter-Agency Agreement with the FAA.

3. Question-Is the incumbent an SDVOSB company?

Response: There is no incumbent.

4. Question-Is any SIEM technology currently in use (Real-Time Correlation)?

Response: Initially the EDSOC will not directly control the SIEM technology. The two major networks consist of an administrative/business mission network that is Contractor Owned Contractor Operated. The second major network is a data center that is Government Owned Contractor Operated. The EDSOC is considering SIEM technology for the Independent Validation and Verification of the contractor operations. Technologies being examined include Splunk, ArcSight, and EnVision.

5. Question-How many systems are on the network to be supported?

Response: Approximately 10,000 workstations and servers

6. Question-What is the expected event rate per day for all systems?

Response: Unknown at this time. The initial triage response and log reduction is done by the network contractors SOC operation.

7. Question-What is the expectation for the acquisition of new security systems/technologies during the contract period?

Response: The Department is consistently examining opportunities and requirements to obtain new capabilities consistent with the mission requirements.

8. Question-What level of access to endpoint systems is provided?

Response: Endpoint direct management is accomplished by the network contractor. The EDSOC will have visibility and data access into the deployed security tools and capabilities.

9. Question-Do systems have endpoint security technology (host IDS, Anti-virus, host firewall, etc)?

Response: Yes. The Department is currently deploying a complete Continuous Monitoring framework including Anti-virus, host firewalls on critical assets, and additional capabilities revolving around a McAfee ePO centric tool suite.

10. Question-Do end user systems comply with a standard configuration?

Response: Yes, standard baselines are USCGB compliant.

11. Question-What level of control will the contractor have to configure firewall/router ACLs, and content filtering technologies?

Response: No direct access.

PAGE 3 OF 13 ED-CIO-13-Q-0011/0001

12. Question-Are publicly accessible systems managed or monitored under this contract?

Response: For the purposes of the answer to the "publicly accessible" question. Publicly accessible is defined as sites that contain Department information that is available to the general public. The Department has numerous publicly accessible sites maintained by the network contractor as well as external hosting organizations. For the internally hosted sites the EDSOC will have data and tool access to monitor the sites.

13. Question-Are any cloud-based services employed that must be managed or monitored under this contract?

Response: Currently there are no external cloud services but at least one and potentially two are in work. There will be no direct management required and the monitoring capability and requirements is being negotiated.

14. Question-Will the transfer of incumbent MSSP tools includes complete accreditation packages (including System Security Packages, Configuration Management Plans, Disaster Recovery plans, etc…).

Response: Yes, if they are not provided then the awardee will be responsible to support their production.

15. Question-Per OCIO-01 will approval from Enterprise Architecture Review Board (EARB) and Change Advisory Board (CAB) is granted prior to contract start date for any physical transfer of systems? This would allow for an expedited and smooth transition within the 10day period provided by the government.

Response: Yes. EARB approval will be complete prior to contract award. Currently only three systems require transfer to the Department. Webinspect is already within the Department's environment. The RedSeal system is currently being moved into the environment. The second system contains the deployed Sourcefire sensors that reside at the external boundaries at several contractor locations.

16. Question-Per OCIO-05 (pg.22), will the contractor be required to provide the security impact assessment if there is any significant changes to the information system (i.e. physical transfer of systems)?

Response: Yes, in conjunction with the Government team. Currently two systems will be within the Departments boundary.

17. Question-Will these systems require reaccreditation or security package updates if there is a physical transfer of systems? If so, will the contractor be responsible for reaccrediting these systems?

Response: Yes, in conjunction with the Government team. Currently two systems will be within the Departments boundary.

18. Question-Can the Government elaborate on the following: “Provide 24x7x365 on-call, 8x5 weekdays on-site”. Will the contractor be required to only work onsite week days Monday-Friday from 8am to 5pm? What is the expectation for non-working hours? Will the contractor be able to remotely access systems and tools during non-working hours, weekends, and holidays?

Response: The vendor will ensure the EDSOC is physically manned 24 hours a day, 7 days a week at 550 12th St SW, Washington DC. No remote access, to tools on the security network, is available.

Limited remote access is available for some of the tools within the Departments other network nodes.

PAGE 4 OF 13 ED-CIO-13-Q-0011/0001

19. Question-Is all work expected to be performed at 550 12th st SW or will there be remote operations capability for some/all of the EDSOC systems?

Response: The vendor will ensure the EDSOC is physically manned 24 hours a day, 7 days a week at 550 12th St SW, Washington DC. No remote access, to tools on the security network, is available.

Limited remote access is available for some of the tools within the Departments other network nodes.

20. Question-Will DoEd follow the accepted practice from other federal and DoD agencies in accepting the facility clearance from joint venture owner/members as a valid clearance for the joint venture?

Response: Yes, ED will follow the accepted practice(s) from other Federal agencies in regards to this issue.

21. Question-Can the facility clearance be obtained post-award? Requiring a Top Secret clearance pre-award will restrict competition significantly.

Response: Yes, it can.

22. Question-What does the gov expect in section 27 with regard to the stated period of performance?

Response: The periods of performance for this acquisition are a four-month Base period with five 12-month Option Periods.

23. Question-Where in the proposal response should we put the information requested for Joint

Venture/Teaming Agreement - Business Volume?

Response: Please put it in the Business Volume.

24. Question-May the same contracts/citations be used in both the Corporate Experience section of the Technical Volume as the Past Performance Volume? Is it the Government’s intent to have repeated information in both volumes?

Response: Though they can be similar, please note the requirements of the Past Performance volume

25. Question-When are the Past Performance Evaluations due to the Department of Education from the evaluator?

Response: The Department will accept them as they are sent by the Evaluator. The Department does not expect the contractor to follow up with the Department to ensure receipt of past performance evaluations.

26. Question-Will the Government allow this piece of the Technical Volume to be outside of page count?

Response: All interested Offerors should adhere with all page limitation requirements of the Solicitation

27. Question-Are resumes required for only key personnel (project manager, senior SME(s), and any other proposed key personnel)?

Response: Key Personnel only.

PAGE 5 OF 13 ED-CIO-13-Q-0011/0001

28. Question-Will the Government allow graphics, tables, figures and diagrams to be single-spaced 8-point Times New Roman font?

Response: No. Text must be no smaller than 10 pt.

29. Question-The Key personnel are listed as PM and two SME’s. What is the estimated total number of FTE’s?

Response: This is a performance based contract and the proposal needs to identify the vendor staffing plan to support the requirements.

30. Question-Reference paragraph 4.1 of the PWS where it is states that the contractor shall perform transition with the incumbent contractor staff. Would the government please provide the name of the incumbent along with the contract number under which the incumbent is providing service?

Response: There is no contractor incumbent, incumbent contractor staff refers to the contractor supporting the Managed Security Service Provider through the IAA with FAA.

31. Question-Would the government please provide metrics or data associated with historical security incidents, intrusion attempts and any other relevant historical information?

Response: To date we have had approximately 400 US-CERT reportable events with 95% of them classified as CAT 4, 5, or 6.

32. Question-Reference paragraph 2.0 of the PWS: Would the government please provide some additional description or data associated with the size of the ED network describing the amount of users, equipment connected and geographic coverage, etc.?

Response: Approximately 10,000 workstations and servers. The two major networks consist of an administrative/business mission network that is Contractor Owned Contractor Operated.

The second major network is a data center that is Government Owned Contractor Operated.

The Department has small employee locations in nearly every state.

33. Question-Reference paragraph 4.3, Task 3 of the PWS regarding the word “Develop” an

Education Security Operations Center (EDSOC): Is this requirement a new effort to be built from scratch or does the EDSOC exist today and requires refinement of it operation capability? If the EDSOC exist, would the government please provide data describing the historical level of effort implemented to date?

Response: This is a new effort; the EDSOC does not exist today.

34. Question-We understand the offerors are expected to propose the most appropriate staffing mix to accomplish the requirements as stated in the PWS. Since the incumbent has the best information on level of effort (LOE), would the government please post the historical FTE LOE used to support this requirement.

Response: There is no incumbent contractor. The current function is provided by a Managed Security Service Provider through an Inter-Agency Agreement with the FAA. This is a new effort expanding beyond the support previously provided by the MSSP. Therefore, there is no assigned FTE number available.

PAGE 6 OF 13 ED-CIO-13-Q-0011/0001

35. Question-In the past performance volume, can we include commercial past performance from organizations that will not allow mention of support to their SOC due to sensitivity of information?

Response: After consultation with the end-users, please provide as much as information as possible without compromising information security.

36. Question-Will the contractor be responsible for the relocation of the hardware? If so, should that be included in the pricing? (PWS Page 3 Task 4.1 second to the last bullet).

Response: No. The hardware and software relocation will be conducted by the Government.

The vendor may be asked to participate in the configuration of the equipment.

37. Question-Will the contractor be responsible for software licenses?

Response: No. All licenses will be Government Furnished Equipment.

38. Question-Can you provide comprehensive list of security tools that the Department of

Education has installed or are planning on installing? Are any of these currently owned by the current SOC provider?

Response: No. All licenses will be Government Furnished Equipment.

39. Question-What current cyber monitoring / incident response infrastructure (IDS, IPS, FireEye, Encase, ArcSight, etc.) does the Department of Education want to use as part of this procurement?

Response: The Department has a full suite of defense in depth security tools currently deployed within both the Contractor Owned/Contractor Operated and the Government Owned/Contractor Operated networks that are maintained and operated by the network contractor. Due to the sensitivity we will not disclose additional information beyond what is described in the PWS or is answered by other vendor questions.

40. Question- Is there a requirement for the margin size on the proposal?

Response: Please set margins at one (1) inch for all sides.

41. Question- In .34 ADDENDUM TO 52.212-1--PROPOSAL INSTRUCTIONS, under Volume II –

Business Volume, it states “the volume shall be double sided”. Was this supposed to be double-spaced and single sided, to match the rest of the proposal?

Response: Yes, Volume should be Double Spaced.

42. Question-. Is the government requesting that proposers include a compliance matrix with their submission? If so, in what volume should this compliance matrix be included, and will it count against the page limits for that volume?

Response: The solicitation does not specifically state that Offerors must create and submit a compliance matrix. If the Offeror intends to do so, please ensure to adhere to all solicitation page limitations.

PAGE 7 OF 13 ED-CIO-13-Q-0011/0001

43. Question- “At a minimum, the contactor shall perform transition with the incumbent contractor staff. Activities shall provide for the transfer of control of all ED systems, information, documentation, equipment, and operation activities from the incumbent MSSP.” (4.1 Task 1 - Transition Support – page 3).Are there any specific details that can be provided as to the ED systems (i.e. quantity, operating systems, etc.)?

Response: Currently only three systems require transfer to the Department. HP WebInspect is already within the Department's environment, the OS is the responsibility of the contractor providing the network service, and the application will be the responsibility for the recipient of this contract. The RedSeal system (appliance) is currently being moved into the environment, physically located within the contractor providing the network services facility. The deployed Sourcefire sensors (appliances) that reside at the external boundaries at several contractor locations will be maintained by the recipient of this contract.

44. Question- . “Contactor shall become familiar with and initiate takeover of incumbent MSSP activities and operations within 10 business days of contract start date; complete transition and assume control of all ED systems, contract information, documentation, equipment, activities, and operations by the end of the transition period NLT 15 Aug 2013 (Note: This may involve arranging the physical transfer of systems).” (4.1 Task 1 - Transition Support - page3). Are there any additional licensing requirements and/or ownership of hardware that will need to be considered?

Response: All licensing requirements will be handled by the Department prior to contract award date.

45. Question- The EDSOC monitors ED Internet and network access points, analyzes network traffic to identify emerging threats, detects and coordinates the response and recovery efforts for cyber-attacks against ED, and provides leadership with security situational awareness information regarding the overall security risk posture of the enterprise information assets.

(4.3.1 – Operations - page 6). Should it be assumed that the enterprise includes all ED principal offices?

Response: Yes. The Enterprise includes all Principal offices. The Federal Student Aid (FSA) has a Government maintained security element providing support and security operations for the data center during normal business hours.

46. Question- “The Network Monitoring/IDS Sensor Network primarily consists of tools deployed and managed by the network contractor that includes a complete suite of McAfee products that provides the Department with a Caesar’s like Continuous Monitoring capability. Additional vulnerability management and forensic investigation tools such as SourceFire, RedSeal, HP WebInspect, Splunk, Nessus, and EnCase, are available.” (4.3.1 – Operations - page 6). Should it be assumed that this is an all-inclusive list of tools that would be leveraged for this opportunity?

Would the contractor have the ability to leverage additional tools and/or propose additional tools to be considered?

Response: No, this list will grow as new capabilities and services will be integrated into the operations. As part of an on-going process the contractor is encouraged to develop requirements and propose capabilities and solutions to increase the efficiency and effectiveness of operations.

47. Question- “The Contractor shall develop and maintain the Contingency Plan for EDSOC operations and conduct contingency plan testing yearly. Plans shall be developed to cover

PAGE 8 OF 13 ED-CIO-13-Q-0011/0001

support for all Department of Education SOC functions.” (4.4.1 Technical Writing and Administrative Support - page 8). Would it be possible to obtain any specific details as to the requirements as they relate to contingency testing?

Response: This is a new effort, the EDSOC does not exist today and the specific requirements will be developed and implemented in alignment with existing government policies.

48. Question- Are Key Personnel required to be listed by name?

Response: Yes.

49. Question- Does ED map the NAICS Code 511199 to Sin 132-51?

Response: The appropriate NAICS code for this requirement is 541512.

50. Question- Please clarify Vol III – Past performance – Are we to provide a write-up or merely copies of Attachment M?

Response: Please adhere to the instructions set forth in the addendum to FAR 52.212-1.

51. Question- Should we create a Vol IV for Contract artifacts like the GSA Schedule, etc. that you have asked us to include?

Response: Please include as part of the Business Volume

52. Question- Should we include the VA Certification Letter demonstrating that we are a VA certified SDVOSB?

Response: Please include as part of the Business Volume

53. Question- “4. Support Cyber Security Research and Engineering efforts: Researches, evaluates, engineers, and provides life cycle support for tools, technologies, and solutions for safeguarding, monitoring, assessing, and investigating the security of classified and unclassified IT assets.”

Would these activities be part of Tasks 1 – 4, or unique activities within Optional Tasks 5 and 6?

Response: These will be a combination of activities. They may be increases in capacity or scope from Tasks 1-4 or maybe new capabilities or unique activities.

54. Question- Are there currently Memorandums of Understanding/Agreements (MOUs/MOAs) established with the EDUCATE contractor regarding the access to networks, systems, applications, and data stored, processed, and transmitted under that infrastructure contract?

Response: This will be the responsibility of the Government to ensure appropriate access is provided.

55. Question- Is the government requiring that every category shall have a named individual assigned to it at the proposal stage?

Response: No. Key Personnel only.

56. Question- 4.1 Bullet #4 mentions that the contractor shall take over incumbent systems NLT Aug

15, 2013. Para 5 Table item #9 states that transition must be complete NLT 30 days after award.

Do these dates coincide? Can these be specified in terms of contract start date? What is the extent of the effort to take over incumbent systems (e.g. type and number of systems)?

Response: Based on anticipated award date the dates coincide. In the event of a delay in award the Government will identify specific transition actions that must be accomplished by 15 Aug

PAGE 9 OF 13 ED-CIO-13-Q-0011/0001

57. Question- 4.2 Bullet #4 states "Contractor shall provide and finalize the Program Management Plan within 20 business days of contract start date." but Para 5 Table item #11 states "within 20 days of contract award". The Table in paragraph 5 consistently bases deliverables on contract award date while the narrative generally bases them on contract start date.

Response: Contract Award and Contract Start Date are the same date, the day the vendor is awarded the contract and the period of performance begins.

58. Question- 4.3.1, paragraph 4 states that the network monitoring/IDS sensor network are deployed and maintained by the "network contractor" and lists a number of other tools that are available. Does the EDSOC contractor have any control over these systems? Are these systems to be transitioned to the EDSOC as part of the consolidation described in Para 2.0 "Background"?

Response: The EDSOC contractor will have limited control over the systems and maintaining the devices under the purview of the contactor owned network. Some configuration capabilities and full access to the information/data to included query and reporting capability will be available.

59. Question- EDCIRC is mentioned in several locations (e.g. 4.4.2 bullet #4 and Para 8.0 description of Tier 2 indicate that EDCIRC will remain as an organization after award), however, Para 2.0 "Background" and Para 3.0 "Scope of Work" indicate that contract will consolidate EDCIRC and other efforts. Will EDSOC and EDCIRC remain as distinct organizations or is the offeror at liberty to merge them into a seamless operation? The PWS seems to indicate that the EDCIRC functions somewhere between the Tier 1 and Tier 2 levels:

4.4.2 states "Escalate unexplained, anomalous activity to EDCIRC analysts for further investigation"

8.11 states that Tier 2 shall "Perform quality control checks of Tier 1 and EDCIRC events".

Response: The EDCIRC is an existing body, Government Civilian membership. The vision is to merge as many of the capabilities as possible and eliminate duplication allowing the delivery of Services as efficiently as possible. As part of innovation and efficiencies the potential to merge all of the Services exists.

60. Question- 4.4.3 requires "a minimum of one complete penetration test for all Department networks and outsourced capabilities." How many networks and outsourced capabilities exist?

Response: Currently there are two major networks identified in FY14 for penetration testing, EDUCATE and VDC.

61. Question- Para 5.0 Table item 44. Is the contractor expected to merely support forensic investigation or to provide a full service of legally sound forensic investigation (including expert witness testimony) or is there a separate law enforcement activity responsible for this?

Response: Base capability is to support forensic investigation only. If law enforcement or legally sound forensic investigation is required it will accomplished by entities outside of this contract. If required, Optional Tasks 5/6 may be used for additional support or Services.

62. Question- PWS: 1.2-Will the contractor be permitted full read-only access to all systems under which IV&V services are to be performed?

Response: A combination of access rights dependent upon the tool set and the contractual agreements.

PAGE 10 OF 13 ED-CIO-13-Q-0011/0001

63. Question- Is there and existing or preferred system for documenting cyber incidents?

Response: Currently we are using a capability referred to as Department's Operational Vulnerability Management System (OVMS) that is based on OpenFISMA.

64. Question- What are the quantity and type of devices that the SOC will be responsible for monitoring?

Response: Initial monitoring is the McAfee ePO suite, 8 -10 Sourcefire sensors, Webinspect, RedSeal, and access to a number of security tools within the contractor owned/operated networks.

65. Question- Are bandwidth and communication costs to be included in our response?

Response: No.

66. Question- Of the data retained, how much of it is structured versus unstructured data? (i.e. raw versus relational data? Can the Government please provide figures and percentages?

Response: Unknown. This is an initial capability that currently does not exist. The anticipation is a low volume start rate from a limited set of tools expanding over time as additional Services and capabilities are required.

67. Question- Is there any particular security tool considered preferred in the realm of security incident and event monitoring?

Response: No.

68. Question- Can the Government please define the unit of “SE”?

Response: SE stands for Service.

69. Question- Can the Government please provide an explanation which differentiates the Monthly

Rate $_____ requested per CLIN for CLINs such as 0001, 0002, 0003, and 0004 verses that of the “Unit Price” and “Amount” given a Quantity of 0.00 and a Unit of SE?

Response: Please address the Monthly and Hourly rates being requested in each CLIN. Please also include your total proposed price for each periods of performance in the column labeled “Amount,” as applicable.

70. Question- In square footage, how much office space has been allocated for insourcing this functionality?

Response: The space is an open floor, 1200 sq. ft., Operations Center with consoles. Within the space is a 256 sq. ft. SCIF. No dedicated separate office space is provided.

71. Question- Has a facility been identified to act as the backup site? Should disaster recovery be considered in scope for the proposal?

Response: No. Yes DR planning will be required

72. Question- Given the current CLIN structure, how does the Government anticipate reimbursing contractors for travel associated with developing and maintaining the backup site?

Response: No DR/backup site at this time. When a backup site is identified the appropriate contract modifications will be identified.

PAGE 11 OF 13 ED-CIO-13-Q-0011/0001

73. Question- Have the security management tools, both software and hardware, been acquired, or is identifying and purchasing the software tools for managing the SOC part of the transition?

Response: Yes some tools have been acquired. As part of an on-going process the contractor is encouraged to develop requirements and propose capabilities and solutions to increase the efficiency and effectiveness of operations. All tools will be acquired by the Government outside of the scope of this effort.

74. Question- Due to the need for separation of duties for IV&V activities, does the Government believe that contactors currently providing the following services to the Department of Education will cause an Organizational Conflict of Interest (OCI) that cannot be overcome by an OCI Mitigation Plan as directed by NIST/FISMA requirements? System and Software Development Acquisition & Contracts Support Response: Organizational Conflict of Interest (OCI) issues will be addressed on a case-by-case basis. The current network contractor operation is the primary target of the IV&V actions.

75. Question- The solicitation states: "Offerors are instructed to identify no less than 3 but no more than 5 relevant customers that can provide insight into the declared past performance". Will the government accept subcontractor past performance? Also, in terms of the prime contractor's proposed past performance, is it acceptable to the government if such past performance is in the form of subcontracts? In other words, will the government accept past performance from the prime which has been performances by the prime in the role of a subcontractor on the subject past performance reference?

Response: Please note that the subcontractor’s past performance will not count as past performance for the Prime. For work performed by the Prime as a subcontractor, please also identify the dollar complexity of the overall effort and the amount awarded to the Prime in their subcontractor.

76. Question- Reference: Page 30, 1. Cover Page. The cover page shall include the project title, name, and contract information of the Offeror’s authorized official for contract administration, and the name and contact information for the Offeror’s negotiators for the technical proposal.

(Does not count towards page count)? Does the above refer to a “cover letter?” Or is this information to be included on the actual cover of the Technical Volume? If the information is to be included on the actual cover of the Technical Volume, can the Offeror include a cover letter, not to be included in the page count?

Response: Please adhere to the requirements of the solicitation and provide the information requested.

77. Question- Page 30, 9. Corporate Partnership Commitment Letters. This section contains letters of commitment from all identified subs and partners that will be providing services under this contract. Is the government requesting that the whole document be included or just the signature page? If the whole document is to be submitted, will it count towards the page count?

Response: After consulting with the end-user, please provide the whole document. However, only the signature page will count towards the page limit.

78. Question- Reference: Page 30, C) Offerors must include their proposed Conflict of Interest (COI) plan in this Part. Can the Offeror submit its company’s OCI Plan to satisfy this requirement?

Response: The Offeror can submits its company’s OCI plan, so long as it addresses the issues

PAGE 12 OF 13 ED-CIO-13-Q-0011/0001

79. Question- the Past Performance Volume shall be limited to 10 pages, single sided and double spaced with 12-point Times New Roman font. Offerors are instructed to identify no less than 3 but no more than 5 relevant customers that can provide insight into the declared past performance. Will the government either increase the page count for the past performance volume from 19 pages to 20 pages or remove the requirement for double spacing?

Response: The page limitation remains unchanged. Please directly address the information requested in this Section.

80. Question- Performance Work Statement, Page 7, Section 5.3- Is an “anticipated tools” listing available?

Response: No. Due to the sensitivity we will provide general tool information and specific tool information for the transition portions. The systems that are transitioning are: RedSeal, Sourcefire, and WebInspect. The Department, within the Contractor Owned/Contractor Operated network, is in the process of fielding a Continuous Monitoring capability based on the McAfee ePO framework.

81. Question- Performance Work Statement, Page 7, Section 5.3- Is a sanitized architecture available for review?

Response: No

82. Question- Performance Work Statement, Page 10, Section 5.4.3, Sub Bullet three; Page 19, Deliverable 34- What is the intended frequency of the Department-wide penetration test?

Response: Minimum of one per year for each network.

83. Question- Will ED facilitate access and transition contact time with key MSSP resources during the transition face?

Response: Yes.

84. Question- Can the Department detail the number of sensors and locations to be monitored by tier 1 personnel as well as a current avg alert volume in order to properly scope staff and propose potential efficiencies?

Response: 8 -10 Sourcefire sensors deployed to 4 - 5 locations. No specific volume information is available. The existing MSSP provides the Department with notification of 5 -7 US-CERT reportable events per week.

85. Question- There is no mention of a current SIEM technology in use today. Does ED have existing SIEM licenses or plan on procuring a SIEM for supporting SOC activities? If procuring, is it anticipated that the awardee will support the tool selection or will a tool be procured prior to award?

Response: Initially the EDSOC will not directly control the SIEM technology. The two major networks consist of an administrative/business mission network that is Contractor Owned Contractor Operated. The second major network is a data center that is Government Owned Contractor Operated. The EDSOC is considering SIEM technology for the Independent Validation and Verification of the contractor operations. Technologies being examined include Splunk, ArcSight, and EnVision. The awardee will participate in developing requirements for all tools being deployed within the EDSOC environment. All tools will be acquired by the Government outside of the scope of this effort.

PAGE 13 OF 13 ED-CIO-13-Q-0011/0001

86. Question- There is no mention of a current ticketing system technology in use today. Does ED have an existing ticketing system it intends to use for processing work requests and tickets? or plan on procuring a ticketing system for supporting SOC activities? If procuring, is it anticipated that the awardee will support the tool selection or will a tool be procured prior to award?

Response: Currently we are using a capability referred to as Department's Operational Vulnerability Management System (OVMS) that is based on OpenFISMA. As part of an on-going process the contractor is encouraged to develop requirements and propose capabilities and solutions to increase the efficiency and effectiveness of operations. All tools will be acquired by the Government outside of the scope of this effort.

87. Question- There is no mention of a current portal or reporting technology in use today. Is this the intended purpose of the OVMS constraint? Does ED have an existing portal system other than OVMS it intends to use for reporting and situational awareness? or plan on procuring a system for supporting SOC activities? If procuring, is it anticipated that the awardee will support the tool selection or will a tool be procured prior to award?

Response: The only portal like capability currently in use is OVMS. Additional capabilities are being examined under a separate contract effort that the awarded will participate in requirement and capability identification.

Descript: The purpose of this amendment is to post the Questions and Answers recieved in response to the EDSOC Solicitation Notice.

All other terms and conditions remain the same.

550 12th St SW - 7th Floor Washington DC 20202-4210