Solicitation_ED-FSA-16-R-0009,_Amendment_0006.pdf

NSN 7540-01-152-8070 STANDARD FORM 30. (Rev. 10-83) Previous Edition unusable Prescribed by GSA FAR (48 CFR) 53.243

Page of Pages AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT 1. Contract ID Code

2. AMENDMENT MODIFICATION NO. 3. EFFECTIVE DATE 4. REQUISITION/PURCHASE REQ. NO. 5. PROJECT NO. (if applicable)

6. ISSUED BY CODE 7. ADMINISTERED BY (If other than item 6) CODE

(x) 9A. AMENDMENT OF SOLICITATION NO.

9B. DATED (SEE ITEM 11)

10A. MODIFICATION OF CONTRACT/ORDER NO.

8. NAME AND ADDRESS OF CONTRACTOR (NO., Street, Country, State and ZIP Code)

CODE FACILITY CODE

10B. DATED (SEE ITEM 13)

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

The above numbered solicitation is amended as set forth in item 14. The hour and date specified for receipt of offers is extended, is not extended.

Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended, by one of the following methods:

(a) By completing items 8 and 15, and returning ______ copies of amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted;

or (c) By separate letter or telegram which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OR OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN REJECTION OF YOUR OFFER. If by virtue of this amendment your desire to change an offer already submitted, such change may be made by telegram or letter, provided each telegram or letter makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

12. ACCOUNTING AND APPROPRIATION DATA (If required)

13. THIS ITEM ONLY APPLIES TO MODIFICATION OF CONTRACTS/ORDERS. IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

Check One

A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE

CONTRACT ORDER NO. IN ITEM 10A.

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation date, etc) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(b).

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority)

E. IMPORTANT: Contractor is not, is required to sign this document and return _______ copies to the issuing office.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible)

Except as provided herein, all terms and conditions of the document referenced in item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER (Type or print)

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

15B. CONTRACTOR/OFFEROR 16B. UNITED STATES OF AMERICA

(Signature of person authorized to sign)

15C. DATE SIGNED

(Signature of Contracting Officer)

16C. DATE SIGNED

Attachment Page

PAGE 2 OF 4 ED-FSA-16-R-0009/0006

The purpose of this amendment is to establish a deadline for submitting questions regarding changes made to the solicitation by Amendment 0005. Only questions related to the changes made in Amendment 0005 will be accepted for response. All relevant questions must be submitted by Friday, June 9, 2017 by 3:00pm EST. Below are responses to some of the questions received thus far:

1. Several questions were received regarding page limitations.

RESPONSE: Offerors shall submit both a redlined version, as well as a clean version of the revised documents. The clean version will count towards page limitations. If there are no revisions to be made, then submit the original document and state that no revisions were made.

2. Pages 8-9, Update Section C.3 Additional Terms and Conditions, 52.239-70 Access to Contractor and Subcontractor Information Systems and Related Resources in Carrying Out Privacy and Information Security Inspections (DEVIATION), (b) The requirements listed in Items 1, 2, and 3 of this section, requiring the offeror to share all user; system; and database account information, as we as passwords;

security credentials; encryption keys; algorithms; and related, contradicts any and all best practices and recommendations under NIST, ED CIO guidance, and industry best practices. In similar situations, the common practice is for the auditing body to observe while the body being audited enters credentials and provides required evidence. This provides the auditor with all the required information while maintaining the confidentiality of sensitive information and avoiding reconstitution efforts. Complying with this requirement as written creates a significant opportunity for breach that the offeror has no ability to mitigate. Please advise under what circumstances ED will require such unfettered access to contractor systems, data, PII, etc. Please confirm that, in the event this requirement is not modified to comply with industry best practices, FSA will provide indemnification if a breach occurs due to the negligence of FSA staff, contractors, or agents who were provided such access.

RESPONSE: One example of circumstances where this will be required is part of an audit by the Office of the Inspector General. The Department of Education will not provide indemnification.

3. Page 9, Update Section C.3 Additional Terms and Conditions, 52.239-70 Access to Contractor and Subcontractor Information Systems and Related Resources in Carrying Out Privacy and Information Security Inspections (DEVIATION), (b) Please clarify the scope of this section with reference to the following: "Cooperation also includes allowing the Government to make reproductions or copies of information and equipment, including, if necessary, collecting a machine or system image capture." A blanket agreement to allow FSA to make reproduction copies and/or images would significantly increase risk and opportunity for breach that the offeror would be unable to mitigate.

RESPONSE: Offerors are required to meet the terms of the contract.

4. Page 10, Update Section C.3 Additional Terms and Conditions, 52.239-70 Access to Contractor and Subcontractor Information Systems and Related Resources in Carrying Out Privacy and Information Security Inspections (DEVIATION), (e) Remedies for Breach The Department and its contractors routinely evaluate and agree to Acceptable Risks (ARs) under FISMA rules. For example, if the Department cannot implement Java 9.0, the Department provides direction to its contractors to use an earlier, less secure version and considers it an AR. Please confirm that any such ARs under limitations imposed by the Department which do not allow offerors to meet the required hardware/software/configuration of contractor systems will not result in the contractor providing indemnification under this section.

PAGE 3 OF 4 ED-FSA-16-R-0009/0006

RESPONSE: Should the Department provide directions for vendors to follow, then the Department expects the vendors to adhere to that direction.

5. Pages 15-16, Update Section E.1 Addendum to FAR 52.212-1 -

Instructions to Offerors - Commercial Items (Jan 2017), Section A of Proposal Please confirm that offerors are submitting new management plans and that previously submitted RFP responses shall not be used for evaluation and that any prior evaluation ranking will be discarded and replaced with a new ranking assigned to this requested submission. Please confirm that this amendment replaces instructions to offerors in section A of the original RFP.

RESPONSE: The Government has taken corrective action through Amendment 0005 and will re-evaluate offers received in accordance with the terms of the solicitation.

6. The Update Section E.1, pages 15 through 17, includes the following instructions for Section B of Proposal and Section C of Proposal: "Any changes to previously submitted past performance information (or Quality Control Plans for Section C) shall include revision marks via track changes utilizing strikeouts and bold red font for added or modified text." However, this language was excluded from the instructions for Section A and Section D. Does this mean that for Section A, the Government wants the bidder to only provide the information identified in the seven items identified for the Management Plan and resumes of Key Personnel, if required, and not re-submit their original Section A with revisions? Further, does this mean that for Section D, the Government wants the bidder to only respond with a revised small business participation plan (if the bidder decides to do so), and not re-submit their original Section D with revisions?

RESPONSE: The entire proposal should be submitted with revision marks, as well as a clean version for page count purposes.

7. Are the Cover Letter and Negative Judgments section still required?

RESPONSE: Yes. The Government is seeking a complete proposal submission with a redlined version as appropriate, as well as a clean version for page count purposes.

8. If we have no changes to a particular section are we still required to resubmit that section?

RESPONSE: Offerors are required to submit the Management Plan and Resumes of Key Personnel Proposed with a redlined version as appropriate, as well as a clean version for page count purposes.

9. Section A of Proposal states Offerors are required to submit new management plans and key personnel resumes per the instructions below. Does this mean offerors are required to submit a new management plan and key personnel resumes addressing only items 1 through 7 on Page 16 of the amendment? What about Cover Letter, Negative Judgements that were required in Section A previously. Are these Items 1 thru 7 in addition to previous management plan requirements or supersede instructions issued in the previous RFP?

RESPONSE: Yes. The Government is seeking a complete proposal submission with a redlined version as appropriate, as well as a clean version for page count purposes.

10. Question 6 on Page 16, refers to Capabilities/processes which enable FSA to remotely access the Contractors proprietary systems in read only mode. As it relates to this question can you be more specific as to the access that is required? For example is this access for read only to the collections platform to

PAGE 4 OF 4 ED-FSA-16-R-0009/0006

view borrower notes and work efforts/call histories etc. or remote access to collection system/server etc.

to test network security. We want to insure we answer thoroughly and completely.

RESPONSE: The Government is seeking access to any system that contains the Government’s data/information.

FSA - Acquisitions, 830 First St NE - Suite 91F3 Washington DC 20202