ESSS GUARD Capabilities RFI V3 - QA Final.pdf

Question Answer

Would you consider IBDSS Next to be a predecessor to the GUARD/IBDSS requirement? Is the work contemplated under this new IDIQ a continuation of or follow-on to the scope performed under the IBDSS Next vehicles?

The scope is similar in that the GUARD effort will host a continuation of sustainment activities performed under IBDSS Next vehicles. However, the scope of other activities encompassed in GUARD is expected to exceed that of IBDSS Next.

Could the Government please clarify whether the 10-page limit for the RFI response includes or excludes the cover page and table of contents? Could the Government please clarify whether graphics, tables, or charts are included in the 10-page limit?

The page limit has been eliminated.

3 Is there any anticipated risk of funding cuts that will impact this effort? No.

4 Will the Government require offerors to have a DCMA approved property management system for Government Furnished Property (GFP)? Yes.

Can the Government clarify whether upcoming task orders within the IDIQ are expected to prioritize CONUS or OCONUS installations, and whether any specific theaters (EUCOM, CENTCOM, INDOPACOM) are anticipated first?

There is no specific priority regarding CONUS vs

OCONUS.

Does the Government expect vendors to demonstrate capability across all high security mission sets (nuclear facilities, SCIF/SAPF, UL2050), or will individual delivery orders identify which specialized environments are required?

Vendors are expected to have the relevant company certifications as well as personnel certifications and work experience to design and install CMD equipment and implement network designs at AF facilities at the time of RFP release. This would be inclusive of nuclear facilities and/or SCIF/SAPF facilities if the vendor intends to bid on those project types as part of delivery orders.

Will interface control documents (ICDs), data schemas, and integration specifications for OMScompliant components and DMDC3 be released before the IDIQ proposal, or only at the individual delivery order level?

These documents are expected to be released at the Order level.

Can the Government clarify the proportion of cloud/DevOps work envisioned relative to physical security integration, and whether cloud operations will include hosting, containerized deployments, or only support to existing Government infrastructure?

The Government is not yet able to clarify the proportion of cloud/DevOps work relative to physical security integration. Cloud operations may include hosting, containerized deployments, and support to existing Government infrastructure, but this is expected to be clarified at time of RFP release.

For the requirement to sustain 50+ sites simultaneously, can the Government clarify whether sustainment will be centrally managed under the IDIQ or handled independently under each task order?

Sustainment is currently expected to be structured as separate task orders delineated regionally under the IDIQ.

Though these regions have not yet been definitized, sustainment of 50+ sites simultaneously remains a valid estimate.

Does the Government require that network engineers supporting each delivery order hold active CCNPlevel certifications, or can equivalent manufacturer certifications (Juniper, Fortinet, Palo Alto, etc.) be accepted?

Per DoD 8140 requirements, equivalent certifications may be considered when they demonstrate proficiency with technologies being supported.

Can the Government clarify whether full RMF packages, ATO/IATO support, vulnerability scan artifacts, and STIG checklists will be required at the IDIQ level or only when associated with a specific DO?

These are expected to be required as associated with a specific order.

12 Cloud environment: Is the Government envisioning a contractor-managed cloud, a government-furnished cloud (e.g., DoD Impact Level (IL) 4/5/6), or a hybrid? This is expected to be clarified at time of RFP release.

Data rights & cybersecurity responsibility: What data-rights posture does the Government expect for contractor-developed software and integration technologies supporting DMDC3/open-architecture objectives (e.g., Government Purpose Rights

vs. unlimited rights)? Who holds the Authority to Operate (ATO)/Risk Management Framework (RMF) risk acceptance for fielded systems?

The Government will receive unlimited data rights for software developed for Government exclusive equipment (e.g. RTES) and will receive Government Purpose Rights for software developed in the implementation of COTS integration (e.g. GBR driver development). Contractor will be responsible for providing deliverables to the Government in support of the ATO package to include assessment and authorization packages as directed by the

AO.

Bonding: Given the ~$1B ceiling and the civil-engineering/infrastructure installation scope, will payment and performance bonds be required at the task-order level, and what bonding-capacity expectations should industry plan against?

It is not anticipated that bonds would be required.

However, if it is determined that the requirement calls for a bond, that will be determined at the order level.

Wage determinations: Will task orders be subject to Service Contract Act (SCA) wage determinations, Davis-Bacon Act construction wage rates for civil/infrastructure work, or both?

The Service Contract Act (SCA) wage determinations are expected to apply to Task Orders for services. The Davis- Bacon Act is not expected to apply.

Government-furnished items: What property, equipment, facilities, and information will the Government furnish (e.g., the Configuration Management Database (CMD), Original Equipment Manufacturer (OEM) licenses for legacy systems, government cloud, site access) versus what must the contractor provide?

The spares will transfer from IBDSS Next to GUARD orders as Government Furnished Property (GFP)/Government Furnished Material (GFM). The Government may provide GFP, CMD (Configuration Management Database), warranty and license information via the bidder's library.

DMDC3 documentation timing: The RFI indicates Interface Control Documents (ICDs) will be available at Delivery Order (DO) solicitation. Could a DMDC3/OMS architecture overview or reference architecture be released earlier - at or before RFP

- to let offerors assess integration complexity and price integration risk at the IDIQ level?

This is expected to be clarified at time of RFP release.

COTS qualification: What is the process, timeline, and funding model for qualifying candidate Commercial off-the-Shelf (COTS) equipment for inclusion in the Security Forces Government off-the-Shelf (GOTS)/DMDC3 architecture and the CMD?

It is expected that the Government will qualify all major system components and most peripheral components via the COTS Qualification process. The Government will consider qualifying lower risk peripherals (e.g. cameras, sensors, BMS, etc.) as part of the D&I effort on a case-by-case basis should it be beneficial to the Government. It is anticipated that the Government will be updating the CMD for new components on a quarterly basis.

Legacy system sustainment & licensing: Will incoming contractors be expected to assume sustainment of systems fielded by prior FPS4/IBDSS contractors, including proprietary/OEM-specific systems? If so, will the Government obtain or transfer the necessary OEM licenses, credentials, and support agreements, or must the new contractor renegotiate them?

Yes. Clarity regarding licenses, credentials, and support agreements is expected to be provided at time of RFP release.

Acquisition structure & on-ramps: Recognizing a final structure is undecided, is the Government considering capability-based pools or functional groupings (versus all awardees competing for the full scope)? Given the 10-year ordering period, are periodic on-ramp/off-ramp opportunities being evaluated to refresh the awardee pool over the life of the vehicle?

The Government has not made a decision regarding capability-based pools or functional groupings, but this is expected to be clarified at time of RFP release. Period on-ramp/off-ramp opportunities are expected.

OCONUS host-nation support: For OCONUS installations in active theater Areas of Responsibility (AORs), how does the Government envision managing host-nation business-license and visa requirements? Will the Government provide contracting or diplomatic facilitation, or is this entirely the contractor's responsibility?

This is the Contractor's responsibility.

Technology refresh over contract life: For a 10-year IDIQ, what is the anticipated approach to incorporating significant changes in technology and cybersecurity standards (e.g., new Defense Information Systems Agency (DISA) Security Technical Implementation Guides (STIGs), evolving OMS/MBSE standards) over the life of the contract?

Contractor will be responsible implementing ONLY Govt approved baseline configuration changes.

Zero Trust (ZT) for Operational Technology (OT) compliance: Will the Integrated Base Defense Security Systems (IBDSS) solution be required to achieve, at minimum, Target Level ZT in accordance with the Department of War (DoW) 'Zero Trust for Operational Technology (ZT for OT) Activities and Outcomes' (v2) and Directive-Type Memorandum (DTM) 25-003, 'Implementing the DoD Zero Trust Strategy'? If so: (a) at what point in the lifecycle (design, delivery, sustainment) must Target Level be achieved, and over what timeline; (b) is the contractor responsible for designing to and self-assessing against the ZT for OT Activities and Outcomes, or will the Government conduct that assessment; and (c) how are these requirements expected to reconcile with the contractor's existing Risk Management Framework (RMF), Defense Information Systems Agency (DISA) Security Technical Implementation Guide (STIG), DoD Control Systems Security Requirements Guide (SRG), and Unified Facilities Criteria (UFC) 4-010-06 obligations?

This is expected to be clarified at time of RFP release.

ZT for OT at the device layer: The DoW ZT for OT guidance requires Non-Person Entity (NPE) credentialing (e.g., X.509 certificates via Public Key Infrastructure (PKI)), secure OT protocols, and break-glass/compensating controls for devices that cannot natively comply. How should offerors address ZT for OT outcomes for resource-constrained or legacy IBDSS field devices (cameras, sensors, access-control controllers) that cannot support certificate-based authentication or secure protocols, and what is the Government's expected process for documenting exceptions, compensating controls, and break-glass mechanisms?

This is expected to be clarified at time of RFP release.

Physical security as a ZT for OT enabler: The DoW ZT for OT guidance identifies robust physical security controls - access control, video surveillance, intrusion detection, and perimeter/zone segmentation - as direct enablers of ZT for OT outcomes, and directs coordination between cybersecurity and physical security teams. Does the Government view the IBDSS scope as both (a) OT assets to be secured under ZT for OT and (b) a physical-security enabler of ZT for OT outcomes for other base control systems, and will coordination with Facility-Related Control Systems (FRCS) and OT cybersecurity stakeholders fall within the contractor's scope?

This is expected to be clarified at time of RFP release.

Government-Furnished Equipment (GFE) and OT connection rules: The DoW ZT for OT guidance specifies that only GFE may connect to an OT environment, with non-GFE requiring an approved deviation and command authorization. How will this apply to contractor-furnished installation, test, configuration, and sustainment equipment (e.g., laptops, programming/test devices) used across 50+ sites - will the Government furnish such equipment, or is there a standard deviation/authorization process offerors should price against?

This is expected to be clarified at time of RFP release.

Can the Government provide clarity on the expected depth of DE/MBSE deliverables, such as whether full SysML architectures, requirements traceability, or model based test artifacts will be required at the task order level?

This is expected to be clarified at time of RFP release.

Will interface control documents (ICDs), data schemas, and integration specifications for OMScompliant components and DMDC3 be released before the IDIQ proposal, or only at the individual delivery order level?

These are expected to be released at the Delivery Order level.

Does the Government intend for each task order to require a full Program Protection Plan—including antitamper, supply chain threat analysis, parts counterfeiting mitigation, and hardware/firmware vulnerability assessments—or will this be required only for specific technology-development efforts?

The Program Protection Plan is maintained by the Government. The Contractor will be required to be in compliance with the requirements of the PPP.

For Integrated Base Defense efforts involving IDS, PACS, VSS, sensors, alarms, monitoring, sustainment, and operational readiness, is AFLCMC expecting the security-process and lifecycle-management work to be embedded within the core GUARD acquisition, or could there be separate support lanes for:• physical security systems lifecycle management• installation security readiness and acceptance tracking• IDS/PACS/VSS integration status and deficiency tracking• digital dashboards for security posture, sustainment, and readiness• security CONOPS / response-force integration support• accreditation or compliance evidence management where secure facilities are involved

It is expected that this work be contained with the GUARD IDIQ scope.

31 Does the government view this as equipment/sustainment only, or as an integrated security operations and lifecycle-management requirement?

This requirement is expected to consist of components of both sustainment and integrated security operations/lifecycle-management.

Small Business (SB) set-aside: Will the Government strongly consider designating all, or a substantial majority, of the Integrated Base Defense Security Systems (IBDSS) IDIQ as a Small Business set-aside, whether as a total set-aside or through capability-based SB pools?

What North American Industry Classification System (NAICS) code and corresponding size standard does the Government anticipate assigning to this acquisition?

NAICS Code: 561621.

Corresponding size standard: $25M The Government may consider partial Small Business set-asides for the GUARD IDIQ - final determination will be provided at time of RFP release.

Contract type & accounting system: What contract types are anticipated at the task-order level (Firm-Fixed-Price (FFP), Time-and-Materials (T&M), cost-reimbursable, or a mix)? Will an approved Defense Contract Audit Agency (DCAA) cost-accounting/estimating system be mandatory at IDIQ award, or required only for cost-type task orders?

It is expected that task orders will be a mix of cost-type, FFP, and T&M, though contract type at the order level has not been decided. It is expected that an approved cost-accounting/estimating system be required at IDIQ-award.