Answers to Questions.doc

Subject: Questions Regarding the PWS for Solicitation FA3022-08-Q-0001

The following questions/comments are submitted regarding the PWS for Solicitation FA3022-08-Q-0001.

1.1 Summary of Expectations

The mission of the Network Control Center (NCC) is to provide site management of Command, Control, Communications, Computer and Intelligence (C4I) information resources for decision-makers, war fighters and other site users. Additionally, the service contractor is expected to be a partner with the base community in continuously improving the quality of programs and services offered to customers. The contractor shall perform/provide Columbus AFB with timely, proactive, high quality communications and computer services. These services shall include, but not limited to, Information Technology (IT) planning, telecommunications support, Base Communications Center (BCC), Automatic Message Handling System (AMHS) administration and support, local customer support of regionalized data processing, Network Management (NM) and Administration, firewall administration, small computer systems support and maintenance, Defense Information System Network (DISN) node administration, Combat Information Transport System (CITS), software installation, configuration and support, wing software management, webmaster functions, information assurance, information protection operations and customer training, support and education. Contractor’s proficiency level must keep pace with technological advances in the IT industry.

Question: The summary states that “small computer systems support and maintenance” is part of this solicitation, but there is no further elaboration regarding these functions in the PWS. Are these functions part of the solicitation or should all reference be removed?

Answer: Remove small computer systems support and maintenance from Para 1.1.

Ref 1.48.3 -- The requirement states that the service provider is responsible to act as the base delivery point for all Automated Message Handling System (AMHS). AMHS is configured on selected individual workstations on the base and as such AMHS messages are not accessible by anyone but that authorized user.

Recommend that this requirement be removed.

Answer: Remove Para from PWS.

Ref 2.2.2 -- The requirement states that the service provider shall check, download, process, and notify appropriate agencies of incoming AMHS traffic. AMHS is configured on selected individual workstations and as such, AMHS messages are not accessible by anyone but that authorized user.

Recommend that this requirement be removed.

Answer: Remove Para from PWS.

Ref 2.2.3 through 2.2.5 -- Each of these requirements incorrectly indicate that AMHS messages are accessible by NCC personnel. (See previous questions). AMHS is configured on selected individual workstations and as such, AMHS messages are not accessible by anyone but that authorized user.

Recommend that this requirement be removed.

Answer: Remove Para from PWS.

Ref 2.3.6 -- The requirement states that the service provider is to perform system administration in support to wing users in the application and operation of COTS software, specialized applications and standard desktop devices and software.

Please indicate the workload associated with this requirement.

2.3.16 Provide/perform system administration support to wing users in the application and operation of COTS software, specialized applications and standard desktop devices and software.

Question: What are the specialized applications that are used at Columbus AFB and what level of support is expected? Does this include PMO systems?

Answer: Software such as standard SDC, dameware, etc.

Answer: Does not include PMO systems unless an SLA is in place or stated in PWS.

Ref 2.3.21 –The requirement states that the service provider will audit system event and error logs. Currently, access to core server logs is restricted to the NOSC/I-NOSC only.

Please clarify the requirement, i.e., which server logs will be viewed.

Answer: Server logs that are under the control of the NCC.

Ref 2.6.1 -- The references states that overtime will not be paid for non-duty hour emergency responses. This statement does not conform to normal procedures, especially if the emergency response occurs at the end of a pay period when rescheduling, after the fact, is impossible. With an overtime CLIN, it seems entirely within the realm of reasonable expectations that overtime can be applied to events such as this.

Please consider amending this statement to one that allows for overtime when required.

Answer: This references network outages which overtime has never been paid for. PMI will be considered as normal duty hours.

Ref 2.6.7 – The requirement identifies the need to maintain log on scripts. This requirement should fall within the AFNETOPS Center.

Recommend this requirement be deleted.

Answer: This requirement is for the standard organizational scripts that are used for mapping and specific logon requirements.

2.6.10 Act as Defense Information Systems Network (DISN) node site coordinator as defined in DISAC P70-series and Air Force 33-series publications.

Question: Who currently performs the node site coordinator and long-haul management duties and what is the workload?

Answer: See below answer.

2.6.10 through 2.6.14 These requirements seem to indicate that there is a fully operational patch and test facility.

Question: Where is the PTF located and what is the workload associated with these requirements?

Answer: Answer: Remove Para’s from PWS.

9.4.4 Contractor personnel must be certified IAW DoD 8570.01-M. Certification. Certifications must be appropriate for the IA position bring filled. New hire contractors must be certified within 6 months of contract start date. New hire contractors must agree as a “condition of employment” that they will obtain the appropriate certification for the position to be filled. The QAE will verify certification has been accomplished.

Question: How does this statement line up with paragraph 14.12 which requires all NCC personnel to possess IAM level 2 or higher certification?

Question: Does this mean that new hires after 6 months from contract start date will have 6 months to acquire those DoD 8570-1M certification requirements or will they be required to have them at employment start date?

Ref 14…: The reference states, “All NCC personnel must have and maintain one of the following three certifications (GSLC, GIAC Security Leadership Certificate; CISM, Certified Information Security Manager; CISSP, Certified Information Systems Security Professional). These requirements will not be waived and must be obtained within 6 months of employment.”

These certification requirements are associated with Information Assurance Managers, while seemingly ignoring the fact that most of the work performed at the local NCC encompasses that work normally assigned to Information Assurance Technicians. It seems excessive to require network technicians at the local level to possess the higher level security certifications.

Recommend that a distinct separation of IAT and IAM levels be readily identified so as to prevent excessive and unrealistic certification requirements.

Does this mean that new hires after 6 months from contract start date will have 6 months to acquire those DoD 8570-1M certification requirements or will they be required to have them at employment start date?

Answer: NCC personnel Certification requirements in Para will be changed to the following: ISO Certification: Security+ (CompTIA)*, GSEC-Global Information Assurance Certification Security Essentials Certification (Sans Institute), SCNP-Security Certified Network Professional (Security Certified.net), and SSCP-System Security Certified Practitioner (International Information Systems Security Certifications Consortium AKA ISC2)

Answer: IA personnel Certification requirements must have the following and will be added to approperate Para within PWS.

ISO Certification: Security+ (CompTIA)*, GISF - Global Information Assurance Certification Information Security Fundamentals (SANS Institute), GSLC - Global Information Assurance Certification Security Leadership Certificate (SANS Institute)

14.12.3 Network Control Center Technician. The NCC technician(s) shall have four years current working experience in installation, operation, and maintenance of the type(s)/model(s) of items identified in Appendix 2 or equivalent.

Question: Is this an overall staff requirement or is each technician expected to have experience on all equipment listed?

Answer: Overall staff requirement. However, each employee that performs any type of hand on will be required to have experience in server/desktop system administration.

14.12.9 Web Page Manager/Programmer. The contractor shall provide one employee whose primary duty shall be web page manager and web programmer. Standard government provided software for this effort includes but not limited to Dreamweaver, Adobe Acrobat, Jva, etc. This employee shall have at a minimum four years experience and/or a technical/associates degree or higher in the development and maintenance of Scripted web pages. Must be fully qualified in the use of proper development tools required to accomplish this task.

Question: Does this position include any web scripting such as ASP or any interface with live databases such as Oracle or SQL?

Answer: Yes

14.13 Personnel Substitutions. Proposed substitutions of the personnel occupying the positions identified above must be submitted in writing to the QAP/FSA/CO at least 15 days in advance of the proposed substitutions.

Question: How does this requirement allow the contractor to fill a vacancy in 2 weeks?

Answer: Replace Para with the following>

14.13 Personnel Substitutions. Proposed substitutions of the personnel occupying the positions identified above must be submitted in writing to the QAP/FSA/CO at least 7 days after selection of replacement personnel and prior to hiring allowing for validation of needed requirements.

In Appendix 1 – Work Load Estimates, page 57, it is stated:

Thin Client

1. What is the estimated time for each one of these individual events?

Answer: Driven by daily requirements. New system to Columbus.

2. Additionally, this work load chart, shows Citrix, no where else in the PWS is Citrix mentioned. What will be the required skill set for this support?

Answer: Remove Citrix requirement from PWS.