Copy of Copy of Copy of Questions and Answers_10 June 2022(2).xlsx
XLSX spreadsheet 14 KB Posted
- Attached to
- WINGS Penetration Test - AMENDMENT 0001
- Solicitation number
- FA330022Q0029
View the file
Other files
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Sheet1
| Reference | Questions | Answers |
| SOW | Under the Requirements section #17 - The Pen Test must be performed and results received between 10 June and 31 July as agreed to by both parties. |
Given that this response is not due until 31 June, do you have a new timeline for services to be provided?
| The Pen Test must be performed and results received between 15 June and 31 July. | ||
| Is this award LPTA? | Award will be made in accordance to the ADDENDUM TO 52.212-2, EVALUATION -- COMMERICAL ITEMS BASIS FOR CONTRACT AWARD. Please reference Part II Price. | |
| SOW | How many tests you anticipate running during the 5 year period? | One per year. |
| What is the page count for the tech approach/capability statement? | No required page count | |
| Who is the incumbent? | This is a new contract. | |
| What is the total value of the incumbent contract? | This is a new contract. | |
| Contracting | What are the submission guidelines/Instruction for this solicitation? | Please refer to the Combined Synopsis Solicitation for guidelines and instructions for the solicitation. |
| Contracting | Are we supposed to have two volumes for the Technical and Price part or does the single volume need to be sent for both Technical as well as Price Quote? | Your capability statement should include the technical, per the instructions in the Combined Sysnopsis Solicitation, you will need to complete the price chart under the Schedule of Supplies/Services. |
| SOW | How many live web pages are in scope for penetration testing on each of the four websites? | Small number of static pages. All other pages are dynamically generated depending on access and function. |
| SOW | How many web forms requiring user interaction are in scope on each of the four websites? | Small number of static pages. All other pages are dynamically generated depending on access and function. |
| SOW | Are web services to be tested? If so, how many endpoints are in scope (i.e., the number of parameters per method)? | External Pen Test only. |
| Is there currently an incumbent company or previous incumbent, who completed similar contract performing these services? If so - are they eligible to bid on this project and can you please provide the incumbent contract number, dollar value, and period of performance? | This is a new contract. | |
| SOW | Specify the VLAN details how many are included in the Scope? | No VLANs. External Pen Test only. |
| SOW | Can you please provide the current number of infrastructure details (Physical Server, Virtual Server, Network Devices, etc | NA - External Pen Test only. |
| SOW | How much (%) of the infrastructure is in the cloud? | NA - External Pen Test only. |
| SOW | What is the size of the IT environment? | NA - External Pen Test only. |
| SOW | Do you manage your own data Center, or do you utilize any 3rd-party/colocation facilities? | NA - External Pen Test only. |
| SOW | What is the approximate budget? | The Government is unable to provide a budget. This is a competitive acquisition and expect offerors to provide a price that is fair and reasonable. |
| SOW | In the attachment 1 statement of work on page no. 1 under the Requirement, point#8 indicates that "Experience performing DoD Pen Tests (preferably USAF) using Risk Management Framework (RMF)." | Yes, vendor must have experience performing DOD Pen Tests. |
| Could the agency please clarify whether the person can fulfill this requirement instead of a firm? | Contractor whether firm or individual must be able to satisfy the requirement in accordance to the solicitation | |
| Combo | The extended amount must equal the unit price multiplied by the number of units." Should we multiply by 1 extra unit or by multiple units: I.e 2,3,4..etc? | The Quantity and Unit of Issue is provided. Please provide the unit price as well as the total price. |
| Combo | A Firm Fixed Priced Award will be made in accordance with the following: NAICS Code: 541512; Size Standard: $30M. This acquisition is being solicited as a 100% small business set-aside. Does this mean that to submit a bid a company must have $30M in sales & revenue? | $30M is the dollar threshold for NAICS 541512 If you are unsure if your company is a small business under that NAICS 541512, you may check on SAM.gov. |
| Combo | When is the project intended to be awarded and what is the potential start date? | The projected award date is 14 Jun 22. The Period of Performance start date is 15 Jun 22. |
| By when would the project need to be completed? | The Pen Test must be performed and results received between 15 June and 31 July. | |
| Is there any specific list of tools that can be used or any that are excluded for this assessment? | No | |
| In the SOW, the item number 1 under section “Additional Information “states that “External Websites will be provided”. In the combined synopsis solicitation, a list of CLIN have been provided under the section “Schedule of supplies/services”. Do these CLINs represent the external facing websites that need to be tested? Please confirm. | Web Sites will be provided to the winning vendor at the first meeting between the agency and vendor. The CLINS is a description of the services in which we are seeking from the vendor. | |
| SOW | In the SOW, under the section “Requirements”, item number 17, states that “The Pen Test must be performed and results received between 10 June and 31 July as agreed to by both parties”. Is this 10 June and 31 July or 10 July and 31 July? Please confirm. | The Pen Test must be performed and results received between 15 June and 31 July. |
| SOW | In the SOW, under the section “Additional Information” item number 3 states that “If requested, a Pen Test report example will be provided”. Should we mention this as a part of the RFQ when submitting the response? | Yes. |
| SOW | We understand that this a fixed award that will occur annually for 5 years. Does this mean an average of 30 Mil for the entire 5 years? Could you please elaborate on the method of providing the results? | $30M is the dollar threshold for the NAICS code. The NAICS code determines if a business is small or large, based on the dollar threshold. If your company exceeds the dollar threshold for that NAICS, which is the annual revenue for that NAICS, then the business will be considered a large. |
| SOW | How many pages and inputs for each application? | Small number of static pages. All other pages are dynamically generated depending on access and function. |
| Combo | Is it acceptable to submit PART II: PRICE using excel format? | You may submit an excel spreadsheet for additional information, but per the instructions, you must complete the pricing chart under the Schedule of Supplies/Services. |
| SOW | Please confirm that the work is to be conducted remotely. It is clear in the SOW, but in the solicitation on page 1 it states, “The offeror shall provide the services listed below, which is to be performed on Maxwell, AFB…” so we wanted to clarify. | All work will be performed remotely, and has been updated on the Combo Synposis Solicitation, page 1. |
| Please confirm that “WINDS” below is referring to WINGS. | WINGS. Has been changed in the Combo Synposis Solicitation. | |
| For the WINGS web application pen test, how many static pages and dynamic pages are required to be assessed for the four external facing WINGS websites? (approximate) | Small number of static pages. All other pages are dynamically generated depending on access and function. | |
| For the requirement below, is the 30 days business days or calendar days? Pen Test must be complete within 30 days of execution of plan. | Calendar days | |
| Could the Government please confirm that an annual on-site meeting is not required for the contractor to attend? | No on-site meeting required | |
| Could the government please specify whether this is a one-time or multiple-times-a-year test? | One time per year | |
| How many roles does the application have on average (it indicates we can do self-registration, but can we do registration per role or just normal user registration and expect to elevate privileges)? | Standard user roles. No elevated roles. | |
| We believe website is hosted at on-premise data center per Additional Information point # 4 and contains PII/SPI data but no classified data. | Yes, confirmed | |
| In the event, we get access to any PII and halt the test do we have to continue it after the vulnerability is closed? | If PII is accessed, notify the POC for the Pen Test but continue testing. No retesting of Vulnerabilities required. | |
| Do all four external-facing WINGS websites contain the same functionality and represent different environments dev, qa, preprod/uat, and prod? Can we get their url/domain? | Sites perform different, coordinated functions. URLs will be provided to the winning vendor. | |
| Please confirm pen test would be required only once a year and the awardee not be required to retest after vulnerabilities are resolved per Requirements #13. | Once per year. Full test and results. No retest after vulnerabilities have been resolved. | |
| Please confirm that the content/functionality of websites will not undergo major changes after the base year. | No major changes to structure or framework but may have enhancements and changes. | |
| Any other reporting requirement after the pen test is conducted and a list of identified vulnerabilities is submitted. | An acceptable detailed report is a deliverable. | |
| Any restriction on hours/weekdays of pen testing per Requirements #15? | No testing on Federal holidays or holiday weekends. | |
| Are you looking to develop this new application similar to WINGS or you want to purchase licenses of existing product WINGS? | External Pen Test only. No application development? |
File details come from the government source that posted it. Updated .