WBT - Solicitation Questions_Wth_Answers.pdf

WBT – Solicitation Questions

PWS 4.2 – Previously Developed Air Force Course Samples

PWS 4.2 requires offerors to provide two samples of previously built Air Force courses produced within the last three years. Because Air Force courseware contracts may require delivery of final courseware, source files, and associated materials to the Government and may restrict subsequent contractor distribution of those materials, please clarify what the Government will accept as a qualifying course sample.

Specifically:

1. Will the Government accept a controlled demonstration, screenshots or video walkthrough, redacted excerpts, or a prior Government customer reference confirming the offeror's development of and functionality provided by the course in lieu of submitting Government-owned courseware?

Government will accept a controlled demonstration, screenshots or video walkthrough. We anticipate being presented with printed documentation of submitted courses showing storyboard materials.

2. Does the Government require the samples to consist of executable/interactive courseware, or will documentary evidence demonstrating the required capabilities be acceptable?

We highly prefer to visually see executable courseware in its operational state.

Samples should display visual and audio evidence of how the courseware meets identified requirements requested in the PWS.

Note: we have access to all courseware on most all DOW government Learning Management Systems.in which we would only need to know where the courseware is located.

3. May qualifying course samples and associated experience be provided by a proposed subcontractor or teaming partner, or must the samples represent work performed by the prime offeror?

Either example will work.

4. Requirement 4.2 Possess Subject matter Experience states offerors must “Provide no more than two (2) samples of previous built AF course in one (1) of the subject matter area listed below for evaluation.” Will the Government accept course samples in these subject areas from non-Air Force courses developed for other DOW or DHS aviation platforms?

Government will accept courses that show aviation platform training for other DOW services or DHS.

PWS 4.1 – NIST 800-53 Certification

PWS 4.1 requires the contractor to possess and provide a current NIST 800-53 certification that has been held for more than 12 months.

Please clarify what specific certification, assessment, or other documentation the Government intends offerors to provide to satisfy this requirement.

Specifically:

1. Will a current CMMC Level 2 assessment/status satisfy PWS 4.1?

No, a CMMC Level 2 assessment status does not fully meet NIST 800-53 compliance. While they are closely related, they are designed for entirely different scopes and environments with the NIST 800-53 being more stringent.

2. Alternatively, will an assessment demonstrating compliance with NIST SP 800- 171 satisfy the requirement?

No, NIST SP 800-53: is designed for federal government information systems. It is highly complex, featuring hundreds of controls across 20 distinct control families.

NIST SP 800-171 pulls a streamlined subset of 110 controls from NIST 800-53 to protect Controlled Unclassified Information (CUI) on commercial networks.

3. What documentation should an offeror submit with its proposal to demonstrate compliance with PWS 4.1?

To demonstrate compliance with PWS 4.1 vendors can submit the following items showing meeting the requirement.

• Data center records in good standing since July 2024 documenting NIST 800- 53 compliance.

• Third party data center NIST 800-53 compliance certification in good standing since July 2024 of performed test of controls documented in security assessment reports showing meeting NIST 800-53 standards.

• Security assessment reports in good standing since July 2024 showing NIST 800-53 compliance being met.

4. Requirement 4.1 states “Each vendor must submit the National Institute of Standards and Technology (NIST) 800-53 certification. Certification must current and in good standing since July 14, 2024.” However, NIST is a performance standard, not a certifying authority and does not issue “NIST Certifications”. Additionally, this requirement does not indicate if the Air Force is requiring compliance with NIST 800- 53 low, moderate, or high baseline controls. Please clarify what specific certification, authorization, assessment, or other documentation the Government will accept as evidence of compliance with this requirement.

The broader use of NIST SP 800-53 compliance across the public and private sectors is dictated by a combination of statutory mandates, executive policies, commercial requirements, and its status as the global blueprint for other security frameworks.

The DoD Mandate: The Department of Defense issued a comprehensive policy memorandum establishing a mandatory, phased adoption of NIST SP 800-53 Revision 5 and CNSSI 1253 Revision 5. All modern Air Force IT architectures and weapon systems must adhere to these newer baselines. The servers and computer systems that the Department of Air Force utilizes to meet mission objectives are considered to be a weapon system.

5. Additionally, please confirm if offerors are required to have evidence that demonstrates compliance prior to July 14, 2024. If yes, can the Government clarify the relevance of this date for NIST 800-53 compliance?

To clarify the relevance of having the NIST 800-53 certification prior to a specific date demonstrates that the vendor currently meets and has the recommended compliance and procedures steps in place and they have a solid track record of history with documented compliance in meeting these requirements over a given period of time.