C2SES_III_Draft_RFP_Q A_I.pdf

C2SES III Draft RFP Questions & Answers 1 November 2016

Page | 1

C2SES III

FA4600-16-R-0007

Draft RFP Question and Answer (Q&A)

This Question and Answer (Q&A) does not supplement or take place of the Request for Proposal (RFP). Answers to questions, RFP clarifications, requirements, and other pertinent documents are subject to change without written notice to potential offerors. Please refer to the final RFP (when posted) for all C2SES III requirements.

Q1: Table L2.0 and Paragraph L3.2. Would the Government consider allowing offerors to treat the Executive Summary as a separate volume versus being part of Volume I? Given that the Executive Summary is to include a Master Table of Contents that addresses the entire proposal, treating this as a separate volume may make handling this material easier for Government evaluators.

A1: Yes – the government will add the Executive Summary to be part of Volume IV.

Q2: PWS Paragraph 1.1.1 Application Security and IA. Is there a list of specific code development training that is acceptable and satisfies requirements under 1.1.1a (e.g. Company specific training, CERTs Secure Coding, ISC2 CSSLP, GIAC GSSP, ECSP Java, etc.)? Is a certificate in secure code development a requirement?

A2: Any one of these CERTs would be acceptable. One is not more preferred over the other.

The government does not want to limit the vendor to one specific methodology.

Q3: PWS Paragraph 4.6.2, 4.6.4. The PWS calls out system administration of the NPES software support and test environment and the FSAM software support environment. Does the government anticipate requiring system administration for the DSS-C (FSR, GADSS, Low-to- High) software support environment?

A3: Yes – the government does anticipate system administration for DSS-C and will modify the

PWS.

Q4: PWS Paragraph 4.6.5(e). The PWS states the Contractor shall coordinate with Command Data Administrators to ensure FSAM data model conforms to Enterprise Data Model standards. Will the Government provide the Enterprise Data Model standards in the Bidder’s Library?

A4: Yes – the Government will update the Bidder’s library to include the EDM standards, but not the model itself.

Q5: CPIF Plan. In relation to this objective, how would the following scenarios be handled after a release is planned?

Scenario 1: A high priority change is requested by the Government and must be implemented due to a mission requirement AS1: Like the reviewer noted below, “These issues are very common with complex legacy systems and would necessitate a negotiation to reset the approved release content.” A specific

C2SES III Industry Day Questions & Answers 8 June 2016

Page | 2 answer cannot be given to this question, at this time. These will be handled on a case by case basis.

Scenario 2: One of the approved SCRs cannot be implemented due to an external dependency AS2: Contractor should notify Gov’t ASAP when any type of external dependency is causing risk to performance. Depending on timing, resources expended (hours and $) Government and contractor would need to revise the content agreement possibly eliminating the SCR from the content or replacing it with another task.

Scenario 3: All tasks are completed, there are additional backlog tasks that could be completed AS3: Reasonable to assume contractor would work on additional tasks up until the point where they still underrun enough to obtain their max fee. The backlog list is reviewed monthly during ITPs.

Scenario 4: One of the tasks approved will require a larger number of hours than estimated due to underlying complexities that are discovered while coding AS4: This will have to be brought to the attention of the COR. This is a cost contract which is based on actuals, however the contractor is expected to remain within proposed costs. See PO #1—the contractor would likely not get a 100% completion rate for the delivery.

Q6: These issues are very common with complex legacy systems and would necessitate a negotiation to reset the approved release content. If the release content changes, how would the score be affected? For example, the new high priority task causes 4 other tasks to be removed from the list due to the effort required. Is there any weight given to large tasks or would doing the new task (and removing several others) cause the score to drop?

A6: See PO #1—by default swapping 1 large SCR for 4 smaller SCR’s makes the completion of the large SCR more weighted (the denominator in the completion rate formula would shrink making the failure to complete an SCR more negatively impactful on the contractor).

Q7: If the contractor has no control over the external dependency, does the incomplete task still count against them?

A7: No, the Government would need to be reasonable in their negotiation of the impact to the SCR content list in this case.

Q8: Is there “extra credit” for doing additional work or could that be counted in the next release as already completed?

A8: There is no extra credit – hopefully the contractor is incentivized to develop accurate estimates and find innovative ways to complete the work as quickly as possible, which would reflect positively in CPARS.

Q9: Cost Model. The current version indicates a “circular reference” will a revised version provided?

A9: The government is reviewing the cost model to fix the circular references.