FA460026Q0012 - Questions and Answers.pdf

QUESTIONS AND ANSWERS DOCUMENT

SOLICITATION PIID: FA460026Q0012

Cybersecurity Support Services for Offutt AFB Defense Red Switch Network (DRSN)

Offutt AFB, Nebraska

REQUIREMENT SPECIFIC

What is the contract that these services are currently being performed under?

Current services are being performed by Leidos Inc (prime contractor) under Department of the Army AMP AETCJOS contract W911NF-24-F-0039. Services are set to end 15 March 2026.

Is this a brand-new contract?

This is a brand-new Department of the Air Force contract for these services that will be specific to Offutt AFB, NE.

Are there current employees onsite executing these services?

There are currently four employees, one of whom is being funded by Air Education and Training Command (AETC). AETC will no longer pay for this billet after 15 Mar 26.

Can the Government clarify the expected daily operational workload for the Cybersecurity Specialist and ISSO roles across DRSN, G ASNT, NAAS Klaxon, and connected NC3 systems?

ISSO: DRSN: 70%, G-ASNT: 10%, Klaxon: 10%, other NC3 systems: 10% Cyber Specialist: DRSN: 60%, G-ASNT: 15%, Klaxon: 15%, other NC3 systems: 10%

Are there any new systems or RMF packages expected to be added during the base or option periods beyond those explicitly listed in the PWS?

No new systems or RMF packages are expected to be added, but the government reserves the right to add RMF packages under the 2.1.3 subsection.

How many active ATO packages are currently under management for Offutt DRSN and associated NC3 systems?

Currently two ATO packages: One for DRSN (located in XACTA), one for G-ASNT (this ATO is in eMASS and is managed by the AFNWC Program Office, our personnel have a list of site controls which were exported by the PMO to address and gather artifacts for but are not expected at this time to have their own eMASS package to maintain. This may change in the future as AFNWC decides how they want sites to provide inputs). There is a 55 SCS desire to develop an ATO package for the NAOC Aircrew Alerting System Klaxon, but at this point the package has not been started.

Will contractors be expected to lead external audits and inspections independently, or primarily support Government led audit teams?

Primarily to support Government-led audits.

Can the Government clarify expectations related to configuration management reviews, including frequency and depth?

As required based on periodic updates to ATO package (at least annually) and/or Security Control Assessor audits of portions of the package that cover system configuration (I believe currently based on the number of controls in the package SCAs are auditing one quarter of the controls annually), ISSO’s will work with maintenance and engineering personnel to review the configuration of the system (current hardware and software) to determine if what is documented is still correct. Additionally, as modifications are made to the system, they should be updating the ATO packages so that the configuration management audits go more smoothly.

Is the Program Manager (48 hours per year) intended for oversight only, or will the PM also perform hands-on technical duties?

The program manager is intended for oversight only, not hands-on technical work.

Are there any on call or after hours support expectations beyond standard weekday hours mentioned in the PWS?

Typically, the Information Assurance contractors’ duty hours are daytime hours.

However, there may be instances where the extenuating circumstances would require other than normal daytime hours, e.g., war, local security incidents, natural disasters, or other instances determined by Commanders. The government is willing to work with the contractor following these occurrences to allow adjustment to days/hours during normal duty to ensure they stay within the funded amount of hours.

Is surge support anticipated during audits, inspections, or ATO renewals, and if so, how should that be priced?

Surge support is not anticipated. Contractor will need to plan and manage the different packages to allow all requirements to be met without additional support.

Must all personnel possess TS with SCI at time of award, or will SCI adjudication after award (within 3 months) be acceptable as stated in the PWS?

TS with SCI must be possessed by all personnel at time of award. Subsection 1.3.3.3 further specifies that the SCI caveat, NC2-ESI, must be obtained within three months of contract award.

Will the Government assist in facilitating SCI indoctrination timelines, or is full readiness expected immediately upon contract start?

TS-SCI clearance is expected upon contract start date, with the exception that NC2-ESI must be obtained within three months of contract award. The government will facilitate NC2-ESI clearance with contractor support.

Is there a current Facility Clearance Level (FCL) requirement specified on the DD254, and if so, what level? Can we opt in after award?

Yes, TS FCL is specified in the DD254. Other security requirements are specified in Blocks 10 and 11, with details in Blocks 13 and 14.

Will travel under CLIN 0004 be reimbursed as actuals (ODC) or should it be built into fixed pricing?

Travel/TDY will be reimbursed on a case-by-case basis as determined by the Contracting Officer Representative or Contracting Officer.

Do not provide pricing for Travel/TDY. Travel/TDY CLINs will be added at the time of award, with each having an annual value. This annual value is the same for all offerors and, therefore, will not be utilized to determine the total evaluated price of an offer.

This CLIN will not be funded unless travel is used and will be actuals (ODC).

Will there be a formal transition period at contract start to ensure continuity of RMF and ATO activities?

Yes, transition period is from 01 Mar 2026 to 15 Mar 2026.

Are there specific RMF milestone timelines the contractor must meet (e.g., ATO renewals, control assessments, package submissions)?

Yes, each package has different milestone timelines that must be met by the contractor.

Are monthly or quarterly status reports expected as part of performance?

Yes, monthly status reports are expected as part of performance.

Monthly Status Reports are referenced in several areas of the PWS as “MSR”.

Can the Government confirm whether the staffing levels identified in the CLIN structure (2 FTE Cybersecurity Specialists, 2 FTE Senior ISSOs, and 48 hours of Program Management annually) are intended to support both steady-state operations and surge activities such as inspections, audits, ATO events, or cybersecurity incidents?

I believe the vendor has misread the PWS. Para 2.1 is for 1 FTE Cybersecurity Specialist (level 2). But yes, the three FTE are expected to support all activities. There are no surge requirements. Contractors are expected to manage their workload distribution to ensure priority is given to ensure preparation and support for events like controls audit (as an example) as needed, but maintaining the flexibility to work steady state items when not working other priorities. The team should manage their workload and coordinate with Unit GOV ISSM on questions in priorities.

Can the Government clarify the division of responsibility between Government and contractor personnel for RMF activities, specifically identifying which roles are advisory or supporting versus Government-authoritative (e.g., ISSM, AO decision authority)?

The government will fill DAO, AO and ISSM roles. These functions have overall risk acceptance authority. The contractor will fill the support and advisory role, as discussed in the PWS (see sections 2.1 and 2.2). The government ISSM will review and ultimately accept or reject work accomplished by the contractor.

Can the Government clarify expectations for program management activities under this contract and confirm whether 48 hours per year is intended to cover all coordination, reporting, stakeholder engagement, and contract administration activities?

The PM is expected to interface with the government ISSM and COR to ensure all tasks are accomplished in adherence to the PWS. The PM will oversee general performance of contract terms, such as ensuring monthly status reports are completed on time, personnel are trained, government training travel arrangements are made, hiring is accomplished, good order and discipline is maintained, security clearance coordination is accomplished, etc.

Can the Government clarify whether cybersecurity tools, RMF repositories, scanning platforms, and configuration management systems are Government-furnished or contractor-provided?

Government-furnished.

Are contractors expected to provide support during cybersecurity incidents or emergent vulnerabilities, including after-hours or surge response? If so, are these activities expected to be covered within existing CLIN hours?

The resident ISSOs and Cybersecurity Specialist are expected to provide cybersecurity support under extenuating circumstances that would require other than normal daytime hours, e.g., war, local security incidents, natural disasters, or other instances determined by Commanders. This is expected under existing CLIN hours. The government is willing to work with the contractor following these occurrences to allow adjustment to days/hours during normal duty to ensure they stay within the funded number of hours.

Are offerors are required to hold a Top Secret Facility Clearance (FCL) at time of award, or whether a contractor with an existing Secret FCL may be eligible for award and subsequently be sponsored for an upgraded TS FCL prior to the start of classified performance?

Repeat.

Is the Program Manager position under this requirement is expected to be performed on-site at Offutt AFB, or whether the Program Manager may provide oversight and coordination remotely?

The PM may provide oversight remotely.

The PWS states destruction facilities at USSTRATCOM are currently unavailable to 55 SCS. Where will classified media/equipment destruction occur, who funds courier costs, and what are the SLA timelines?

Media destruction is performed by 55 SCS IA personnel using NSA-approved media shredders at USSTRATCOM. Other destruction arrangements are still being discussed with USSTRATCOM for equipment.

May the program management functions be performed by off-site personnel or integrated into other labor categories, provided all PWS requirements are met?

Repeat.

Are contractor personnel expected to provide routine on-call or after-hours support beyond normal duty hours, or will such support be limited to exceptional circumstances coordinated by the COR?

Repeat. These would be exceptional one-off circumstances.

For cybersecurity and ISSO labor categories, will the Government consider equivalent professional experience and certifications in lieu of the stated minimum education requirements, consistent with DoD 8140.03 role-based qualification guidance?

Currently 8140 qualification matrix and associated work roles is still in work does not have specific criteria for ISSO’s and Cybersecurity Specialist. The closest match to those responsibilities are 722 – Information Systems Security Manager, 462-Control Systems Security Specialist, and 612-Security Control Assessor. 8140 requirements was added to the PWS in anticipation of these cybersecurity roles being added. DFARS 252.239-7001 addresses contractor requirements but is based on DoD 8570 and hasn’t been updated based on 8570 being rescinded. However, the intent of 8140 is clear, to provide a broader pathway for cybersecurity workforce to achieve foundational qualifications for work roles assigned. It is the government’s opinion that a contractor may have real-world cybersecurity experience but never have attended college. If a contractor identifies a potential employee with an appropriate certification for the type of work being performed and real-world experience in an equivalent work role, that will be considered appropriate in accordance with 8140 intent on a case-by-case basis.

What is the estimated frequency of weekend support, and will it be compensated as additional hours or schedule adjustment?

Weekend support is none to minimal and will not be compensated as additional hours.

Given TS/SCI with NC2-ESI requirements, will the Government consider extending the 30-day vacancy fill timeline to 60-90 days?

No, contractor should maintain a pool of potential candidates who hold TS/SCI or are TS/SCI eligible and be able to place them as needed to address employee turnover. Due to the workload the government does not want to over task and potentially fall behind on required actions by extended periods of vacancy.

Does 24/7 POC availability require on-site presence or is phone/remote contact acceptable after hours?

Phone/remote contact is acceptable after hours.

Is the Program Manager a dedicated FTE or can it be part-time concurrent with other duties?

Program Manager can be part-time concurrent with other contracted company duties.

The intent is for the PM to be contacted on an ad hoc basis as needed. They could cover this workforce as well as numerous other workforces on different contracts (however the company wants to use the individual). The COR would typically provide day-to-day direction directly to the IA team. In the event the COR was having an issue with the IA team (quality, interpersonal issues, etc) they would contact the PM as the company liaison and expect them to address the issue.

Note: Government will address 1.3.3.3 to remove the requirement for the PM to have a TS/SCI and NC2-ESI.

Will the Government sponsor NC2-ESI indoctrination? What is the estimated processing timeline?

Yes, the government will sponsor NC2-ESI. Estimated processing is within 90 days.

Can personnel begin work on collateral tasks while awaiting SCI/NC2-ESI access?

Yes, TS/SCI-cleared personnel can attend formal DSS-2A training, work on security training, and participate in OJT while awaiting NC2-ESI access.

Members will need to be read in to SCI as soon as they begin work. The workspace is a TS/SCI SCIF. They will be able to sit in an alternate duty location while only having a TS and begin working on other required training, but they should be SCI eligible and read in

ASAP.

What FCL level is required for the prime contractor (Secret, Top Secret, or TS/SCI)?

TS/SCI.

Are there SAPs or compartmented programs beyond NC2-ESI requiring access?

No, standard SCI caveats will be addressed during the SCI read-in.

Will the Government provide a draft DD Form 254 with the solicitation?

This is a question for 55 CONS. I did create an unsigned draft for them.

Will the Government provide a funded transition/phase-in period? If so, what duration?

There is an anticipated phase-in period starting upon contract award. This will be included in the base year period of performance and funding.

What is the DSS-2A training course duration and class availability at Ft. Huachuca?

The class runs minimum once a month for a duration of 11 days.

For the Cybersecurity Specialist, Senior ISSOs, and Program Manager roles, which DoDM 8140 work roles does the Government consider applicable?

Repeat

For each in-scope system, is the Government’s workflow system of record XACTA IA Manager, eMASS, or both? Will the Government provide accounts/access at contract kickoff? Are there standard local templates or formats (control test procedures, POA&M structure, evidence naming conventions) that contractors are expected to use?

XACTA training and access will be provided by the government. This is expected to occur during the transition period. eMASS training/access will be provided for the appropriate NC3 systems in the future, as dictated by the respective system. There are standard templates and formats dictated by the Delegated Authorizing Official.

The PWS notes that emergencies or crises may require continuous support beyond normal duty hours. Could the Government clarify what scenarios are considered a “crisis” or “emergency” for this purpose (specific exercises, inspections, incidents), and whether there is an expected maximum duration for continuous operations?

Examples of when continuous support may be required include war, cybersecurity incidents, natural disasters, weather events, or other instances determined by Commanders, the Office of Personnel Management, or the National Command Authority.

There is no expected maximum duration for continuous operation.

To mitigate schedule risk at contract start, we respectfully request confirmation of the following: (1) Whether any contract tasks may be performed prior to completion of SCI/NC2 ESI, given the requirement for TS eligibility at award and SCI/NC2 ESI within three months. (2) The anticipated timelines and processes for Facility Clearance (FCL), Visitor Authorization Requests (VARs), and recurring Entry Authorization List (EAL) updates. (3) What Government-furnished resources will be provided, and whether a contractor property management plan is required for any Government-furnished property.

(1) TS/SCI-cleared personnel can attend formal DSS-2A training, work on security training, and participate in OJT while awaiting NC2-ESI access. They can also create network accounts and begin reviewing ATO package, or control artifacts gathered outside of RMF systems of records and meeting with stakeholders.

(2) FCLs should be established prior to contract start. VARs, PERM Certs, and EALs may be implemented during the transition period.

(3) Government will provide GFE as outlined in Section 3. of the PWS. At this time, there is no requirement for a property management plan.

PWS mentions designation of primary and alternate focal point contacts, available 24/7 including holidays. Is this requirement in addition to the 3 identified FTEs (ISSO and security specialist)? What are the government expectations for "being reachable" and what are the expectations that the contractor FTE should be prepared to support. PWS requires a minimum of an associate’s degree in information technology or cybersecurity. Is there an equivalent experience waiver allowable if the employee does not have the degree but has relevant work experience?

The requirement may include the FTEs and the PM. The government expects that phone calls will be answered, or returned, in a timely manner. Support will vary, but mainly to accommodate visiting government auditors (however, government would push for this to occur during normal business hours). After-hours calls would primarily be in the event of one-off scenarios (times of war, security incidents, natural disasters, or required support as dictated by Commanders, National Command Authority, etc., to provide continuous mission support in extremely rare scenarios and hours would be adjusted on the back end to stay within budgeted hours). Government will consider work experience and certification combination on a case-by-case basis.

PWS requires a minimum of an associate’s degree in information technology or cybersecurity. Is there an equivalent experience waiver allowable if the employee does not have the degree but has relevant work experience?

Repeat.

DRSN training is listed as required for 66% of FTE, can the government elaborate exactly what DRSN training is required and who provides?

DSS-2A training provided by the government.

There seems to be a mismatch between guidance regarding seniority and experience for the 2 FTE ISSO positions. Para 1.3.2.2 lists the experience required for the ISSO at 4 years and an associate’s degree, however the description in para 2.2 lists the ISSOs as "senior" and the tasks associated with the ISSOs appear to be at the senior level. Can the government comment on the possible mismatch between the two paragraphs?

This was erroneously added. Intent is for ISSOs to meet para 1.3.2.2, they would be experienced (having performed ISSO duties previously), but would not be senior per industry standards.

Para 1.3.6 delineates a requirement for a COOP plan to be submitted. With only 3 FTE available for this solicitation, the COOP plan would simply be to utilize existing workforce on an 8-hour shift covering all 24 hours daily until the emergency is discontinued. Can the government comment about what exactly is required to be included in a COOP plan for these FTEs?

As referenced, the COOP would need to state the shift coverage and how cybersecurity support may be accomplished for differing contingency scenarios. It may also include the possibility of utilizing the Program Manager to augment in the case of FTE unavailability. Telework may also be an option, depending on the contingency.

The synopsis lists total yearly hour per FTE at 1880. Can the government comment as to how that total is defined as normal FTE hours minus 2 weeks of leave minus 11 government holidays normally equate to 1912 hours.

1880 was used to account for federal holidays, differences in paid time off (PTO), and sick leave.

The total yearly hours for the GM support is listed at 48 hours per year or a total of 6 full workdays per year. PWS lists the requirement for the PM to be responsible for overall direction and interaction with the COR and CO. Given the small number of hours per year this requirement may be a mismatch in hours. Can the government please comment on their thought process for PM support and the small number of hours associated with that task.

The 48 hours is not intended to be worked consecutively. The intent is for the PM to be contacted on an ad hoc basis as needed. They could cover this workforce as well as numerous other workforces on different contracts (however the company wants to use the individual). The COR would typically provide day-to-day direction directly to the IA team. In the event the COR was having an issue with the IA team (quality, interpersonal issues, etc) they would contact the PM as the company liaison and expect them to address the issue.

Synopsis lists place of performance as 201 Lincoln Hwy Offutt AFB. Is the actual work location for the three FTEs located in Bldg. 500, Bldg. D or another location?

Actual place of work is USSTRATCOM, Bldg 1000 at 901 SAC Blvd, Offutt AFB NE 68113.

What is the DoD Cyber Workforce Framework (DCWF) code and work role for the Cybersecurity Specialist 2 and ISSO?

There is none currently provided. Please see previous response.

Are there SLAs, response time targets, performance thresholds (PWS references quality standards but no explicit metrics)?

Much of the work is driven by the ATO and adherence to Delegated Authorizing Official RMF package requirements. Any items not mitigated for the ATO will be covered under POA&Ms, which will require completion status updates. Government agency audits will determine suspenses for artifacts identified.

Can the Government estimate the annual number of Travel/TDY opportunities?

One to two TDY opportunities annually.

Could the Government please confirm when the initial or refresher DSS-2A Switch training, GASNT operator and maintenance courses, Enterprise Mission Assurance Support Service (eMASS) and XACTA workflow platform training (both updated to support NIST SP 800-53 Rev-5) need to be completed after submission of the Initial Training Plan?

XACTA and eMASS training will ensue locally once NIPRNet and SIPRNet accounts are established, likely during the transition period. DSS-2A O&M switch training will be scheduled with the Joint Interoperability Test Command post contract award.

The PWS requires a COOP to be developed within 180 days and describes contractor responsibilities during declared crises. Can the Government clarify expectations for minimum on-site/remote coverage during emergencies (e.g., minimum staff per shift, specific function continuity requirements)?

Repeat.

The PWS requires the contractor to produce and update SOPs, security artifacts, and accreditation documentation. Will predecessors’ SOPs, templates, or current documentation (including TEMPEST, XACTA controls, etc.) be provided as GFI at project start, or are contractors expected to develop these independently?

Information that has been previously created will be available. Some items (example for Klaxon) have not been created yet and will be on contractor to develop based on other artifact examples, industry examples, etc.

Is this 100% onsite in Offutt NE or is remote work or hybrid allowed?

Contractors are expected to work onsite, however, situational telework is permitted for unclassified tasks. The PM can be remote.

Please confirm whether “CORA” (Cyber Operational Readiness Assessment) support is in scope under this requirement. If yes, what specific CORA activities and deliverables are expected (e.g., evidence collection, briefing support, remediation tracking, report development)?

CORA work is not part of the scope of this contract.

Can the government clarify the expected work schedule - the PWS states "Daytime support Monday-Friday" but also mentions 24/7 POC availability?

Monday – Friday daytime support is the norm. 24/7 availability is specified for extenuating circumstances only.

CONTRACTING SPECIFIC

Will any additional templates be provided for pricing or are we to simply fill out pages 3 and 4 of the RFP (pdf) and only submit pages 3 and 4 as our pricing volume?

Pricing can either be provided on pages 3 and 4 of the solicitation document, or be provided on a separate document (considered a quote and not technical).

For CLIN 0001 (Cybersecurity Specialist 2), is this intended to be one FTE equivalent (1,880 hours) or multiple personnel sharing the hours?

One FTE.

Can the government please clarify if the Price Quotation, Technical Capability, and Fill- In's be submitted as 3 separate documents/volumes?

These are considered three different documents.

For the fill-in clauses, are we able to include a section in the Table of Contents that address the fill-in clauses? Also would there be a particular format that you want us to follow when answering the fill-in clauses.

Government has no format required; it can also be marked in the solicitation document.

Addendum to 52.212-1 Instructions to Offerors does not include requirements for font. Will the Government please confirm Offerors should use no less than 10 pt Times New Roman for Text and 9 pt Times New Roman for tables and figures?

There is no requirement for font. The only requirement is that the technical proposal shall not exceed the page limitation specified.

Does the cover page count towards the page limit of the Technical Capability?

No, cover pages and tables of content do not apply to the page limitation of the technical approach.

For the fill-in clauses, are we able to include a section in the Table of Contents that address the fill-in clauses? Also would there be a particular format that you want us to follow when answering the fill-in clauses.

Government has no format required; it can also be marked in the solicitation document.

Which WD labor categories the Government intends offerors to use for the Cybersecurity Specialist and Senior ISSO positions (and whether the Program Manager position is considered exempt from SCA coverage).

The wage determination does not apply as applicable labor categories have been determined to be employed in a bona fide executive, administrative, or professional capacity. FAR 52.212-5 has been updated accordingly.

Does the Government require a fixed number of full-time equivalents (FTEs) for each CLIN, or may offerors propose staffing levels based on their technical approach to meeting all PWS requirements and performance outcomes?

They are fixed FTEs: CLIN X001: 1 FTE; CLIN X002: 2 FTEs

The solicitation reflects multiple option periods extending up to FY2031. Can the Government confirm: (1) Total anticipated contract length; (2) Whether all option periods are planned or subject to funding only.

(1) The anticipated period of performance is 1 March 2026 to 30 August 2031. If it is in the best interest of the Government, the contract has the opportunity to expire after the completion of each option period.

(2) Options will either be fully funded or incrementally funded based on the availability of funds at the time

Can the Government confirm whether technical acceptability will consider experience supporting classified, NC3, or mission-critical environments, or if technical acceptability is limited to basic compliance with the PWS?

Technical proposals/approaches will be evaluated against the Performance Work Statement to determine technical acceptability.

Since CLINs are Firm Fixed Price but expressed in hours, should offerors propose a total annual lump sum per CLIN or an hourly rate multiplied by listed hours?

Hourly rate multiplied by listed hours.

Are there any anticipated labor escalation expectations across the multiple option years, or should pricing remain flat?

Contractor will be able to request upward adjustments to wages if they fall below the rates specified as new revisions of the SCA Wage determination are published.

Are there any historical price ranges or IGCE considerations the Government can share for reasonableness context?

The government cannot share details of the IGCE.

Can the Government confirm whether the Service Contract Act wage determination applies to these cybersecurity labor categories, or if they are considered exempt computer professionals?

The SCA does apply to this contract.

Under the LPTA process, will the Government strictly evaluate only the three lowest priced offers first?

Correct. In the event the three lowest priced offers do not yield three technically acceptable ratings, the next lowest priced offer will be evaluated. This process will continue until the government has three technically acceptable offers or until all quotes are exhausted.

If the lowest priced offer is found technically unacceptable, will the Government move sequentially to the next lowest priced offer?

Correct.

Are past performance references required?

Past performance references are encouraged but are not an evaluation factor.

Will the Government provide a Quality Assurance Surveillance Plan (QASP) with measurable performance thresholds prior to award?

The QASP is only specific to the Government side. Measurable performance thresholds can be found in the PWS, 1.4 Services Summary

For CLIN 0002, does “Two (2) FTE ISSOs” mean two full time individuals each working 1,880 hours, totaling 3,760 hours annually?

Correct. Two ISSOs working 1,880 hours each for a CLIN total of 3,760.