Attachment 8. Questions and Answer Final 01.pdf

Item # DATE SUBMITTED QUESTION from Offeror GOVERNMENT RESPONSE

1 4/22/2026

We would appreciate clarification regarding the document safeguarding requirement under this solicitation.

If performance under this contract will occur in Government-provided space and contractor personnel will not be authorized to perform remote work, will the Government consider removing or modifying the contractor document safeguarding requirement, since classified information and materials would remain under Government control within Government facilities?

The effort is accomplished in a government facility however, this does not remove the responsibility of all individuals safeguarding documentation from CUI to classified. Please see RDFAR 252.204-7025 and Clause 252.204-7021.

2 4/22/2026 In reference to the DC3 SETA opportunity, can the Govt please clarify the number of required key personnel resumes to be included with the submission. We are not clear based on the language included in the Section L instructions and SOW Appendix A.

Only one key personnel resume is required as only one key personnel is required for the base and options years.

As a reminder the base year will consist of 8 FTE's and 5 FTE's for the option years.

3 4/27/2026 Could the Government clarify the SOW numbers? The instructions refer to sections 2.5.1 through 2.5.1.10 and 2.6.1, but no such references exist in the SOW. Sow had been amended to correct this issue

6 4/27/2026 What is the expected transition timeline? There is no transition in 7 4/27/2026 What is the expected format, frequency, and classification level of Deliverable 3.7? Offeror will submit report as required and in the same format as the other reports

8 4/27/2026 What is the maturity (if any) of DC3’s current DevOps structure? Is the Government open to DevSecOps? This question is too broad. DevOps and DevSecOps is an accepted government/DoD development process.

9 4/27/2026

Per the Attachment 3 - Section L requirements within the Section 2.1 Table, the key personnel and security clearances response is limited to four (4) pages; however in Section L.4 Gate 2: Key Personnel and Security Clearance: Key Personnel for the Base Year - seven (7) FTEs; for OY1, OY2, and RFO 52.217-8 - five (5) FTEs: (Labor Categories:

Senior Cybersecurity Engineer(s) (one (1) minimum) and Mid-level Cyber Security Engineers. Question: Please clarify if the Government is expected to receive a total of seven (7) Key Personnel resumes, or are you asking for one (1) Senior Cybersecurity Engineer resume and one (1) Mid-level Cybersecurity Engineer resume?

Documents have been updated

10 4/27/2026

IAW Attachment 3 - Section L.3 Volume I, Administrative Submission, in Section 3.2 – Completed DD Form 254 (Department of Defense Contract Security Classification states that the Contractor is required to minimally hold an active facility clearance level of TOP SECRET with safeguarding at SECRET. Question: Please confirm if the SECRET safeguarding requirement is only for the Prime (with privity of contract) or all teaming members/subcontractors under the Prime?

The DD 254 will flow down to the subcontractors as well.

11 4/27/2026 1. Section M references SOW paragraphs 2.5.1-2.5.10 and 2.6.1 of the SOW. The relevant SOW paras are 2.4.1.1 -

2.4.1.10 and 2.5.1; request clarification from the government. Sow had been amended to correct this issue

12 4/27/2026 2. Does the government intend to down select or use the Past Performance submission on 5/8 as a second gate criteria?

If so, recommend clarifying in Section M. Yes

13 4/27/2026 3. PPQ states, “Given what I know today about the contractor’s ability to execute what he promised in his proposal,” recommend the government clarify the question being asked here. Document has been revised

14 4/27/2026 4. Will the government accept CISSP at the time of award for the KP(s)? No, the awardee KP cannot be working towards CISSP.

16 4/28/2026 Could the government kindly share information on whether there are any pain points or challenges with this contract that we should be aware of while proposing a solution? No paint points.

18 4/28/2026 Is there any specific methodology / tools DAF that we should be aware of while proposing a solution? Offerors should be aware of different methods / tools to be able to make suggestions as a SETA.

19 4/28/2026 What key performance indicators (KPIs) will define success for this contract?

a. Workforce Stability: Per SOW Section 5.9, maintaining an employee turnover rate of 10% or less and ensuring no position remains vacant for more than fifteen (15) business days.

b. Deliverable Timeliness: Adherence to the delivery schedule outlined in SOW Section III, such as the submission of Monthly Status Reports by the 7th of each month and Incident Reports within one hour of an event.

c. Financial Management: In the Monthly Status Report (Deliverable 3.2), maintaining cost variances within 5% of planned costs.

d. Technical & Analytical Quality: The quality, accuracy, and actionability of analysis provided in Specialized Reports (Deliverable 3.7) and other technical deliverables as assessed by the COR."

20 4/28/2026 Could the government kindly extend the proposal due date by one week? No this delays the contract timeline milestones.

22 4/28/2026 Does the Government consider only the Senior Cybersecurity Engineer (minimum one) as Key Personnel, or are all proposed Mid-level Cybersecurity Engineers also designated as Key Personnel for evaluation purposes? Documents have been updated

23 4/28/2026 Is SCI eligibility required at submission, or only upon contract performance? At submission.

24 4/28/2026 Are Key Personnel required to be 100% on-site, or is a hybrid/remote model acceptable? Personnel should be available 100%; any changes should be discussed and coordinated after fully understanding level of effort needed.

25 4/28/2026 Can we submit our CPRAS reports/Recommendation letters/previous evaluations in lieu of Attachment 5: Past Performance Questionnaire?

No, need standardization in document expectations - no differences in submission from one contractor to another. A questionnaire is not required if the identified contracts have an annual rating in CPARS. Offerors must clearly annotate in Solicitation Attachment 5 – Past Performance Questionnaire that a CPARS rating exists, Solicitation #: FA701426R0001

Solicitation RFP List Project: DC3 SETA Follow on Systems Engineering and Technical Assistance (SETA) Professional Support Services

SUBMITTED QUESTION from Offeror GOVERNMENT RESPONSE

26 4/28/2026 How many current DC3 users and user roles will the contractor support (by role: analysts, engineers, managers, etc.)?

The contractor will provide support across the DC3 enterprise, which consists of approximately 400+ personnel spanning multiple directorates. The nature of this SETA contract is to provide a flexible technical and engineering capability to augment various Government-led teams as mission priorities dictate. The specific number of users or roles supported at any given time will be dynamic and prioritized by the COR, who will manage and deconflict all contractor tasking.

27 4/28/2026 Are there expected changes in user counts or new user groups during the Period of Performance? SETA will not have an expected change in primary stakeholders - "users" are systems related and SETA are not developing/creating for users.

28 4/28/2026 What percentage of supported users are expected to be onsite at DC3 versus permanently remote? What system is the question focused on for specific users?

29 4/28/2026 Please provide a current list of security, monitoring, and enterprise tools in use (SIEM, EDR, SOAR, vulnerability scanners, ticketing, identity management, backup, etc.). Government will not be providing a complete list of security, monitoring, and enterprise tools.

30 4/28/2026 For each tool listed, provide vendor and version

This information can be provided to awardee after award. The government understands offerors may desire this information to gain insight if they hold acceptable levels of understanding of the tools, and where they could provide recommendations immediately for improvement. Unfortunately this also provides too much internal information for manipulation by others.

31 4/28/2026 Which tools are integrated today (data flows, APIs, log forwarding) and which integrations are planned or required? Too broad of a question

32 4/28/2026 Can you share current operational and system views or architecture diagrams referenced in the SOW?

Due to OPSEC, detailed operational and system architecture diagrams will not be provided during the solicitation phase. All necessary technical documentation, diagrams, and Government Furnished Information (GFI) required for performance will be provided to the successful offeror during the Kickoff Meeting and subsequent in-processing, as referenced in SOW Sections 4.0 and 5.3

33 4/28/2026 Do you require continuous monitoring (24x7) for any systems, or is monitoring limited to business hours/core duty hours? There is no continuous monitoring required by this contract.

34 4/28/2026 Is the contractor expected to perform incident detection, triage, and response, or only provide engineering/analysis support for incidents? Engineering analysis and support.

35 4/28/2026 For recurring incidents, is the contractor expected to lead Root Cause Analysis (RCA) and implement corrective actions? Contractor is expected to participate in RCA and corrective actions. If ther are opportunities for the contractor to lead efforts, that will be discussed at that time with their government representative.

36 4/28/2026 Will the Government provide tool licenses (GFE/GFI) or is the contractor expected to procure licenses? Government will provide

37 4/28/2026 After installation, what level of support is required from the contractor (L1 helpdesk, L2 engineering, L3 vendor escalation, patching, upgrades)? SETA does not have product installation responsibilities.

38 4/28/2026 Are there approved maintenance windows and change management procedures the contractor must follow? No 39 4/28/2026 Clarify whether the contractor’s role is monitoring only, incident handling, or both. Yes the contractor monitors potential risks and incidents in different context.

40 4/28/2026 What are the expected SLAs for incident detection, initial response, containment, and remediation? This information can be provided to awardee after award. The government understands offerors may desire this information to gain insight if they hold acceptable levels of understanding

44 4/28/2026 Please provide a list of all assets (servers, endpoints, network devices, cloud tenants, virtual machines, storage systems) that the contractor will be responsible for supporting. SETA provides engineering support throughout DC3; listing all assets is too broad for immediate release.

45 4/28/2026 For each asset, indicate whether it stores or processes CUI, LES, PAI, or classified data. No response

46 4/28/2026 Confirm the preferred formats for deliverables (WAR, Monthly Status Report, Specialized Reports, Trip Reports, Final Report). PDF

47 4/28/2026 For the monthly Status Report financial snapshot, confirm the cost categories the Government expects (labor, tools, travel) and any required chart types.

Confirmed. As stated in the description for Deliverable 3.2, the financial snapshot shall, at a minimum, break down costs by labor, tools, and travel. It must also include graphics showing actual versus planned costs and a written explanation for any variance exceeding 5%.

48 4/28/2026 Confirm the preferred date/time and attendee list for the Kickoff Meeting and the recurring monthly meeting cadence.

Per SOW Section 5.3, the date, time, and specific attendee list for the Kickoff Meeting will be mutually agreed upon by the contractor and the COR post-award. The meeting will be scheduled to occur no later than five (5) calendar days after contract award.

49 4/28/2026 For proposed personnel, what is the expected timeline for clearance adjudication and SCI eligibility validation? KP should already be in possession of clearance and be SCI eligible

50 4/28/2026 The SOW requires CMMC Level 2; please confirm whether the Government will share the C3PAO assessment artifacts or if the contractor must provide proof of certification for subcontractors. Please provide proof of certification for subcontractors.

51 4/28/2026 The SOW states the GFE/GFI list is not finalized; please provide the anticipated GFE/GFI items and the timeline for finalization.

The Government will provide all necessary equipment and information for contract performance, as stated in SOW Section 4.0. While the final GFE/GFI list is not yet available, anticipated items include standard IT equipment such as laptops and access to required Government software and networks. A finalized list will be provided at the Kickoff Meeting.

52 4/28/2026

Section L instructs offerors to “thoroughly detail the approach to providing DC3 support, specifically addressing Sections 2.5.1 through 2.5.1.10 and Section 2.6.1 of the SOW.” However, upon review of Attachment 1 – SOW, these section numbers do not appear to be present or are not clearly identified.

Can the Government please clarify:

Sow has been amended to correct this issue

SUBMITTED QUESTION from Offeror GOVERNMENT RESPONSE

54 4/28/2026 Given that the scope of work emphasizes systems engineering, cybersecurity, and technical analysis support services, will the Government consider revising the NAICS code from 541511 to 541512 to better align with the predominantly technical nature of the requirements outlined in the SOW?

541611 is the NAICS code for this requirement as stated on the solicitation block 10.

55 4/28/2026 Can the Government please clarify that the Volume IV Factor II Past Performance must be submitted 8 May 2026 10 am EST. Can the Government also clarify if it is the PPQs that must be submitted at this date/time or the 13-pg narrative or both? Yes attachment 5 and the 13 page narrative must both be submitted by May 8th @ 10AM.

56 4/28/2026 Can the Government please clarify what content is anticipated in the 'Narrative of Offeror' 2 page allocation within the Volume I Administrative Submission? Please reference L.3 Administrative submission

57 4/28/2026 Will the Government accept CMMC Level 2 self-assessment documentation as per our record within the Supplier Performance Risk System (SPRS) as proof for this gate requirement? Documents have been revised

58 4/28/2026 In lieu of an official CMMC Level 2 certificate at the time of proposal submission, will the Government accept a self-assessment or documented evidence demonstrating compliance with CMMC Level 2 requirements Documents have been revised

59 4/28/2026 If the Government does not accept a CMMC self-assessment, would the Government consider proof of a scheduled third-party assessment (e.g., confirmation of an upcoming C3PAO assessment date) as acceptable for proposal submission, given current industry-wide delays and backlog in obtaining certification?

Documents have been revised

60 4/28/2026 Regarding the requirement to address how proposed Key Personnel meet the specified qualifications (1 page), does the Government intend for this to be a single consolidated page covering all Key Personnel, or one page per individual Key Personnel One key personnel for this effort.

61 4/28/2026 Can the Government please clarify the section references in this sentence "Thoroughly detail offeror’s approach to providing DC3 Support, specifically addressing sections 2.5.1 through 2.5.1.10 and section 2.6.1 of the SOW". We believe it to be 2.4.1 thorugh

2.4.1.10 and section 2.5.1?

Sow has been amended to correct this issue

62 4/28/2026 Can the Government please clarify if the 13 pages allocated for this factor encompass a narrative that the Offeror can author in responding to items a - d listed in 5.5. The narrative is included in that 13 pages

63 4/28/2026 Can the Government please validate that the PPQs do not count in page count and are directly emailed to the Government, not included in our submission.

Yes it will be directly emailed to the government. The offeror will submit the past performance on May 8th before submitting volumes I, II, III and V.

64 4/28/2026

Can the Government please clarify if the Minimum Requirements in the KP Table apply to each Key Personnel for the Base Year, i.e the Senior Cybersecurity Engineer (1 FTE) and the Mid-Level Cyber Security Engineers. The description provided lends itself as the minimum requirement for the Senior Cyber Engineer. Would there be another row of the table provided for the minimum requirements for the Mid-Level resources?

There is only one key personnel and it is the senior cyber security engineer.

65 4/28/2026 Can the Government please clarify the number of resources in the Base Year. Appendix A lists seven (7) FTEs (Sr. Cyber Engineer and Mid-Level Engineers) while Section 2.4 Labor Categories lists 7 Technical Resources (Sr. Cyber Engineer and Mid-Level Cyber Engineers) and 1 Senior Portfolio Manager.

Documents have been updated

66 4/28/2026 Will the Government consider prime contract past performance efforts of less than twelve (12) months in duration as meeting the recency requirement, provided the work performed is relevant in scope, complexity, and magnitude to the requirements? Yes

67 4/28/2026 Regarding the requirement for documented evidence of successful performance as a prime contractor on at least one DoD contract within the past five (5) years, will the Government consider performance as a prime on a Small Business Innovation Research (SBIR) Phase I or Phase II effort as meeting this criterion?

Relevant past performance is defined as efforts performed in the past five (5) years that directly relate to the functional areas and key tasks(s) of the Statement of Work (SOW) which are similar to the size, scope, and complexity for this effort. Please reference section L.6.

68 4/28/2026 In evaluating past performance, will the Government consider relevant experience from proposed subcontractors/teaming partners, including permitting submission of at least one project performed by a subcontractor to demonstrate the team’s collective capability? Yes

69 4/28/2026

Can the Government clarify where the Offeror should explain the approach to recruiting, selecting, onboarding and retaining personnel? It is noted in Attachment 4 2.2.3 to be included as part of the Staffing Approach but in Attachment 3 4.1.2 it notes providing a plan to staff, recruit, retain anad replace personnel. With the limited page count in each section, clarification would assist in allocating the pages appropriately.

please provide in the staffing approach

71 4/28/2026

Do all minimum technical experience requirements outlined in Appendix A apply uniformly to all Key Personnel positions, or are specific requirements intended to align with each labor category (e.g., Senior Portfolio Manager, Senior Cybersecurity Engineer, Mid- Level Cybersecurity Engineer)? For example, requirements such as managing teams of 10 or more personnel or managing contracts of $10M or more appear more applicable to a Portfolio Manager role than to Mid-Level Cybersecurity Engineers. Can the Government clarify or delineate which requirements apply to each specific position?

Documents have been updated

73 4/28/2026

The solicitation requires a CMMC Level 2 certification at time of proposal submission. Given that C3PAO-led CMMC Level 2 certification assessments are not broadly achievable until approximately November 2026, and are not currently mandated across all contracts, can the Government clarify whether a finalized certification is required at submission, or if offerors with a completed assessment, approved POA&M, and a defined path to certification will be considered acceptable?

Documents have been updated

74 4/28/2026 The base year requires seven FTEs while option years require five FTEs. Can the Government clarify whether this reduction reflects a change in mission scope or if staffing flexibility is expected to meet evolving requirements? Internal staffing requirements based on business need.

75 4/28/2026 Can the Government clarify how it will evaluate the relevance of prior DC3-specific experience versus broader DoD cybersecurity, systems engineering, and mission support experience? Direct involvement or relatability in similar environments to DC3 provides added value to evaluation relevance.

SUBMITTED QUESTION from Offeror GOVERNMENT RESPONSE

76 4/28/2026 Can the Government clarify the expected on-site versus remote work requirements, and whether hybrid support models will be considered acceptable?

Expectations should be 100% on-site, however if opportunities change for place of work, these discussions will be had with the government rep.

77 4/28/2026 The CLIN structure appears to include both firm-fixed-price and labor-based elements. Can the Government clarify the intended contract type for labor (FFP vs. LH) and how offerors should structure pricing for the level of effort? Documents have been revised

78 4/28/2026 Can the Government provide additional guidance on anticipated travel requirements and whether ceilings will be established under ODC CLINs?

Travel is very limited, likely more local to the Maryland DC area however a budget is being created for additional potential needs.

79 4/28/2026 Will CPARS evaluations be the primary source of assessment, or will narrative descriptions be equally weighted? Both will be considered.

80 4/28/2026 Will the Government provide access to required cybersecurity tools and platforms, or are contractors expected to furnish their own toolsets? government provided

81 4/28/2026 Can the Government clarify whether an award will be made strictly on a tradeoff basis, prioritizing technical merit, or if any lowest-price technically acceptable considerations apply?

Please refer to Section M Attachment 4. The Government shall evaluate the proposals based on pass/fail of the Gate and where Factor I Technical and (Subfactor 1-Technical Approach, Subfactor 2- Management Approach, and Subfactor 3 Project Staffing Approach) are more important than Factor II Past Performance. Factor I Technical when combined with Factor II Past Performance, are significantly more important than Factor III Cost/Price.

82 4/28/2026

Section L 2.1 states the proposal shall be accompanied by a cover letter on company letterhead transmitting the proposal.

Given that Volume IV – Past Performance is due on 8 May 2026 and the remaining volumes are due on 21 May 2026, could the Government please confirm whether a cover letter is required for both submissions (Past Performance on 8 May and full proposal on 21 May), or only for the full proposal submission on 21 May?

It is only for the full proposal submission

83 4/28/2026 The Volume I structure lists a '2 page Narrative of Offeror' but does not specify the required content for this narrative.

Could the Government please clarify what specific information should be included in the 2-page Narrative of Offeror (e.g., company background, NAICS alignment, capability overview, organizational description, or other content)?

Please reference L.3 Administrative submission

84 4/28/2026

Sections L and M consistently reference SOW Sections 2.5.1 through 2.5.1.10 and Section 2.6.1 as the basis for the Technical Approach evaluation. However, the attached SOW (Attachment 1) labels the corresponding labor category duties as Sections 2.4.1 through 2.4.1.10, and no Section 2.5.1, 2.6.1, or 2.6 exists in the SOW as issued. Could the Government please confirm that the correct SOW sections to address in the Technical Approach (Volume III, Factor I) are 2.4.1 through 2.4.1.10? Additionally, could the Government please clarify whether Section 2.6.1 referenced in Section L 4.1.1.1 corresponds to the Senior Portfolio Manager duties (SOW 2.5), and whether there is a separate Section M evaluation criterion associated with those requirements?

Sow has been amended to correct this issue

85 4/28/2026

Section L L.4 instructs offerors to email Key Personnel clearance verification information to BTO.SECURITY.OFFICE@us.af.mil and then send an email confirmation to the CO and CS. Could the Government please confirm (a) whether this clearance verification email must be sent prior to or concurrent with the proposal due date of 21 May 2026, and (b) whether the confirmation email to the CO/CS constitutes sufficient documentation of Gate 2 compliance within the proposal package itself, or whether a separate written confirmation document must be included in Volume II?

It can be submited prior to proposal submittal.

86 4/28/2026

Section L 5.6 states that a Past Performance Questionnaire (PPQ) is not required for contracts with an existing CPARS annual rating, and that offerors need only annotate on Solicitation Attachment 5 that a CPARS rating exists. However, if CPARS ratings exist and a PPQ is not required, there is no practical basis for completing and submitting Attachment 5 solely to annotate that the form itself is not needed. Could the Government please confirm whether offerors submitting CPARS ratings in lieu of PPQs may instead annotate the existence of CPARS ratings directly within the Past Performance narrative in Volume IV, rather than completing and submitting Attachment 5? If Attachment 5 must still be submitted in some form, please clarify the minimum required content (e.g., Section 1 contract identification only) so that offerors can comply without completing fields that are only applicable to questionnaire-based submissions.

A questionnaire is not required if the identified contracts have an annual rating in CPARS. Offerors must clearly annotate in Solicitation Attachment 5 – Past Performance Questionnaire that a CPARS rating exists. Please reference section 5.6 of section L.

87 4/28/2026

Section L, paragraph 4.1.1.1, instructs offerors to address "sections 2.5.1 through 2.5.1.10 and section 2.6.1 of the SOW." Section M evaluation criteria (paragraphs 2.2.1 through 2.2.1.8) similarly reference SOW sections 2.5.1.x.

However, the SOW numbers the ten primary task descriptions under Section 2.4.1 (2.4.1.1 through 2.4.1.10). SOW Section 2.5 addresses the Senior Portfolio Manager labor category, and Section 2.5.1 describes portfolio management services. Will the Government issue an amendment correcting the SOW section references in Section L and Section M to reflect the correct task numbering (2.4.1.1 through 2.4.1.10)?

SOW has been amended to correct this issue

88 4/28/2026

Section L states the Government anticipates awarding "Firm Fixed Price (FFP) for Labor CLINs & Time and Material (T&M) for Other Direct Costs." The CLIN schedule designates all labor CLINs as "Firm Fixed Price." However, Section M, paragraph M.1, states the contract will be "a single Labor Hour (LH) & T&M (ODCs) Tools and Travel contract."

Additionally, the solicitation incorporates FAR 52.212-4 Alternate I, which applies to time-and-materials or labor-hour contracts. Please confirm whether the labor CLINs will be awarded as Firm Fixed Price or Labor Hour, and whether the Government will issue an amendment to resolve this conflict.

Documents have been revised

SUBMITTED QUESTION from Offeror GOVERNMENT RESPONSE

89 4/28/2026

The SOW, Section L, and Section M repeatedly define "Key Personnel" as "seven (7) FTEs" in the base year and "five

(5) FTEs" in option years, encompassing Senior Cybersecurity Engineers and Mid-level Cybersecurity Engineers.

However, SOW Appendix A states: "One Key Personnel is required from the team composition, NOT in addition to. The site lead and Key Personnel will be one in the same." Please clarify whether all proposed FTEs are considered Key Personnel requiring individual resumes, qualification narratives, and clearance verification for Gate 2 compliance, or whether there is one designated Key Person (the site lead), with the remaining FTEs being non-Key Personnel.

Documents have been revised

90 4/28/2026

If the answer to Question 3 indicates that only one individual is designated Key Personnel, does Gate 2 still require resumes for all proposed FTEs (Senior Cybersecurity Engineers and Mid-level Cybersecurity Engineers), or only for the designated Key Person? Section M, Gate 2, appears to require resumes for all proposed engineers regardless of Key Personnel status.

Documents have been revised

91 4/28/2026

The solicitation uses multiple clearance standards. SOW Section 2.1 requires "a fully adjudicated Top-Secret clearance" and states personnel "must be able to obtain and maintain SCI eligibility." Section L, Gate 2, requires "a current and active Top Secret (TS) security clearance." SOW Appendix A states personnel "Must possess a Top Secret/SCI clearance." Please clarify: at the time of proposal submission, must all proposed personnel hold a TS/SCI clearance, or is a fully adjudicated TS clearance with SCI eligibility sufficient for Gate 2 compliance?

Docuemnts have been revised

92 4/28/2026

The SOW staffing table in Section 2.5 shows the Senior Portfolio Manager at 1 FTE in the base year and 0 FTEs in option years. The CLIN schedule includes CLIN 0003 for the Senior Portfolio Manager (base year only) with no corresponding option year CLINs. Section 2.2 and Appendix A define Key Personnel as "seven (7) FTEs" for the base year, limited to Senior and Mid-level Cybersecurity Engineer labor categories. Please confirm: (a) Is the Senior Portfolio Manager included within the 7 base-year FTEs, or is the Senior Portfolio Manager a separate position (totaling 8 FTEs in the base year)? (b) Is the Senior Portfolio Manager considered Key Personnel? (c) Should offerors confirm that the Senior Portfolio Manager is excluded from option year pricing?

the senior portfolio manager will only be for the base year / documents have been updated for key personnel

93 4/28/2026

Gate 1 requires offerors to submit "proof of CMMC certification level 2 (the official certificate)" with the proposal and treats the absence of this certificate as a pass/fail disqualifier. DFARS 252.204-7021 and 252.204-7025, as completed by the Contracting Officer, state the CMMC Level 2 requirement applies "by Nov 2026." Contract performance does not begin until September 2026. Must offerors possess a Final CMMC Level 2 (C3PAO) certificate at the time of proposal submission (May 21, 2026), or is a Conditional Level 2 status acceptable at proposal submission with Final certification required by November 2026?

Docuemnts have been revised

94 4/28/2026

Section M, paragraph 2.2.5.5, states: "Offerors shall not submit a price for the potential six (6) month extension of services period because the Government will use the price of the final option year to calculate the price of the six (6) month extension." However, the CLIN schedule includes CLINs 3001 and 3002 for the RFO 52.217-8 extension period (6 months, FFP). Should offerors leave CLINs 3001 and 3002 unpriced, or should offerors price these CLINs? If pricing is required, should it equal one-half of the corresponding OY2 CLIN amounts?

Docuemnts have been revised

95 4/28/2026

The solicitation body, page 5, under "Description/Specifications/Statement of Work," contains dates that conflict with the dates on page 2 and in Section L. Specifically, page 5 states questions are due 31 March 2026, Past Performance is due 7 April 2026, and proposals are due 24 April 2026. Will the Government issue an amendment removing the obsolete dates from page 5?

Revised

96 4/28/2026

SOW Section 5.1.2 acknowledges that "Contractor employees who are permanently remote will establish standard operating practices." However, the solicitation does not specify which roles may be performed remotely versus on-site at the Linthicum Heights, MD facility. For pricing and staffing purposes, can the Government indicate (a) the expected on-site versus remote posture, and (b) whether a hybrid work model is acceptable for certain positions?

No permanently remote employees

97 4/28/2026 Section M, paragraph 2.1, under the second step of the evaluation process, states regarding Gate 2: "Offerors must receive a pass rating to be considered technically acceptable for Gate 1." This appears to be a typographical error, as the surrounding context describes the Gate 2 evaluation. Can the Government confirm this should read "Gate 2"?

Documents have been revised

98 4/28/2026 Section L, paragraph 6.1, states cost/price content must be confined to "the Cost/Price Volume IV." The Volume Organization table in Section L 2.1 designates Cost/Price as Volume V. Please confirm the correct volume designation for the Cost/Price submission.

Correct it should be Vol V this issue is fixed

99 4/28/2026

The solicitation includes NTE CLINs for ODC Tools and ODC Travel but does not provide a Government estimate, ceiling amount, or historical baseline for either category. SOW Section 5.8 references both CONUS and OCONUS travel. Can the Government provide guidance on (a) an estimated annual NTE ceiling for tools and travel, or (b) typical historical travel frequency and destinations to support reasonable ODC pricing?

Please see Attachement 6 Price Proposal Form

100 4/28/2026 Section L provides instructions for submitting PII to the DC3 Security Office for clearance verification. What is the expected timeline for the DC3 Security Office to complete verification? If verification is not completed before the proposal due date, will proposals be held pending verification or treated as non-compliant under Gate 2?

Contractors will not be held non-compliant based on Security's timeliness for clearance verification.

SUBMITTED QUESTION from Offeror GOVERNMENT RESPONSE

101 4/28/2026

Section M, paragraph 2.2.4.1, references "documented evidence of successful performance as a prime contractor on at least one (1) U.S. Department of Defense (DoD) contract." The Past Performance Questionnaire (Attachment 5, Section 1L) includes "Key Personnel" as a contractor role option alongside "Prime Contractor" and "Subcontractor." May offerors include past performance examples where the offeror's proposed Key Personnel performed in relevant roles under a different prime contractor, or must all examples reflect contracts held by the offeror as prime?

Key Personnel can be evaluated/assessed by their previous experiences, however Past Performance evaluations are directly related to Prime and Subcontractor company submissions.

102 4/28/2026 Gate 1 requires "proof of CMMC certification level 2 (the official certificate)." DFARS 252.204-7025, paragraph (d), requires offerors to provide "the CMMC unique identifier(s) (CMMC UIDs) issued by SPRS." Should offerors submit both the CMMC certificate and the CMMC UID(s) with the Gate 1 submission, or is the certificate alone sufficient?

Docuemnts have been revised

103 4/28/2026

Section L, paragraph 4.1.3.2, requires offerors to demonstrate understanding of the staffing reduction from 7 FTEs (base year) to 5 FTEs (option years). If the Senior Portfolio Manager is a base-year-only position, does the transition plan need to address the transfer of portfolio management responsibilities to the remaining engineering team, or will the Government absorb those functions?

The government will absorb the portfolio management functions.

104 4/28/2026 SOW Section 5.8.3 references OCONUS travel (EUCOM and/or PACOM Area of Responsibility). Is OCONUS travel anticipated during contract performance, and if so, what is the estimated frequency and duration to support ODC pricing?

OCONUS travel is not anticipated.

105 4/28/2026 SOW Section 5.4.2 requires a Quality Control Plan (QCP), and the kickoff meeting agenda (SOW 5.2.1) references the QCP. Is the QCP a formal contract deliverable subject to Government acceptance? If so, when is it due relative to contract award?

The QCP is not currently in the Deliverables list in section III. It should be drafted and provided to the Government personel for project kickoff, and refined within 60 days after (based on information exchanged during kickoff).

106 4/28/2026 SOW Section 5.1.1 states the contractor "may be required access to Government facility outside of duty hours" and that "overtime pay is prohibited without COR and CO approval." Under the contract type ultimately established for labor CLINs, how should offerors account for potential surge or after-hours requirements in their pricing?

Document revised

107 4/28/2026

SOW Section 4.1 states a "definitive list of Government Furnished Equipment (GFE) and Government Furnished Information (GFI) has not been finalized." Should offerors assume that workstations, classified network access, software licenses, and workspace at the DC3 facility will be Government-furnished, or should offerors include contractor-furnished equipment in their pricing?

No GFE should be included in pricing.

108 4/28/2026 Section L states that “A questionnaire is not required if the identified contracts have an annual rating in CPARS.” In an instance where a 5-year contract has just ended and a CPARS has not been completed since the base year, would the government still like the offeror to use the latest CPARS or is a completed PPQ preferred?

Yes in this instance you will need to compelte the PPQ as your past performance was not performed annually.

109 4/28/2026 The table in Section 2.4 of the SOW appears to be at odds with the level of effort described in Appendix A. Can the government please clarify whether 8 or 7 FTEs are required during the base year? The base year should have 8 personnel and go down to 5 in the following two years.

110 4/28/2026 Has there been any change to the historical level of effort for this effort? If requirements have been added or removed, please delineate. SETA activities the level of effort will always be support the mission of DC3

111 4/28/2026 Section L, Section 1.4, Page 3, Volumes I, II, III, and V but also defines Volume IV (Past Performance). Can the Government confirm the correct structure? Section 2.1 in the Section L shows the organization of volumes.

112 4/28/2026 Section L, Section 1.4, Page 3, Will Volume IV Factor II Past Performance be used to down select vendors? Additionally, can to Government clarify why that volume must be submitted 8 May 26 as opposed to 21 May 26 with the rest of the proposal? Past performance will be evaluated prior to proposal submission.

113 4/28/2026 Would the Government consider extending due date for Volume IV Factor II Past Performance to 21 May 26 with the rest of the proposal? Rationale: In the event a PPQ is required, additonal time may be needed to coordinate signatures with Government POCs. At this time the government will not consider extending Past Performance or Proposal due dates

114 4/28/2026 Section L, Section 4.1.1.1, Page 7, Can the Government please confirm what should be covered in the detailed approach? Section

4.1.1.1 indicates offerors must specifically address Sections 2.5.1 through 2.5.1.10 and Section 2.6.1; however these sections do not appear to align with the SOW.

Sow has been amended to correct this issue

115 4/28/2026 Section L, Section 5.3, Page 8, Would the Government consider reducing the number of months of continuous active contract performance from twelve (12) to six (6)? In most cases, 6 months of successful performance is sufficient to serve as a past performance reference.

The requirement is for 12 months

116 4/28/2026

Section M, Section 2.0, Page 2, With regard to Gate 2 (Key Personnel and Security Clearance), can the Government clarify the required number of key personnel? The Q&A provided with the solicitation indicates that only one (1) key personnel is required;

however, this section appears to require a minimum of one (1) Senior Cybersecurity Engineer and additional Mid-level Cybersecurity Engineers.

One Key Personnel

117 4/28/2026 Section M, Section 2.1.1, Page 5-7. References SOW paragraphs 2.5.x.xx do not align with the SOW. Can the Government confirm whether these references should instead be 2.4.x.xx to match the SOW released with the solicitation? Docs are amended

118 4/28/2026

SOW, Section 2.4 Pages 5 - 6. Can the Government clarify the number of FTEs required for the base and option years? Section 2.4 (Labor Categories) appears to indicate 8 FTEs in the base year, including a mix of Senior and Mid-level Cybersecurity Engineers, plus one (1) Senior Portfolio Manager. In Option Year 1 (OY1) and Option Year 2 (OY2), only 5 FTEs appear to be required, consisting of a mix of Senior and Mid-level Cybersecurity Engineers.

Base year has 8 FTE's and each Option Year has 5 FTE's

SUBMITTED QUESTION from Offeror GOVERNMENT RESPONSE

119 4/28/2026 Price Proposal Form (All Tabs). Is there a standard man-year in hours that should be used in developing our estimated hours (For example 1880 hours, 1920 hours, etc.)? No

120 4/28/2026 Price Proposal Form (Base Year). Does the Government foresee a phase-in/transition period prior to the start of the base year? No

121 4/28/2026

1. Could the government please clarify what the contract type will be and how billing should be proposed (e.g. FFP monthly fixed price or actual hours expended at fixed labor rates) and update the RFP accordingly? There are conflicts in the following locations: Section M.1 4th paragraph states an FFP (Labor CLIN) & T&M ODC Tools & Travel may be awarded but Section M.1 5th paragraph states that the acquisition will result in a single Labor Hour & T&M travel contract. The SOW tasking is high level, citing a wide range of potential tasking, without specific milestones or deliverables except reports and the monthly status report requires a financial 5% cost variance financial snapshot, all of which are more appropriate to a labor hour contract type versus FFP. RFP Section B CLIN structure indicates an FFP monthly billing. 52.212-4, alternate 1 which states that it is used when a T&M type task order is contemplate. For an FFP task order, the 52.212-4 without its alternate is more appropriate.

Documents have been updated

122 4/28/2026

2. Section L.1 states that the acquisition is being conducted under Revolutionary FAR Overhaul (RFO) Part 12.6 Streamlined Procedures for Evaluation and Solicitation for Commercial Products and Services, but the RFO does not include a 12.6 . Is the correct reference to RFO 12.2?

This has been corrected

123 4/28/2026

3. Safeguarding CUI does not constitute Secret safeguarding, only storing Secret does. The CMMC requirement covers CUI data handling. If the only requirement a contractor possesses is to store CUI, the Defense Counterintelligence and Security Agency (DCSA) will not authorize safeguarding at the classified level 32 CFR 2001.43 and 32 CFR Part 2002.1 Furthermore, the majority of work is scheduled to occur at the Government site; therefore, including a safeguarding SECRET requirement seems to be overly restrictive in this RFP. We respectfully request that the RFP remove the requirement since it does not appear necessary for the work as contemplated.

Safeguarding Secret and TS is required.

126 4/28/2026

The solicitation requires CMMC Level 2 certification for the prime contractor. Does this requirement flow down to all subcontractors, or only those whose systems will process, store, or transmit it? Additionally, if a subcontractor holds a Conditional (rather than Final) Level 2 status at the time of award, is that acceptable, provided Final status is achieved within a defined period of performance?

Docuemnts have been revised

127 4/28/2026 Section 5.7.1 requires CMMC Level 2 certification verified by a C3PAO assessment. Will a Conditional Level 2 (C3PAO) status be acceptable at the time of proposal submission, provided the final status is achieved prior to contract award?

Documents have been revised

128 4/28/2026 How does a vendor demonstrate CMMC Level 2 compliance? Docuemnts have been revised

129 4/28/2026 The Q&A response dated April 24, 2026, states the Base Year consists of 8 FTEs; however, SOW Section 2.2 references 7 FTEs for the Base Year Key Personnel. Can the Government confirm the total required FTE count for the Base Year and clarify how many of those positions are designated Key Personnel versus total required FTEs?

8 personnel for the base with one of those individuals acting as Key Personnel

130 4/28/2026 For the Key Personnel succession plan required in Volume II, Gate 2, must the succession candidate already hold an active TS clearance at the time of proposal submission, or is a clearance-in-process acceptable for the designated backup? yes needs to hold an active TS

131 4/28/2026 Section 5.9.1 states no position may remain vacant for more than 15 business days. Does this vacancy limitation apply to non-Key Personnel positions only, or does it equally apply in the event Key Personnel depart during contract performance?

yes all positions.

132 4/28/2026 Section 2.4.1.8 requires all-source intelligence analysis and the generation of intelligence products. Will contractor personnel require access to specific intelligence community systems (e.g., JWICS, SIPRNet) beyond a TS/SCI clearance?

If so, will the Government provide access to the required platforms as Government-Furnished Equipment (GFE)?

Yes

133 4/28/2026 Section 4.1 indicates the GFE/GFI list has not been finalized. Will the Government provide a preliminary or draft GFE/GFI list prior to proposal submission so that offerors may accurately account for any contractor-furnished equipment or licensing costs within their price proposals?

No, the contractor will not need to include pricing

134 4/28/2026 SOW Section 5.1.2 references permanently remote employees and their standard operating practices. Are any of the 8 Base Year positions eligible for remote or hybrid performance, or is full on-site presence at the DC3 Linthicum Heights facility required for all personnel?

Government revised SOW to remove all permantely remote language

135 4/28/2026

The CLIN structure includes CLIN 0003 (Senior Portfolio Manager) for the Base Year only, with no corresponding Portfolio Manager CLIN in the Option Year CLIN structure (1001/1002, 2001/2002, 3001/3002). Can the Government confirm that the Senior Portfolio Manager position is a Base Year-only requirement and that no Option Year pricing for this labor category is required?

Correct, Senior PM is a base period only role

136 4/28/2026 For ODC CLINs 0004 and 0005 (Tools and Travel, NTE/T&M), should offerors propose a specific Not-to-Exceed ceiling, or will the Government provide a defined cap? Given that the GFE/GFI list and travel requirements have not been finalized, how should offerors develop and support these estimates in the Cost/Price Volume?

see Attachment 6

SUBMITTED QUESTION from Offeror GOVERNMENT RESPONSE

137 4/28/2026

Section M.2.2.5.5 states the Government will calculate the 6-month extension price using the OY2 rate and that offerors should not submit a price for the extension period. However, CLINs 3001 and 3002 appear in the CLIN schedule. Should offerors leave CLINs 3001 and 3002 blank in the Uniform Pricing Template, or populate them with the OY2 rate for reference purposes?

Revised

138 4/28/2026

Section L.5, Volume III instructions direct offerors to address SOW sections "2.5.1 through 2.5.1.10 and section 2.6.1";

however, the SOW uses section numbering 2.4.1.1 through 2.4.1.10 and 2.5.1 for the labor category duties. Can the Government confirm the correct SOW section references intended for the Technical Approach response? Sow has been amended to correct this issue

139 4/28/2026

For past performance submissions where a current CPARS rating exists, is the offeror required to complete and submit Attachment 5 (Past Performance Questionnaire) with a notation referencing CPARS, or is a written statement identifying the contract number and confirming a CPARS rating exists sufficient for the Volume IV submission?

A questionnaire is not required if the identified contracts have an annual rating in CPARS. Offerors must clearly annotate in Solicitation Attachment 5 – Past Performance Questionnaire that a CPARS rating exists. Please reference section 5.6 of section L.

140 4/28/2026 1. Do all personnel assigned to the contract (including non-key personnel) require a Top Secret facility clearance, or does this requirement apply only to key personnel?

Top Secret Facility Clearance applies to the company, while a TS clearance applies to the individual. All non key personnel and the single key personnel will need a top secret clearance

141 4/28/2026

2. The SOW specifies that a CMMC Level 2 certification is required. Can you please confirm whether a self-assessment would be sufficient to meet this requirement? If not, would it be acceptable for a subcontractor to hold the full CMMC Level 2 certification in lieu of the prime?

Documents have been revised

142 4/28/2026

We respectfully request clarification regarding the requirement for CMMC Level 2 certification and whether the Government’s intent is to require contractors to possess a current CMMC Level 2 certification assessed and validated by an authorized C3PAO, rather than allowing self-assessment or uncertified status. From an industry perspective, a C3PAO-validated certification provides independent verification that a contractor has fully implemented and institutionalized the 110 security controls required under NIST SP 800-171, significantly reducing supply chain risk and improving confidence in the contractor’s ability to protect Controlled Unclassified Information (CUI). Given the sensitivity of the work and the importance of safeguarding Government information, please confirm whether the Government intends to prioritize or require C3PAO-certified CMMC Level 2 contractors to ensure validated cybersecurity compliance and reduced performance risk.

Documents have been revised

144 4/29/2026 Can the Government reassess the CMMC level 2 C3PAO for CUI handling for this effort?