Questions_submitted_to_insider_threat.pdf

1. In order to properly develop a recommended solution and pricing, we’d need at least an estimate of total log volume (we measure this in Messages per Second – MPS). Others measure this in EPS

– Events per second, which we can also work with.

This question does not apply to this Government requirement.

2. What is the LOE or FTE that the Government is estimating for this effort? There is one reference to personnel in this solicitation and one mentions 1 person.

Offerors must review the PWS and create their own estimate of what will be required to successfully accomplish this work.

3. Does "quantity" of 1 refer to one person over the course of this contract? What does "Unit of issue - each" mean?

One “each” is the total cost to perform for one year.

4. Assuming we learn the number of FTE requested for this effort - does the government intend to define labor categories for the breakouts of the team required?

Offerors must review the PWS and propose labor categories they believe are appropriate for the work described.

5. What will be the reporting structure for this effort?

Report to SAF/AAZ Insider Threat Program Lead for operational control (OPCON); our Contracting Officer Representative (COR) for administrative control (ADCON).

6. Assuming cross agency interaction between the Air Force and other entities that support the Air Force, are there additional security requirements or permissions outside of Top Secret that must granted. If all Insider Threat Analysis is to be completed - this would assume involvement with Air Force One operations and special operations detachments.

No additional security requirements or permissions outside of TS

7. For Key personnel on this contract - will the government be requiring Counter-Intelligence qualifications given the nature of the work and the national security directive that the program is enforcing?

No. Counter-Intelligence qualifications will not be required

8. What systems, database, and/or network tools is currently in use by the AF?

The Insider Threat Program is a new program. There are minimal tools in use currently. This effort will help the government select best practices, systems, databases, and/or network tools to satisfy the requirements of the AF Insider Threat Program.

9. Can you provide examples of existing AF response elements?

AF response elements may include, but are not limited, to Air Force Office of Special Investigations, SAF A6 CIO, Surgeon General, Law Enforcement, and Information Protection offices.

10. A. Place of Performance: Who is required to travel to the Pentagon; the entire team? How do we determine team members required to travel 2 - 3 times per month for meetings?

There will be 2 individuals needed to travel to the Pentagon approximately. 4 times per month.

Travel requirements and composition will be dictated by purpose of the Pentagon meetings.

B. Place of Performance: How long should the personnel plan to be in DC for meetings?

Meetings to date have typically lasted no longer than one day in length. However, coordination and collaboration leading to meetings may dictate a longer stay

C. Place of Performance: If contractor resides in DC, will they be allowed to work full time at the Pentagon or will they be required to work at an off-site location?

The government is prepared to provide space in the Pentagon for 2 people

11. Security Requirements: Must each team member have their own Top Secret Security Clearance or will the security clearance given to the company extend to each contracted employee?

Individuals need their own TS clearance

12. Deliverables: Does the AF have a SharePoint account or will the contracting agency be required to secure and customize the account?

The Air Force does have a SharePoint account.

13. PWS Paragraph 1.1, last sentence: Is there a contractor currently involved in managing or supporting development and implementation of the Air Force Insider Threat program? If so, please provide the name of the company involved and the duration of the contract.

This opportunity is not a recompete, it is a new requirement. Work related to this effort is currently being performed separately on another contract.

Prime: Alion Science and Technology Corporation Contract Number: SP0700-99-0301-DO-0232 Contract Vehicle: WSTIAC DO 232

14. PWS Paragraph 1.3, three sub-bullets: The three sub-bullets mention input to the 18-22 POM cycle, and a concept of operations (CONOPS). Are there draft or initial versions of these documents currently in development?

Yes

15. PWS Paragraph 1.4.5: Must the individual supporting work on-site at the Pentagon have an active Top Secret clearance at the time of proposal submission or contract award? Will the Government accept an individual with a recent clearance (within the five year window for Top Secret) that can be reactivated in a timely manner?

Yes, expected to have TS at time of award. Top secret eligibility is good for 5 years; access depends on need to know. If eligibility is current (within 5 years), access may be granted; we do not know current time lines for access but will make/support effort to achieve same in a timely manner.

16. PWS Paragraph 2.1: Paragraph 2.1 implies that contractor support will be provided at the Pentagon. However, paragraph 1.4.3 states that contractor work will be predominately at the contractor’s facility with only limited monthly meetings at the Pentagon. Can the Government clarify work location requirements and frequency (full time, part time)?

One FTE is needed for day-to-day Pentagon support. Other team members may work remotely.

17. PWS Paragraph 3.1, Requirements Analysis and Resourcing, first sub-bullet: How many OPRs will be involved? Are they all located in the Pentagon? What grade or rank are the individuals the contractor would be expected to interface and/or work with?

OPRs will primarily be those attending the Insider Threat Working Group meetings. They include, but are not limited to, SAF/AA; SAF/GC; SAF/IG; SAF/AQ; SAF CIO A6; AF/A1; AF/A2;

AF/A4; AFOSI; 24th AF; 25th AF

18. Paragraph 3.1, Requirements Analysis and Resourcing, 3rd sub-bullet: The Government tasks the contractor with developing “detailed budget recommendations” for the COA approved by the Secretary of the Air Force. However, the table in 4.1 does not identify a related deliverable or timeframe for the budget recommendations. Should they be addressed in the COA or provided in a separate document/format?

It is included in table 4.1 as the Requirements Analysis and Reporting.

19. A.Paragraph 3.1, Integrated Planning, Monitoring, and Communications, 1st sub-bullet: Is it the Government’s intent that the contractor prepare and deliver a final, approved AF Insider Threat Implementation Plan?

No

B. If so, recommend identifying the plan as a deliverable in paragraph 4.1, as well as a projected timeframe for completion.

N/A

20. PWS Paragraph 3.1, Integrated Planning, Monitoring, and Communications, 2nd sub-bullet: How frequently does the AF Insider Threat Working Group meet? Are meetings held in the Pentagon?

Finally, does the term “DoD Insider Threat” refer to another working group or a set of DoD sponsored activities that must be monitored? Please clarify.

AF InT WG normally meet monthly or as needed; normally held in the Pentagon. There is another DoD Insider Threat Working Group to coordinate efforts and collaborate on best practices.

21. PWS Paragraph 3.1, Integrated Planning, Monitoring, and Communications, 2nd sub-bullet: What is the application host environment for the “Task Management Tool”? Is the TMT a Government or contractor developed, installed or managed tool?

The TMT host environment is irrelevant to the contract. The tool can only be accessed via Government system and network.

22. PWS Paragraph 3.1, Integrated Planning, Monitoring, and Resourcing, fourth sub-bullet: The sentence refers to “frequent weekly stakeholder planning meetings”. Are the meetings weekly or only frequently? Please clarify.

Meetings, either one on one, or in groups are needed to engage stakeholders. They may be weekly or more frequently.

23. PWS Paragraph 3.1, Integrated Planning, Monitoring, and Communications, 5th sub-bullet: What is the application host environment for the “Performance Tracking Tool”? Is the PTT a Government or contractor developed, installed or managed tool?

The Performance Tracking Tool is government product to track progress of Insider Threat Requirements. The host is SharePoint

24. A. PWS Paragraph 3.1, Design Hub Concept of Operations, second sub-bullet: Is the table top exercise (TTX) already planned and scheduled?

The TTX is planned. Please see the revised PWS in amendment 2.

B. If so, where will it be located, what is its duration, and how many participants are anticipated?

Unknown location, duration, participants. However, participants will most likely be those from the AF response elements and/or AF InT WG

C. If not, what role will the contractor have in planning and developing the TTX?

N/A

D. Will the contractor be required to deliver a formal exercise report at the conclusion of the TTX?

Yes, the contractor will be required to deliver a formal exercise report at the conclusion of the

TTX.

25. PWS Paragraph 4.1, Deliverables Table, first deliverable: In paragraph 3.1, the Government mentions several tracking tools (i.e., Task Management Tool, Performance Tracking Tool). Is the SharePoint/access database tracking tool called out in the deliverable table a new tool or one of the two tools already mentioned?

These are existing tools that are already presented in the delivery table.

26. PWS Paragraph 4.1, third set of deliverables: Timing for this set of deliverable materials indicates the contractor may receive tasking from DoD or DNI. What specific tasking should the contractor expect and how frequently?

Specific tasking will remain undefined as the contractor will be required to respond to day to day action officer work as needed. The frequency may be daily, monthly or quarterly.

27. PWS Paragraph 4.1, sixth deliverable (COAs): As written, the description implies that the contractor will have some responsibility for OPR implementation plans and COAs. Earlier discussion in 3.1 of the PWS indicates that the OPRs are responsible for developing their own plans with assistance from the contractor. We recommend the Government review the requirement and the deliverables and clarify roles and responsibilities.

OPRs may be task saturated or lack expertise and need assistance in developing implementation plans and COAs.

28. A. Paragraph 4.1, 8th and 9th deliverables: The TTX is due in October 2015 and the CONOPS in

March 2016. Is planning already underway for the TTX (see question21 above)?

Please see answer to question 24 above.

B. Shouldn’t a draft CONOPS be prepared prior to the TTX? If so, a draft should be included in the deliverables table.

CONOPS has been added to the PWS. Please see the revised PWS in amendment 2.

29. Addendum: National Insider Threat Minimum Standards, Paragraph C. Insider Threat Task Force

Roles and Responsibilities: The term “JTIF” is used in the first sentence of this paragraph, but is not defined. Please provide a definition for the term.

It should be “ITTF” (Insider Threat Task Force)

30. Are there page limits, format or font restrictions for the technical volume?

Please see the Instructions to Offerors (ITO) in amendment 1.

31. The evaluation criteria state the resulting contract will be FFP with cost reimbursement for travel.

There are no specific travel requirements identified in the PWS nor in the Pricing Breakdown.

Does the Government anticipate contractor travel requirements outside the Washington DC area?

If so, please identify so they can be addressed.

Contractors may be required to travel up to 2 times per year to San Antonio; 1 person for 1 week per visit.

32. For this opportunity, can the FTE's only be required to have TS clearances While the contractor is in the TS clearance process?

No. Companies are required to have a facility clearance.

33. Section 1.2 Background of the PWS requires the successful offeror to develop and coordinate a strategy, CONOP and OPR plans across multiple complex Air Force “communities.” Does the Air Force’s market research provide evidence of two or more HUBZone small businesses with the experience and capability to perform such a broad analysis and the PWS objectives across these large AF “communities”?

Yes.

34. Since this effort will be FFP, have the OPRs been identified? Will Government please share the number of OPRs and their location?

OPRs will primarily those attending the Insider Threat Working Group meetings. They include, but are not limited to, SAF/AA; SAF/GC; SAF/IG; SAF/AQ; SAF CIO A6; AF/A1; AF/A2; AF/A4;

AFOSI; 24th AF; 25th AF; Most reside in the Pentagon and San Antonio TX

35. Will Government clarify where work will be performed? Section 1.4.3 states that work will be performed at the contractor site with 2-3 monthly trips to the Pentagon for meetings. However,

2.1 states that Government will provide personnel with computer, phone, and desk space at the Pentagon.

Both locations.

36. Given the sensitivity of the work performed, will Government consider allowing a portion of the contracting team to sit on Government site?

Please see the answer to 10C above.

37. If the contractor only makes a few trips a month to Pentagon, will the contractor be required to have access to a SCIF off-site to handle sensitive materials?

Please see the answer to 57 below.

38. A. As part of the Hub Concept of Operations, section 3.1 requires that the contractor conduct a table top exercise will the contractor be responsible for creating a working prototype to exercise the Hub procedures and processes?

B. If not, what AF component will implement a prototype of the contractor CONOPS?

N/A

39. In section 3.1, AF/AAZ leads the AF Insider Threat Working Group, will each individual OPR be represented in that Working Group?

40. Does the Government anticipate a separate contract to fully implement the final Hub CONOPS?

No, however that may change.

41. If there is a separate contract for implementation, will the awardee of this contract be restricted from responding due to an OCI concern?

The government does not expect there to be follow-on work for the contractor. FAR 9.5 and DFARS 209.5 will apply in the event there is follow-on or other work available from this effort

42. Section 4.1 schedules the Table Top exercise for October 2015, but the Hub CONOPS is due in March 2016? Are these dates correct?

See revised Deliverables Table in the PWS in Amendment 02.

43. Our HUBZone status is pending with SBA but will be awarded prior to contract start. Will Government consider a pending HUBZone company as long as said company receives HUBZone approval prior to the beginning of the period of performance on September 15th?

No, HUBZone status must be awarded prior to submitting proposals.

44. Would Government accept a document as an attachment that would prove our HUBZone submission and acceptance into the HUBZone program by the September 15th?

Please see the answer to 43 above.

45. A .Does the AF have an insider threat capability in place?

The AF has capability that needs to be placed into a larger Insider Threat Program.

B. Is it the responsibility of the contractor to recommend that capability as part of the COA?

46. A. Does the AF have a data analytics capability in place?

The AF has capability that needs to be placed into a larger Insider Threat Program

B.Is it the responsibility of the contractor to recommend that capability as part of the COA?

47. The deliverable table shows that the contractor is responsible for tracking Fort Hood requirements. Will any travel be required to Fort Hood? Any other locations?

There is no other travel expected outside the NCR and San Antonio.

48. Are any travel or ODCs anticipated as part of this effort?

Travel: Yes, please see answer 10A.

ODCs: No

49. Does the AF have an anticipated LOE?

Please see answers 2 and 4.

50. The deliverables table states 1 cleared personnel required at time of award, is this a key personnel?

No, personnel who conduct work do not have to be key personnel.

51. Are there page limits for the Tech volume?

Please see the ITO per amendment 1.

52. Is the Pricing_Breakdown_Insider_Threat.pdf, the preferred format for submitting price for this effort? Is it allowable for the contractor to add more detail to the pricing template?

53. Are past performances required?

Per the evaluation criteria; no.

54. Section 1.1 of the PWS (Attachment 1) describes the Air Force Insider Threat Program as a “nascent” and “maturing” program.

a. Has a company / consultant been supporting the Air Force to stand up or lay the groundwork for this program and now pending solicitation?

b. If so, is the company / consultant eligible to bid?

c. If so, does the company / consultant qualify as a HUBZone?

55. Section 1.2 Background of the PWS requires the successful offeror to develop and coordinate a strategy, CONOP and OPR plans across multiple complex Air Force “communities.” Does the Air Force’s market research provide evidence of two or more HUBZone small businesses with the experience and capability to perform such a broad analysis and the PWS objectives across these large AF “communities”?

56. Section 1.4.3 Place of Performance and Section 1.4.4 Type of Contract. Given the intent to award a Firm Fixed Price contract using an LPTA selection method, we are quite concerned with the pricing ramifications presented by “travel to the customer location (Pentagon) is expected 2-3 times per month.”

a. Is it the intent of the Air Force to restrict competition to firms / consultants within the

NCR?

No.

b. Since the current pricing structure guarantees firms / consultants in the NCR a significant pricing advantage in an LPTA environment, will the Air Force consider altering the pricing structure to allow for firms / consultants outside of the NCR to remain competitive against these firms that don’t have to add significant travel costs to their price?

No, however higher cost proposals will be at a disadvantage.

57. The DD-254 in Section 11 (c) requires contractors to “receive and generate classified material,” yet Section 1 (b) shows that contractors do not have to be cleared for Safeguarding.

a. Is it the intent of the Air Force for ALL classified work to be performed at the Government program office in the Pentagon?

Yes, Please see the answer to 37 above.

58. Section 1.4.5 Security Requirements of the PWS states that, “upon contract award, at least one cleared individual must be available to support the Government program office.”

a. Since it appears to be the intent of the Air Force that ALL classified work must be performed at the Pentagon (question 4 above), is it also the intent of the Air Force for the “cleared individual(s)” to perform this classified work at the Pentagon?

b. Will this “cleared individual(s)” be given office space in the Pentagon?

Yes, please see 10C.

59. The solicitation nor any of the attachments provided for FA7014-15-R-5015 contain any proposal instructions for the Factor 1 – Technical response that we can find.

a. What is the page limit for Factor 1 – Technical?

b. Does the Air Force require or desire a cover page, TOC, Glossary, etc.

c. What format should the Factor 1 – Technical response be in?

d. Is Contractor format acceptable?

No.

60. For potential offerors with DSS-approved Insider Threat Programs and on-going efforts with DSS, the FBI and other DoD and civilian agencies to develop and implement of Insider Threat Programs, we are perplexed about the absence of a past performance requirement. Is it the intent of the Air Force to not request past performance experience or any other evidence of development of a DSS-approved ITP?

We are not requesting past performance information.

61. What Volumes are required? Technical, Price etc.

62. Should Reps and Certs along with Solicitation Acknowledgement be in a separate volume?

Please provide in price volume.

63. Is FAR 52.212-3, Offeror Representations and Certifications-Commercial Items, ALT I the only Rep and Cert required?

Yes.

64. In the Evaluation Criteria it talks about travel and ODCs but there is no CLIN for these items, will travel and ODCs be added after award?

The pricing sheet provided was for the total dollar value for the base year, the options, and the grand total. It does not reflect any of the CLINs.

65. Due to the level of importance of this SOL may we have an extension?

The Government does not know what SOL means. Per amendment 2, the government has provided an extension.