VTC IDIQ QandA_Updated.pdf

These answers consolidate all vendor questions into thematic responses for the official

Q&A amendment.

Theme 1: Pricing Structure, Corrective Maintenance, and CLIN 0004 Hardware

The Government acknowledges the ambiguities in the pricing structure. A formal amendment will be issued to clarify as follows:

1. Controlling Document: Pricing CLIN Matrix 1.xlsx file is the official and sole document for pricing submission.

2. Corrective Maintenance: The act of remediating STIG findings is considered corrective action and is outside the scope of the fixed-price preventative maintenance CLINs. Labor for remediating STIG findings is not included in the monthly Preventative Maintenance rates. Remediation for STIG findings shall be ordered and priced at the task order level using the appropriate, fully burdened hourly rates submitted under CLIN 0002 (Engineering) or CLIN

0003 (Installation).

3. Hardware Pricing (CLIN 0004) & SOO Evaluation: The NIPR Teams and Secure

VTC SOOs are Sample Projects used to evaluate technical and pricing capabilities. Offerors must submit a complete, priced Bill of Materials (BOM) for each of the two SOO designs. This pricing must be submitted in a separate Price Narrative volume and will be used to calculate a portion of the

Total Evaluated Price (TEP). For the master IDIQ pricing sheet, CLIN 0004 will be treated as "Not Separately Priced" (NSP). Future hardware requirements on task orders will be competitively quoted.

4. TEP Formula: A corrected pricing matrix will be issued via amendment to address a potential formula error that double-counts certain values.

Theme 2: Labor Categories and SCA Compliance

The Government acknowledges the potential for SCA misclassification. To ensure fair competition and realistic pricing, the following guidance is provided:

1. Engineering/Design Services (CLIN 0002): Personnel performing advanced system design, such as those holding a CTS-D certification, meet the professional exemption criteria under 29 CFR Part 541 and are considered SCA-Exempt. Offerors shall propose a realistic, fully burdened salaried professional rate for this labor.

2. Installation Services (CLIN 0003): This rate should be a blended, fully burdened hourly rate for all non-exempt implementation tasks, including physical installation, commissioning, and testing. Offerors should map personnel to the most appropriate SCA category based on their duties (e.g., 23183 - Electronics Technician Maintenance III).

Theme 3: Proposal Instructions & Page Limits

Supporting evidence documents (such as personnel certifications and training records) and draft deliverables required for the SOO evaluation (such as the BOM and System

Design Document) do not count against the 40-page narrative limit for the technical proposal. These items should be provided as clearly labeled, separate appendices.

Theme 4: Historical Data, System Inventory, and Incumbent Information

The incumbent contractor is Applied Global Technology (AGT) under contract

FA820121D0004. At contract start, the Government anticipates placing approximately 1

Tier 1, 23 Tier 2, and 10 Tier 3 systems under maintenance. Detailed historical maintenance ticket data is unavailable for release; offerors must base their proposals on the estimated system-month quantities provided in the pricing matrix.

Theme 5: Security Clearances & Facility Clearance (FCL)

A SECRET-level Facility Clearance (FCL) at the prime contractor level is not required. A complete DD Form 254 will be issued via amendment. The Government will not sponsor interim SECRET clearances for contractor personnel.

Theme 6: Equipment Standards & Network Connection Approval

In accordance with DoD and Department of the Air Force policy, the Government strictly enforces Approved Products List (UC APL and TSG-6) compliance. To obtain network connection approval, all proposed equipment must meet the standards for DISA UC APL, TSG-6, NIAP, RMF, STIG/SRG, BAA/TAA, enclave cryptography, compute-mediated isolation, and UCR-CORE interoperability as detailed in PWS Section 2.1.2.

Theme 7: SOO Design Exercise Details

The Government provides the following specific details for the SOO design exercises:

A. NIPR Teams SOO Questions:

• Room Photographs: No, the room is notional for this exercise.

• Multiple Cameras: Offerors must adhere to the component list specified in the SOO scope requirements.

• Audio Configuration Changes: Offerors must adhere to the component list specified in the SOO scope requirements.

• Display Content: The four displays are intended to show independent content sources.

• Ceiling Height: 9 feet.

• Room Finishes: Painted concrete walls and a drop ceiling with acoustic tiles.

• Floor Box Location: Yes, located in the northeast corner next to the existing workstation.

• Network Ports: Yes, offerors can assume adequate network ports already exist.

• Assistive Listening: No, this is not a requirement.

• Digital Signage/Scheduling: No, this is not a requirement.

• Equipment Rack: Yes, the contractor is responsible for providing the equipment rack.

• Rack Location: A designated location is available in the northeast corner next to the existing workstation, with local power and data available.

B. Secure VTC SOO Questions:

• Room Photographs: No, the room is notional for this exercise.

• Secure Codec: The contractor shall provide the secure codec.

• COMSEC Equipment: No, COMSEC equipment should not be included in proposals.

• SIPR Connectivity: No, SIPR connectivity is Government-furnished.

• Pathway Depiction: Yes, secure and unclassified pathways must be depicted in engineering deliverables.

• Pathway Availability: Yes, the pathway from the communications room to the conference room is available and usable for new cabling.

• Existing Cabling: CAT6 copper.

• SIP/H.323 Testing: Acceptance testing must comply with DISA cybersecurity protocols, including the Application Layer Gateway (ALG) SRG, Session

Border Controller (SBC) STIG, and Network Infrastructure Policy / Router &

Switch STIGs.

• Bridge Interoperability Testing: Yes, this is required for final acceptance.

• Encryption Devices: Encryption devices are Government-furnished.

• Equipment Rack: Yes, the contractor is responsible for providing the equipment rack.

• Rack Location: A designated location is available in the existing communications room, with local power and data available.

Theme 8: SOO Design Approach & Bill of Materials (BOM) Requirements

The Government's intent for the NIPR Teams and Secure VTC SOO exercises is to evaluate an offeror's integration and engineering expertise. The major equipment items depicted in the SOO drawings and descriptions are considered mandatory baseline components. The offeror's engineering task is to develop a complete, functional, and compliant system built around that mandatory baseline. Offerors must provide a complete Bill of Materials (BOM) that includes not only the specified major components but also all underlying and unlisted parts required to make the system fully operational. As part of their technical proposal, offerors must also provide a narrative that demonstrates how their complete BOM satisfies the mandatory requirements of PWS Section 2.1.2 (Equipment Standards and Network

Connection Compliance).

Theme 9: Miscellaneous

As per 252.204-7025, CMMC Level 1 is required and sufficient for award.

Q1: Since the DoDIN APL is being sunset by DISA, can this requirement be removed or updated?

• Answer: As shown in PWS Section 2.1.2 of the updated solicitation, the legacy DoDIN APL requirement has been officially removed. The Government has modernized the requirement to focus on local connection approval via the standard Risk Management Framework (RMF) and DISA STIG/SRG configuration baselines.

Q2: Does the FIPS 140-3 requirement for NIPR CUI/PII apply to all peripheral AV devices (e.g., cameras, displays, microphones) which generally do not support cryptographic encryption?

• Answer: No. The FIPS 140-2/3 cryptographic module standard applies only to components that perform active encryption and cryptographic functions within the system boundary (such as the VTC codec or secure network gateways). It does not apply to standard, non-encrypting analog, or digital peripherals such as displays, cameras, or microphones. COTS products remain fully acceptable for these peripheral roles. Note that, the FIPS 140-2 standard officially expires 21 Sep 2026. After this sunset date, active FIPS 140-2 modules are no longer considered actively validated for new procurements, and organizations must transition to the modern FIPS 140-3 standard.

Systems already fielded and running FIPS 140-2 validated modules can generally continue to operate using those legacy modules until they reach normal end-of-life, major architectural overhaul, or specific component updates require recertification. However, any substantial software or operational environment update to an existing encryption and cryptographic components after the sunset date forces alignment with the active FIPS 140-3 validation stream rather than relying on legacy status.

Q3: How is a vendor expected to "physically disable" Cloud Telemetry or Call Home features (e.g., Cisco ThousandEyes) since these are software-based components?

• Answer: The term "physically and logically disable" in this context requires the contractor to disable these features in the device’s software/firmware configuration interface in accordance with the applicable DISA STIG/SRG. Additionally, the contractor's network design must logically isolate the VTC systems, ensuring that base firewalls block any outbound external routing (no default gateway to the public internet). No physical modification or dismantling of hardware is required.

Q4: The security requirements list TSG-6 optical KVM switches and 360° status indicators with physical privacy shutters. Since no TAA-compliant COTS cameras or KVMs currently meet these specs, is the Government's intent to force a custom-built solution rather than COTS?

• Answer: No. The Government’s intent is to utilize standard, commercially available COTS products. The specific TSG-6 and 360° indicator guidelines are reference baselines for highly classified enclaves and do not override the primary requirement for COTS and TAA compliance. Standard, compliant COTS cameras with integrated physical privacy covers (or manual lens caps) and industry-standard optical KVMs that meet the required security boundaries are fully acceptable. Custom-built hardware is not required.

Q5: Will the Government grant a further extension of the proposal due date to Friday, September 4th?

• Answer: No. To ensure a seamless transition of services prior to the expiration of the incumbent contract on 30 September, the proposal submission deadline remains unchanged at 1400 MST on August 31, 2026