Attachment_4_-_Q&A_DevSecOps.pdf

ASK ME ANYTHING (AMA) QUESTIONS / RESPONSES

FA8307-19-R-0133

Software DevSecOps Services 2 October 2019

QUESTIONS RESPONSES

1. Could you also confirm the required Facility Clearance Level an awardee must have?

Minimum FCL requirements are Unclassified, maximum are TS/SCI. The determination of which classification level will be made at the call level. The

“sample” DD254 is only a draft.

2. Could you provide the draft DD Form 254 as a separate attachment?

Sample DD254 was issued with Amendment 1.

However, please note that DD254 will be issued at the call level, as applicable.

3. Confirm that the ceiling value for each BPA is $95 million? Or is the combined value of the three, which collectively represent LevelUP, $95 million?

BPAs do not have a ceiling. However, the Government is working to better define a response to this question and will provided via amendment.

4. Confirm that the Air Force plans to issue 15 BPAs for each solicitation? Or 15 BPAs collectively?

Up to 15 for each BPA. Potentially a total of 45 BPAs.

5. Does the prime contractor needs to hold a Top Secret

Facility clearance at the time of proposal submission to be eligible for award?

Minimum FCL requirements are Unclassified, maximum are TS/SCI. The determination of which classification level will be made at the call level. The “sample” DD254 is only a draft.

6. Are we able to submit (or does it make sense), a response/offer, considering we do NOT possess the capability to fulfill ALL the roles required in the BPA?

BPAs will only be issued to those vendors who can fulfill all the requirements as stated in the RFQ.

7. Will the Agency consider awarding part of this BPA to a Small 8A who can provide solid support, but limited (at this stage of growth) in personnel count?

At this time, the Government is only issuing BPAs as a whole.

8. Does this mean that companies without an FCL can respond and that the security requirements will be handled at the BPA Call level?

Yes, the security requirements will be handled at the Call level.

9. If a prospective bidder has foreign ownership, but is fully compliant with Foreign Ownership, Control or Influence (FOCI) regulations, are they still ineligible to bid?

Please note that some calls placed under these BPAs will require contractor access to proscribed information, i.e., Top Secret, Sensitive Compartmented Information, Special Access Program, Communication Security, and Restricted Data. As a result, any prospective offeror that has foreign ownership, control or influence (FOCI) as defined in National Industrial Security Program Operating Manual, Chapter 2, Section 3, will need to make that known to the Government Contracting Officer with the submission of its quote. In addition, to be found responsible and eligible for award by the Government Contracting Officer, that prospective offeror will also need to provide proof it has put in place security measures to negate or mitigate FOCI.

Please note this also applies to subcontractors and teaming partners.

10. Will Facilities or Personnel clearances be required for this solicitation?

Clearances will be required at the call level. Minimum FCL requirements are Unclassified, maximum are TS/SCI. The determination of which classification level will be made at the call level.

11. Is there an incumbent?

No, this is a new requirement.

12. Is there a dollar amount?

BPAs do not have a ceiling. However, the Government is working to better define a response to this question and will provided via amendment.

13. Does the respondent vendor need to have a past-performance in the US Air Force to be awarded?

No; however, please note that past performance is not an evaluation factor.

14. Does the contractor have to have experience with LevelUP?

No All companies must be registered in SAM.gov in order to onboard to these BPAs and be in compliance with the directions of the solicitation.

15. Can small business joint venture submit?

Yes

16. Would you be open to ideas/experience from the commercial industry?

Please note that the Government is no longer accepting comments/questions.

17. Cover Letter, Para Notice. Does the Government anticipate Cost as a potential contract type? Rationale:

The price spreadsheet does not require a Cost pricing model and the BPA Guide does not list Cost as an option.

Cost is reserved for Travel and ODCs only. No call will be issued as Cost.

18. Cover Letter, Para 2. How does the Government plan to verify ownership status during evaluations?

All companies must be registered in SAM.gov in order to onboard to these BPAs and be in compliance with the directions of the solicitation.

19. Attachment 1 ITO, Page 3, Para G. When does the Government anticipate making award of contracts?

BPA award determination will be at the Event Day on 13 November 2019. Attendees will be notified no later than 1 November 2019.

20. Attachment 1 ITO, Page 4, Para I (4). References Attachment B, Price Listing Worksheet. We believe it should reference Attachment 3 Pricing Sheet. Please clarify.

Correct. However, please note that Price has been removed from the evaluation criteria. Determination of price fair and reasonableness will be determined at the call level.

21. Attachment 1 ITO, Page 5, Para 2 B (Note). States the BPA Event Day is a continuation of the technical evaluation and attendance is mandatory. Request the Government provide, at least, a general overview of the purpose and potential requirement(s) of the BPA Event Day. Rationale: Since there is such a quick turn between notification of selection and the Event Day; we would like a better understanding of the type of personnel needed to attend. For example, if there is going to be a technical engineering task or other scenario that may require multiple individuals, we would like to begin planning personnel attendance.

The Government is currently working logistics and format. Details regarding Event Day will be provided to attendees as soon as available but no later than 1 November 2019. However, offerors should prepare for a Q&A regarding the technical capabilities cited in their quote.

22. Attachment 1 ITO, Page 7, Factor 2 Portfolio Review.

Request the Government elaborate with additional detail what it is looking for in a “detailed portfolio” and “source code” repository with links. Rationale: While a bidder may have individuals working on projects of similar scope and technologies; our customers may not be willing to allow release of source code or access into repositories by an external organization.

The portfolio review is not limited to traditional past performance, intending to allow companies to propose with no DoD experience. Please provide an unclassified version or write up, if possible or commercial experience.

23. Attachment 1 ITO, Page 7, Factor 2 Portfolio Review.

The page limitation is 3 pages for this Factor; however, the Government is requesting a “detailed portfolio” and/or “source code repository”. Does the Government believe 3 pages is sufficient length to provide a detailed discussion across the 5 areas of the Statement of Objectives?

Yes, the page limitations are sufficient to provide a detailed discussion across the five (5) areas of the

SOO.

24. Attachment 1 ITO, Page 7, Factor 2 Portfolio Review.

Request the Government increase the page length to at least 5 pages so bidders can provide sufficient details.

Rationale: Our customer will probably not allow external access into their systems and/or release of source code to an outside agency for proposal purposes. The extra page length will enable us to provide the detailed description requested.

The page limitations will not change. The Government believes the limitations listed are sufficient.

25. Attachment 1 ITO, Page 7, Factor 3 Price. Should bidders base their pricing on a specific location or should pricing be based on anywhere within CONUS?

Please note that Price has been removed from the evaluation criteria. Determination of price fair and reasonableness will be determined at the call level.

26. Attachment 2, SOO, General. Internal header states Attachment A; however, the file name is Attachment 2.

This is confusing since it appears the documentation references Attachment A instead of the file name.

Attachment numbers have been corrected and are included with this amendment.

27. Attachment 2, SOO, Para One. Request the Government provide background information on the LevelUP and LevelUP pathfinder programs. Rationale:

The Government is requesting support for these programs but do not define it at a sufficient level to draw comparisons with our current portfolio of work.

This is a DoD DevSecOps initiative. Background information on pathfinder programs will not provide scope for the intent of these BPAs.

28. Attachment 2, SOO, Para Five. Reference states “If a key personnel position is identified at the call level, the contractor shall minimize the operational burden.” Please explain what is meant by “the contractor shall minimize the operational burden”.

The contractor needs to ensure limited vacancy of key personnel positions due to impact of operational missions, the Government wants to ensure limited changeover/gaps in key positions.

29. Attachment 2, SOO Pag2, Reference bullet “Ability to perform cyber penetration analysis (pen-testing) and red teaming/blue teaming.” Please verify it is the Government’s intent that BPA holders will conduct pen-testing. We believe this to be counter to DoD policy in that pen-testing can only be accomplished by authorized agencies. And system owners must acquire pen-testing from external agencies – not be conducted by the same Government or Contract entity that is also designing, implementing or providing O&M on the networks and applications being tested.

Yes, we are requesting contractors perform internal pen-testing and red/blue teaming.

Pen-testing for compliance or operational capability will be conducted in accordance with mandated agencies per DoD policy.

30. Attachment 3, Pricing Sheet, Summary-FFP. Row 5 States the beginning of the period is 1 Oct 19. Will the Government be updating this spreadsheet or maintain all POPs will start on 1 Oct?

Please note that Price has been removed from the evaluation criteria. Determination of price fair and reasonableness will be determined at the call level.

31. Attachment 3, Pricing Sheet, Summary-FFP. What are the definitions of Level 1, Level 2, and Level 3? Rationale:

The Government has established Labor Category skill levels but does not define them. Also, there is no deference in tasks and qualifications between the skill levels.

Level 1 is considered entry level, Level 2 is moderate experience, Level 3 is a senior/expert level. NOTE:

Requirements for labor category descriptions are arbitrary to the talent we are seeking. Labor category descriptions are written to ensure we do not restrict talent based on educational/experience requirements.

32. Attachment 3, Pricing Sheet, Summary-FFP. Is it the Government’s intent not to provide skill levels for Help Desk Support Services or Programmer/Developer?

Please note that Price has been removed from the evaluation criteria. Determination of price fair and reasonableness will be determined at the call level.

33. Attachment 3, Pricing Sheet, T&M_LH Rate Buildup.

There is no “Fee” or “Profit” column. Please explain how bidders should account for fee/profit.

Please note that Price has been removed from the evaluation criteria. Determination of price fair and reasonableness will be determined at the call level.

34. Attachment 3, Pricing Sheet, General. The RFQ Letter alludes to the possibility of Cost type contracts. However, the Government has not provided pricing tabs for Cost type orders. Please clarify whether the Government plans to pursue Cost type orders.

Cost is reserved for Travel and ODCs only. No call will be issued as Cost.

35. Attachment 5, BPA Guide, Page 3, Last sentence.

Please clarify whether references to Attachments A & B should be changed to 2 & 3 respectively.

Attachment numbers have been corrected and are included with this amendment. Please note that Price has been removed from the evaluation criteria.

Therefore, the pricing attachment has been removed.

36. Attachment 5, BPA Guide, Page 4, Last Paragraph.

Reference states “In the event the ordering officer determines that there exists insufficient sources within the small business set-aside to provide the Government an adequate level of geographic area coverage or services.”

What is the Government’s definition of “adequate level of geographic area coverage”? Rationale: Is there a geographic area coverage requirement that is not stated in the solicitation?

This will be determined once quotes are received and evaluated. However, The Government reserves the right to award one (1) or more small business, small business team or joint venture if qualified and eligible for a BPA award. If the Government chooses to exercise this right and two or more small businesses/teams/joint ventures are determined qualified and eligible for a BPA, the Government will consider small disadvantaged business status in its selection for award.

37. Attachment 5, BPA Guide, Page 5, Para III. Should reference to Attachments A be changed to Attachment 2?

If not, please clarify the purpose of the Scope of Work in relation to the BPA and when it will be provided.

Attachment 2 – SOO defines the scope of this BPA.

Attachment numbers have been corrected and are included with this amendment.

38. Attachment 5, BPA Guide, Page 6, Para 8. States that work will range from Unclassified to TS/SCI. However, all Labor Categories state “Ability to attain Secret security clearance”. One of these do not match the other’s requirement. Please clarify.

Clearances will be required at the call level. Minimum FCL requirements are Unclassified, maximum are TS/SCI. The determination of which classification level will be made at the call level.

39. Attachment 5, BPA Guide, Page 6, Para 8. Request the Government state the level of Facility Clearance required of all bidders at contract award.

The BPA Guide has been revised to clarify that security requirements will be identified at the call level.

40. Attachment 5, BPA Guide, Page 8, Attachment A.

Should this page be titled Attachment 2 Statement of Objectives? Please clarify. Recommend deleting this page since it is not needed and no Scope of Work is provided under separate cover.

Attachment 2 – SOO defines the scope of this BPA.

Attachment numbers have been corrected and are included with this amendment.

41. Attachment 5, BPA Guide, Page 9, Attachment B.

Please clarify Attachment B Price List and whether or not it is Attachment 3 Pricing Sheet or something different.

Recommend this page be deleted since all attachments are external files.

Please note that Price has been removed from the evaluation criteria. Determination of price fair and reasonableness will be determined at the call level.

42. Attachment 5, BPA Guide, Page 10, Attachment C.

Recommend updating Para II Ordering Procedures to reference Attachment C. (see 3rd bullet)

BPA Guide has been revised to incorporate the Ordering Procedures and is included with this amendment.

43. Attachment 5, BPA Guide, Page 11, Attachment D.

Recommend deleting this page, it is not needed.

BPA Guide has been revised and is included with this amendment.

44. Attachment 5, BPA Guide, Page 12, Attachment E.

Recommend deleting this page, it is not needed.

BPA Guide has been revised and is included with this amendment.

45. Attachment 5, BPA Guide, Page 13, Attachment F.

Recommend deleting this page, it is not needed.

BPA Guide has been revised and is included with this amendment.

46. Attachment 5, BPA Guide, Page 14, Attachment G.

Recommend deleting this page, it is not needed.

BPA Guide has been revised and is included with this amendment.

47. Attachment 6, Provisions and Clauses, General. Does the Government require offerors to fill out the Representations and Certifications and submit with their proposal? If so, please provide guidance on what to submit and how to submit.

Offerors are required to complete Reps and Certs in accordance with FAR 52.212-3 and 52.212-3, Alt I.

Please submit with Volume I.

48. Attachment D, OnOff Ramp, Page 1, 2(d). Request the Government remove item (d), from this list. Rationale:

Proposals are very subjective, even a very active offeror may not be chosen for a variety of reasons. We don’t believe a BPA holder should be penalized for 100% participation but failing to be awarded a Call Order

The Government has determined that item (d) will remain. Please note that Attachment D has been incorporated into the BPA Guide.

49. Attachment G, Labor Category. Please provide a definition of Level 1, Level 2 and Level 3 as associated with Labor Categories. Rationale: There are no task or qualification distinctions between skill levels

Level 1 is considered entry level, Level 2 is moderate experience, Level 3 is a senior/expert level. NOTE:

Requirements for labor category descriptions are arbitrary to the talent we are seeking. Labor category descriptions are written to ensure we do not restrict talent based on educational/experience requirements.

50. Attachment G, Labor Category, Programmer/Developer. Is it the Government’s intent not to provide skill levels for Programmer/ Developer?

Please see answer to question 32.

51. Attachment G, Labor Category, Help Desk Support Services. Is it the Government’s intent not to provide skill levels for Help Desk Support Services?

Please see answer to question 32.

52. Attachment G, Labor Category, Network Engineer. Is it the Government’s intent not to provide skill levels for Network Engineer?

Yes, as long as they meet the requirement of Attachment 3.

53. The RFP states “Offerors shall provide a portfolio and/or source code repository with links”. How should the offeror provide a source code repository to the Government. In most cases, the source code is owned by our customer and not releasable.

The portfolio review has the option for companies to provide a source code repository.

Companies are not limited to traditional past performance to allow companies with no/minimal DoD experience the opportunity to propose.

54. Is the Government asking for customer references in Portfolio Review section? If yes, what information is the offeror would suffice?

The Government is not specifically requesting customer references, please be aware of page limitations in ensuring you meet the criteria for portfolio review.

55. Could you please elaborate on BPA event day objectives and structure for evaluation?

The Government is currently working logistics and format. Details regarding Event Day will be provided to attendees as soon as available but no later than 1 November 2019. However, offerors should prepare for a Q&A regarding the technical capabilities cited in their quote.

56. In response to the RFQ, can the offeror include the subcontractor’s references?

Subcontractor references are not required. Please note, there are page limitations for submissions.

57. The Government has released 3 related RFQs. We want to confirm that this particular one focuses on providing DevSecOps pipeline (LevelUp Platform) integration, implementation and support adoption by other project initiatives.

Question is unclear. There are 3 BPAs as part of the DevSecOps initiative.

1) Software DevSecOps Services

2) DevSecOps Pipeline and Platform Integration and Licensing Services

3) Cloud Services

58. Would the Government be willing to provide technical details on the preceding program - “Up”

UP is the Unified Platform, one of the many DevSecOps Programs these BPAs will support/enable.

For better understanding of what is intended for these BPAs, please read the “DoD Enterprise DevSecOps Reference Design” Document:

https://dodcio.defense.gov/Portals/0/Documents/Do D%20Enterprise%20DevSecOps%20Reference%20Des ign%20v1.0_Public%20Release.pdf?ver=2019-09-26- 115824-583

59. Could the Government please provide personnel security clearance requirements for this program?

The personnel security requirements will be provided at the call level. Clearances will be required at the call level. Minimum FCL requirements are Unclassified, maximum are TS/SCI. The determination of which classification level will be made at the call level.

60. Does the Government anticipate other agencies outside of the USAF leverage LevelUp Platform?

Yes. This BPA will be open to all of DoD.

https://dodcio.defense.gov/Portals/0/Documents/DoD%20Enterprise%20DevSecOps%20Reference%20Design%20v1.0_Public%20Release.pdf?ver=2019-09-26-115824-583 https://dodcio.defense.gov/Portals/0/Documents/DoD%20Enterprise%20DevSecOps%20Reference%20Design%20v1.0_Public%20Release.pdf?ver=2019-09-26-115824-583 https://dodcio.defense.gov/Portals/0/Documents/DoD%20Enterprise%20DevSecOps%20Reference%20Design%20v1.0_Public%20Release.pdf?ver=2019-09-26-115824-583 https://dodcio.defense.gov/Portals/0/Documents/DoD%20Enterprise%20DevSecOps%20Reference%20Design%20v1.0_Public%20Release.pdf?ver=2019-09-26-115824-583

61. Attachment 1, page 7 & 8, Factor 3 Price states, The Offeror’s proposed rates and other information will be evaluated to ensure continuity and traceability of prices to the technical volume and between the initial quote and any revisions thereto.

Given Offerors are required to provide labor rates for a pre-defined set of labor category, please clarify this statement. Specifically, what continuity and traceability are Offerors to include in their proposal and in what volume should it be included?

Please note that Price has been removed from the evaluation criteria. Determination of price fair and reasonableness will be determined at the call level.

62. Attachment 3 requires Offerors to provide a firm fixed price. However, the solicitation does not provide sufficient information to determine a level of effort and the FFP spreadsheet does not include a column for hours associated with each labor category. Please consider changing the spreadsheet to include the column for labor hours and populate the column with hours for evaluation purposes only.

Please note that Price has been removed from the evaluation criteria. Determination of price fair and reasonableness will be determined at the call level.

63. Attachment 5, page 6, Section 8 states, “Work will range from Unclassified to TS/SCI with special access required. Security requirements will be determined at the BPA call level. However, the contractor shall provide personnel with the requisite clearances to support the effort as identified in the call.”

Given this requirement and the time required to obtain Top Secret facilities clearances, are Offerors required to have a Top Secret facilities clearance at time of proposal submission? Should Offerors submit their redacted versions of DD Form 441 with their proposals?

Clearances will be required at the call level. Minimum FCL requirements are Unclassified, maximum are TS/SCI. The determination of which classification level will be made at the call level.

Clearances are not required at the BPA level, but will be needed at the call level.

64. Attachment F, page 1, (b) states, “The Contractor agrees that a partial basis of award of this BPA will be the key personnel proposed, including those employed by subcontractors, if applicable. Accordingly, the Contractor agrees to assign under the BPA those key personnel whose credentials, experience and expertise were provided with the quote and which meet the qualification requirements included with the Labor Category Attachment, necessary to fulfill the requirements of the

BPA”

Please clarify these statements as there are no requirements for Offerors to submit Key Personnel resumes with the proposal and (d) indicates that Key Personnel will be determined at the Call level.

Call award will be based on the key personnel proposed. There are no requirements to submit Key Personnel at this time. Information contained in Attachment F has been incorporated into the BPA guide and is included with the modification.

65. How does the government intend to access the portfolio/source code repository?

The Government will utilize the links provided.

66. What is the process and/or how often should the portfolio / source code repository be updated?

The portfolio review is only for the initial evaluations.

Any future source code will be handled in accordance with specific calls.

67. Can you provide examples for including in the portfolio review and/or categories of definitions related to current program gaps?

Specific examples for evaluation are at the vendor's discretion. Solicitation for specific program gaps will be at the call level.

68. For all teams, the contractor must provide qualified manpower within ten (10) business days of Government request or of a vacancy. If a key personnel position is identified at the call level, the contractor shall minimize the operational burden. In this case does the qualified manpower have to be on site at San Antonio, TX, Colorado Springs, CO, and Odgen, UT or can the support be available remotely?

Location will be determined at the call level, work may or may not be at a Government or Contractor site depending on the requirement.

69. On page 1 of the SOO, the primary place of performance for the platform development team is stated as Colorado Springs, CO, but notes that it’s subject to change. Would a potential change in location be limited to San Antonio, TX or Ogden, UT, which were identified as other LevelUP locations?

Location will be determined at the call level, work may or may not be at a Government or Contractor site depending on the requirement.

70. Can the government specify the number of the domains that which development, build, test and deployment (Staging and Production) are anticipated?

Domains will be determined at the call level. For better understanding of what is intended for these BPAs, please read the “DoD Enterprise DevSecOps Reference Design” Document:

https://dodcio.defense.gov/Portals/0/Documents/Do D%20Enterprise%20DevSecOps%20Reference%20Des ign%20v1.0_Public%20Release.pdf?ver=2019-09-26- 115824-583

71. Is the government willing to consider a Cross Domain Solution for propagating source and configuration code, as well as changes to this code across classification enclaves?

Yes, the government is willing to consider a Cross Domain Solution (CDS) for propagating source and configuration code. Any CDS must be approved through the Defense Security/Cybersecurity Authorization Working Group (DSAWG) via the National Cross Domain Strategy and Management Office (NCDSMO).

72. Other than the infrastructure technologies named in Attachment 2 are there any other technologies that are in use today and or that are expected to be leveraged?

Please see the “DoD Enterprise DevSecOps Reference Design” Document:

https://dodcio.defense.gov/Portals/0/Documents/Do D%20Enterprise%20DevSecOps%20Reference%20Des ign%20v1.0_Public%20Release.pdf?ver=2019-09-26- 115824-583

73. To what extent is the government willing to procure new tools/technologies for evaluation, innovation?

The Government is constantly seeking to procure new tools/technologies and is continuously evaluating specific use cases.

74. Will a prime-awardee be able to add subs to assist in the work when a “Call” is announced?

Yes, but the subs must be identified when responding to the call RFQ.

75. Does the technical volume for evaluation purposes outweigh price? i.e. is this a tradeoff?

Please note that Price has been removed from the evaluation criteria. Determination of price fair and reasonableness will be determined at the call level.

https://dodcio.defense.gov/Portals/0/Documents/DoD%20Enterprise%20DevSecOps%20Reference%20Design%20v1.0_Public%20Release.pdf?ver=2019-09-26-115824-583 https://dodcio.defense.gov/Portals/0/Documents/DoD%20Enterprise%20DevSecOps%20Reference%20Design%20v1.0_Public%20Release.pdf?ver=2019-09-26-115824-583 https://dodcio.defense.gov/Portals/0/Documents/DoD%20Enterprise%20DevSecOps%20Reference%20Design%20v1.0_Public%20Release.pdf?ver=2019-09-26-115824-583 https://dodcio.defense.gov/Portals/0/Documents/DoD%20Enterprise%20DevSecOps%20Reference%20Design%20v1.0_Public%20Release.pdf?ver=2019-09-26-115824-583

76. Can the government specify the number of the domains that which development, build, test and deployment (Staging and Production) are anticipated?

Please see the response to Question No. 70 above.

Domains will be determined at the call level. For better understanding of what is intended for these BPAs, please read the “DoD Enterprise DevSecOps Reference Design” Document:

https://dodcio.defense.gov/Portals/0/Documents/Do D%20Enterprise%20DevSecOps%20Reference%20Des ign%20v1.0_Public%20Release.pdf?ver=2019-09-26- 115824-583

77. Shall rate build-up be based on Government or Contractor site?

Please note that Price has been removed from the evaluation criteria. Determination of price fair and reasonableness will be determined at the call level.

78. What city and state location shall the rate build-up be based upon?

Please note that Price has been removed from the evaluation criteria. Determination of price fair and reasonableness will be determined at the call level.

79. Are there labor category requirements and/or descriptions for Levels 1, 2, and 3?

See response to Question No. 49 above.

80. Is labor category Level 3 the more senior/expert level?

Yes, see response to Question No. 49 above.

81. Can all volumes be combined into a single PDF file for submission?

Please submit volumes in separate PDFs.

82. In relation to Factor 2: Portfolio Review, will the Government accept links to DI2E project spaces where the Government may need to obtain access to a given project in order to view associated data and details?

Yes

83. Will this contract support AFLCMC/HNCP’s Cyber Enterprise Services (CES) contract requirements at the conclusion of the CES contract’s period of performance of 20 Feb 2021?

At this time, the follow-on acquisition strategy has not been determined for the Cyber Enterprise Services IDIQ.

84. Reference Attachment 3 –Pricing Sheet. The T&M/L-H Rate Buildup tables do not include profit columns. Will profit be proposed for T&M and labor hour task orders when responding to a task order request?

Please note that Price has been removed from the evaluation criteria. Determination of price fair and reasonableness will be determined at the call level.

85. Reference Attachment 1 – ITO SW DevSecOps p. 7, Attachment 3 –Pricing Sheet, and FAR 15.404-1. The Factor 3: Price evaluation states that a “Price Analysis will be conducted”. However, Attachment 3 requires offerors to provide the rate buildup associated with FFP and T&M/L-H rates, which implies a cost analysis rather than a price analysis. Please clarify the Government evaluation plan.

Please note that Price has been removed from the evaluation criteria. Determination of price fair and reasonableness will be determined at the call level.

https://dodcio.defense.gov/Portals/0/Documents/DoD%20Enterprise%20DevSecOps%20Reference%20Design%20v1.0_Public%20Release.pdf?ver=2019-09-26-115824-583 https://dodcio.defense.gov/Portals/0/Documents/DoD%20Enterprise%20DevSecOps%20Reference%20Design%20v1.0_Public%20Release.pdf?ver=2019-09-26-115824-583 https://dodcio.defense.gov/Portals/0/Documents/DoD%20Enterprise%20DevSecOps%20Reference%20Design%20v1.0_Public%20Release.pdf?ver=2019-09-26-115824-583 https://dodcio.defense.gov/Portals/0/Documents/DoD%20Enterprise%20DevSecOps%20Reference%20Design%20v1.0_Public%20Release.pdf?ver=2019-09-26-115824-583

86. Where does the Air Force anticipate the primary places of performance for the DevSecOps support? For example, will most of the individuals be working in San Antonio?

This will be determined at the call level.

87. Are there certain labor categories that the Air Force anticipates will be working in certain regions (i.e. some labor cats will be focused in Colorado Springs while others will be focused in San Antonio and Ogden)?

This will be determined at the call level.

88. In Factor 2: Portfolio Review, the Gov states, “Offerors shall provide a portfolio and/or source code repository with links to demonstrate a technical understanding of DevSecOps engineering, software development, cybersecurity and/or IT support and operations. Offerors may provide information for several Government or commercial clients that they consider most relevant in demonstrating their ability to perform the proposed effort.” Due to proprietary nature of coding and of customer data usage rights, providing a source code repository with links is not possible for all companies.

Instead, would a listing of contract experience as well as applicable labor categories be sufficient instead to show experience and expertise in the required areas?

Yes, a listing of contract experience as well as applicable labor categories be sufficient instead to show experience and expertise in the required areas.

89. Does the Government envision support for Cloud One as a task or tasks under this BPA?

Tasks. The Cloud Services BPA is supplemental to the CloudOne effort.

90. Are remote/contractor work sites authorized? If so, will offerors be asked to propose separate remote/contractor/client site rates?

Contractors are requested to propose a high & average rate to accommodate various work sites.

91. What infrastructure as code tools are currently in use by the LevelUp Pathfinder?

LevelUP uses various tools as listed in the BPA license pricing sheet. For more information, please use the link below:

https://dodcio.defense.gov/Portals/0/Documents/Do D%20Enterprise%20DevSecOps%20Reference%20Des ign%20v1.0_Public%20Release.pdf?ver=2019-09-26- 115824-583

92. The Government specifies that the contractor shall “harden containers following DoD best practices.” Where can these best practices be found?

Please see the “DoD Enterprise DevSecOps Reference Design” Document:

https://dodcio.defense.gov/Portals/0/Documents/Do D%20Enterprise%20DevSecOps%20Reference%20Des ign%20v1.0_Public%20Release.pdf?ver=2019-09-26- 115824-583 https://dodcio.defense.gov/Portals/0/Documents/DoD%20Enterprise%20DevSecOps%20Reference%20Design%20v1.0_Public%20Release.pdf?ver=2019-09-26-115824-583 https://dodcio.defense.gov/Portals/0/Documents/DoD%20Enterprise%20DevSecOps%20Reference%20Design%20v1.0_Public%20Release.pdf?ver=2019-09-26-115824-583 https://dodcio.defense.gov/Portals/0/Documents/DoD%20Enterprise%20DevSecOps%20Reference%20Design%20v1.0_Public%20Release.pdf?ver=2019-09-26-115824-583 https://dodcio.defense.gov/Portals/0/Documents/DoD%20Enterprise%20DevSecOps%20Reference%20Design%20v1.0_Public%20Release.pdf?ver=2019-09-26-115824-583 https://dodcio.defense.gov/Portals/0/Documents/DoD%20Enterprise%20DevSecOps%20Reference%20Design%20v1.0_Public%20Release.pdf?ver=2019-09-26-115824-583 https://dodcio.defense.gov/Portals/0/Documents/DoD%20Enterprise%20DevSecOps%20Reference%20Design%20v1.0_Public%20Release.pdf?ver=2019-09-26-115824-583 https://dodcio.defense.gov/Portals/0/Documents/DoD%20Enterprise%20DevSecOps%20Reference%20Design%20v1.0_Public%20Release.pdf?ver=2019-09-26-115824-583 https://dodcio.defense.gov/Portals/0/Documents/DoD%20Enterprise%20DevSecOps%20Reference%20Design%20v1.0_Public%20Release.pdf?ver=2019-09-26-115824-583

93. Does the Government plan to have technical demonstrations or coding challenges at the BPA Event Day?

The Government is currently working logistics and format. Details regarding Event Day will be provided to attendees as soon as available but no later than 1 November 2019. However, offerors should prepare for a Q&A regarding the technical capabilities cited in their quote.

94. Is there a threshold or limit for individual orders on the BPA?

BPAs do not have a ceiling. However, the Government is working to better define a response to this question and will provided via amendment.

95. Are vendors expected to support ALL CNCF compliant distributions?

No, not expected to support ALL.

96. What levels of support are vendors expected to provide through the help desk? (L1-L3)

The level of support will depend on the requirement at the call level.

97. Will there be direct awards/contracts from responding to this BPA or is this award a down select to competitively bid on task orders released under the BPA?

BPAs will be awarded to those vendors who meet the criteria established. BPA holders will then compete for awards at the call level.

98. What is the pricing evaluation process and criteria for both the BPA and the Task Orders?

Evaluation process and criteria are provided in the ITO. Evaluation criteria will also be identified in each call RFQ.

99. Please confirm that an offerer can be a prime and/or on multiple teams as sub?

Prime BPA holders can only hold one BPA, however, they can participate as a subcontractor/teaming partner.

100. Will the content in the source code repository be excluded from the Factor 2 page limit?

Recommendation is that the contractor provide links to the repository.

101. If the offerer’s portfolio examples contain links as recommended, is the content exempt from the page limit?

Content is exempt from the page limit.

102. How will the government evaluate DevSecOps understanding through links to external end products, like public facing government websites?

It is at the discretion of the vendor to propose a narrative that clearly meets the requirements. The Government does not intend to research links to sources of content, please provide a description of portfolio review. Links may be used to access source code versus content.

103. Is the portfolio intended to be a past performance writeup?

No, past performance is not an evaluation factor.

104. Are contractors required to always work onsite or is remote work also acceptable?

Location will be determined at the call level, work may or may not be at a Government or Contractor site depending on the requirement.

105. Per the note at the end of Factor 2: Portfolio Review, will offerers that provide code repositories be scored higher?

No.

106. In order to support a 24 hour operations and/or business hours (0830-1630) help desk, does the government expect the same level of support after hours as they do during regular office hours (0830-1630)?

The work schedule will be determined at the call level. Support may be required for 24 hour operations. The vendor has the discretion to propose as they see fit.

107. For Labor Rate Pricing, Can the Government elaborate on ‘other locations specified at a later date’?

Can rates be adjusted for locality at the “call level” for future orders?

Please note that Price has been removed from the evaluation criteria. Determination of price fair and reasonableness will be determined at the call level.

108. Pricing Sheet template does not specify Government or Contractor site for rate location, Can the Government add tabs for Government/Contractor Site Rate sheets for each CLIN type?

Please note that Price has been removed from the evaluation criteria. Determination of price fair and reasonableness will be determined at the call level.

109. There are different levels of experience within Cloud Architect, Data Scientist, Help Desk, Programmer/Developer, and Network Engineer LCATs. Would the Government consider Level 1, Level 2, and Level 3 designations for each to be consistent with the other LCATs?

See answer to Question No. 49 above.

110. Will 11 x 17 fold out count as one page?

No, however, the use of 11 X 17 fold out should be limited to the items described in the ITO.

111. The Tech Volume is currently limited to 5 pages, yet the evaluation criteria suggest "great technical detail, be able to co-locate in various geographical locations and provide a robust mechanism for hiring and retaining highly capable personnel". Would the Government consider changing the page count to 7 pages to allow for sufficient detail for these major areas?

The Government believes the page limitations are sufficient to provide a detailed narrative.

112. Based on RFQ requirements, please confirm that during the BPA proposal evaluations, the Government is evaluating prime contractor capabilities only.

Confirmed

113. Attachment 3 – Pricing Sheet: The two “Summary” tabs have hidden Column B which is titled, “Contractor Labor Category”. Are Offerors required to add their Contractor Labor Category here? Is it acceptable to the Government if Offerors leave this field blank?

Please note that Price has been removed from the evaluation criteria. Determination of price fair and reasonableness will be determined at the call level.

114. Attachment 1 – ITO: Section 1. I. (4) Volume IV:

PRICE (FACTOR 3) states on Page 5: “Note that the rates proposed will be considered base rates and locality rates may be applied at the Call level.” On which locality or region should the Offeror’s proposed rates be based? The national average? Colorado Springs, CO?

Please note that Price has been removed from the evaluation criteria. Determination of price fair and reasonableness will be determined at the call level.

115. Will the Government provided the equipment necessary for Call Order execution (laptops, monitors, keyboards, phones, etc.)?

Each individual call will dictate the necessity of

GFP/GFE.

116. What are the differences in requirements between the Labor Category Levels 1, 2, and 3?

See answer to Question No. 49 above.

117. Attachment G – Labor Category LevelUp: All except one of the labor category descriptions state the requirement that resources have the ability to “attain a

Secret security clearance”.

However, Page 6 of Attachment 5 – BPA Guide states, “Work will range from Unclassified to TS/SCI with special access required.” Should Offerors price their BPA rates assuming they must accommodate up to a TS/SCI clearance for any and all proposed labor categories?

Security requirements will be identified at the call level.

Please note that Price has been removed from the evaluation criteria. Determination of price fair and reasonableness will be determined at the call level.

118. Attachment 1 - (2) Volume II: TECHNICAL CAPABILITY (FACTOR 1) – will the Government clarify and/or elaborate on the requirement to “be co-located in various geographic locations.” Are Offerors to show they have offices in various geographical locations, or show their approach to working with and/or supporting teams in various geographical locations, or show their past experience working with teams in various locations?

Offerors should show their approach to working with and/or supporting teams in various geographical locations.

119. Attachment 1 - (3) Volume III: PORTFOLIO REVIEW(FACTOR 2) – how does the government prefer to be given access to source code repositories?

Please clarify. Is the question referring to providing links? Or will additional access need to be granted?

120. Attachment 1 - 2. Basis of Award – Step 3 – Is the government able to provide any details around the BPA Event Day?

The Government is currently working logistics and format. Details regarding Event Day will be provided to attendees as soon as available but no later than 1 November 2019. However, offerors should prepare for a Q&A regarding the technical capabilities cited in their quote.

121. Can you perform a Portfolio Review that is in/on a controlled classified government site/repository? If you cannot review a Portfolio that is on a Government Site, how will you rate the evaluation?

It is at the discretion of the vendor to propose a narrative that clearly meets the requirements. The Government does not intend to research links to sources of content, please provide a description of portfolio review. Links may be used to access source code versus content.

122. On what specific Technical Understanding basis will you measure the Portfolio review to score each rating?

All evaluation criteria as been provided in the ITO.

123. Are you looking for the Portfolio to demonstrate Technical Capability?

Please refer to the evaluation criteria.

124. Are you looking for the Portfolio to demonstrate Technical Experience?

Please refer to the evaluation criteria.

125. How many Large Business will be awarded?

This will be determined once quotes are received and evaluated.

126. How many Small Businesses will be awarded?

This will be determined once quotes are received and evaluated. However, The Government reserves the right to award one (1) or more small business, small business team or joint venture if qualified and eligible for a BPA award. If the Government chooses to exercise this right and two or more small businesses/teams/joint ventures are determined qualified and eligible for a BPA, the Government will consider small disadvantaged business status in its selection for award.

127. Do the reps and certs in Attachment_6_- _Provisions_and_Clauses_-_SW_DevSecOps.pdf, need to be filled out and included with submission? If so, what volume should it be included in? We suggest including it within Volume I: Administrative and updating page count inclusions or requirements.

Please include with Volume I. Reps and Certs will not be counted as part of the page count.

128. Many of our projects are located on the high-side in support of Government programs which require security clearances due to the classification of source code, methodologies, and/or data Can we send links to classified source code repositories? If so, what networks do the evaluators have access to?

The Government will not be accepting classified proposals. The portfolio review is not limited to traditional past performance, intending to allow companies to propose with no DoD experience.

Please provide an unclassified version or write up, if possible or commercial experience.

129. Unclassified source code is often marked FOUO, requiring we lock down source code repositories with at least username/password and SSL security. How should we provide login credentials to our source code repositories? Should we list username/passwords in the Portfolio Review volume?

Do NOT list username/passwords in the Portfolio Review volume. The Government does not intend to research links to sources of content, please provide a description of portfolio review. Links may be used to access source code versus content.

130. Several of our source code repositories are stored on Defense Intelligence Information Enterprise, which is unclassified but requires an account on www.di2e.net in order to access. Do evaluators have access to DI2E?

Yes http://www.di2e.net/

131. Can the Government please describe the BPA Day on November 13? What is the format? Where will it be held?

The Government is currently working logistics and format. Details regarding Event Day will be provided to attendees as soon as available but no later than 1 November 2019. However, offerors should prepare for a Q&A regarding the technical capabilities cited in their quote.

132. For the proposal submittal, would the Government prefer all files saved to a compressed archive (e.g., Zip file), or, as separate attachments in a single email?

Separate attachments in a single email.

133. For Volume II, Portfolio Review.

Please clarify what evidence should be provided if the Offeror’s source code resides on Government systems?

It is at the discretion of the vendor to propose a narrative that clearly meets the requirements. The Government does not intend to research links to sources of content, please provide a description of portfolio review. Links may be used to access source code versus content.

134. For Volume II, Portfolio Review.

Please clarify in addition to the evidence/artifacts that should be provided (via links), what else is required/expected within the 3-page limit in order for Offerors to be deemed “Excellent”?

It is at the discretion of the vendor to propose a narrative that clearly meets the requirements. The Government does not intend to research links to sources of content, please provide a description of portfolio review. Links may be used to access source code versus content.

135. For Volume II, Portfolio Review. The term “technical rigor” is used several times. Please clarify what is meant by “technical rigor” and what is required/expected within the 3-page limit for Offerors to prove the company meets the expected “technical rigor”.

Technical rigor means that the analytical techniques are applied correctly and in an intellectually honest way. It is at the discretion of the vendor to propose a narrative that clearly meets the requirements.

136. For Volume IV, Price. To establish a consistent evaluation of labor categories and rates, will the Government provide the minimum requirements for the following?

years of experience required for each labor category by level (i.e., Level 1, 2, 3) education requirements by labor category level certification requirements by labor category level

Please note that Price has been removed from the evaluation criteria. Determination of price fair and reasonableness will be determined at the call level.

137. For Volume IV, Price. To establish a consistent evaluation of labor rates, will the Government provide what location should be used when completing Attachment 3, Pricing Sheet?

Please note that Price has been removed from the

138. Is there a minimum number of awards to Small Business for this BPA?

Not at this time. However, the Government reserves the right to award one (1) or more small business, small business team or joint venture if qualified and eligible for a BPA award. If the Government chooses to exercise this right and two or more small businesses/teams/joint ventures are determined qualified and eligible for a BPA, the Government will consider small disadvantaged business status in its selection for award.

139. What events will occur at BPA Event Day?

The Government is currently working logistics and format. Details regarding Event Day will be provided to attendees as soon as available but no later than 1 November 2019. However, offerors should prepare for a Q&A regarding the technical capabilities cited in their quote.

140. For BPA Event Day, will invited offerors be expected to complete a sample task?

The Government is currently working logistics and format. Details regarding Event Day will be provided to attendees as soon as available but no later than 1 November 2019.