AMA QAs 5Aug2020.pdf

AMA QUESTIONS / RESPONSES

FA8307-20-R-0112

Software DevSecOps Services 5 August 2020

QUESTIONS RESPONSES

1. Will foreign nationals attend Orals for the Government? If so, all Orals presentations will have to be approved through Export Control.

The Government will not have foreign nationals in attendance for orals. If the company is going to have foreign nationals attend they need to coordinate with the Government to work what is necessary in advance.

2. What is the Ceiling for the BOA? There is no ceiling.

3. Are there any OCI concerns with this BOA? OCI concerns will be handled at the order level.

If the vendor believes there is an OCI concern with the basic BOA they need to identify the OCI (potential or real) and provide an OCI mitigation plan with their quote.

4. #45

The Government will not have foreign nationals in attendance for orals. If the company is going to have foreign nationals attend they need to coordinate with the Government to work what is necessary in advance.

5. What number of awards are set aside for small businesses?

There are no intended percentages. The Government reserves the right to execute one or more small business, small business team, or joint venture if qualified and eligible for the BOA.

If the Government chooses to exercise this right and two or more small business/teams/joint ventures are determined qualified and eligible for a BOA the Government will consider small disadvantaged business status in its selection for a BOA.

6. Our clients have concerns on us showing their source code. Can we show our demo source code?

The Government will not be accessing the Offerors source code. Offerors should be prepared to virtually present a portfolio and/or source code repository if selected to participate in the Oral Presentation/Portfolio Review (Subfactor 1.2). Yes you can show Demo source code.

7. What are the potential customer agencies that will use this BOA?

The DoD are the potential customer agencies that will utilize the BOA.

8. We noticed that 3 vendors got awarded roughly 6 months ago, why did this got reopened in 6 months or so.

The current BOA is still in place. The Government intends to do at least annual onboarding for the Software DevSecOps Services BOA.

9. What is the existing usage of the BOA (ie: what is the value of Task Orders awarded to date, etc.)?

BOA is currently being utilized by the Platform One office and other AF organizations. Current value of orders to date is $102M.

10. are you expecting a single company to be able to perform all 5 SOO objectives?

Yes. Vendors must demonstrate their ability to meet all SOO requirements in order to be determined the most capable of satisfying the Government's requirements

11. Will the Government will use any Foreign Nationals during the Orals Evaluation?

The Government will not have foreign nationals in attendance for orals. If the company is going to have foreign nationals attend they need to coordinate with the Government to work what is necessary in advance.

12. Do graphics count as part of the 5-page count or count as a whole page for Volume 2, Subfactor 1.1 Technical Capability?

If graphics are included in the text then it goes against the page count for that volume. If the graphic is a standalone graphic on one page it will go against the page count.

13. Do the contractors need to have any level of secret clearance?

The clearance levels for FTE's will be determined at the order level. If a company does not have a facility clearance the Government will sponsor the clearance as necessary at the order level award.

14. Of the Orals 15 to 30-minute timeslot, how much of that time should be reserved for Q&A?

The offerors should allow 5 minutes for Q&A.

15. From Q&A #59 Can you explain what is meant by "personnel" and not the contractor only managing the platform that you confirmed as a correct statement? Which personnel are being referenced here as not managing the platform?

Contractors will be used to manage the platform if dictated by the task order at that level

16. Can you provide clarification as to whether the Offerors Representations and Certifications and fully executed NDA should be separate document attachments to Volume 1 or incorporated into the Volume 1 as Enclosures?

There is no longer a requirement for a NDA.

Offerors are required to complete Reps and certs in accordance with FAR52.212-3 and 52.212-3, Alt 1. Please submit with volume 1.

Incorporated is allowed.

17. How many RFQs does the Government anticipate issuing in a single year on this BOA?

The amount of orders is unknown due to the fact that it is a decentralized contract vehicle. It will depend on the need of the customers.

18. Are Offerors required to modify the Attachment 5 to conform with the formatting instructions provided (ie: margins, font type, font size, etc.)?

Attachment 5 is not subject to the margins and font size etc.

19. Are Orals expected to be strictly unclassified? If not, what is the highest level of classification of materials that can be presented during orals?

The orals will be unclassified.

20. What is the mix (roughly speaking) of small to large business in the current pool of awardees?

The current mix is 10 small business and 9 large business.

21. Since any DOD organizations can use this BOA, i'm assuming any Contract Officer has the ability to cut an order via this BOA?

Yes once they are provided decentralized authority.

22. From Q&A #142 - The answer is confusing. Can you please confirm that Volume I is a stand-alone document and Volume II is an additional stand-alone document and these two files equal one submission?

Yes

23. For companies with a very broad portfolio of programs and products, and given limited tech volume page count and limited time during orals:

what technical areas or product/program types should they be focusing on highlighting in their Orals/portfolio?

Offerors should determine how they will demonstrate their ability to meet all the requirements of the RFQ within their quote. The SOO is general in nature so that your company can decide what it would like to present in technical detail needed to demonstrate knowledge and experience associated with the

SOO.

24. Reference the answer to question 134. Yes you can use graphics in your technical narrative. If a graphic takes up an entire page then it counts as a page. If an 11X17 fold out is used, it counts as two pages. If the graphic and or text box is on the page within the text it is just part of the count for that page.

25. Is there a possibility that the deadline for submission will be extended, since there are still some Q&A's still pending?

Quote due date has been extended to 10:00 AM CDT on 12 August 2020.

26. What are the potential customer agencies that will use this BOA?

The DoD are the potential customer agencies that will utilize the BOA.

27. Reference the answer to question 134. Is it a typo that a graphic would count as one page in the RFQ response?

Yes you can use graphics in your technical narrative. If a graphic takes up an entire page then it counts as a page. If an 11X17 fold out is used it counts as two pages. If the graphic and or text box is on the page within the text it is just part of the count for that page.

28. In the context of the SOO scope - will you evaluate a vendor more favorably in either the initial eval or orals if their experience aligns with the current platform technology baseline i.e. k8, istio, etc.

It is considered a strength to have experience in core DevSecOp Initiative technologies such as Kubernetes and Service Meshes. A great guide is the DoD CIO’s DevSecOps reference architecture because it focuses on tool functions not specific tools. However, we are also interested in most technology in the Cloud Native Computing Foundation (CNCF) ecosystem which is ever evolving. We expect Offerors to have expertise in core technologies and an understanding of how to implement those popping up. Also to clarify, this is the P1 baseline not the UP baseline.

29. Can you provide more insight on the 15-30 minute Oral session. Will you be providing specific questions or topics for bidders to answer during the session?

No the Government will not be providing specifics questions or topics for Offerors to answer during the session.

30. From Q&A #9 - the answer of "final response pending" seems to conflict with other answers for Q20, 48, 49, etc. that say offerors must demonstrate their ability to meet all SOO requirements. Please confirm responses must address all teams, not just choose the 2 or 3 they have expertise in.

Question 9 now includes a response. See Attachment 6 – Revised QAs, included with this Amendment.

The SOO requirements are not about addressing 5 teams. It is five potential areas of need for this BOA. Vendors must demonstrate the ability to meet all SOO requirement areas. The order level requirements may be all 5 areas or just 2 areas.

That is why it is important to address all areas as stated in the ITO.

31. Is the government looking for the contractor to provide a proposed solution to the five objectives in the SOO, or instead is the government looking for staff augmentation services that can assist the government in these five objective areas?

Both with the pace of the CNCF ecosystem the Government is always looking for vendors that have evaluated new technologies, incorporated, integrated and have shown the ability to run it at scale. Also looking at staff augmentation and growing our team as demand grows.

32. Is the Oral expected to be virtual or face 2 face? Virtual

33. Clarification on question 110 answer. Does the government consider the JV a separate prime thus allowing a company to propose as a prime and as part of a JV?

Offerors can quote as a Prime and as part of a JV. However, if submitting a quote under the same CAGE Code, and both are eligible for BOA, then only the JV will be the BOA awardee. If submitting under different CAGE Codes, then both will be eligible for a BOA.

34. Do graphics, of any kind, count as a single page by themselves when placed in-line with text in an 8.5x11 page? Or do the graphics placed in-line with text count in the overal 5-page count?

If a graphic takes up an entire page then it counts as a page. If an 11X17 fold out is used it counts as two pages. If the graphic and or text box is on the page within the text it is just part of the count for that page.

35. Reference question 134. If a graphis is smaller than a full page, would it be included in the page count or count as a full page.

If a graphic takes up an entire page then it counts as a page. If an 11X17 fold out is used it counts as two pages. If the graphic and or text box is on the page within the text it is just part of the count for that page.

36. To clarify graphics, would a graphic that consumes half an 8.5 x 11 page count as 1 entire page?

If a graphic takes up an entire page then it counts as a page. If an 11X17 fold out is used it counts as two pages. If the graphic and or text box is on the page within the text it is just part of the count for that page.

37. Can we propose new technologies related to DevSecOps in the technical response?

Yes

38. How many people are accepted at the oral presentation?

There can be as many attendees as necessary;

however, one person should be in charge

39. Can you confirm that responding to the request to “provide your firm’s capabilities to meet the general scope” (from the SOO) means addressing the four teams and the IT support & operations and the bullet points given for each?

The SOO requirements are not about addressing 5 teams. It is five potential areas of need for this BOA. Vendors must demonstrate the ability to meet all SOO requirement areas. The order level requirements may be all 5 areas or just 2 areas.

That is why it is important to address all areas as stated in the ITO.

40. Where can we get a tech stack for DevSecOps at DoD?

https://software.af.mil/dsop/documents/

41. What is the anticipated timeline between notification for Highly Capable rating and the schedule for orals presentation?

The turnaround will be quick. As stated in the ITO the tentative date for notification of attending orals is 2 September and the tentative date for orals is 9-10 September.

42. If we convert Att. 5 into a Word Doc [for reps and certs requirement for Vol. 1] -- do we have to convert the font size to 12?

No

43. Is a text box considered a graphic and therefore, according to your previous answers, is considered a full page?

If a graphic takes up an entire page then it counts as a page. If an 11X17 fold out is used it counts as two pages. If the graphic and or text box is on the page within the text it is just part of the count for that page.

44. Given that there is COVID concerns will this round of oral presentations be remote?

Yes

45. Is any graphic considered as a page itself even though its emebedded in a part of the page?

If a graphic takes up an entire page then it counts as a page. If an 11X17 fold out is used it counts as two pages. If the graphic and or text box is on the page within the text it is just part of the count for that page.

46. Why does a graphic that occupies less than a page, count as one (1) page? Typically, graphics and text narrative are combined into a page as long as the graphic (or table) uses 10 point font?

If a graphic takes up an entire page then it counts as a page. If an 11X17 fold out is used it counts as two pages. If the graphic and or text box is on the page within the text it is just part of the count for that page.

47. If our team has done some work with some of the DevSecOps tools from PlatformOne, is that ok if some of that work is found in our portfolio?

Yes

48. what is the website where the devsecops records design repository lives that the Capt just referenced?

https://repo1.dsop.io/users/sign_in -https://p1.dsop.io/#/

49. For the 5 page technical capability document.

What is meant by great technical detail in the statement below in the evaluation criteria "Highly Capable indicates that the company thoroughly discusses how it will meet the general scope of the agreement in great technical detail."?

The specifics of how code has been implemented and being specific across tools and orchestration would be great detail. There can never be enough detail in what you submit.

50. Is it safe to say graphics is not preferred? Vendors should submit the technical capability in a format that depicts a great technical understanding of the SOO.

51. We have small graphics embedded in our pages but our total page count is 5 pages. Is this acceptable?

Yes as long as other specifics of the ITO have been followed.

52. when you’re asking for reps and certs, is it acceptable to submit our company report from SAM.gov under FAR reps & certs tab?

Yes

53. Many large companies have numerous program, product, and experience examples that cover all of the 5 requirements in the SOO. Are any areas more important than others? Should we focus on certain technical areas to highlight during the Orals presentation?

Offerors must demonstrate their ability to meet all SOO requirements in order to be determined the most capable of satisfying the Government's requirements. All areas are equally important.

54. When are slides for the Orals Presentation due, if selected?

There is not a requirement for slides. The vendors will present in a way they best see fits the requirements of the ITO.

55. Given the three criteria, which are more important, if any: indicates that the company thoroughly discusses how it will meet the general scope of the agreement in great technical detail, is able to co-locate in various geographical locations, and provides a robust mechanism for hiring and retaining highly capable personnel to perform services.

As stated in the ITO there are no weighted areas.

Sending Offerors must demonstrate their ability to meet all SOO requirements in order to be determined the most capable of satisfying the Government's requirements

56. Do you know what teleconference app you'll use for Orals? Zoom, MS Teams, etc?

Zoom

57. What government agencies will be able to use the BOA?

The DoD are the potential customer agencies that will utilize the BOA.

58. when will the Air Force repository website be posted?

All websites listed during AMA are listed at the end of Q&A.

59. What specifics are you looking for in requirement "Co-located in geographic location"

Offerors need to show the ability to supply teams to multiple locations. The actual team requirement location will be determined at the order level. Due to COVID there has been an increase in teleworking. This also would affect location but will be addressed at the order level.

60. Do you plan to include/allow ODC type funding for specialized technical support services (current or future projects)?

Yes. This information will be provided at the order level as well as, all funding and or types of funding will be determined at the order level

61. When does the Government anticipate releasing the modification (with today's recording)?

The Government intends to release the amendment early next week Monday or Tuesday

62. Do you see this program interacting with the VAULT effort out of the OCDO? If so, is their an interest in offerors providing strategies to further integrate data and solutions?

The Government is not naming specific programs.

63. Will the Government be extending the response deadline given today's AMA session and awaiting formal release of today's answers to questions?

Quote due date has been extended to 10:00 AM CDT on 12 August 2020.

64. Is there any possibility of extending the RFP response date?

Quote due date has been extended to 10:00 AM CDT on 12 August 2020.

65. If our portfolio has K8s, but maybe not istio, does that disqualify our portfolio for this effort?

No

66. Are you interested in embedded/aircraft systems migration to DevSecOps (strangler pattern, microservices, virtualization of hardware, etc.)?

Yes

67. Will the government ask for access to our code respository in advance of the orals, only at the orals, or/and for a period of time after the oral presenation is over?

The Government will not be accessing Offerors source code. Offerors should be prepared to virtually present a portfolio and/or source code repository if selected to participate in the Oral Presentation/Portfolio Review (Subfactor 1.2).

68. Is a portfolio submission required for the first phase of the submission? Or only for orals?

Only for the oral presentation.

69. Could you please repeat what you stated about providing Read access to a code repository? Will the Gov't be reviewing code separately from what is presented during Orals?

The Government will not be accessing the Offerors source code. Offerors should be prepared to virtually present a portfolio and/or source code repository if selected to participate in the Oral Presentation/Portfolio Review (Subfactor 1.2).

70. Will the Government release the names of people and/or company names of AMA attendees?

No

71. What is the micro-purchase threshold to enable an ordering activity to place orders directly with a BOA Holder? (Page 4, Attachment 4)

Micro-purchase threshold is currently $10K.

Orders under 10K can be directly awarded to a BOA holder

72. Are there any DevSecOps technologies or management systems your agency has disliked working with or was harder to manage than preferred technologies or systems- or is what you're requesting a completely new management system

The Government is unopinionated and let the programs we work with pick what they want for their development teams.

73. The second paragraph of the SOO says, "In addition, the Offeror shall propose their strategy to build and operate multi-tenant shared services that support software development teams, such as event streams, databases, data analytics, message queues, storage, and logging." How does this map to the work to be performed by the 5 teams, or is it a separate requirement that should be described in the response?

The SOO requirements are not about addressing 5 teams. It is five potential areas of need for this BOA. Vendors must demonstrate the ability to meet all SOO requirement areas. The order level requirements may be all 5 areas or just 2 areas.

That is why it is important to address all areas as stated in the ITO.

74. Is there a public list available of who is already on this opportunity?

https://software.af.mil/wp-content/uploads/2020/05/Platform-One- BOAs_Distro-A.pdf

75. To compliant and capable, are we required to address the details of all five teams to the level of detail used in the SOO?

The SOO requirements are not about addressing 5 teams. It is five potential areas of need for this BOA. Vendors must demonstrate the ability to meet all SOO requirement areas. The order level requirements may be all 5 areas or just 2 areas.

That is why it is important to address all areas as stated in the ITO.

76. can you spell Mr. Shalon and his LinkedIn? Nicolas Chaillan https://software.af.mil

77. Will Small Business BOA holders be able to bid on F&O tasks or only SB reserved Tasks?

All BOA holders are eligible to quote on orders.

78. If two BOA holders decide to team at the Call Order level, would that count against the Off Ramping criteria?

No but offerors must inform the Contracting office if they are teaming.

79. There was an answer in the QA that said more info on how to address the 3 Page SOO in a 5 page Response...which parts are instructional vs requirements would be coming. When will that be provided?

See Attachment 6 – Revised QAs

The SOO requirements are not about addressing 5 teams. It is five potential areas of need for this BOA. Vendors must demonstrate the ability to meet all SOO requirement areas. The order level requirements may be all 5 areas or just 2 areas.

That is why it is important to address all areas as stated in the ITO.

80. I believe you already answered that in the Q&A that the SOO scope is the 5 teams and their subordinate bullets.

The SOO requirements are not about addressing 5 teams. It is five potential areas of need for this BOA. Vendors must demonstrate the ability to meet all SOO requirement areas. The order level requirements may be all 5 areas or just 2 areas.

That is why it is important to address all areas as stated in the ITO.

81. So the contractor will build a system that will then become a hub or repository for in-house agency stakeholders to choose what devsecops systems or functions they need?

Specifically for Platform One it is our job to build robust infrastructure as code/configuration as code that we can deploy infrastructure agnostic so that people can then choose the opinionated bootstraps as desired.

82. Q&As stated that "Prime BOA holders can only hold one BOA," but can primes submit 2 bids, one as a large biz prime and one a MPJV? If both entities are elegible for award, would the Gov pick the which company gets an award?

Offerors can quote as a Prime and as part of a JV. However, if submitting a quote under the same CAGE Code, and both are eligible for BOA, then only the JV will be the BOA awardee. If submitting under different CAGE Codes, then both will be eligible for a BOA.

83. Q29 is the one with Final Response Pending See Attachment 6 – Revised QAs.

All offerors must demonstrate their ability to meet all SOO requirements in order to be determined the most capable of satisfying the Government's requirements. The following areas and their respective bullets are considered the general scope: 1)provide support to platform development teams 2) provide support to platform & product onboard teams 3)provide support to product development teams 4)provide support to cybersecurity teams and 5)provide support to information technology support & operations

84. Is there an average team size or FTE count to expect on the Call Orders?

No

85. Does prior knowledge, skills, and experience of employees (before they joined the company) count towards meet technical criteria?

Personal experience is acceptable.

86. WHo from the P1 Team or the Gov will be attending the Orals presentations?

The names will not be provided.

87. Would there be a consideration to socio-economic status bidders or have different tracks for sb and large businesses?

The Government reserves the right to execute one (1) or more small business, small business team or joint venture if qualified and eligible for a BOA. If the Government chooses to exercise this right and two or more small businesses/teams/joint ventures are determined qualified and eligible for a BOA, the Government will consider small disadvantaged business status in its selection for a BOA.

88. Can you share your SB Goal percentage contract $s?

Government is not providing this information.

89. What kind of presentation of actual code samples do you expect to see during orals briefs?

This can take up quite some time out of the 30 mins to present and go over code / scripts, etc. Would demos or videos of working code be preferable?

It is up to the offeror to best show how they will demonstrate the factors in the ITO. There is not a requirement to show source code.

90. How long (length of presentation) do the Orals typically last?

As stated in the ITO the oral presentations will be 15-30 minutes.

List of reference links from AMA:

https://dodcio.defense.gov/Portals/0/Documents/DoD%20Enterprise%20DevSecOps%20Reference%20 Design%20v1.0_Public%20Release.pdf?ver=2019-09-26-115824-583 https://software.af.mil/dsop/documents/ https://p1.dsop.io/#/ https://software.af.mil/wp-content/uploads/2020/05/Platform-One-BOAs Distro-A.pdf https://repo1dsop.io/users/sign_in

AMA recording (Please note written responses take precedence):

https://us02web.zoom.us/rec/share/_89FA5fzq31IRLfT5HrhfIkMR6j6T6a8gXVMr_cIzk1rHd8Vd2wQcOAZ JVt-m8Xo?startTime=1596221751000 https://dodcio.defense.gov/Portals/0/Documents/DoD%20Enterprise%20DevSecOps%20Reference%20Design%20v1.0_Public%20Release.pdf?ver=2019-09-26-115824-583 https://dodcio.defense.gov/Portals/0/Documents/DoD%20Enterprise%20DevSecOps%20Reference%20Design%20v1.0_Public%20Release.pdf?ver=2019-09-26-115824-583 https://software.af.mil/dsop/documents/ https://p1.dsop.io/#/ https://software.af.mil/wp-content/uploads/2020/05/Platform-One-BOAs%20Distro-A.pdf https://repo1dsop.io/users/sign_in https://us02web.zoom.us/rec/share/_89FA5fzq31IRLfT5HrhfIkMR6j6T6a8gXVMr_cIzk1rHd8Vd2wQcOAZJVt-m8Xo?startTime=1596221751000 https://us02web.zoom.us/rec/share/_89FA5fzq31IRLfT5HrhfIkMR6j6T6a8gXVMr_cIzk1rHd8Vd2wQcOAZJVt-m8Xo?startTime=1596221751000