Attachment 6 - Revised QAs 5Aug2020.pdf

REVISED QUESTIONS / RESPONSES

FA8307‐20‐R‐0112

Software DevSecOps Services 30 July5 August 2020

QUESTIONS RESPONSES

1. Is this considered a ‘re‐solicitation’ for the

DevSecOps BOA, previously issued via

FA830719R0133?

This is a new RFQ to onboard additional vendors to the current Software DevSecOps Services BOA previously awarded via FA830719R0133.

2. Do any awards that were made as part of

FA830719R0133 still hold? Or are these no longer applicable? (e.g. FA830720G0040, FA830720G0041, etc.)

The current BOA holders still hold. As stated above, this is a new RFQ to add additional contractors to the current Software DevSecOps Services BOA pool previously awarded via

FA830719R0133.

3. Is this previous solicitation (FA830719R0133) to be considered no longer active?

FA8307‐19‐R‐0133 is no longer active. Offerors must respond to this RFQ to be considered for receipt of a BOA.

4. Our company uses many commercial best practices. One of those practices is to recruit/retain the most talented folks we can and setup Agile virtual environments to take advantage of their talent. Is the government open to executing the BOA in this model, with engineers working virtual to the sites listed, or do all the engineers have to be located at the sites listed in the SOO (understanding that a few more will be added).

The location of work will be established at the order level.

5. Will the agency consider the commercial past performance in lieu of CPARS?

Past Performance is not an evaluation factor. As stated in the ITO, the Government may use information obtained from other sources, for example CPARS, to determined responsibility.

6. Should we assume the Agile managers will be reporting to the Government program management office? There is no program management function required from the contractor?

This will be determined at the order level.

Depending on the tasking, vendors may be combined with other teams comprised of Government and other contractors which makes contractor program management unnecessary.

7. Subfactor 1.1 specifically asks for hiring and maintaining qualified personnel for multiple locations, does it mean it is more of a staffing for DevSecOps services? Does the government expect

Final response pending.

Yes, over the course of the BOA, vendors may be required to provide qualified personnel for more of Agile development and operational support capabilities from the contractor?

DevSecOps services on multiple orders and locations; therefore, your company will be evaluated on your ability to scale, including the ability to increase labor for potential surge requirements in the future. Yes, Agile and Operational support capabilities are expected.

8. Is there any specific reason the current platform development teams are located only at Colorado Springs, CO location?

The Platform One development team’s span beyond Colorado Springs, CO.

9. Is it a mandatory to meet the SOO requirements for all the streams (5 teams)? Can we choose 2 or 3 team capabilities and give more emphasis based on our experience in the response?

Final response pending.Yes, Offerors must demonstrate their ability to meet all SOO requirements in order to be determined the most capable of satisfying the Government’s requirements.

It is up to the Offeror to determine what information they want to present in their quote in order to satisfy the requirements of the RFQ.

10. Should we expect only the labor categories (LCATS) in the attachment 3 for all BOA orders? Will there be any additions to the LCATS during the BOA period? We don’t see any LCATS related to Database Analyst, Database Administrator, Data Modeler, QA Testers, etc., Irrespective of the delivery methodology (Agile, DevSecOps) we believe these LCATS may be required for any product and platform development.

Additional labor categories may be included at the order level. Those categories and qualifications will be identified in the RFQ for that specific order.

11. Do the agency accept the commercial projects source code repository during oral presentation?

Commercial project source code repositories can be presented during oral presentations as long as the offerorOfferor can present it virtually.

The Government, itself, will not be accessing it.

12. What is the tentative timeline for Oral Presentation if selected?

Details regarding the Oral Presentation will be provided to those who receive a Highly Capable rating in Subfactor 1.1 on or about 2 September.

However, Offerors should expect a short timeline; no more than a week from notification.

13. Can you provide a template or example for the quote? As a Small business, we are at a natural

The Government does not have a template to provide.

disadvantage against those that have done this before. Any template or example will be useful.

14. In the past we have been told there was a fee paid to the government of $150K to onboard onto

Platform 1 (for a small dev team), should we include this as a part of the quote or should we assume this is included as a part of RFQ?

This is not accurate information. There is not a fee for vendor onboarding to the DoD DevSecOps Basic Ordering Agreements.

15. What section should the actual quote be in?

Should the quote be broken down or just a lump sum?

Please refer to the ITO for submission instructions.

16. There are two parts to the quote: The effort to onboard and then to sustain the effort through 2025. Should the quote be broken up?

There are two parts to the quote: Volume I – Administrative and Volume II – Technical. The agency is requiring one whole, complete quote.

The quote should not be broken up and Offerorsofferors should demonstrate their ability to satisfy all the requirements of the RFQ.

17. Is there a template for the technical section?

The questions that must be answered. It is confusing since they are spread across 6 attachments.

The Government does not have a template to provide. Please refer to the ITO for submission requirements.

18. Onboarding onto platform one would likely require design changes and product improvements, can we expect to have access to DoD users as “sponsor users” to conduct human centered design exercises?

Yes

19. Is there a template for how to list the actual quote (the $$ amounts)? Should it be milestone based? OKR? What is preferred? Can you provide an example.

The Government does not have a template to provide. Pricing is not required for this RFQ.

Pricing is only required/reviewed at the order level.

20. The SOO has five objectives, can a company provide an RFQ to cover just one objective or do they need to be able to do all of the objectives in the

SOO?

Offerors must demonstrate their ability to meet all SOO requirements in order to be determined the most capable of satisfying the Government’s requirements.

21. In section (2)(a) of Attachment 1, it mentions “…and be co‐located in various geographic locations.” Does this mean the business has to have employees co‐located in various geographic locations at the time of submission, or does this

The location of employees will be determined at the order level. Your company needs to articulate your ability to provide labor onsite or virtually depending on the Government’s requirement at the time the order is solicited.

mean the business has to articulate its ability to do so?

22. Can the business submitting the quote substitute prior personal work experience (e.g., standing up CI/CD pipelines as an employee for prior companies, standing up tooling that aligns with a GitOps approach for IR&D efforts as an employee for prior companies), especially if it is a newly established business?

Final response pending. Offerors should determine how best to demonstrate prior work experience as it relates to the RFQ. Personal work experience is permissible to include and may be considered for relevancy and may be determined acceptable.

23. For the up to 25 BOAs the Government anticipates issuing, what is the intended percentage mix of large and small businesses?

There are no intended percentages. The Government reserves the right to execute one

(1) or more small business, small business team or joint venture if qualified and eligible for a BOA. If the Government chooses to exercise this right and two or more small businesses/teams/joint ventures are determined qualified and eligible for a BOA, the Government will consider small disadvantaged business status in its selection for a BOA.

24. Will the Government consider Offeror’s that do not have an existing Facility Clearance?

Yes the Government will sponsor Facility Clearances, if necessary.

25. In Subfactor 1.2 – Oral Presentation/Portfolio Review the Government requests demonstration of a “source code repository.” ‐ For projects of a CLASSIFIED nature or where the code belongs to the government, or both, is an explanation of scope/outcome of relevant projects acceptable in lieu of source code repository demonstration?

Source code is preferred but if it isn’t possible do your best to explain outcomes achieved for DoD users.

26. Can the Government specify/clarify which Cloud environments are currently being supported or which support is desired in the future?

AWS and Azure from various Government IaaS programs but we are infrastructure agnostic so we will add to the code base as customer demand drives the roadmap.

27. Section 1.J. of the ITO indicates there are two volumes to be submitted for this BOA (Administrative and Factor 1: Technical). Section 2 indicates that reps & certs (which we assume to be Attachment 5) must be submitted. Could the government provide an updated list of all documents to be submitted for this BOA?

Offerors are required to complete Reps and Certs in accordance with FAR 52.212‐3 and 52.212‐3, Alt I. Please submit with Volume I. ITO has been updated to reflect submission requirements.

28. Section 1.J. of the ITO states “All submissions shall reference the complete RFQ number.” Does the Government mean that the RFQ number should be put in the email subject line?

Yes and include with quote volumes.

29. It is difficult to tell what parts of the SOO are strictly informational and what parts need to be addressed in the technical volume. Can the Government give some idea of the overall structure it would like to see for the technical volume?

Final response pending.Please refer to the ITO for the requirement for the technical volume.

30. Would the Government consider Arial 8pt font for tables and graphics

Tables and graphics font will remain as listed in the ITO.

31. We are a little unclear around the instructions for executing NDAs with the A&AS companies. Are we supposed to execute NDAs? If so, where should we include the executed documents?

The Government is not requiring Offerors to execute a NDA. It is up to the Offeror to determine if they want to execute a NDA with the firms listed inno longer utilizing A&AS support for this RFQ, therefore the ITO. If submitting a fully executed NDA, please include in Volume I. ITO has been updatedrevised to include thisremove the NDA information.

32. Will cover page and table of contents be counted in the page limits of 2 and 5 for Administrative and

Technical respectively?

As stated in the ITO, page limits do not include covers for volumes, tables of contents, glossaries of abbreviations and acronyms, indices, title pages, cross reference indexes, section dividers/tables if they are inserted solely to provide ease to the reader in locating parts/sections of the quote, and pages marked

“This page intentionally left blank”.

33. Roughly how many vendors will proceed to the

Phase 2 (Orals) if the total number of vendors being awarded is up to 25?

That will be determined after review of Subfactor 1.1.

34. Will prior experience with the Air Force be a factor in the evaluation?

Please reference the ITO.

35. How many people from one vendor can attend the orals phase?

Oral presentations will be virtual. Your company can have as many attendees as necessary;

however, one person should be in charge.

36. Will the orals be virtual or in‐person?

Virtual

37. Will debriefs be provided for all phases?

Debriefs will be provided as requested and IAW applicable regulations.

38. Please confirm whether source code repositories need to be provided for Subfactor 1.1 or Subfactor 1.2?

Do not provide source code repository information with the quote. Offerors invited to Oral Presentation/Portfolio Review (Subfactor 1.2) should be ready to present their source code repository.

39. Will Orals be virtual or in person? Virtual

40. How many participants may offerors have in their Orals presentations?

Oral presentations will be virtual. Your company can have as many attendees as necessary;

however, one person should be in charge.

41. Will offerors be able to have engineers from the portfolio samples on standby to help answer Government questions during Orals?

Oral presentations will be virtual. Your company can have as many attendees as necessary;

however, one person should be in charge.

42. If Orals will be virtual, what technology will be used? I.e., Skype, ZoomGov, etc.?

This is still being determined. Oral Presentation/Portfolio Review (Subfactor 1.2) notices will include this information.

43. If the Orals are to be done in‐person, what connectivity will the presenter have in order to connect with the portfolio?

N/A – Oral Presentation/Portfolio Review will be conducted virtually.

44. Does the Government expect the contractor to provide the evaluators access to the portfolio following its presentation at Orals?

No

45. Will the Government verify citizenship of the staff receiving Orals presentation, in order to allow defense contractors to present ITAR / Export Controlled software?

Your company will need to notify the Government in your quote if special arrangements need to be considered.

46. What is the general scope that offerors shall cover in their Volume 2 Technical Capability document?

Refer to the ITO and RFQ documents.

47. Will the Government increase the page count for the Technical Capability document to 7 pages? We believe this is required to cover the SOO general scope and other items.

No, the Government will not increase the page count. Offerors should be as complete and concise as possible within the page limit stated in the ITO.

48. What part of the SOO is considered the general scope to be addressed in the ITO Section J.2.B Technical Capability documents response to the General Scope?

The following areas and their respective bullets are considered to be the general scope: 1) provide support to platform development teams, 2) provide support to platform & product onboarding teams, 3) provide support to product development teams, 4) provide support to cybersecurity teams, and 5) provide support to information technology support & operations

49. Is "General Scope" (that offerors shall cover in Volume 2 Technical Capability) defined as the following SOO requirements: 1) provide support to platform development teams, 2) provide support to platform & product onboarding teams, 3) provide support to product development teams, 4) provide support to cybersecurity teams, and 5) provide support to information technology support & operations?

Yes and their respective bullets

50. Will the SOO requirements, numbered 1‐5 in the previous question, be evaluated with equal importance assigned to each?

Final response pending.Please refer to the ITO for evaluation criteria. The SOO requirements are of equal importance. Orders may or may not include all tasks outlined in the SOO; therefore, the Government is looking for well‐ rounded companies that can satisfy all the SOO requirements.

51. Are there are any of the SOO requirements that are more desired for this on ramp than others, and will the Government identify them?

Please refer to the ITO for evaluation criteria

52. Does the BOA contain any set‐asides for small businesses and related classifications as designated by the SBA?

The Government reserves the right to execute one (1) or more small business, small business team or joint venture if qualified and eligible for a BOA. If the Government chooses to exercise this right and two or more small businesses/teams/joint ventures are determined qualified and eligible for a BOA, the Government will consider small disadvantaged business status in its selection for a BOA. Note ‐ Small business set‐asides are determined with BOA order RFQ.

53. What is the expected frequency of requests for manpower and resources from the contractor?

The usage of these BOA’s will be decentralized to other organizations within DoD. It is difficult to ascertain how many requirements will actually be realized by Platform One Customers.;

however, offerors should demonstrate the capability to meet potential surge requirements in the future.

54. How will labor categories be defined in terms of maximum and minimum billing rates?

The Government is not requesting pricing with this RFQ. Rates will be requested with the RFQ for specific orders.

55. ITO page 3, Section J, 2nd paragraph. – “Fold‐ outs may be used for tables, figures, and charts only, on 11 x 17 paper and not less than Times New Roman 10 pt. font. Page limits do include fold‐outs.”

Would the Government confirm 11 x 17 counts as one (1) page?

Yes, however, 11X17 fold‐outs count as two (2) pages.

56. ITO page 2, Section F, C – Would the Government please confirm if the NDAs should be submitted separately from the quote and emailed to Ms.

Fernandez, with a copy to Ms. Charles and Ms.

Davenport?

Please include fully executed NDAs with Volume I. The Government is no longer utilizing A&AS support for this RFQ, therefore the ITO has been revised to include this remove the NDA information.

57. ITO page 2, Section F, C – If the NDAs are expected to be submitted with the quote, would the Government please confirm if the NDAs should be submitted as an attachment to Volume I and emailed to Ms. Fernandez, Ms. Charles, and Ms.

Davenport?

Please include fully executed NDAs with Volume I. The Government is no longer utilizing A&AS support for this RFQ, therefore the ITO has been revised to include this remove the NDA information.

58. ITO page 6, Section 4 of Factor 1: Technical – states “4. Although past performance will not be used as an evaluation factor, such information obtained from other sources available to the Government, e.g., the Contractor Performance Assessment Reporting System (CPARS).”

Would the Government allow Offerors to name its relevant past performances?

Past Performance is not an evaluation factor. As stated in the ITO, the Government may use information obtained from other sources, for example CPARS, to determine responsibility.

59. SOO page 2, Platform & product onboarding teams 1st bullet – “Ensure external Government & Government contractor teams can onboard platform & product teams to the Platform One platform ensuring platform environments on multiple networks are stable, reliable, and available. Please note: this does not require initiating or managing Government led agreements or contracts.”

Would the Government confirm this relates to the contractor only managing the platform (not the personnel)?

Correct

60. ITO page 4, Volume II, (b) Subfactor 1.2, Oral Presentations/Portfolio Review – Would the Government consider Client POCs to request Source Code Repository access in lieu of Source Code Repository Links, since these are bound by client access approvals?

The Government is not requesting source code repository information. Do not provide source code repository information with the quote.

Offerors invited to Oral Presentation/Portfolio Review (Subfactor 1.2) should be ready to present their source code repository virtually.

61. ITO page 4, Volume II, (b) Subfactor 1.2, Oral Presentations/Portfolio Review – Would the Government please confirm if there is a minimum or maximum number of projects/contracts required for the portfolio evaluation?

There is no minimum or maximum of portfolio projects required; however, your company will need to stay within the allotted time.

62. ITO page 4, Volume II, (b) Subfactor 1.2, Oral Presentations/Portfolio Review – Would the Government please confirm if there is a page limit on the Portfolio submission?

There is no submission requirement for Subfactor 1.2. Only those Offerors who receive a Highly Capable rating in subfactor 1.1 will be invited to participate in Oral Presentation/Portfolio Review.

63. Attachment 1, Section 2. B, Step 1 reads “Similarly, if terms, conditions, or assumptions are included in a quote, the Offeror’s quote might be excluded from the competition for failing to comply with the RFQ’s instructions”. Would the Government clarify that terms, conditions, and/or assumptions within a Quote that do not otherwise contravene solicitation clauses shall not cause Offeror’s exclusion from the competition.

Any terms, conditions, and/or assumptions included with a quote might exclude an Offeror from the competition. This does not only apply to solicitation provision/clauses.

64. Attachment 2, Page 1 reads “If a key personnel position is identified at the order level, the contractor shall minimize the operational burden.”

Key personnel should be available for the duration of the period of performance of the order if proposed.

Please clarify what is meant by operational burden AND identify the timeline imposed

65. Reference: Attachment 1 RFQ FA8307‐20‐R‐0112

Instructions to Offerors/Basis for Entering into

Agreement for Software DevSecOps Services

Section J(2)(b) Subfactor 1.2 – Oral

Presentations/Portfolio Review says, "…Offerors shall also be prepared to present a portfolio and/or source code repository that demonstrates a technical understanding of DevSecOps engineering, software development, cybersecurity and/or IT support and operations." Further on in the same paragraph, it says, "…Offerors should be prepared to present their source code."

Question 1: Based on the and/or qualifier in the first sentence referenced, will the Government please confirm that a source code repository is not required if a Portfolio is presented at Orals, even though the last referenced statement indicates an expectation that source code will be presented?

Source code repository information is not required to be submitted with the quote.

Offerors should be prepared to virtually present a portfolio and/or source code repository if selected to participate in the Oral Presentation/Portfolio Review (Subfactor 1.2)

66. Reference: Attachment 1 RFQ FA8307‐20‐R‐0112

Instructions to Offerors/Basis for Entering into

Agreement for Software DevSecOps Services

Section J(2)(b) Subfactor 1.2 – Oral

Presentations/Portfolio Review says, "…Offerors shall also be prepared to present a portfolio and/or source code repository that demonstrates a technical understanding of DevSecOps engineering, software development, cybersecurity and/or IT support and operations." Further on in the same paragraph, it says, "…Offerors should be prepared to present their source code."

Question 2: If the offeror is not able to present a code repository because the project is classified and the code is non‐releasable, will the Technical

Approach and Portfolio Presentation satisfy the

Subfactor 1.2 Orals requirements, or will the lack of

Offerors may provide information for several Government or commercial clients that they consider most relevant in demonstrating their ability to perform the proposed effort. The Government is evaluating your technical understanding and capabilities. This can be conveyed through various methods to include:

links to demonstrations, narrative, source code or web applications.

a code repository disqualify the offeror from entering into an agreement under this BOA?

67. Will the Government please confirm that a teammate of the prime offeror may provide the sample code repository?

It is up to the offeror to determine their presentation of the code.

68. Will the prime offeror be able to add not‐ previously‐named subcontractor teammates after award?

Yes

69. Will other Services/Agencies be able to use this BOA for work outside of the USAF, and if so, which ones?

This BOA is available for use within DoD.

70. What is the clearance requirement? i.e. Secret, TS, etc.

This will be determined at the order level.

71. How many applications currently exist in the environment?

We have numerous development applications in production, some of which have over 10k daily active users

72. Of the applications that exist what are the technologies/products that were used to create them?

Mix of licensed commercial products and open source tools from the CNCF community

73. Of the applications, how many are GOTS (Government off the shelf) solutions versus purchased COTS (commercial off the shelf)?

We have a separate platform, pipeline, process and accreditation for COTS/open source and green field. There are over 70 COTS products approved for use and the first several GOTS applications are being fielded now

74. How many users will be supported by the overall environment?

Anticipated track is 100K developers by the end of the calendar year and continued growth in

75. How many users are currently being serviced by each application?

It varies based on pipeline configuration and requirements ranging from dozens to 50,000+

76. Is the idea to move all applications to a cloud‐ based infrastructure? (AWS or Azure GovCloud)

Where it makes sense, yes that is the default.

However we need to push out platform to the edge systems which included embedded and disconnected environments

77. We are a commercial organization that has many partnerships with COTS software companies and create our own as well, would we be allowed to introduce that software as well?

Yes. Teams are encouraged to do so but all decisions get made by the teams through our Architecture Design Review process led by our

CTO.

78. What certifications or compliances are required for the environment?

The platforms we build go through the DoD Fast Track ATO process. Applications go through our C‐ATO process which culminates in a certificate to field decision and then allows for continuous deployment to production.

79. Do you have any business intelligence or reporting capabilities/gaps currently in your environment? Is that a desired capability?

Yes we do have gaps and yes we are interested in expertise to deploy automation within pipelines to collect these metrics.

80. What tools are currently being used to address integration of the applications for reporting purposes?

We’ve tried various open source projects and collaborated with other Fortune 500 companies but have not settled on a solution yet.

81. Do you currently use Qlik, Tableau, PowerBI, Tibco Spotfire, ThoughtSpot, COGNOS or Business Objects in the environment/infrastructure?

Tool adoption is driven by team architecture decisions or customer demand. Our goal is to support a robust set that can be configured on deployment driven by customer requirements for their environment.

82. Do you currently have any centralized databases or data lakes being used in the environment for centralization of application and/or transactional data?

Yes

83. Do you currently have any type of reporting data warehouse?

Yes

84. Can you please provide a timeline for the anticipated orals presentation?

Details regarding the Oral Presentation will be provided to those who receive a Highly Capable rating in Subfactor 1.1 on or about 2 September.

However, Offerors should expect a short timeline; no more than a week from notification.

85. Could the Government provide clarity as to what they would like to see in “great technical detail” as to our capabilities to “meet the general scope”

(Highly Capable adjectival rating for Factor 1) given that the SOO, being the general scope, is inconsistent in what should be proposed?

Offerors should determine how they will demonstrate their ability to meet all the requirements of the RFQ within their quote. The SOO is general in nature so that your company can provide the technical detail needed to demonstrate knowledge and experience in the areas outlined in the SOO. It is that detail which

The first paragraph of the SOO (incorporated by reference as the general scope) indicates what the contractor shall support but the second paragraph indicates what the Offeror shall propose, meanwhile the third paragraph returns to what the contractor shall implement.

In only the second paragraph is it evident that the Offeror is proposing anything in this RFQ. Is it the government’s intention that the Offeror shall also propose how the contractor shall support and shall implement, pursuant to paragraphs one and three, respectively?

will determine the capability ratings of the contractors during evaluation.

86. RFQ Cover Letter, paragraph 1, the Government makes reference to "small business teams" however, there does not appear to be any further direction to describe prime/sub relationships or team composition in any of the required volumes. Does the Government intend for offerors to identify teaming partners and utilize their expertise within the proposal response where applicable, or does the Government intend for only prime contractor information to be included within the response?

It is up to the Offeror to decide how they choose to propose. Offerors may identify teaming partners and how they will utilize their expertise or only provide information as the prime.

87. Will the Government please confirm that no pricing information is expected to be submitted?

No pricing information is required for this RFQ.

88. RFQ Volume II Technical ‐ The Government requires that offerors specifically describe their ability to be co‐located in various geographic locations. The Government identifies Platform One locations in San Antonio, Colorado Springs, and Ogden within the SOO, does the Government intend offerors to describe proximity in terms of mileage or is co‐location required within the same municipality?

Location of work will be determined at the order level.

89. Oral Presentation/Portfolio Review ‐ The Government states that offerors should be prepared to present source code as part of the subfactor 1.2 submission. In the event that development efforts were conducted within a Government code repository and/or the Government retained rights to a developed product after project completion, such that

The Government is evaluating your technical understanding and capabilities. This can be conveyed through various methods to include:

links to demonstrations, narrative, source code or web applications.

offerors no longer have access to the code repository, is there an alternative method for offerors to present their technical capabilities and approaches?

90. Given that the prime contractor may not have access to customer or classified source code repositories for the oral presentations, can a Prime use a teaming partner or subcontractor’s source code repository for evaluation?

It is up to the Offeror to decide how they present their source code.

91. In Attachment 1, Government states, “Invitations to the Oral Presentation/Portfolio Review will be provided to qualified attendees on or about 2 September 2020. BOA determination will be contingent on the results of the RFQ.” Will the Government please provide an anticipated timeframe / dates for oral presentations to help offerors plan for availability of our staff?

Offerors should expect a short timeline; no more than a week from notification.

92. With regard to the BOA_RFQ_Cover_Letter_‐ _WSW_DevSecOps, Paragraph 3, once responses to questions are provided, will the Government provide further details for time and instructions for access to the Ask Me Anything (AMA) session?

Yes. Information regarding the AMA is being provided with these responses.

93. May an offeror who is a Subcontractor in a Large BPA, be a Prime in a Small BPA?

Yes, an Offeror who is a subcontractor on one BOA can be a prime BOA holder. Prime BOA holders can only hold one BOA, but can participate as a subcontractor/teaming partner.

94. Please validate the Government contracts with the AS&S Contractors have clauses within them that protect submitting contractors proprietary as disclosed by the Government to the AS&S

Contractor for the purposes of supporting proposal evaluation and other related

Confirmed. However, Offerors can elect to execute a company to company NDA as outlined in the ITO.The Government is no longer utilizing A&AS support for this RFQ, therefore the ITO has been revised to remove the NDA information.

95. Are there any teaming restrictions on non‐ exclusive teaming?

No

96. As a small business, we do not operate in all included labor categories. Will the lack of breadth of experience prevent our ability to achieve a Highly

Offerors must demonstrate their ability to meet all SOO requirements in order to be determined

Capable rating? How will the issuer evaluate depth of experience vs. breadth of experience?

the most capable of satisfying the Government’s requirements.

97. The Project Management labor category mentions ‘Agile managers’. Is this category synonymous with scrum masters and release train engineers from an Agile and SAFe perspective?

Yes. Specific certification doesn’t matter but we expect a history of management style that shows flexibility to changing requirements.

98. What architectures and platforms does the existing software live on?

The basis of everything we do is made up of Kubernetes, service mesh (like Istio) and CNCF tools for pipeline workloads. We support multiple Kubernetes distributions which can then be selected based on customer request.

99. What DevOps practices are the current teams using?

Our adaptation of Xtreme Programming along with flavors of Scrum and Kanban

100. Does any type of pipeline exist today?

Yes with dozens of configurations and tools swaps that can be made based on preference.

The pipeline is part of our C‐ATO.

101. Have teams in the past tried to use other methods than Platform one to achieve DevOps?

Yes but Platform One is the only one complaint with the DoD DevSecOp reference design architecture and therefore had DoD‐wide reciprocity.

102. What type of root level access do DevSecOps Engineers have in building out the necessary components of a pipeline?

We use zero trust and least privilege so this varies per team and is decided upon by our Cyber Security Guild.

103. What version of K8s cluster is in use? 1.17.3

104. What level of hardening and security scanning is required for an automated pipeline?

We employ static code analysis, dynamic code analysis and pen testing prior to approving a certificate to field. The results are approved by our CISO prior to fielding and in coordination with the mission owner AO.

105. What level and degree of PEN testing is required of the contractor?

We have an internal red team that does this for our products to remain in compliance with all ATOs and both C‐ATOs.

106. Are you also looking for Scrum Product Owner roles?

Every team has a Product Manager/Product Owner, Anchor and developers

107. Do the Platform One teams operate using the SAFe Framework, Scrum, Kanban, or a combination of all?

Our adaptation of Xtreme Programming along with flavors of Scrum and Kanban

108. Is the ‘instructional trainer’ role similar to an ‘agile coach’?

Yes

109. Are there teams whose primary purpose is to improve the effectiveness of the platform and product teams?

Absolutely. Our customers are software developers.

110. Will the government allow for a submission to the BOA as a large business prime and also as a small business mentor protégé joint venture?

Prime BOA holders can only hold one BOA, however, they can participate as a subcontractor/teaming partner.

111. Attachment 1 – ITO, Section 3 – Evaluation

Factors states, “Offerors shall plan for an estimated time limit for the Oral Presentation/Portfolio Review of between 15 and 30 minutes; the exact amount of time will be stated in the invitation.” However, the evaluation states “This subfactor is met when the

Offeror provides a detailed technical approach and portfolio and/or source code repository sufficient to demonstrate a technical understanding of

DevSecOps engineering, software development, cybersecurity and/or IT support and operations.” We believe it would be extremely difficult to satisfy the requirement for a detailed technical approach and portfolio/code repository demonstration in this timeframe. Strongly suggest the government provide up to 1 hour for the oral presentation.

The Government plans on staying with the 15‐30 minutes timeline.

112. Do the code samples need to be complete (i.e., executable code) or can we just provide a set of classes of code?

It is up to the Offeror to determine how they present their code.

113. How many awards have been made under the current BOA?

114. What is the minimum size of the small business respondents?

As stated in the RFQ Cover letter, the size standard is $30M.

115. Can quotes include other small businesses as subcontractors?

Yes

116. Can quotes include multiple subcontractors?

Yes

117. What is the target award date?

Tentatively, 30 September 2020

118. Do small business respondents need to supply teams across multiple locations in order to receive an evaluation of ‘highly‐capable’ for technical capability?

Offerors need to show the ability to supply teams to multiple locations. The actual team requirements will be determined at the order level.

119. Is there a list for the tech stacks (software languages/frameworks) of each/any of the product teams?

The actual tech stack requirements will be provided in the order level RFQ.

120. What limitations (in terms of BOA participation) are foreseen for companies that would like to perform this work virtually?

There are no limitations; however, actual work will be determined at the order level.

121. Reviewing the LCATs, some state a requirement for the “ability to obtain a Secret clearance”.

Attachment 4 states that work may be performed up to the level of TS/SCI. Will the Government provide clarification as to the security clearance required by level at the BOA level or for each order?

The clearance requirements for personnel are determined at the order level. All clearance levels may or may not be required.

122. In the Attachment 3_Labor Category; there are several LCATS that indicated Levels 1, 2 and 3. The qualifications and clearance requirements are provided. Will the Government provide clarification as to the LCAT qualifications required by level at the BOA level or for each order?

Qualifications will be provided at the order level.

123. Please confirm there will not be rates at the BOA level, that they’ll be negotiated for individual Delivery / Task Orders under the BOA.

No pricing information is required for this RFQ.

Rates/Pricing will be requested with the order level RFQ.

124. Attachment 4 Section I states “This BOA will leverage various contract types to include Time & Materials/Labor Hour and Firm‐Fixed price.” Do the “various contract types” also include Cost Plus Fixed Fee or Cost Plus Award Fee?

No. Contract type included with the BOAs are:

FFP, T&M, LH, and Cost ‐ for travel and ODC only.

125. DFARS Clause 252.203‐7000 Requirements Relating to Compensation of Former DoD Officials has a date of 2011‐09, and it was updated in Apr‐16.

DFARS 252.205‐7000 Provision of Information to Cooperative Agreement Holder has a date in RFQ 1991‐12 of Nov‐04. Will the Government use the current versions of these clauses?

Yes, the most current version applies. However, DFARS currently reflects Sep 2011 for 252.203‐ 7000 and Dec 1991 for 252.205‐7000.

126. Will personnel clearances and clearance processing be sponsored at the BOA level to support 10‐day staffing requirement on orders?

Personnel clearance timelines vary and will not be a consideration for evaluation, however the vendor will still be responsible for providing adequate staffing requirements regardless of clearance status. The clearance process starts once an order is awarded.

127. Will facility clearances and sponsorships be executed at the BOA level to support 10‐day staffing requirement on orders?

Facility clearance and sponsorships will be executed upon award at the order level. Facility clearance timelines vary and will not be a consideration for evaluation, however, the vendor will still be responsible for providing adequate staffing requirements regardless of clearance status.

128. Will GFE for classified spaces, and accompanying certification and accreditation, be managed at the BOA level to support 10‐day start up requirements per order award?

This will be determined at the order level. The staffing requirements will also be determined at the order level.

129. Can LCATS be added at the individual order to cover the scope of work on that order?

Additional labor categories may be included at the order level. Those categories and qualifications will be identified in the order RFQ.

130. For subfactor 1.2 Is the 15‐30 minutes to include both the oral presentation and portfolio review? If so, would the Government consider identifying target timelines for each separately?

Yes the 15‐30 minutes includes both the oral presentation and portfolio review. There are no target timelines for the oral presentation or portfolio review.

131. Do offerors have to propose across the entire

BOA scope?

Offerors must demonstrate their ability to meet all SOO requirements in order to be determined the most capable of satisfying the Government’s requirements.

132. If an offeror does not propose the entire BOA scope would that result in a lower evaluated rating?

Offerors must demonstrate their ability to meet all SOO requirements in order to be determined the most capable of satisfying the Government’s

133. Regarding co‐locating, is the support to these teams dedicated full‐time resources or temporary to meet surge requirements?

Team makeup and FTE amounts differ and will be described at the order level.

134. Volume II, Subfactor 1.1, the RFQ states

“technical narrative”. May graphics be used to Graphics may be used, but will be counted as a page. 11X17 fold‐outs count as two (2) pages.

convey capability or is only text allowed? Please clarify.

135. Due to COVID situation, will the oral be virtual using Zoom or Teams (approved DoD tool) and will the bidder be limited to attendees?

Virtual. The Government is still in the process of determining how the Oral Presentation/Portfolio Review (Subfactor 1.2) will be conducted, but the notices will include this information.

136. With this being an email submission, are there any file size limitations?

10MB

137. Please confirm that tables, figures and charts presented on 8.5x11 paper may be Times New Roman 10 point.

Yes

138. Please confirm that 11x17 paper counts as 1 page.

Yes, 11X17 counts as two (2) pages.

139. Please confirm that the Government will provide submission acknowledgement emails.

Government will provide submission acknowledgement emails, however, the

Government will not be responsible for any failure of receipt of the quote or any failure of the

Offeror to verify receipt of the quote.

140. What is the process/format for submitting source code? Will an online repo be used?

As stated in the ITO, Offerors are not required to submit source code with their quote. Offerors should be prepared to virtually present a portfolio and/or source code repository if selected to participate in the Oral Presentation/Portfolio Review (Subfactor 1.2).

141. With Platform One being all WFH unit, why does location matter? Their whole work force is now WFH or will this change or have an end date?

Location of work will be determined at the order level. Teleworking policies may be different for Platform One customer organizations.

142. Is there a preferred template/format for the quote? Or is it to be included with the Cover Letter in the Administrative volume?

As stated in the ITO, Offerors are to submit two separate volumes:

Volume I – Administrative

Volume II – Technical (Subfactor 1.1)

143. Please confirm that the submission of one (1) electronic file is to include both Volume I and

Volume II?

Correct, but as stated in the ITO, volumes shall be submitted as separate attachments.

144. Please confirm that electronic signatures are acceptable due to the current COVID‐19 restrictions?

Electronic signatures are acceptable.

145. Can the Government confirm that only Subfactor 1.1 Technical Capability should be submitted on 10 August.

Volume I – Administrative and Volume II – Technical (Subfactor 1.1) shall but submitted on or before 10 August 2020.

146. How will source code be shared for Subfactor

1.2? (via screenshare or GitHub?)

Offerors should determine how they will virtually present their source code during the Oral Presentation/Portfolio Review (Subfactor 1.2).

147. Does the Government have a preferred method for Offerors to share source code behind client firewalls?

Offerors should determine how they will virtually present their source code during the Oral Presentation/Portfolio Review (Subfactor 1.2).

148. Many projects for clients are behind firewalls and considered proprietary to the client. Will the Government accept an alternative to source code submission such as a descriptive project write‐up to include all technologies and methods used?

The Government is not requiring a submission for Subfactor 1.2. If selected to participate in the Oral Presentation/Portfolio Review (Subfactor 1.2), Offerors should determine how they will virtually present their source code during the Oral Presentation/Portfolio Review (Subfactor 1.2).

149. How many projects may be included in the portfolio review?

Offerors should determine how many projects to virtually present during the Oral Presentation/Portfolio Review (Subfactor 1.2) in order to satisfy the ratings defined in the ITO and stay within the timeframe provided.

150. How many individuals will Offerors be allowed to attend orals presentation/ portfolio review?

Oral presentations will be virtual. Your company can have as many attendees as necessary;

however, one person should be in charge.

151. Will Orals presentations/portfolio reviews be conducted in‐person or virtually?

Virtually

152. If source code is behind a Government firewall, will the evaluators have appropriate credentials and/or clearances to access source code?

The Government will not be accessing the Offerors source code. Offerors should be prepared to virtually present a portfolio and/or source code repository if selected to participate in the Oral Presentation/Portfolio Review (Subfactor 1.2).

153. How should Offerors submit and/or share source code?

The Government is not requiring Offerors to submit source code as part of their quote.

Offerors should be prepared to virtually present a portfolio and/or source code repository if selected to participate in the Oral Presentation/Portfolio Review (Subfactor 1.2).

154. Are all offerors required to have an existing facility security clearance (FCL)? If yes, does having an existing company SCIF have any value?

Security requirements will be determined at the order level. A Facility Clearance is not required in order to propose on these BOAs.

155. The Platform One Remote Work Policy states that all Platform One personnel should default to remote work/ teleworking to the maximum extent possible. Does that Policy apply to this BOA?

Location of work will be determined at the order level. Teleworking policies may be different for Platform One customer organizations.

156. Is there a desire to utilize the cloud architect in support of the development and product teams to optimize their code?

Yes

157. Is there a planned desire for a cloud architect to help dev teams optimize their code?

Yes

158. A 24/7 helpdesk is listed in the SOO under Information Technology Support and Operations. Do all positions under this BOA require 24/7 support? If not, please specify which positions require 24/7 support.

This will be determined at the BOA order level.

159. What is the maximum number, if any, of staff per team for each of the teams?

This will be determined at the BOA order level.

160. What is the target award date?

Tentatively 30 September 2020

161. Do small business respondents need to supply teams across multiple locations in order to receive an evaluation of ‘highly‐capable’ for technical capability?

Offerors must demonstrate their ability to meet all SOO requirements in order to be determined the most capable of satisfying the Government’s requirements.

162. Can the list of the products with their locations be provided?

No. We must protect the OPSEC of several programs we partner with.

163. Can the list of products with their applicable tech stack be provided?

The basis of everything we do is made up of Kubernetes, service mesh (like Istio) and CNCF tools for pipeline workloads. We support multiple Kubernetes distributions which can then be selected based on customer request.

164. Reference ITO Section 1, Paragraph J, second paragraph. Do Fold‐outs count as one or two pages?

Fold‐outs count as two (2) pages.

165. Can individual Orders issued under this BOA be issued to a large Corporation under different CAGE

Codes for different divisions / locations (all registered in SAM), even if the BOA itself is issued to a different division / CAGE Code?

Individual order will have the same CAGE Code as the BOA holder.

166. Or do all Orders under a BOA have to have the same CAGE Code as the BOA?

Orders will have the same CAGE Code as the BOA holder.

167. If the answer to question above is no, could separate BOAs be issued to more than one division as long as they each submit a qualified proposal?

BOAs will not be issued to separate divisions within a company. Prime BOA holders can only hold one BOA, however, they can participate as a subcontractor/teaming partner.

168. Could the government please confirm that there are no OCI concerns with this BOA?

OCIs will be evaluated at the order level.

However, if Offerors determine there is a potential for an OCI IAW FAR 9.5 with this BOA, they should notify the Contracting Officer immediately.

169. Are offerors required to address all five teams

(listed in the SOO) in their proposal response?

Offerors must demonstrate their ability to meet all SOO requirements in order to be determined the most capable of satisfying the Government’s