(U) CSO Call 8_Project Smiley_Q_A.pdf
PDF 99 KB Posted
- Attached to
- CSO Call 8 - "Project Smiley"
- Solicitation number
- FA8600-23-S-C056-0008
- Issued by
-
Department of the Air Force
About this file
This document is a Questions and Answers (Q&A) file for CSO Call 8 - Project Smiley, a cyber assessment solicitation from the Air Force Life Cycle Management Center (AFLCMC). The Q&A reveals key details about a penetration testing requirement where vendors will conduct security assessments against development networks. AFLCMC anticipates 4 concurrent vendor assessments and indicates that testing may include both external and internal access scenarios, with social engineering components. The agency will provide a DD 254 security classification specification at contract award, and vendors must be prepared to handle potential export control regulations.
The solicitation clarifies that penetration tests will target development networks, not production environments like NIPR/SIPR, and includes both assumed-breach and external testing scenarios. There is no incumbent contractor, and offerors must be capable of meeting personnel security clearance requirements without relying on government resources. Small business subcontracting plans may be required depending on FAR 19.7 criteria, and the applicable NAICS code is 518210 with a $40.0M size standard. The contract will be awarded under FAR Part 12 as a full and open competition.
View the file
Other files
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
CSO Call 8 - Project Smiley
Questions and Answers
Q: Can you disclose how many total vendors you anticipate running penetration testing against?
A: Vendors should be capable of 4 concurrent assessments. AFLCMC prefers offerors to propose the cost per vendor assessment.
Q: Will you test each vendor one time or will you test each vendor periodically over a 5-year period?
A: The possibility of retests exists.
Q: Can you confirm that we are only testing development networks and not touching NIPR/SIPR or any production type environments?
A: AFLCMC does not anticipate testing these environments.
Q: How many national security systems and overall systems are included in the SOW?
A: AFLCMC cannot provide this information at this time. Section 3.1 of the SOO identifies development networks.
Q: How many vendors will we need to provide security assessments for?
A: Vendors should be capable of 4 concurrent assessments. AFLCMC prefers offerors to propose the cost per vendor assessment.
Q: The document indicates "the proposal submission must include, at a minimum, the following five parts." Only four parts are listed. Is there an intended fifth part?
A: There are only four parts to this solicitation.
Q: The document indicates "FAR-based contracts awarded pursuant to this CSO Call which meet FAR Subpart 19.7 criteria for small business subcontracting plans shall include FAR 52.2 19-9, Small Business Subcontracting Plan (SEP 2023)." Are all Prime offerors required to submit a small business plan with their proposal?
A: Small business plans are required to be submitted if the conditions of FAR 19.7 are met.
Q: The document indicates "Offerors must possess all required personnel security clearances, facility clearances, and other infrastructure requirements necessary to perform any proposed classified work in accordance with a Contract Security Classification Specification (DD Form 254) without reliance on Government resources." Does the government intend to provide a copy of the DD254, thereby indicating place(s) of performance?
A: AFLCMC will provide a DD 254 at contract award. A DD 254 will not be provided with the Call.
Q: Will all penetration tests originate from the outside, or will there be an assume-breach scenario?
A: AFLCMC anticipates both origins.
Q: Will any internal access be provisioned.
A: Yes.
Q: Will there be any social engineering involved in the scope?
A: Yes.
Q: Do we know what kind of EDR solutions, or other defenses, the target companies have in place?
A: This information is vendor dependent.
Q: Have these assets been tested before? If so, how long ago?
A: This information is vendor dependent.
Q: Is there an incumbent?
A: No.
Q: Can you confirm if there should be four or five parts for the subject proposal submission, please, and if it is five, what that fifth part should be? There’s a discrepancy in the Call document where five parts are called out, but then only four are listed.
A: There are only four parts to this solicitation.
Q: Can you please confirm that offerors need to be registered and certified with the DLSC to participate?
A: The awarded contract may be subject to Export Control or Administration Regulations which requires an active and certified DD Form 2345. Approval of the DD Form 2345 will be verified if proposal is chosen for award. Follow additional guidance at https://www.dla.mil/Logistics- Operations/Services/JCP/
File details come from the government source that posted it. Updated .