Cyber III - RFI Questions.pdf

Cyber 3 Assessment

FA8723-23-F-9001

RFI Contractor Questions

1. Question: Will the 9 sites be done in the base year or will they be broken out into a base/option year schedule?

Answer: The cyber security assessment on all 9 sites will be broken out into a one base year and three option years schedule.

2. Question: The subject sources sought announcement, Cyber 3 Assessment, requires the contractor to be on the approved Agent for the Security Control Assessor (ASCA) Space Operations Command (SpOC) list. Please provide instructions for seeking approval for the ASCA SpOC list.

Answer: This is not under our office’s domain. The contractor will need to contact the ASCA Approval Authority (AO).

3. Question: What is the estimate of the number of devices (computers (workstations & servers), routers, switches, etc) that will need to be tested at each site?

Answer: The government would not like to answer this question at this time.

4. Question: Each of the Cyber III system level PWS's mentions the following:

"The Contractor shall utilize their own Air Force Space Command (AFSPC)-approved cybersecurity assessment tool to perform the Security Assessment. This tool must be a standalone analysis suite that will not be connected to any mission system or non-secure Internet Protocol Router network before, during, or after the Security Assessment."

"The Security Assessment is complete without connecting an assessment tool to the mission system."

There are numerous DoD approved assessment tools that are provided by DISA and other services and approved for use by USSF/AFSPC (ACAS, SCAP, SCC). These are non-intrusive but will require network access in order to function correctly.

Answer: CDRL A002 section 2.5 Section speaks to a tool not connected to the mission system at any time. – 2.5.1 . restates the outcome of assessment tool will not be connected.

There is not a question but identification of auditing tools - it not our intent to dictate a process but to outline the requirement, with the exception of reducing site operational disturbance by the use of scripting to pull data. Section 1.2.2.2 “develop scanning scripts, Section 2.4. and 2.4.1 to produce scripts that will run on the assessed systems and devices to automate the Defense Information Systems Agency (DISA) Security Technical Implementation Guide (STIG) Checklists process.

5. Question: Additionally, the overall Cyber III RFI it states that:

"The contractor will produce custom scripts to automate any manual portion of the STIG Checklist."

This is quite different from the above statements regarding custom script development in the system level PWS's - Most manual STIG checks cannot be automated into a custom script as they rely heavily on interviewing local technical POC's and reviewing site and system level artifacts.

Answer: The government agrees with above statement that manual questions and reviewing artifacts will not be automated.