FMQ-22_CLS_RFP_QA_Responses_(21_August_2014).pdf

Solicitation FA8730-14-R-0017

Questions & Answers, 21 August 2014

Question Number

Document Reference

Title Comment/Question Response

1.

PWS PWS section 5.3.5 states “Patches are to be distributed on a quarterly basis to all applicable systems via electronic means”. Will the government please define electronic means?

CD\DVD will be distributed to all sites. The PWS has been updated for clarity.

2. PWS PWS 3.5.1 discusses the Transition Plan. We have found no CDRL referencing the Transition Plan. Please clarify how the Transition Plan should be addressed and how it should be delivered.

The Transition Plan is expected to be delivered as part of the RFP response and will not be a CDRL.

Please see Section L (Attachment 7).

3. PWS PWS section 3.5.1 references the Sub-Staffing plan as part of the Transition Plan, again there is no CDRL for a Sub-Staffing Plan. Please clarify how the Sub-Staffing Plan should be addressed and how it should be delivered

Please see Section L (Attachment 7), 4.3.2.1.b.

4. PWS PWS section 5.3.5 states “In situations requiring more frequent updates, the Contractor will test security patches and implement in a manner that will not impact mission operations” can the government quantify this statement, i.e. the contractor may be required to provide more frequent updates but not more than XX per contract year.

Having to plan for and price this section is complicated when the possible updates are left open-ended. Additionally, the requirement that the implementation “not impact mission operations” is somewhat vague.

No, critical patches cannot be anticipated for the life of the program.

Historically, the AN/FMQ- 22 has not had to provide out-of-cycle updates.

5. PWS PWS 6.3 The contractor as part of CLS activities is responsible for repairs intended to return unserviceable spares to serviceable conditions. How are and who makes BER determinations on assets identified as “repairable” rather than “expendable”?

PWS paragraph 6.3 has been updated. The Contractor will make decisions regarding Beyond Economic Repair (BER). This is a performance based CLS effort.

6. Are all LRU’s expected to be returned to the contractor or can expendable items be disposed of on-site?

Yes, with the exception of consumables such as batteries.

7. PWS PWS section 6.3.1 PSE list we believe to be currently incorrect as the following items are not provided as an integral part of the system;

Step ladder, Work Gloves, Maintenance Laptop. Will these be made available to each location before contract award?

Please reference previous Q&A answers from 18 Aug 2014.

8. PWS PWS section 6.3.1 lists “air temperature and Relative Humidity probe QMH102M” twice.

One of the instances should be removed.

Yes, please see revised PWS (Attachment 6) and the new Attachment 15, PSE & LRU List.

Question Number

Document Reference

Title Comment/Question Response

9. PWS PWS section 6.3.2 IUID should the contractor assume that all fielded equipment is already labeled? Can the contractor also assume the labels have been validated, verified and uploaded to registry? If not should the contractor price the costs associated with retrieving or recreating all fielded IUID markings, then validating and verifying each one before uploading to the IUID registry?

Yes, fielded equipment already has IUID labels that have been validated, verified, and loaded into the registry.

10. PWS PWS section 6.3.3 are there currently any assets still under warranty? If so how long is the existing warranty period?

Most items in the spares depot will be out of warranty at the estimated time of contract award.

Please see the “FMQ-22 Spares Warranty Status” PDF uploaded to FBO on this solicitation to identify the spares that will be under warranty at the time of contract award. Please also note the updated Attachment 10 (Government Furnished Property List dated 26 August 2014).

11. PWS PWS section 6.4 PHS&T the 3 and 4 day metric is referring to when the item is physically shipped from the contractor facility or when the item should arrive at the needed location. There seems to be some ambiguity between the PWS paragraphs and the performance objective listed in table 2-1.

Revised paragraph 6.4

12. Regarding the TO, can the contractor expect to receive an updated TO (Updated from its current state including completed VAL/VER effort) after contract award or will the contractor be expected to update the TO in accordance with this CDRL from its current state?

Yes, the Contractor will be provided with the Final TO in Microsoft Word soft copy.

13. PWS PWS section 7.3.1 (Certification Test and Evaluation (CT&E)) includes the phrase “Please refer to paragraph 5.2.2 for details on the CT&E process.” Should this reference be to paragraph 5.2.6 instead?

Changed PWS to correct reference.

Document Reference

Title Comment/Question Response

14. PWS PWS section 5.2.2 says, referring to DIACAP supporting documents, “Supporting artifacts shall consist of documentation created as a result of other system and program requirements.” Does this mean that the government will not require any document not specifically called out in one of the existing CDRLs to be provided for the DIACAP package?

CDRL A007 provides a complete list of required documentation for current accreditation. If the requirements for DIACAP change a contract modification will be required. CDRL A007 within Exhibit A and PWS section 5.2.2 has been updated.

15. PWS PWS section 3.3.1 say, “The contractor shall provide, implement, and maintain a tracking system to record and track audits, surveillances, inspections, testing schedules, and results.” Does this include results of information assurance audits and vulnerability scans?

Yes, quarterly scans should be kept for historical purposes as defined in 5.2.2 C&A Documentation. Quarterly scan results will be provided per CDRL A007 in Exhibit A which has been updated.

16. PWS For PWS section 5.2, in the event that DoDI

8510.01 and DoDI 8500.2 are in conflict with NIST SP 800-37 Rev 1 and the controls called out by the referenced document NIST SP 800- 53, which documents are to take precedence?

Currently, DoDI 8510.01 and DoDI 8500.2 will take precedence until the Government fully converts to NIST SP 800-53 standard.

17. PWS PWS section 5.2.2 requires the provision of “7. Artifacts (supporting documentation) as required” for the Comprehensive DIACAP package. Can the Government please elaborate as to what additional artifacts may be required?

See answer to Question 14.

18. PWS For PWS section 5.2.3, can the Government please list the number of “specific theater clearances required for all AN/FMQ-22 increments”? How many individual theater clearances does the Program currently support?

At this time there are no required theater clearances.

19. PWS In PWS section 5.2.5, when the Government says “the Government will provide guidance and test tools to the Contractor to assist the contractor in ensuring proper configuration and verification of IA controls for the system”, does this include licenses for Tenable Nessus? Are penetration testing tools (Core Impact, for instance) expected to be used as part of ensure compliance with the controls? If so, will these tools be provided?

Will training on the tools be provided?

The Nessus scanner is one part of the Assured Compliance Assessment Solution (ACAS). The licenses for Nessus 5.2.7 and Security Center 4.7.1 will be provided post-award. The Government will provide access to web based training on usage post-award.

Document Reference

Title Comment/Question Response

20. PWS In PWS section 5.2.6, when the Government says “The Contractor shall support two formal CT&E test events as required for re-accreditation purposes”, is this two formal CT&E events during the first Task Order year, or two events to take place over the entire length of the IDIQ contract?

There will be two events that take place over the entire length of the IDIQ contract.

21. PWS PWS section 5.2.8 says “If security CAT I, CAT II, or CAT III vulnerabilities are identified, the Contractor, as directed by the Government, shall correct those deficiencies and release instructions, installation scripts, and GPO’s to the field to correct those vulnerabilities.” Can these vulnerabilities be corrected as part of the quarterly patching solution? If not, how soon do the vulnerabilities need to be corrected after discovery, and by what method should they be corrected?

Yes, patches to correct vulnerabilities will be issued quarterly via CD\DVD media unless it is a critical TCNO, which will be addressed as stated in paragraph 5.3.5.

22. PWS PWS section 5.3.1: Is the Host Intrusion Prevention System (HIPS) the only Host- Based Security System (HBSS) module the Government requires to be installed on the

FMQ-22?

Yes, currently HBSS is the only requirement but could change at a future date. If the requirement changes a contract modification will be required.

23. PWS PWS Section 4.1 (SCRM) states “The contractor shall implement the guidance for handling of counterfeit material IAW procedures contained within AFI 23-101 Section 5J.” AFI 23-101 Section 5J deals with the detection and management of counterfeit materials. Given that the effort required to monitor counterfeit materials varies with the depth of inspection of products, to what level is the government concerned about such materials? Component parts of PCB assemblies? Fuses and resistors on such assemblies? Laptops or computer assemblies purchased from a major manufacturer as a unit? End items such as wind sensors? Additionally, does the government require the contractor to perform audits of the manufacturers from which it procures items in order to verify their SCRM capabilities and processes? The response to this question will have a direct impact on the level of effort required to meet the government’s requirement.

For evaluation of the AN/FMQ-22 system with regards to the Program Protection Plan, the Government is concerned with SCRM at the LRU level.

If CDRL B002 (Exhibit B), Program Protection Implementation Plan, is required, it will be purchased in conjunction with a separately priced CLIN X004 (Special Projects) order.