ICPS_DRAFT_RFP_questions_answers_19APR18.pdf

ICPS DRAFT RFP QUESTIONS/ANSWERS 19 APR 18

1. QUESTION: Is this a mandatory requirement (8(a)) or will the Air Force allow a SBA Small

Business and/or SVOB to compete directly for this solicitation?

ANSWER: ICPS will remain in the 8(a) program. No other socioeconomic category will be used.

2. QUESTION: Is anticipated contract start date for this requirement June 13, 2019?

ANSWER: Transition is estimated to start 12 May 19 for 30 days with the base period starting 13 Jun 19.

3. QUESTION: Page 14 of the RFP shows start date of 13-Jun-2019, correct?

ANSWER: Transition is estimated to start 12 May 19 for 30 days with the base period starting 13 Jun 19.

4. QUESTION: The statements in Section L 4.2 Relevant Contracts are conflicting in terms of age of PPI (5 years) with Section M (3 years). Please clarify age of the PPI. “The contracts must have been completed in the past five years”. Section M notes “the effort must be ongoing or must have been performed during the past three years from the date of issuance of this solicitation”.

ANSWER: Section L, 4.2 has been updated to state "The contracts must have been completed in the past three years"

5. QUESTION: Past Performance, Section L, 4.1.1 references a paragraph 3.5 but no subsequent paragraph 3.5 “Each offeror shall submit Past Performance Information (PPI) with its proposal IAW the format contained in paragraph 3.5 below.”

ANSWER: Section L, 4.2 has been updated to state "Each offeror shall submit Past Performance Information (PPI) with its proposal IAW the format contained in paragraphs below."

6. QUESTION: CLIN 2005 page 6 of the RFP should probably reference OPTION 1 not BASE YEAR.

ANSWER: CLIN 2005 updated to read OPTION 1. 5. Performance Quality Assessment is based on PPI submitted (questionnaires) and CPARs that pertain to the contract information submitted.

7. QUESTION: Section M, Performance Quality Assessment, page 4, is the assessment based on the completed Past Performance Information Questionnaires completed by the referenced client/CO/COR? If not, how is this performance quality assessment performed?

ANSWER: Performance Quality Assessment is based on PPI submitted (questionnaires) and CPARs that pertain to the contract information submitted.

8. QUESTION: What is the status of the IOP Gateway? Is that in production?

ANSWER: IOP is deployed and operational within the Air Force Gateway.

9. QUESTION: Will you allow a subcontractor with a TS clearance to hold the clearances until our company (the prime) is able to get our facility security clearance?

ANSWER: The Offeror (prime) is required to have and maintain a TS Facility Clearance.

PWS paragraph 6.2.1 Industrial Security. The contractor shall follow the security requirements outlined in the Department of Defense (DD) Form 254, Department of Security Classification Specification. The Government considers the requirement of an active Contractor TOP SECRET (TS) Facility Clearance as a definitive responsibility matter. Clearance documentation shall be the sole responsibility of the Offeror. Offerors are advised to review their clearance documentation prior to the proposal due date. Prime Offerors without a TS Facility Clearance will not be considered for award. Offerors shall submit the DD254 with Blocks 6 and 7 completed. Offerors should review the DD254 new format as the block numbers may have changed.

On contract start date, a minimum of 90% of individuals working shall have a TS/SCI clearance and be Director of Central Intelligence Directives (DCID) 6/4 eligible with a current Single Scope Background Investigation (SSBI); the remaining personnel must hold a minimum of a Secret clearance pending the completion of an SSBI investigation and must work to obtain their TS/SCI clearance within 90 days of contract award.

10. QUESTION: Have you considered GSA IT70 HACS?

ANSWER: GSA IT 70 HACS is for purchase of commercial supplies/services. ICPS has no commercial services.

11. QUESTION: Would you consider more of an emphasis on technical solution rather than such a heavy reliance on Past Performance?

ANSWER: The Government has put much time into determining the best way to evaluate proposals and contractor experience. It is the determination of the Government that Past Performance is necessary to determine the appropriate experience to perform on ICPS.

12. QUESTION: If a company teams, can the subcontractor's past performance be part of the evaluation?

ANSWER: Yes, the subcontractor's past performance can be evaluated also.

13. QUESTION: When do you anticipate full release of the RFP?

ANSWER: Anticipate release of the formal RFP in June 2018.

14. QUESTION: Are there positions that the Government has designated as Key?

ANSWER: The task lead and functional leads as identified in paragraphs 2.5.2.3 and 2.5.2.4 of the PWS.

15. QUESTION: Could 8(a) STARS II be considered for this opportunity?

ANSWER: 8(a) STARS does not allow for any COST type CLINS. COST type CLINS are used for the ICPS requirement. Therefore, 8(a) STARS is not a viable vehicle to use for ICPS.

16. QUESTION: Does the offeror need to have a DCAA Audited System at the time of submission?

ANSWER: IAW FAR 16.206-3(b), “The contractor’s accounting system is adequate for price determination.”

17. QUESTION: If a DCAA Audited System is not required, what requirements are associated with

CPFF CLIN 0002?

ANSWER: IAW FAR 16.206-3(b), “The contractor’s accounting system is adequate for price determination.” A pre award survey will be conducted at receipt of proposal to determine if each offeror has an adequate accounting system.

18. QUESTION: Is there an incumbent contractor currently performing these services or if this is a new requirement? If there is an incumbent, could you please provide the contract number?

ANSWER: Incumbent is SSI; previous contract number is FA8773-17-C-0001.

19. QUESTION: Based on the pricing spreadsheet the contract appears to have a "cost plus" requirement. Are you considered non-compliant if you have a compliant accounting system, but do not have a DCAA approved system?

ANSWER: IAW FAR 16.206-3(b), “The contractor’s accounting system is adequate for price determination.” A pre award survey will be conducted at receipt of proposal to determine if each offeror has an adequate accounting system.

20. QUESTION: Are you willing to request a DCAA audit following contract award?

ANSWER: IAW FAR 16.206-3(b), “The contractor’s accounting system is adequate for price determination.” A pre award survey will be conducted at receipt of proposal to determine if each offeror has an adequate accounting system. A post award audit of the awardee can also be requested after award.

21. QUESTION: Does the Government wish to receive responses to the DRAFT RFP, including pricing, or is it seeking commentary on the draft documents posted at this time?

ANSWER: Answered on 28 Mar 18- the Government is looking for comments on the draft documents only. No pricing should be submitted at this time.

22. QUESTION: Are we still on track for a May RFP release?

ANSWER: RFP estimated to be released in June 2018.

23. QUESTION: Can you at all (or direct me) on how the IOP relates now and in the future to MCOP and the coming Unified Platform effort? My guess is that this IOP support is focused on current ops and the platform eventually will somehow migrate towards UP.

ANSWER: No relation.

24. QUESTION: The proposal validity period is 365 days after submission. Why is the government requesting such a long proposal validity date? Is the Government anticipating an award at least a year after submission?

ANSWER: The Government anticipates award in April 2019, which is close to a year from time of proposal submittal. However, if there are any delays in review of the proposals or in the case of a protest, a 365 validity period provides enough coverage for the Government without having to go back out to the contractors to validate their proposals.

25. QUESTION: All three subfactors provide the incumbent an incredible advantage as they have the exact system details that need to be addressed. Will the government please provide additional details as to the IOP current system configuration and release level to include system component model numbers and configurations so that we may appropriately provide recommendations?

ANSWER: A Reading Library will be available to contractors to review documents that are not releasable to the public. Information will be included in the RFP as to how to place a reservation to review these documents.

26. QUESTION: This paragraphs states that recent contracts “must have been completed in the past five years,” however, ICPS DRAFT Section M Paragraph D Factor 2 – Past Performance (Recency Assessment) states that efforts “must have been performed during the past three years from the date of issuance of this solicitation”. Please confirm the correct recency requirement.

ANSWER: Section L, 4.2 has been updated to state "The contracts must have been completed in the past three years".

27. QUESTION: ICPS DRAFT Section M Paragraph A. states that “past performance history will be evaluated on a basis significantly more important than price considerations where the Government may elect to trade past performance for price, if warranted.” We request the government consider technical approach be considered significantly more important than price considerations as Past Performance greatly benefits the incumbent.

ANSWER: The Government has put much time into determining the best way to evaluate proposals and contractor experience. It is the determination of the Government that Past Performance is necessary to determine the appropriate experience to perform on ICPS.

28. QUESTION: PWS paragraph 2.5.2.3 requires one full-time task lead and one full time alternate task lead. Paragraph 2.5.2.4 also requires an “…employee as lead for each of the functional areas: Quality Assurance, Technical Support, Systems Engineering, and Development.” First, can the task lead and alternate task lead also serve in the role of a functional lead or does the Government request these be different individuals? Secondly, is the Government asking for one

(1) each lead for each functional area for a total of four or is it one functional lead for all areas?

ANSWER: Yes, task (and alt) leads can also perform functional leads, but should not perform multiple functional lead duties.

29. QUESTION: PWS paragraph 2.6 – Location and Hours of Work. Please clarify the requirements and level of effort to be performed at various contractor and subcontractor facilities.

ANSWER: Updated PWS paragraphs 2.6 to state “Performance of this PWS requires work primarily at 90 COS facilities located on JBSA, Lackland AFB, 3515 S. Gen McMullen, Bldg 3, San Antonio, TX 78226, and other facilities in the San Antonio area.

Available work hours for the Sensitive Compartmented Information Facility (SCIF) are 0600-1800 hours with workdays Monday through Friday, except U.S. Federal holidays. Only Government personnel are authorized to unlock/lock the SCIF. There may exceptions to the primary work area, but only on a case-by-case basis, therefore, contractors may start no earlier than 0600. All employees are expected to be available during core hours. Core hours of work are from 0900 to 1500 daily.

If the contractor's "holidays" don't align with the Federal holiday schedule, the contractor must provide their personnel an alternate work location. The SCIF will be closed on Federal holidays” and 2.8 to state “Travel to other Government facilities or other contractor facilities may be required in coordination with the Contracting Officer and the Government COR. The contractor shall make necessary travel arrangements for employees for TDY purposes. All travel requirements (including plans, agenda, itinerary, or dates) shall be pre-approved by the COR, and is on a strictly cost reimbursable basis. Anticipate contractor personnel shall be required to travel for approximately five days for each Continental United States (CONUS) trip and seven days for each Other than Continental United States (OCONUS) trip during the contract. These requirements shall include travel overseas; however, they will not include travel into combat areas. Contractor shall provide a daily update and final trip report to the COR within five duty days after trip completion.” (CDRL A003)

30. QUESTION: PWS paragraph 3.2.1: Will the government please provide or allow access to information that better explains the role and function of the MRIP, IOPS, GWM, TPS, CMS, and ISUR? This information is needed to better explain our approach to subfactors 1-3.

ANSWER: A Reading Library will be available to contractors to review documents that are not

31. QUESTION: PWS paragraph 3.3.2 requests the contractor “…establish and maintain version control for all software and configuration items (CI) being prototyped and innovated.” Is there a system in place currently used and, if so, what is it?

ANSWER: It is the responsibility of the Contractor to provide their preferred capability.

32. QUESTION: PWS paragraph 3.3.3: Is there a road map or way-ahead available to discuss/illustrate the current development and deployment direction of IOP so we may incorporate this into our proposed solution?

ANSWER: No.

33. QUESTION: PWS paragraph 3.4.4: Are “operating training venues” developed and delivered to the 39 IOS for instruction or are they delivered locally to the end users?

ANSWER: Operating training venues are developed and delivered to both the 39 IOS and locally to end users.

34. QUESTION: PWS paragraph 3.4.5: What version of IOP is currently fielded and what is included in the baseline deployment. How are add-on software/hardware capabilities currently handled?

ANSWER: A Reading Library will be available to contractors to review documents that are not

35. QUESTION: PWS paragraph 3.4.8: Are temporary/permanent networks currently active and do they have an ATO? Does the contractor have to manage/control these systems?

ANSWER: Current permanent networks are in transition from DIACAP to RMF. Temporary networks will have to be dealt with under RMF, as required. Contractor must manage and control these networks.

36. QUESTION: PWS paragraph 6.2 states, “…remaining personnel must hold a minimum of a Secret clearance pending the completion of an SSBI investigation and must work CMMI effort to obtain their TS/SCI clearance within 90 days of contract award.” What is meant by “CMMI effort?” We could not find reference to it in any of the documents nor in Appendix 1, Acronyms.

ANSWER: PWS paragraph 6.2.1 Industrial Security. The contractor shall follow the security requirements outlined in the Department of Defense (DD) Form 254, Department of Security Classification Specification. The Government considers the requirement of an active Contractor TOP SECRET (TS) Facility Clearance as a definitive responsibility matter. Clearance documentation shall be the sole responsibility of the Offeror. Offerors are advised to review their clearance documentation prior to the proposal due date. Prime Offerors without a TS Facility Clearance will not be considered for award. Offerors shall submit the DD254 with Blocks 6 and 7 completed. Offerors should review the DD254 new format as the block numbers may have changed.

On contract start date, a minimum of 90% of individuals working shall have a TS/SCI clearance and be Director of Central Intelligence Directives (DCID) 6/4 eligible with a current Single Scope Background Investigation (SSBI); the remaining personnel must hold a minimum of a Secret

37. QUESTION: PWS paragraph 6.4 states that Historical Usage and examples of OCRs are listed in Appendix 2, however, Appendix 2 only lists examples. Will the government please provide historical usage information and clarify if this is considered surge support with additional personnel or adjustment to current personnel schedules/locations only?

ANSWER: PWS paragraph 6.4 updated to read “Examples of OCRs can be found in Appendix 2. “

38. QUESTION: Section L.2.2.9 specifies, “Offeror has an Active TOP SERET Facility Clearance, or have submitted a TOP SECRET Facility Clearance to the DSS Facility Clearance Branch…” In the event the Offeror is a Joint Venture, DSS will not inspect and grant a Facility Clearance in advance of contract award. Will the Government accept the Managing Partner and any other Partners in the Joint Venture holding an active TS Facility Clearance as evidence the Joint Venture can hold and service TOP SECRET clearances and access to SCI?

ANSWER: PWS paragraph 6.2.1 Industrial Security. The contractor shall follow the security requirements outlined in the Department of Defense (DD) Form 254, Department of Security Classification Specification. The Government considers the requirement of an active Contractor TOP SECRET (TS) Facility Clearance as a definitive responsibility matter. Clearance documentation shall be the sole responsibility of the Offeror. Offerors are advised to review their clearance documentation prior to the proposal due date. Prime Offerors without a TS Facility Clearance will not be considered for award. Offerors shall submit the DD254 with Blocks 6 and 7 completed. Offerors should review the DD254 new format as the block numbers may have changed.

On contract start date, a minimum of 90% of individuals working shall have a TS/SCI clearance and be Director of Central Intelligence Directives (DCID) 6/4 eligible with a current Single Scope Background Investigation (SSBI); the remaining personnel must hold a minimum of a Secret

39. QUESTION: Section L.4.1.1 requires Past Performance Information (PPI) on “…the offeror and all subcontractors, teaming partners, and/or joint venture partners who are proposed to perform 30 percent or more of the proposed effort…” However, L.4.1.1 also states “Past performance of either party in a joint venture counts for the past performance of the entity.” We interpret this to mean an offeror bidding as a Joint Venture is not required to show past performance for both parties in the JV, since past performance of one party counts for the performance of the entire entity. This will permit us to feature the most relevant and strongest past performance. Please confirm this interpretation.

ANSWER: Yes, your interpretation is correct. However, in accordance with 13 CFR 124.513(d)(2), The 8(a) partner(s) to the joint venture must perform at least 40% of the work performed by the joint venture.

(i) The work performed by the 8(a) partner(s) to a joint venture must be more than administrative or ministerial functions so that the 8(a) partners gain substantive experience.

(ii) The amount of work done by the partners will be aggregated and the work done by the 8(a) partner(s) must be at least 40% of the total done by all partners. In determining the amount of work done by a non-8(a) partner, all work done by the non-8(a) partner and any of its affiliates at any subcontracting tier will be counted.

Also important is 13 CFR 124.513(e)(1), SBA must approve a joint venture agreement prior to the award of an 8(a) contract on behalf of the joint venture. A Participant may submit a joint venture agreement to SBA for approval at any time, whether or not in connection with a specific 8(a) procurement.

40. QUESTION: Section L is silent on the need for Offerors to propose a transition plan, although the proposed CLIN structure implies there will be a transition. Also, Section L is silent on requiring a management plan, or staffing plan. Having performed similar work for this customer set, it has been our experience the majority of performance-related risks tie directly to staffing solution and technical project management, especially risk management. We recommend the Government add an additional sub-factor for offerors to disclose their management practices, and discuss risk and risk management at both the technical and programmatic level.

ANSWER: A transition plan will not be required. A staffing plan will be requested as part of the cost/pricing proposal submittal.

41. QUESTION: Section M, C, Factor 1: TECHNICAL. The Government’s evaluation approach for FACTOR 1 and each subfactor requires offerors to address technical approaches to address potential challenges likely in the conduct of ICPS. However, the Subfactor-level evaluation criteria neglect to assess the potential risks and risk management associated with the proposed solution. IOP is a very complex system, and supports multiple cyber weapon systems (in https://www.law.cornell.edu/definitions/index.php?width=840&height=800&iframe=true&def_id=3e1275e6fc3818559e5d445a696109ce&term_occur=23&term_src=Title:13:Chapter:I:Part:124:Subpart:A:Subjgrp:292:124.513 https://www.law.cornell.edu/definitions/index.php?width=840&height=800&iframe=true&def_id=864d5305dae29d8825417d97bf0db27e&term_occur=10&term_src=Title:13:Chapter:I:Part:124:Subpart:A:Subjgrp:292:124.513 different roles). Failing to address technical, programmatic, and mission risks to supported customers in addressing the evaluation of each Subfactor could result in significant impacts. We recommend the Government incorporate a risk analysis as part of the evaluation of each Subfactor, and that overall evaluation of Technical Acceptability incorporate analysis and mitigation of these risks.

ANSWER: The Government is reviewing Section M, Factor 1.

42. QUESTION: Section M requires “Qualified Offeror must have an Active TOP SECRET Facility Clearance at the time of contract award.” This appears to be a disconnect with L.2.2.9. We recommend the language in L be adopted for Section M, and that further that a Joint Venture with Managing Partner and any other Partners holding an active TS Facility Clearance as evidence the Joint Venture can hold and service TOP SECRET clearances and access to SCI.

ANSWER: Section L and M have been updated to correspond to each other.

43. QUESTION: Reference “Draft ICPS Relevancy Assessment Matrix.” The Government has signaled the relevancy criteria will be tied to annual amounts > $3.5 Million. This could be a significant bar to competition. For one, FPDS data would indicate the incumbent contract does not meet this threshold. We recommend the Government look at a tiered relevancy evaluation protocol, similar to that used on the DCRIOS contract (FA8733-16-R08002), where past performance was evaluated, including revenue, as a body of work rather than by individual citation.

ANSWER: The Government is reviewing the annual dollar amount on the Relevancy Assessment Matrix.

44. QUESTION: PWS Paragraph 3.4.2 The contractor shall attend and provide SME support for developmental tests, operational tests, field service evaluations, test readiness reviews, and test-related TIMs. During testing and evaluations, the contractor may be required to play the role of operator. Is contractor test (CT) required to support developmental and operational tests?

ANSWER: This performance requirement infers the ICPS contractor to support third party test agency testing by providing SME support.

45. QUESTION: PWS Paragraph 3.4.8 The contractor shall design, build, modify, maintain, and administer 90 COS/DOP developmental systems, networks, and environments. As part of the testing activities, do you require a range environment test plan?

ANSWER: No formal range environment test plan is required.

46. QUESTION: PWS Paragraph 3.5 The contractor shall provide information assurance (IA) for 90 COS customers per current guidance directive(s) (currently DoDI 8510.01, Risk Management Framework (RMF) for DoD Information Technology (IT)). QUESTIONS: 1) Do you need IA test plan for this? 2) Are you following a specific DOD IA guidance publication such as NIST SP 800- 115?

ANSWER: 1) No formal IA test plan is required. 2) No, 90th COS performs tests and assessment procedures required to fulfill documentation required under the RMF accreditation process.

47. QUESTION: Reference PWS Paragraph 3.3.3: If the Government is open to achieving enhanced capabilities and potential cost savings, we recommend allowing offerors to propose a Managed

Security Services solution for SIEM and IDS/IPS in addition to responding to the requirements supporting the current environment.

An on-site Managed Security Services approach enables 24×7 SOC support and regulatory compliance. These services can integrate existing Government personnel, processes and technologies in a way that makes information security a force multiplier without the considerable expense and inefficiency of maintaining single technologies like ArcSight. Managed Services solutions can provide the Government with five capabilities in one shared technology platform - SIEM, IDS/IPS, Vulnerability Management.

ANSWER: The Government is reviewing PWS paragraph 3.3.3.

48. QUESTION: Reference Section M: This reads as if the Government is evaluating a specific, proposed upgrade solution, whereas in the draft PWS, the Government only makes reference to upgrades in a general way. Is there a specific upgrade project in place, currently? If so, will offerors be provided insight into important information like the current and planned architecture? It seems, based on this Evaluation Factor, that only the incumbent would have knowledge of the upgrade paths and architecture in sufficient detail to meet Technical Evaluation Criteria Subfactors 1 a, b and c.

ANSWER: A Reading Library will be available to contractors to review documents that are not

49. QUESTION: The go/no go (acceptable/unacceptable) technical evaluation approach along with price factors being equal to all non-price factors combined seems to follow more of a Lowest Price Technically Acceptable evaluation process than a Best Value trade-off process. We respectfully assert that using this approach will result in LPTA-like offers that will potentially limit a contractor’s ability to staff cleared personnel that are in high demand (cyber security experts). It is our understanding that the 90th COS mission is too critical to risk an LPTA-like procurement. Would the Government consider changing the Evaluation Criteria to reflect a true Best Value determination process with Technical and Staffing approaches being evaluated for soundness, feasibility, innovation and low-risk, for example?

ANSWER: This effort is a best value source selection. Technical, Past Performance, and Cost/Price will be evaluated.

50. QUESTION: Reference Section M: Suggest the Government provide clarification on this TOP SECRET Facility Clearance requirement as it relates to unpopulated Joint Ventures. For example, the Government could require each member of the Joint Venture to have a TOP SECRET Facility Clearance and then issue a DD254 to the Joint Venture upon award.

ANSWER: The Offeror (prime) is required to have and maintain a TS Facility Clearance.

51. QUESTION: Reference PWS Paragraph 3.1.2: Suggest the Government clarify if the contractor will need to conduct a gap analysis and provide System Architecture Design documents and/or development of the application. See Section 3.2.3 of Attachment 4 – ITO Section L ANSWER: Yes, gap analysis, system architecture design and development will be required in performance of this task.

52. QUESTION: Reference PWS 3.1.2: Suggest the Government clarify if these will be COTS, in-house developed or a mixture of both for this contract.

ANSWER: Innovation efforts on this contract may identify the need for both COTS and Govt-off-the-shelf (GOTS, or in-house) development.

53. QUESTION: Reference PWS 3.5: In Section 3.2.3 of Attachment 4 – ITO Section L (Subfactor 2) it seems ATO expires in 6 months – will the referenced C&A activity include/require renewal of the

ATO?

ANSWER: Understanding that this is just a “what-if” scenario, the scenario states: “The ATO (under DIACAP) for the software development network expires in six months… The network must have an ATO (under RMF) before the ATO expires..”.

54. QUESTION: Reference PWS 1.3: The draft PWS mentions forensics in some areas but not in the Scope summary. Suggest the Government clarify the scope of the forensics capabilities required.

ANSWER: Updated PWS paragraph 1.2.1 to read “1.2.1 The Information Operations Platform (IOP) is an example of one of the 90 COS innovative network defense solutions; it combines network defense tools and services to support AF IA and information operations (IO). IOP is a system of systems hardware platform whose functions include: real-time network monitoring, enterprise-level intrusion detection and prevention, data management (e.g. correlation, analysis, visualization, and storage), documentation, reporting, and policy enforcement. The IOP system enhances network security by analyzing network internet protocol (IP) traffic and identifying suspicious activity through an in-line monitoring approach. Upon detecting network threats, the system offers automated and manual blocking of selected network traffic. Multiple network protocols, including transmission control protocol (TCP), user datagram protocol (UDP), and internet control message protocol (ICMP) traffic, are monitored by IOP. Platform detection techniques include attack signature recognition, anomaly detection, expert system correlations, and pattern recognition. System configurations include deployment of mobile suites for short duration missions and traditional, rack-mounted suites for permanent installation applications.”