Q_and_A_for_Sentinel_2014.doc

ANSWERS TO PROSPECTIVE OFFEROR’S QUESTIONS

FDA-14-RFP-1127332

Sentinel 2014

QUESTION NO.1

On pp. 4-5, Section B.2, Prices/Costs, the Loaded Hourly Rates table includes estimated hours. Can these hours be changed in our response? Do they need to match the firm-fixed price tables on pp. 3-4? Is it possible to add additional CLIN lines? (For instance, to account for tech-related personnel.)

ANSWER NO.1

The estimated hours in the loaded hourly rates chart cannot be changed; The estimated hours are to be used for evaluation purposes and they don’t need to match the firm fixed price table pages 3-4; You can add additional CLIN lines to account for tech-related personnel with loaded hourly rates, and a description of their labor category.

QUESTION NO.2

On p. 25, Section G.1, the second sentence says “All task orders issued under this contract shall conform to the provisions of the contract clause in Part 7 entitled ‘Ordering.’” What is Part 7? Is it a reference to Section I.3 on p. 37, FAR 52.216-18, Ordering (OCT 1995), or a reference to something else?

ANSWER NO.2

Yes; See Amendment 1

QUESTION NO.3

On p. 29, neither box is checked in item XIII. Will an invoice log addendum be required for invoicing under a contract awarded under this RFP?

ANSWER NO.3

Yes; See Amendment 1

QUESTION NO.4

On p. 33, the two links under H.2, items (1) and (2), are dead. Could you please send corrected links?

ANSWER NO.4

See Question and Answer for #4 and #9 below

QUESTION NO.5

On p. 43, Section (2) none of the certifications are checked off as applicable. Could you please confirm that these certifications do not apply to this RFP?

ANSWER NO.5

See Amendment 1

QUESTION NO.6

On p. 51, Section L.5.(1), the due date has been left blank and the time differs from the information on line. Please confirm that the due date is 28 July 2014 by 11:00 am and that this application should be submitted electronically.

ANSWER NO.6

Changed; See Amendment 1

QUESTION NO.7

On p. 51, Section L.6, the proposal instructions do not include any requirements for font, font size, or margins. Would Arial, 11-pt, with 1-inch margins be acceptable to the FDA?

ANSWER NO.7

Yes

QUESTION NO.8

On p. 52, Section L.8, no mention is made of references. Could we include references in our technical proposal without including them towards the 12-page limit?

ANSWER NO.8

Yes

QUESTION NO.9

On p. 34, section H.2, item (6) says, “the vendor must purge all FDA data from its servers and other media…” Could you please define “FDA data”?

ANSWER NO.9

See Question and Answer for #4 and #9 below

QUESTION NO.10

On the NPI form that is required for Key Personnel, what should we use for the contract number and what should we fill in for “description of information released”?

ANSWER NO.10

Do not fill out “description of information released”

QUESTION NO.11

Is there a separate RFP that will be released to encompass the effort to create the databases required for data partners?

ANSWER NO.11

No.

QUESTIONS SHALL BE ACCEPTED VIA EMAIL TARA.HOBSON@FDA.HHS.GOV BEFORE 5:00PM (1700) EASTERN TIME JULY 21, 2014.

Question and Answers for# 4 and #9:

H.2 FISMA Regulations

Current language The contractor shall comply with the following Federal and agency IT security requirements – please include the information contained within the following links and bullets within your contract:

1) http://inside.fda.gov:9003/it/ITSecurity/Communications/ucm230607.htm

2) http://inside.fda.gov:9003/downloads/it/ITSecurity/Communications/UCM378605.pdf

3) 352.239-70 (Standard for security configurations), 352.239-71 (standard for encryption language), and 352.239-72 (security requirements for federal information technology resources). All three clauses can be found on the link below. http://www.hhs.gov/regulations/hhsar/subpart352-30s.html#352.239-72Securityrequirementsforfederalinformationtechnologyresources.

4) http://www.whitehouse.gov/sites/default/files/omb/memoranda/2014/m-14-03.pdf

5) Contractor is required to have an annual Statement of Standards for Attestation Engagements (SSAE No.16) independent examinations and audit of its internal controls. This audit must report on controls placed in operation and on tests of the operating effectiveness of the systems used to run all applications or transactions. Audit reports should be sent to the Food and Drug Administration Contracting Officer's Technical Representative COTR, Chief Security Officer and the FDA Information System Security Officer (ISSO) assigned to the project on an annual basis. Contractor is required to have full knowledge of and compliance with Title III of the E-Government Act of 2002 (FISMA).

6) Contractor must submit a media sanitization plan developed in accordance with NIST SP 800-88 Current Revision for review and approval by FDA. The vendor must purge all FDA data from its servers and other media (backups, etc.) once the contractual relationship with FDA is terminated. Sanitization must be performed in accordance with NIST SP 800-88 Current Revision and FDA SMG 3252.4

New language As per HHSAR 352.239-72 – “Security requirements for federal information technology resources”, the contractor shall:

a. Comply with the Federal Information Security Management Act (FISMA) 2002. Information technology systems that will be used to process, store, or transmit federal information in support of this contract shall be segmented from Contractor’s Corporate Network and adhere to the National Institute of Standards and Technology (NIST) Special Publication (SP) 800 Series and associated Federal Information Processing Standard Publications (FIPSPUB) standards that meet security control baselines supporting data in accordance with FIPS 199. All systems that are operated in support of this contract shall undergo a security assessment and achieve a security authorization to operate by the FDA’s Authorizing Official (AO) prior to processing, storing, or transmitting federal information. The Contractor shall cooperate and provide FDA access to, and information, regarding the Contractor’s systems in conjunction with FDA’s efforts to ensure compliance with all federal and departmental security requirements.

b. Establish a continuous monitoring capability in accordance with NIST SP 800-137.

c. Maintain an accurate inventory of all devices used in the performance of the contract.

d. Use the FDA recommended templates of security artifacts that shall be used with the development or maintenance of any IT system. The following deliverables shall be submitted at least annually or upon significant change to the system and the details contained in the documents must be of the actual environment as built:

· Security Categorization Form (SCF) to be completed with support from the Business Owner/ISSO

· Privacy Impact Assessment (PIA) Form, which is signed off by the FDA Director of Privacy

· E-Authentication Form

· System Security Plan (SSP)

· Information System Contingency Plan (ISCP), to include the relevant parts specific to the system being developed/maintained.

· ISCP Annual Exercise/Test

· Plan of Action and Milestones

e. Review all identified and applicable weaknesses within the Plan of Action and Milestones and provide a resolution within the required timeline. The weakness resolution will include the proposed solution, a project schedule to include the resources required, and the submittal of an artifact to validate the weakness has been remediated.

f. Employees with access to data will be required to undergo a Level 5 Public Trust security clearance, including finger printing, performed under the auspices of the FDA Security Office.

g. Due to the sensitive nature of the information involved, all contractor personnel will be required to sign a non-disclosure agreement before data and information otherwise exempt from public disclosure (e.g. Privacy Act or Data Collected Under an assurance of Confidentiality) may be disclosed to them. Each contractor/sub-contractor employee who may have access to non-public Department information under this task order shall complete and submit the FDA Form 3398: Contractor’s Commitment to Protect Non- Public Information (NPI) Agreement available upon request from the FDA Intranet site. A copy of each signed and witnessed Non-Disclosure agreement shall be submitted to the Project Officer or designee prior to performing any work under the contract. The Project officer or designee will inform the contractor of any additional forms and training that are required (if any).

h. Contractor-owned laptops or other media storage devices to process or store data in the performance of this contract must be authorized by the Contracting Officer (CO).

The following section is to be added to the contract’s deliverable section.

The contractor will provide the following deliverables to the Contracting Officer Representative (COR). Acceptance of the deliverable is designated within the description. The deliverables corresponding to the applicable Enterprise Performance Lifecycle Stages (EPLC) are provided below; exemption from the EPLC does not exempt from the document requirements

CONTRACT DELIVERABLES

Plan Develop and update the System Security Plan using the provided FDA template. Acceptance provided by the Information Systems Security Officer (ISSO).

Information Technology Security Development Phase

Assessment (PIA) Form Develop and update the Privacy Impact Assessment form using the provided FDA template. Acceptance provided by the Privacy Office.

Information Technology Security Planning Phase

Categorization

Form Develop and update the Security Categorization Form using the provided FDA template. Acceptance provided by the Information Systems Security Officer (ISSO).

Information Technology Security Requirements Analysis Phase

Form Develop and update the E‐Authentication Form using the provided FDA template. Acceptance provided by the Information Systems Security Officer (ISSO).

Information Technology Security Requirements Analysis Phase

System Contingency Plan (ISCP) Develop and update the Information System Contingency Plan using the provided FDA template. Acceptance provided by the Information Systems Security Officer (ISSO).

Information Technology Security Test Phase

Exercise Conduct the annual ISCP Exercise using the provided FDA templates for documentation of the Exercise Plan and Report. Approval and acceptance by the Information Systems Security Officer (ISSO).

Information Technology Security Operations and Maintenance

Phase

PAGE