FIRST SET OF RESPONSES.pdf

Cybersecurity Assessments and Services RFP Questions and Answers

BPM041211 - F50B4600024

FIRST SET OF RESPONSES

1. Question: Wanted to check regarding if this work requires onsite presence OR can it be done offshore with just coordination from onshore?

Response: There may be times where onsite presence is required, e.g., documentation reviews or meetings, however the expectation is that the majority of the work will be performed remotely and from within the United States. Offshore/international work is NOT permitted.

2. Question: The name of the incumbent vendor currently responsible for the project.

Response: The RFP is the first released. Other entities, under different contract vehicles, have been providing certain of the services within the scope of this solicitation. .

3. Question: Please confirm that DOIT will accept both prime and subcontractor qualifications to meet the minimum requirements and references/past performances for Solicitation F50B4600024

Response: Past performance must be that of the Offeror and not any proposed subcontractors. See RFP Sections 1.1.1 - 1.1.4.

4. Question: Could the state please indicate if this program/Solicitation will included as part of the 2025 MITD RE: Cybersecurity Assessments and Services Solicitation #:

F50B4600024

Response: This solicitation is unrelated to any MITDP.

5. Question: Please indicate how many awards will be made in Category 4—is it one award, or multiple awards for this category?

Response: See RFP Section 2.1.3.

6. Question: Can the same prime submit proposals for all four categories (with the understanding that if awarded category 4, we would be disqualified from categories one through three)?

Response: No. Do not submit for Category 4 if proposing under Categories 1, 2, and/or 3 and do not submit for Categories 1, 2, and/or 3 if proposing under Category 4. Offerors submitting proposals for Categories 1, 2, and/or 3, are precluded from receiving an award for Category 4. Offerors submitting a proposal for Category 4 are excluded from receiving an award for Categories 1, 2, and/or 3.

7. Question: For Category 4 key personnel, can personnel who are in the process of obtaining a CISSP specialization within the next few months be submitted for this effort?

Response: No.

8. Question: It is our understanding that MBE prime offerors may only satisfy 10% of the MBE requirement. Therefore, all offerors will need to have at least one subcontractor to satisfy the full 20% MBE requirement. We believe it would be in the best interest of the Government to evaluate the qualifications of the entire team, including past performance. Which of the following accurately describes the Government requirement for past performance references?

A. The Offeror MAY provide past performance references from any member of the team (prime or subcontractor) provided each reference meets all requirements stated in the Solicitation regarding size, relevance, and recency. (No change to Solicitation needed.)

B. The Offeror MUST provide at least one reference from each member of the team (prime and subcontractors) and each reference must meet all requirements stated in the Solicitation regarding size, relevance, and recency. (Small change to Solicitation needed) C. The Offeror MAY ONLY provide past performance references from the prime and MAY NOT include any past performance references by subcontractors. (Small change to Solicitation needed).

Response: See RFP Sections 1.1.1 - 1.1.4. Prior experience must be that of the Offeror.

9. Question: (General) Can MD DoIT please clarify if a response per category 1-4 is needed in Volume one for each of the sub sections A-O? It appears that only sections F-J are category specific and would need to be broken down into 4 unique subsections to speak to each of the four categories.

Response: An Offeror should respond only with respect to the category(ies) to which it is submitting a proposal.

10. Question: Please confirm, or explain further, as indicated in the Bidders Conference 12/20/2023:

This RFP solicitation is for a Master Vehicle. One vendor will be selected per category.

As for funding, see the response to Question No. 3.

Response: See RFP Section 2.1.3. . Funding is unrelated to the Offerors ability to demonstrate performance of work.

11. Question: (Section 5.3.2-G) Can MD DoIT please confirm that each vendor needs to provide three client references per category, a total of 12 client references?

Response: If you are submitting proposals for Categories 1, 2, and/or 3, you cannot submit a proposal for category 4. And vice versa- submitting a proposal for Category 4 excludes you from submitting it for Categories 1, 2, and/or 3. Therefore the number of references an Offeror may need to provide would depend on the number of Categories to which it is proposing . Each category will require three references, however the references may be the same.

12. Question: To fulfill the minimum qualification criteria & references documentation from the past five years, can we provide all three references of our subcontractor we are going to collaborate with?

Response: See response to Question No. 3. References must be those of the Offeror and not any subcontractor(s) it may be proposing.

13. Question: (Section 5.3.2-G) Can MD DoIT please clarify, if the vendor has performed work across more than one category for the same client, can the same client reference be used for multiple categories?

Response: If the scope of the work performed, with the client reference provided, aligns to more than one category, that same reference may be utilized.

14. Question: (Section 5.3.2-G) Can MD DoIT please confirm for resource resumes we need one resource for category 1-3 (3 total for categories 1-3) and then three resumes for category 4?

Response: Only Category 4 requires resumes to be provided.

15. Question: (General) Can MD DoIT please clarify, are vendors required to reply for all four categories to be considered for any of the four categories?

See response to Question No. 6.

16. Question: Do Labor hour rates apply to Fixed Price work order awards or will only apply to labor hour work orders?

Response: Labor hour rates apply when work orders require them.

17. Question: Section 2.3.1A Paragraph A states that the contractor shall conduct ~70 cybersecurity assessments within 12 months. Does this mean the vendor should anticipate performing ~70 cybersecurity assessments each year for each of the contract follow-on years?

18. Question: How many task orders does DoIT anticipate will be issued per year under the contract?

Response: This has not been determined as of this date. Per statute, cybersecurity assessments are required every two years. Assessments are required in 2024. The vendor should anticipate this requirement at least every two years, or upon the schedule required by DoIT.

19. Question: Do you want these cybersecurity assessments to be fully automated or with a manual component for added thoroughness?

Response: The Offeror should propose its solution.

20. Question: Category Two: How many purple team engagements will need to be done in Year 1?

Response There are no existing requirements for the number of engagements.

21. Question: Will contractors utilize state assets (i.e., laptops, computers, electronic media, etc.) to perform assessments or are contractors expected to use their own assets?

Response: The State will not be supplying such assets.

22. Question: The current budget allocated for the solicitation.

Response: There is no budget amount associated with this project as of yet. Please see RFP Section 6.3 advising that proposed pricing is part of the evaluation criteria.

23. Question: Also, we would like to know the spend amount of last year under this contract.

Response: There is no prior contract.