CISA COCO OCIO CEEOSS Industry Day QA CISA Responses.pdf

CISA COCO CEEOSS Industry Day Jan 12, 2024 at 10:00AM

Email Questions Government Response Can the government provide a draft section L&M so that Offerors can better prepare for teaming and proposal? (for example, will it be a written technical and mgmt. approach, key personnel, orals, pas performance, phased approach, etc?)

No draft will be issued due to the short time frame. Only the final solicitation issued.

What is the anticipated contract type be - FFP/T&M or combination? The anticipated contract type is a hybrid of Firm Fixed Priced & Labor Hour

What portions of the contract will be unclassified, Secret, TS, and SCI? The classification will depend on the systems and offices they support with Currently that is not known.

What is the estimated value of the contract? The estimated total value is currently undetermined.

Technical Scope:

• Please provide the platform and tools in use today and any anticipated tools in the following scope areas:

- Networking

- Identity and Access Management

- Mobility

- Cloud Support Services

- Communications Services

• To help the Offeror develop a level of effort, will the government provide list of backlog items, anticipated projects, and anticipated milestones/deadlines?

This will not be provided prior to award as it would be voluminous.

Task Areas

• Task One -Technology Evaluation and Integration

- What is the anticipated number of market research reports, trade studies, proofs of concepts, and technology refresh recommendations per year?

The number of market research reports, trade studies, proofs of concepts, a technology refresh recommendations will be determined by agency needs a technology advancements throughout the contract performance.

Task Two -Enterprise Technology Services and Solutions Strategy and Architecture

- Please validate that the scope of the enterprise technology strategy and architecture is limited to the technology areas (Networking, Identity and Access Management, Mobility, Cloud Services, and Communication Services). Other standards, such as for Application Development, are outside the scope of this contract.

- Is there a target architecture and Enterprise Network Taxonomy already established and if so, how mature is this architecture?

- Is there a Enterprise Technology Standards body already established? If so, can the government share the current structure and if applicable, target structure.

Formalized scope will not be posted until final solicitation is issued.

Any details regarding target architecture and Enterprise Technology Standa not be provided prior to award.

Task Three -Technical Solutions Engineering and Implementation

- Please provide the number of applications in on-prem data centers, CISA facilities, and/or cloud environments. Is there a defined strategy yet for these environments going forward? If so, can this be shared?

- Has CISA configured an enterprise cloud environment owned by CISA yet?

- How many applications have been migrated to the CISA-owned enterprise cloud environment? And, how many applications are anticipated to be the environment during this period of performance?

- Can the government share the application migration roadmap?

This information will not be provided prior to award. The applications, syste environment is always adapting based on need and functionality requireme

Given the nature of this work and the importance of this infrastructure and system in running not only the day-to-day operations of CISA but the credibility and integrity that needs to be maintained, RELY suggest that CISA required this work to be performed under GSA HACSIN. Leveraging the HACSIN qualified contractor pool ensures the highest level of security but also those contractors that have the High Availability capabilities. We don’t think all 5 HACSIN categories are required, but the key ones should be considered. Leveraging this does not change any social economic company or unrestricted.

That will be determined based on the responses to the Sources Sought Not

Reading through some of the requirements, such as emerging technology and providing proof of concepts , with unknow emerging technology and number of POC’s will make it impossible for offeror’s to bid an accurate dollar figure. This might be considered Task Orders or some other means that doesn’t require contractors to guess a number, leaving the success of the work very unlikely without cos an modification considerations. Maybe even for this type of work assign a place holder number for all offerors to use for bidding purposes or a LOE for hours Recommendation received and acknowledged.

Recommend ensuring that areas like requirements, technical reviews, Change Request etc. have some quantified number like estimated X CR’ per month. Not having any baseline or set expected LOE will make it impossible for offerors to staff and price in their bid , whereas it will successfully meet CISA’s goals. Highly recommend identification of LCATS and LOE to go out for each task(s) for the contract. Now we know that some of these are simply unknown, but setting an expected baseline will at least give CISA bids that are more accurate and should prevent contract actions down the road. Recommendation received and acknowledged.

In general recommend more descriptions of how environment, tools, software and hardware will be provided or procured to support this work. We have seen this hold up timelines for months, if no years, when a contract is awarded but these logistical and assets are unknown or have not been worked out. Maybe some thought on this and/or how to identify the processes as much as possible and if there is anything the offeror will need to procure identify and decide how they will price this into their bid, In line it would almost seem a PMO contractor would be needed to help this contractor work and logistically receive and use what is needed to perform this statement of work, Each requirement is handled separately. No specific process or procedure identified in advanced.

Will the government consider awarding CEEOSS to multiple vendors? That will be determined based on the responses to the Sources Sought Not Will the government consider using the GSA MAS 54151S Information Technology Professional Services instead of the Cloud SIN? Most of the work is not administrator cloud based but more IT services based.

That will be determined based on the responses to the Sources Sought Not

Will the CISA TESS contract scope be assumed into the CEEOSS scope? No.

Industry Day Chat Questions:

Will application development tasks be executed via another solicitation ? No.

How does the work on this contract gel (or overlap) with work that has been solicited/planned by CSD for building CISA services ie for analytics, data sharing etc? Is this contract purely for internal CISA “enterprise” services? How will the cloud services and any he/sw etc needed to implement be procured?

The contract will be able to provide services to all of CISA.

Cloud services and HW/SW requirements will be handled separately.

For the org chart that was presented - will you be providing the SBS contact info for each section? There is only one SBS for CISA.

Will this RFP be coming out via Alliant 2? That will be determined based on the responses to the Sources Sought Not Given April is there still a TBD on contract vehicle? That will be determined based on the responses to the Sources Sought Not

Will you be releasing a Draft Sections L&M? No, all information will be released in the final solicitation due to timing.

Will CISA consider setting aside this acquisition for 8(a) small businesses? That will be determined based on the responses to the Sources Sought Not Given the security nature of this would CISA consider GSA HACSIN ? Even GSA HACSIN small? That will be determined based on the responses to the Sources Sought Not Will CISA give consideration for SB/SDB/VOSB set aside or partial set aside? That will be determined based on the responses to the Sources Sought Not

Can the government explain the main differences between executed scope today and this new solicitation?

The main difference between the scope executed today and the new solicita the new solicitation will not include Application Development or Operations Maintenance Support. However, transition from Engineering to Operations an additional scope that will be added.

Since requirements/scope has changed from the previous CEEOSS contract, is the Government willing to consider using the 54151S Information Technology Professional Services SIN, as opposed to the 518210C Cloud and Cloud-Related Professional Services SIN? The new scope would seem to suggest a broader portfolio of work, and 54151S seems more appropriate.

That will be determined based on the responses to the Sources Sought Not

Will CISA consider this solicitation to be released as WOSB? That will be determined based on the responses to the Sources Sought Not I agree 54151S seems to fit better That will be determined based on the responses to the Sources Sought Not Since DTSS was released as WOSB, will CISA consider NOT making this WOSB so the rest of us have a chance? That will be determined based on the responses to the Sources Sought Not agree 54151S That will be determined based on the responses to the Sources Sought Not Recommend no matter what HACSIN be required, this is too critical and you want proven contractors with security imbedded in their practices. Recommendation received and acknowledged.

Will there be any other contracts in the OCIO whose contract holders will be conflicted out of an award on this contract? Some current CISA vendors will not be able to participate due to OCI

Can you explain what classification levels are required for this effort?

The classification will range from unclassified to Top Secret and TS/SCI de on the systems and offices they support within CISA.

Especially given internal operations there will be the need to understand HA and support HA systems Your comment is acknowledged.

Is CISA considering making this a multiple award vehicle like DTSS? having a BPA or IDIQ would provide the Government with more options at the task order level, and optimize industry's ability to contribute the best services and solutions to the Government. everyone wins.

That will be determined based on the responses to the Sources Sought Not

Please the sooner the vehicle and set aside type is important if you want great bids and teams by April. IF you could get this out as quick as possible prior to an April drop will help CISA get the bes bids.

That will be determined based on the responses to the Sources Sought Not

GSA can assist in quickly and easily determining the level of interest of Small Businesses via our MRAS RFI survey That will be determined based on the responses to the Sources Sought Not

We cannot save chat. Can you please save and send to attendees. Will a list of attendees be provided? Thank you.

All questions received in the chat have been included in this Q&A. The atte has been posted to the SAM.gov announcement with this Q&A response.

Is the Government open to a late RFI response? No, late responses will not be reviewed.