H98210-12-R-0003 0002.pdf

H98202112940001000

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER (Type or print)

30-105-04EXCEPTION TO SF 30

APPROVED BY OIRM 11-84

STANDARD FORM 30 (Rev. 10-83)

Prescribed by GSA

FAR (48 CFR) 53.243

The purpose of this amendment is to provide answ ers to additional inquiries received on H98210-11-R-0003. As a result of this amendment, the attached questions and answ ers are provided.

1. CONTRACT ID CODE PAGE OF PAGES

Y 1 3

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

16C. DATE SIGNED

BY 18-Jan-2012

16B. UNITED STATES OF AMERICA15C. DATE SIGNED15B. CONTRACTOR/OFFEROR

(Signature of Contracting Officer)(Signature of person authorized to sign)

8. NAME AND ADDRESS OF CONTRACTOR (No., Street, County, State and Zip Code) X H98210-12-R-0003

X 9B. DATED (SEE ITEM 11)

20-Dec-2011

10B. DATED (SEE ITEM 13)

9A. AMENDMENT OF SOLICITATION NO.

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

X The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offer is extended, X is not extended.

Offer must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended by one of the following methods:

(a) By completing Items 8 and 15, and returning 1 copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted;

or (c) By separate letter or telegram which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE

RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN

REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by telegram or letter, provided each telegram or letter makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

12. ACCOUNTING AND APPROPRIATION DATA (If required)

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS.

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE

CONTRACT ORDER NO. IN ITEM 10A.

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation date, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(B).

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority)

E. IMPORTANT: Contractor is not, is required to sign this document and return copies to the issuing office.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

10A. MOD. OF CONTRACT/ORDER NO.

2. AMENDMENT/MODIFICATION NO. 5. PROJECT NO.(If applicable)

6. ISSUED BY

3. EFFECTIVE DATE

18-Jan-2012

CODE

DEFENSE HUMAN RESOURCES ACTIVITY

4800 MARK CENTER DRIVE,

SUITE 07G12

ALEXANDRIA VA 22350-1300

H98210 7. ADMINISTERED BY (If other than item 6)

4. REQUISITION/PURCHASE REQ. NO.

CODE

See Item 6

FACILITY CODECODE

EMAIL:TEL:

H98210-12-R-0003

SECTION SF 30 BLOCK 14 CONTINUATION PAGE

SUMMARY OF CHANGES

SECTION SF 1449 - CONTINUATION SHEET

The following have been added by full text:

HRSAP Operational Support Solicitation Additional Questions

Question:

We can demonstrate all required security controls to run this program, and can comply with every regulation referenced in the RFP-but we do not have the documents listed above. By requiring the

DIACAP package or Interim ATO prior to award, your office is restricting many qualified vendors from participating, severely limiting the competition. Can you please explain why the government cannot make demonstration of DIACAP certification and compliance a requirement shortly after award?

Would the government be willing to audit and certify our IT systems and controls prior to award so that we can obtain the Package required to successfully bid on this requirement?

If the answer to #2 is "no", will the government at least explain the process for obtaining the required

Executive DIACAP Package or Interim ATO, so that we can take the required actions so as to not be disqualified from bidding on this contract in future competitions?

Answer:

Any Outsourced IT-Based Processes operating on our behalf of the government must be accredited and authorized by the agency contracting for service. Ultimately it is the contracting agency (DMDC) that will be accepting the risk and responsibility of the contracted service. Therefore it will be the contracting agency's Designated Accrediting Authority (DAA) who will make that determination and issue the

Authority to Operate (ATO).

What we are requiring is the proposed contractor, prior to conducting services, to have conducted a third party systems certification and accreditation audit based upon the either National Institute of Standards and Technology (NIST) or DoD Information Assurance Certification and Accreditation Process

(DIACAP) standards and requirements. DIACAP is the preferred standard for DOD but we are willing to accept NIST standard if the contractor, can present evidence to validate that all security controls and criteria of the DIACAP have been met.

Upon receipt of the documentation (e.g., POA&M, scorecard, artifacts, actual validation results, etc.)

supporting the accreditation decision, the contracting agency's DAA will make the determination whether or not to accept risk at that time. The contractor must show proof that all technical and procedural security requirements have been sufficiently satisfied in the acquisition in order to protect DoD information in the contracted service provider's operating environment.

H98210-12-R-0003

System accreditation is an ongoing and continual evaluation process with monthly scanning, patching, reporting and annual auditing requirements. The DAA reserves the right issue an Interim (IATO) or

Denial of Authority to Operate (DATO) at any time the system's security posture has degraded to an unacceptable level of risk.

(End of Summary of Changes)