Industry QA_120222.docx

1. Section 2.3.1. requires the offeror to submit evidence of the Executive DIACAP Package and an Authority to Operate (ATO) or Interim Authority to Operate (IATO). If the offeror does not have a signed ATO or IATO at the time of proposal submission, will the Government accept evidence of a third party system certification and accreditation audit based on DIACAP standards and requirements? This evidence would include but not be limited to the Executive DIACAP package (System Identification Profile, DIACAP Implementation Plan, DIACAP Scorecard, and Plan of Action and Milestones), a Risk Assessment Report, Validation Results and actual artifacts/evidence.

Answer: What we are requiring is the proposed contractor, prior to conducting services, to have conducted a third party systems certification and accreditation audit based upon the either National Institute of Standards and Technology (NIST) or DoD Information Assurance Certification and Accreditation Process (DIACAP) standards and requirements. DIACAP is the preferred standard for DOD but we are willing to accept NIST standard if the contractor can present evidence to validate that all security controls and criteria of the DIACAP have be met.

Upon receipt of the documentation (e.g., POA&M, scorecard, artifacts, actual validation results, etc.) supporting the accreditation decision, the contracting agency's DAA will make the determination whether or not to accept risk at that time. The contractor must show proof that all technical and procedural security requirements have been sufficiently satisfied in the acquisition in order to protect DoD information in the contracted service provider's operating environment.

System accreditation is an ongoing and continual evaluation process with monthly scanning, patching, reporting and annual auditing requirements. The DAA reserves the right issue an Interim (IATO) or Denial of Authority to Operate (DATO) at any time the system's security posture has degraded to an unacceptable level of risk.

2. Must the demonstration of security compliance be conducted for the prime contractor?

Answer: Any Outsourced IT-Based Processes operating on the behalf of the government must be accredited and authorized by the agency contracting for service. Ultimately it is the contracting agency (DMDC) that will be accepting the risk and responsibility of the contracted service. Therefore it will be the contracting agency's Designated Accrediting Authority (DAA) who will make that determination and issue the Authority to Operate (ATO).

3. Can you share the name of the incumbent?

Answer: SRA

4. I am hoping to find out if there is an incumbent contractor for the HRSAP ANALYTICAL SUPPORT. If so, could you please provide me with the contractor, contract number, award/expiration dates and approximate value?

Incumbent: SRA Contract number: M67004-10-F-0346 Award date: July 26, 2010 Expiration date: July 26, 2012 Approximate value: $9,672,124

5. After reviewing the document, [we] respectfully request clarification of the Small Business Subcontracting Plan goals included in Attachment B on page 54 and submits the following question: Would the Government please provide additional information regarding what would be deemed “reasonable goals” to be included in the Small Business Subcontracting Plan submission in response to this Solicitation? Are there specific percentage goals that should be incorporated in the Plan?

Answer: Contact Fernando Guerra, DHRA Small Business Specialist, at 571-372-2591.

6. ON PAGE 24- ii. A document certifying the Offeror’s compliance with DIACAP. Offeror’s shall provide evidence of the Executive DIACAP Package and an Authority to Operate (ATO) or Interim Authority to Operate (IATO).

on PAGE 64- 2.3.1. In accordance with the PWS Paragraph 8, the Contractor shall ensure any DoD data is handled using the DIACAP process, minimally at the MAC-II Sensitive Level. As such, the contractor shall identify how they are in compliance and provide evidence of the Executive DIACAP Package and an Authority to Operate (ATO) or Interim Authority to Operate (IATO) acceptable to the government. The Government will not consider further or evaluate any proposal that fails to submit a satisfactory ATO or IATO.

Regarding the requirements above, we do not have a current nor recent project with DIACAP compliance certification. Are there acceptable alternative certifications such as FISMA compliance? We do have government projects where we’ve received security clearance under FISMA.

Answer: See #1. The only alternative certification to DIACAP is NIST.