SAM_Combined QA.pdf

Question Number Question Government Response

Q1 The solicitation states: “Supplier Performance Risk System (SPRS) scoring of 110 aligned with the NIST SP 800 - 171 applicable security controls.” Would the government confirm that they are referencing SPRS Supplier Risk score?

When it comes to SPRS NIST SP 800 – 171 assessments, 110 score is the Assessment Score value.

Q2

If the government is requiring a NIST Score of 110, would the government consider a score of 88 on the NIST 800- 171 assessment, considering a score of 88 on the NIST 800-171 is often used in conjunction with 800-53 for organizations handling Controlled Unclassified Information (CUI), and is considered a passing score for CMMC Level 2?

A score of 110 is indicative of a full compliance per NIST SP 800 – 171. Absent the full compliance that is reflected in the deductions, a lower score may be accepted with a POAM showing the progress towards full compliance.

Q3 If NIST score of 88 is not acceptable would the government consider a score NIST 88 and a POAM to get to 110 as acceptable IAW with reference of CMMC ?

A score lower than 110 will be given a consideration with proper POAM submission that demonstrates progress towards full compliance.

Q4

Does the RMF proposal, including the SPRS process, apply primarily to the Prime supplier’s organization? It is anticipated the solution described in the Prime supplier’s RMF proposal would describe secure file transfers, storage, and security certifications pertaining to subcontractors, but there would not be a requirement to complete the full RMF proposal and SPRS process for subcontractors, (e.g., print and scan vendors). Is this assumption accurate?

SPRS requirement as well as DFARS 252.204-7012 applies to contractors (prime) and their subcontractors.

Q5 The RMF proposal and SPRS process have not been part of this type of program in the past. This seems unduly restrictive of competition and may indicate an unfair competitive advantage in acquisition. Is there a possibility of reducing the requirements in this area?

Per DFARS 204.7602 (see here: Subpart 204.76 - SUPPLIER PERFORMANCE RISK SYSTEM | Acquisition.GOV) “204.7602 Applicability.

Use of SPRS risk assessments is required for the evaluation of quotations or offers in response to solicitations for supplies and services, including solicitations using FAR part 12 procedures for the acquisition of commercial products and commercial services, excluding solicitations for the procurement of supplies or services exempted by the Department of Defense Instruction (DoDI) 5000.79, Defense-wide Sharing and Use of Supplier and Product Performance Information. SPRS retrieves item, price, quality, delivery, and contractor information from contracts in Government reporting systems in order to develop risk assessments of contractors. SPRS is available at https://piee.eb.mil/, and the SPRS user’s guides are available at https://www.sprs.csd.disa.mil/reference.htm.”

Q6

We are a mature business that is classified as a small business under NAICS 541720 ($28M). We are leading a team of both large and small businesses. Because the Small Business Participation Commitment Document (SBPCD) is a pre-requisite for moving onto Phase 2, would the government look more favorably on a team that is led by a small business to help the DOD achieve small business goals, with the understanding that this market research program was set aside for small business from 2009-2019?

This RFP acquisition is solicited on an unrestricted basis and it is not contemplated to change.

Q7

The requested RMF evidence contains corporate sensitive, confidential infomration that FEDRAMP authorized service providers must protect as CUI (per FedRAMP).I fan offeror intends to use a thrird-party, FedRAMP authorized service for storing, processing, and hosting Government data, please confirm it is acceptable for the offeror to provide the FedRAMP Package ID in lieu of the specifiied Compelling evidence, Body of Evidence, and SPRS.

FedRAMP is a higher and more strict standard than the requested NIST SP 800-171 requirement, as it uses an independent, third-party assessment organization to evaluate security against NIST SP 800- 53 security controls. The FedRAMP package ID allows the Government to request the relevant RMF artifacts from FedRAMP.

While an offerror may introduce a 3rd party Information Technology platform that has FedRAMP provisional authorization, this does not exempt an offerror from a requirement as stated in the DFARS 204.7602 (see here:

Subpart 204.76 - SUPPLIER PERFORMANCE RISK SYSTEM | Acquisition.GOV). Specifically, “204.7602 Applicability.

Use of SPRS risk assessments is required for the evaluation of quotations or offers in response to solicitations for supplies and services, including solicitations using FAR part 12 procedures for the acquisition of commercial products and commercial services, excluding solicitations for the procurement of supplies or services exempted by the Department of Defense Instruction (DoDI) 5000.79, Defense-wide Sharing and Use of Supplier and Product Performance Information. SPRS retrieves item, price, quality, delivery, and contractor information from contracts in Government reporting systems in order to develop risk assessments of contractors. SPRS is available at https://piee.eb.mil/, and the SPRS user’s guides are available at https://www.sprs.csd.disa.mil/reference.htm.”

Additionally, the DoDI 8582.01 will be applied to an offerror's use of a Cloud service that follows specific policies and procedures outlined here: Subpart 239.76- CLOUD COMPUTING (https://www.acquisition.gov/dfars/subpart- 239.76-cloud-computing) and here: https://www.acquisition.gov/dfarspgi/pgi-239.7603-procedures.#DFARS_PGI_239.7603.

Q8 Is the SPRS score required for the prime contractor, vendors who supply FedRAMP-authorized Software as a Service, or both?

The prime contractor has a responsibliity to document the use of a Cloud service (SaaS, PaaS, or IaaS) as part of the documentation required to demonstrate compliance of the system that is used in performance of the Contract. Hence, SPRS registration and documentation requirements will apply.

Q9 The instructions do not provide guidance on margins; preferred font; font size for narrative; font size for tables, figures, graphics, etc. Would the Government confirm that Times Roman with 1-inch margins, size 12 for narrative and Arial Narrow size 10 for graphics, tables, and figures is acceptable?

Section Addendum 52.212-1 has been updated as follows. Each side of an 8.5 X 11 inch page with printed text will count as one page. Each side of an 11 X 17 inch page with printed text will count as two pages Font size shall be no less than 12-point, Times New Roman, except for lettering within tables, charts, graphics, and figures. Font size for lettering within tables, charts, graphics, and figures shall be no less than 8-point. A font other than Times New Roman may be used. Tables, charts, graphics, or figures may not cover 60% of the page, and shall be for illustrative purposes only and not used in lieu of main proposal text.

Q10 Since the RMF is actually part of the Technical Volume yet submitted separately, please confirm 2 volumes are needed: Phase 1 Technical Volume: Element 1 and Phase 2 Technical Volume: Elements 2-6. Confirmed as mentioned.

Q11 52.212-5 is addressed on page 13 and again on page 26; however, these RFP sections differ in identifying what is applicable and what is not. Would the Government please confirm that the clauses listed under 52.212-5 as included beginning on p. 25 are applicable to this Procurement.

FAR 52.212-5 has been updated to reflect the clause and deviation dated March 2025.

Q12

Per the Solicitation Phase 1, Volume 4, Small Business Participation proposal is due June 16, 2025, 9:00am ET.

Calculations to determine the dollar value of small business contributions in line with the MQR are to be calculated against the total contract value, however, Offeror pricing is not due until the Phase 2 submission. Would the Government confirm that bidders will calculate the Small Business proposed dollar values using the Not to Exceed IDIQ ceiling amount of $96,557,811.24 as listed in Attachment 11 – Addendum to FAR 52.212-2, Evaluation - Commercial Items, Section 3.6 Price Evaluation (FACTOR 4) Note 1?

For Phase 1 purposes, offerors are advised to submit a percent (%) and associated dollar amount allocations based on Attachment 8 and the Not to Exceed IDIQ Ceiling amount of $96,557,811.24. Offerors entering Phase 2 will be required to revise Attachment 8 based on its proposed amount accordingly and submit with the Phase 2 price proposal.

Q13

The Solicitation states “Phase 1 proposal rating results will be provided within 7 calendar days of the due date for Phase 2” Can the Government please clarify if this means that rating results will be provided no later than seven (7) days prior to the Phase 2 due date, or that rating results will be provided no more than seven (7) days prior to the Phase 2 due date?

Phase 1 rating results will be provided to all offerors no later than 7 days prior to the Phase 2 due date for proposals.

Q14 Would the Government please confirm that Offerors may alter the table provided as needed to accommodate multiple performance years?

Offerors may alter the table provided on a as need basis to accommodate multiple performance years but should not deviate from the information being requested.

Q15 Should offerors base their SB participation plan off the TCV listed in the Solicitation, Attachment 11?

For Phase 1 purposes, offerors are advised to submit a percent (%) and associated dollar amount allocations based on Attachment 8 and the Not to Exceed IDIQ Ceiling amount of $96,557,811.24. Offerors entering Phase 2 will be required to revise Attachment 8 based on its proposed amount accordingly and submit with the price proposal.

Q16 Is it necessary to submit a separate table of MQR targets for each year of the contract (i.e., base plus each of the four option years separately)? To facilitate the Government's review of the SB Participation Plan, should contractors assume equal ceilings per OY at this point?

Yes, offerors are advised to submit a separate table of MQR targets for each contract year ( five year ordering period).

Yes, offerors are advised to assume equal ceilings per contract year for evaluation purposes. The MQR for small business participation for this requirement is 25% of the total contract value for the first and second contract year of the ordering period, and 30% for the remaining years.

Q17 What factors will the Government use to evaluate whether the Contractor has provided a realistic approach to meet or exceed the MQR?

See RFP instructions at 52.212-1 and Attachment 11, addendum FAR 52.212-2 evaluation critera for details. The small business participation commitment needs to express goals in terms of a percentage of total planned subcontracting dollars for the use of small business (SB), veteran-owned small business (VOSB), service-disabled veteran-owned small business (SDVOSB), HUBZone small business (HUBZONE SB), small disadvantaged business (SDB) and women-owned small business concerns (WOSB) pursuant to FAR 52.219-9.

Q18 The BoE notes that the contractor should include an SPRS scoring of 110 aligned with the NIST SP 800 – 171 applicable security controls. What evidence specifically is does the Government require for this score? A self-attestation? Or should contractors have a certification or submission through the SPRS website?

Per DFARS 204.7602 (see here: Subpart 204.76 - SUPPLIER PERFORMANCE RISK SYSTEM | Acquisition.GOV) “204.7602 Applicability.

Use of SPRS risk assessments is required for the evaluation of quotations or offers in response to solicitations for supplies and services, including solicitations using FAR part 12 procedures for the acquisition of commercial products and commercial services, excluding solicitations for the procurement of supplies or services exempted by the Department of Defense Instruction (DoDI) 5000.79, Defense-wide Sharing and Use of Supplier and Product Performance Information. SPRS retrieves item, price, quality, delivery, and contractor information from contracts in Government reporting systems in order to develop risk assessments of contractors. SPRS is available at https://piee.eb.mil/, and the SPRS user’s guides are available at https://www.sprs.csd.disa.mil/reference.htm.”

Q19 The Solicitation points the reader to Appendix A for detailed instructions on the SPRS. Could the Government confirm whether this should instead say Appendix B? Yes. Based on the current reference in the solicitation, Appendix B should be referenced, instead.

Q20

The SPRS links provided in the Appendix B of the Solicitation are no longer valid. Moreover, Appendix B references a GSA process for SPRS submissions which does not seem to align with current requirements and processes for submission via DISA. Could the Government please clarify the correct process for SPRS submission, including the expected documentation and method of submission, and update Appendix B accordingly?

The links may have become outdated based on original write up of the solicitation. The current URL for the SPRS portal is https://www.sprs.csd.disa.mil/default.htm The detailed guidance can also be found at this link follow FAQ section: https://www.sprs.csd.disa.mil/faqs.htm

Q21 Does the government foresee positions that require Tier 5 background investigation? No, the Government does not require Tier 5 background investigations

Q22 The Pricing Worksheet has some Skill Levels that are numbered (e.g., I, II) and others which do not have a number.

Could the Government please clarify how to interpret the I, II or Blank Skill Levels?

Please see amendment 0001. Skill Levels such as Level I correspond to (Entry/Junior), Level II (Intermediate) and Level III (Senior). When no skill level is specified, the description alone applies.

Q23 The Project Manager and Associate Programmer LCATs are missing descriptions. Could the Government please provide those? See Amendment 0001

Q24 The Actual ODE tab references notes (Note 1 and Note 2) but no notes are defined in the document. Can the Government provide these notes? See Amendment 0001

Q25

The PWS outlines specific and highly specialized staffing requirements—particularly in Paragraphs 4.17, 8.1, and 8.3, including expertise in military recruiting, advertising, manpower strategies, and experience with programs similar in scope to OPA/JAMRS. However, the labor category descriptions provided in the solicitation are general and do not reflect these specific qualifications. Could the Government please clarify whether the detailed staff experience requirements in the PWS are intended to apply to the labor categories? If so, would the Government consider revising or supplementing the labor category descriptions to explicitly reflect the qualifications and domain expertise required by the PWS?

The PWS tasks specific details and the RFP evaluation factors including a complete Sample Task Order provide adequate means and guidance for industry to recognize and address within their respective technical proposal elements (Staffing Plan, Initial Phase in and so on) the tailored level of labor qualifications and domain expertise necessary to the Government. To promote full and open competition and ensure best value to the Government, pricing worksheet labor categories are intended to describe general qualifications and skill sets that are reasonably aligned with contract performance objectives. Offerors are free to propose "or equivalent" other professional services labor categories that meet the Governments requirement.

Q26 Could the Government clarify its objectives for FFP ODEs and T&M ODCs given many tasks (e.g., survey administration) are inherently interlinked?

See Amendment 0001 and Attachment 1, Survey and Market Research Services PWS and Attachment 7, Ordering Procedures.

Q27 What documentation does the government look for to justify price reasonableness when a single vendor provides bundled items listed under both FFP ODE and separate ODCs?

Industry is required to demonstrate adequate procurement expertise to professionally deliver pricing support detail to the Governemnt to assist with the required reasonablenss determination. The Government has significant discretion to determine fair and reasonable pricing. For bundled items, the offeror must submit a cost breakdown of the ODE's/ODC's for the Government to better understand the components that make up the bundle price. For this RFP and resulting contract, offerors are required to submit 3 quotes for any single item exceeding $2,500.00. Offerors must also submit Market Research reports, historical pricing extended to its most favored clients (as applicable) and price analysis techniques commonly used within the marketplace and associated best practices that apply accordingly.

Q28 Could the Government please clarify whether the FFP ODEs should be inclusive of labor necessary for tasks like assembly of survey packages? Or should these exclusively focus on the costs of materials?

Yes, offerors are advised to price FFP ODE's ( Rate Card) inclusive of labor for related tasks associated with performing FFP ODE's.

Q29 The solicitation notes that at least one commercial reference is highly encouraged. Could the Government please indicate how the inclusion of a commercial reference would be used in scoring/evaluating past performance? The RFP requirement is a Commercial service. There is no rating method variation implied by the noted comment.

Q30 Is there a minimum requirement for small business subcontracting?

The Minimum Quantitative Requirement (MQR) for small business participation for this requirement is 25% of the total contract value for the first and second year of the base period, and 30% for the remaining years. The small business participation commitment needs to express goals in terms of a percentage of total planned subcontracting dollars for the use of small business (SB), veteran-owned small business (VOSB), service-disabled veteran-owned small business (SDVOSB), HUBZone small business (HUBZONE SB), small disadvantaged business (SDB) and women-owned small business concerns (WOSB) pursuant to FAR 52.219-9.

Q31 Please confirm whether this is a single IDIQ or MAC? This RFP will result in award of a Single Award IDIQ type contract.

Q32 Please confirm that the list of Applicable Documents, reference in Attachment 1 Survey and Market Research Services, page 28-29, is a reference document. Confirmed.

Q33 Please clarify in the Body of Evidence List (BoE), reference in the Solicitation Volume 2 Element 1 on page 58, if offerors need to provide one or all artifacts in this list.

As stated on the SPRS FAQ page, https://www.sprs.csd.disa.mil/faqs.htm, "Before you enter SPRS you should have completed your NIST SP 800-171 assessment, identified your score, and completed a System Security Plan (SSP) for your company. Below are resources to support these tasks.

NIST SP 800-171 DoD Assessment Methodology, Version 1.2.1, June 24, 2020. Page 12 is where the assessment score card begins. www.acq.osd.mil/asda/dpc/cp/cyber/docs/safeguarding/NIST-SP-800-171-Assessment- Methodology-Version-1.2.1-6.24.2020.pdf"

Q34 The incumbent contractor’s name See RFP page 57 of 67

Q35 Original contract number See RFP page 57 of 67

Q36 Total awarded or obligated value to date Not publicly available

Q37 Pricing Structure or unit costs associated with major CLINS ( if publicly available) Not publicly available

Q&A's