Attachment J-7 Symantec Q A_s Consolidated.xls
XLS spreadsheet 31 KB Posted
- Attached to
- Symantec enterprise software license maintenance for anti-virus and anti-spyware capabilities
- Solicitation number
- HC1028-12-R-0077
- Issued by
-
Defense Information Systems Agency
About this file
Attachment J-7 Symantec Q A's Consolidated
View the file
Other files
| File | Type | Posted |
|---|---|---|
| HC1028-12-R-0077-0003.doc | DOC document | |
| Symantec Attachment J-2 Pricing Template revised.xls | XLS spreadsheet | |
| HC1028-12-R-0077-0002.doc | DOC document | |
| Attachment J-5 Symantec Q A_s.xls | XLS spreadsheet | |
| HC1028-12-R-0077-0001.doc | DOC document | |
| HC1028-12-R-0077.doc | DOC document | |
| Symantec Attachment J-2 Pricing Template.xls | XLS spreadsheet | |
| Redacted J A.doc | DOC document | |
| Symantec Attachment J-1 DD254.doc | DOC document | |
| Attachment J-4 Cross Referance Matrix.doc | DOC document | |
| Symantec Attachment J-3 QASP.doc | DOC document |
Show all 11
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Sheet1
| HC1028-12-R-0077 | |||
| Symantec Q&A's | |||
| Questions | Answers | ||
| 1 | One of the questions we have is regarding the Option for the SME, the number of hours per contract year is 960 hours. That is a part time SME. Is that the intention of the SME? | 1 | The SME is an optional CLIN that may be exercised at the choice of the government. 960 hours per year is a valid estimate. |
| 2 | Revise NAICS standard size to include Value Added Resellers, 150 employees. | 2 | At this time, the government is not considering the revision of the NAICS size standard. It remains at 541519 - $25.5M. |
| 3 | In regards to 6.2.1, Will DISA provide sponsorship and the associated collateral necessary to formally engage with the UCCO for the UC-APL? | 3 | Yes, DISA will provide sponsorship through the UC-APL process, however the vendor is responsible for all artifacts required to complete the UC-APL. PWS section 6.2.1 has been updated to include this clarification |
| 4 | In regards to 6.2.1, Additionally, this section references components of a formal C&A process which appears to be beyond the UC-APL process. Is there definition to specific environments that the vendor products will be installed? | 4 | The UC-APL requires C&A before a product can actually be placed on the Approved Product List. This has to be done for every major version of product and properly Government sponsored (DISA PEO-MA will sponsor these items throughout the UC-APL process). The vendor is responsible for the components that make up the recommended solution set when approached the UC-APL process. C&A requirements are outlined in PWS 6.2.1 |
| 5 | In regards to 6.4.2.1, Please define Personal Electronic Device Coverage and OS support required. | 5 | The AV/AS solution shall provide capabilities for, but not limited to, today’s DoD mobile devices per OSD-CIO in the “Use of Highly Functional Mobile Devices” Memo. Those include: Apple iOS, Android OS, Windows 7 Mobile, HP WebOS, RIM Blackberry and Open-source Symbian. PWS section 6.4.2.1 has been revised to include clarification to the mobile device requirements. |
| 6 | In regards to 6.4.2.1, Please define Email Gateway Support required. | 6 | The AV/AS solution shall provide the capability to sit on the Exchance Server and provide AV/AS capabilities there as well. PWS 6.4.2.1 has been updated to reflect this requirement clarification. |
| 7 | In regards to 6.4.2.1, Symantec does not have an AV/AS product that is deployable on AIX, HP UX or Solaris 8. Symantec provides capability through Scan Engine which is a multi-purpose file scanning SDK and server product that can be deployed on a supported platform and then used to scan custom applications on OS platforms we don’t support such as AIX, HP-UX or Solaris 8. The product communicates with third party applications via the ICAP protocol and an SDK is included for C, JAV/ASA and Windows .Net. Does this meet the intent of the requirement? If not, request requirement be removed. | 7 | This needs to be supported by the vendor, have applicable documentation and training with the solution set, have applicable help desk support, as well as meet the HBSS integration requirements in order to be acceptable per the PWS 6.4.2.1 |
| 8 | In regards to 6.4.2.2, Please define Email Gateway Support required? | 8 | The AV/AS solution shall provide the capability to interact with the Exchange Server. PWS section 6.4.2.1 was updated to reflect this clarification in requirement. |
| 9 | In regards to 6.4.2.4, Please provide details and clarification on requirement. | 9 | The AV/AS solution needs to be able to report events and state information to its local command-and-control server. Additionally, the server then must integrate with HBSS' ePO server to pass the event and state data. Doing so will meet the HBSS integration requirement as well as the AV/AS Tier'd reporting requirement. PWS 6.2.4.2 was updated to reflect this clarification. |
| 10 | In regards to 6.10, Does STIG compliance equate to testing of the product components against the existing STIG’s or testing of the product on “STIG’d” devices? If the latter, which operating systems and platforms will be tested? | 10 | The STIG compliance equates to both server side and endpoint side. That said, if a baseline is provided, a STIG assessment and a POAM is required by the Government for all components application, operating system, database) per PWS 6.10 |
For endpoints, the installation of an AV/AS solution should not open up any STIG findings previously on the endpoint. Any delta's between before and after the installation of the AV/AS product in order for it to function properly must be POAM'd and the risk must be accepted by the Government at that time. This assessment should be based on the DoD Consensus Group's FDCC (in the future, to be called Unified Gold Master) image.
11 In regards to 6.11, There is no SCAP for AV/AS products nor any type of certification from NIST for this. 11 The AV/AS malware definition (DAT) files do not need to be SCAP compliant. There is no hard requirement to utilize SCAP specifically however the AV/AS solution shall comply with SCAP applicable standards as they become available per PWS 6.11. As for integration with third party remediation tools, this is only applicable if the AV/AS solution does not do the remediation capability itself. PWS 6.11 has been revised to include this clarification regarding the remediation requirement.
As for the Federal Desktop Core Configuration (FDCC) compliance was mandated by the Office of Management and Budget (OMB) in memo M-07-11, which stipulates any FDCC deviations must be identified and reported.
Any FDCC changes caused by the AV/AS proposed solution on the client needs to be identified by the vendor and the risk accepted by the Government. Additionally, if the vendor provides a baseline, the Server components should comply with the FDCC where possible, and deviations from the standard configurations would be identified to the PMO upon delivery of the baseline at that time. This is referenced as the FDCC Compliance Report, deliverable #48.
| 12 | In regards to 6.11, Since AV/AS products currently do not have specific SCAP enumerations, what is the specific level of integration expected with SCAP remediation tools? | 12 | See Answer 11 Above. | |
| 13 | In regards to 6.11.1, Since there is not a validation program that includes AV/AS product types available. Is the expectation to the vendor that they provide OVAL content definitions for the product configuration for NIST review? | 13 | See Answer 11 Above. | |
| 14 | In regards to Section D, there is no content. | 14 | This is not an error. This section is reserved. | |
| 15 | We were told by our GSA consultant that as long as the NAICS code was in effect when we originally were added to the CCR then we are good to bid. Hopefully you are okay with that as well. | 15 | You must currently be a small business under NAICS 541519 - $25.5 Million size standard in order to be considered for award. The NAICS code is specifically called out RFP A.4. | |
| 16 | We are a little confused by all the documentation around the Symantec software which is in use and has been for the last 5 years. As you know this is not just maintenance as they have to purchase the new licenses. | 16 | The Government's requirement as identified in the RFP, PWS 6.4.4 does not call for the purchase of new licenses. | |
| 17 | Version 0002 of the PWS released in Amendment 2 of the RFP seems to have discrepancies in the paragraph numbering. | |||
| For example, page 11 of 38, should para 6.3.3 be 6.3.2.1; first para 6.3.4 be 6.3.2.3 and para 6.3.5 be 6.3.2.4? | 17 | The numbers have been corrected in the PWS and Amendment 0003 to reflect: 6.3.3 is now 6.3.2.2, 6.3.4 is now 6.3.2.3, 6.3.5 is now 6.3.2.4, 6.3.4 is now 6.3.3, 6.3.5 is now 6.3.4, 6.3.5.1 is now 6.3.4.1, and 6.3.5.2 is now 6.3.4.2. | ||
| 18 | Can a revised RFP be issued with numbering consistent with the CLINs listed in Section B? | |||
| In Item 0001 (1001, etc) of Section B, What paragaph in the amended PWS does Task Area 2, Paragraph 6.3.3 refer to? | 18 | RFP has been revised via Amendment 0003 to correct the PWS references within the CLINs. |
Sheet2
Sheet3
File details come from the government source that posted it. Updated .