HC1028-13-R-0046-0004.docx

HC1028-13-R-0046

SECTION SF 30 BLOCK 14 CONTINUATION PAGE

SUMMARY OF CHANGES

SECTION SF 30 - BLOCK 14 CONTINUATION PAGE

The following have been modified:

QUESTIONS / ANSWERS

INDUSTRY QUESTIONS AND GOVERNMENT ANSWERS (Q&A’s)

Amendment 1

1. RFP - Would the government consider increasing the page limit for the technical/management volume to 25 pages? Given the number of performance requirements and the scope of the solution, we believe that offerors would be able to provide more complete responses with the increase.

Answer: The government will increase the page limit on the technical/management volume to 20 pages.

2. RFP, Section A.1.4 –Would the government reconsider the requirement to resolve assumptions only through questions and answers? Since questions are shared among all vendors, there is sometimes a reluctance to ask questions that might reveal a strategy or other advantage.

Answer: No – the government will not reconsider.

3. PWS, Section 6., capability 2 – Does the government require a separate centralized database for each of the SIPR and NIPR discovered components or will all data be stored in a single database? If so, will cross domain transfers be covered by the government or does the proposal need to accommodate it?

Answer: Yes - the government requires a separate centralized database for each of the SIPR and NIPR discover components. No – cross domain transfers are not required for the solution scope in this solicitation.

4. PWS, Section 6., capability 19 – Would the government please clarify and provide more detail of what “monitor” means for the solution? Is the government looking for an active monitoring solution to detect changes to baseline service models?

Answer: Monitor indicates a requirement to discover any change during an initial discovery, a regularly occurring scheduled discovery or an adhoc discovery as determined by an authorized user.

5. PWS, Section 6.1 and 6.4 – Will each of the 900 users listed require training or only those specified in section 6.4? Can you provide a breakout of the number of users that will be required to administer and the number that will just be users (viewers) of the data?

Answer: Only the users listed in section 6.4 will require training by the vendor. An estimated 102 users will have varying levels of administration duties.

6. PWS, Section 6.3 – Please clarify whether the sixteen services defined represent 16 specific business applications, or, is DISA looking for just the discovery of the components listed?

Answer: Section 6.3 represents 16 specific business applications; DISA requires the solution to meet each requirement designed to discover these specific business applications accurately and in their entirety.

7. PWS - Do the ITSM modules (IM, PM and CM) need to interact with discovered data in the BAM repository?

Answer: The requirement includes integration with DISA’s instances of ITSM. The intent is for BAM data to interact with ITSM to create relationships between existing ITSM OE records, communication device records and storage device records based on matching key data.

8. PWS - Have the mappings and relationships between business applications and business services already been identified?

Answer: POCs for these applications have varying level of information regarding the relationship maps for these business services.

9. PWS, Section 6.3 - What does “non-consecutive days of on-site installation support” imply? Does that mean that contractor personnel cannot be performing installation activities on consecutive days?

Answer: The offeror is not required to be on site for the entire installation period. The environments are transitioned to site technical staff for security reviews at multiple points during the installation and configuration processes. The security reviews can take several days. The contractor does not need to be on site on the days where this review is being completed.

10. PWS - What type of MAC level and COOP (failover) environment is the government asking for? MAC Level II? RTO/RPO=24 hours? Or will the ADDM application reside on current ITSM infrastructure for which there is already MAC and COOP levels defined?

Answer: The MAC level for this system is MAC III. The solution will reside on infrastructure as designed during the engineering phase of the project.

Amendment 2

11. Referring to the QASP document provided with the RFP, Section 4. Scope of Performance refers twice to DISA services being found in section 5.1. There is no section 5.1 in any of the RFP documentation provided. Please clarify.

Answer: Both instances of “5.1” in section 4. Scope of Performance should be “6.3”. This is a typographical error in the QASP.

12. Section L.3.1.i BAM Solution Testing and attachment J-2 Functional Test Plan appear to be inconsistent. Attachment J-2, Section 2.6 states the physical location for testing will be Mechanicsburg, PA. The physical location of the environments will be Mechanicsburg, PA for mainframe and Montgomery, AL for mid-tier. Section L.3.1.i (A) of the RFP states that Offerors’ solution will be shipped to testing locations at 5450 Carlisle Pike, Mechanicsburg PA 17055, and 8705 Industrial Blvd Oklahoma City, OK 73145 facility. Please clarify.

Answer: This is a typographical error. The components required to test the mainframe solution will be shipped by the contractor to 5450 Carlisle Pike, Mechanicsburg PA 17055. The components required to test the mid-tier solution will be shipped by the contractor to 401 E Moore Drive, MAFB/Gunter Annex, AL 36114.

13. Per “12.2 Security Clearances. Technical Implementation personnel working for the contractor require IT-1 Secret clearances on day one of service delivery.” Will INTERIM SECRET Clearances be accepted?

Answer: Yes. The government will accept an Interim Secret Clearance.

14. What is the page limitation for Volume 1 (Executive Summary)? Within the RFP, it makes reference to it being 2 page and 5 page limit.

Answer: The page limitation for Volume I, titled Executive Summary, will be limited to 2 pages.

15. The Past Performance Section in the RFP states that only 3 references may be provided. However, the attachment provided for Past Performance provides space for 4 references. Would DISA please clarify if the references provided should be a quantity of 3 or 4?

Answer: The offeror shall each provide no more than three (3) past performance references using the Past Performance Form Attachments J-3.

16. For the two requirements listed below, what will the system be attempting to import?

The solution provides the capability to import data from.xml.

The solution provides the capability to import data from.xlsx or .csv

Answer: The solution will import business application relationship information and/or identifying information related to assets (for example: application name, sub-application name, LPAR name, OE name) when required.

17. For the second 2 requirements, will there be a system wide agent? Can you expand on the last requirement?

The solution discovers at level 3 for Solaris zones.

The solution discovers, monitors and displays relationships to and from z/OS LPARs, z/VM LPARs or z Linux virtual machines on the mainframe.

Answer: The solution proposed is required to support complex business application discovery in Solaris Zones and the multiple environments residing on the mainframe that are described in this requirement. The solution will support automatic discovery, where business applications cross varying operating environments to include both mid-tier and mainframe.

18. Item 16,17, and 18: The discovery function supports pseudo (ability to run commands as root without actually being root user)

a. Question: Does DISA mean sudo?

Answer: The Government means sudo.

Amendment 3

19. Per DD254 Block 1a Facility Clearance level is blank - Assumption is that a SECRET level FCL meets the requirement. Please clarify.

Answer: Technical Implementation personnel will require a Secret Clearance and an IT-I.

20. Will a small business subcontracting plan be required? If so, is it required to be submitted with the proposal, or will it be required after award?

Answer: Yes, a small business subcontracting plan is required per FAR Clause 52.212-5 (b)(13). (Reference page 54 of the original RFP.) You can submit either an Individual Subcontracting Plan for this effort or your company’s approved Commercial Subcontracting Plan. The plan must be submitted with your proposal. It should be included in Vol V, “Contract Documentation”.

21. Are there small business goals for the solicitation? If so, what are the goals?

Answer: The following socioeconomic targets are in accordance with statutory goals established for Department of Defense (DoD) agencies: Small Business (SB)- 36.7%; Historically Underutilized Business Zone (HUBZONE) - 3.0%; Service-Disabled Veteran Owned Small Business (SDVOSB) -3.0%; Small Disadvantaged Business (SDB) - 5.0%; and Women Owned Small Business (WOSB) - 5.0%. See new information added to paragraph L.3.6.

22. Section 6.1 Task 1 Mainframe Hosts – Can you confirm that there are Qty 22 physical mainframes in this environment, and the list provided does not just represent LPARs, etc.?

Answer: Yes. The “DISA Environment” table in “6.1 Task 1 – Provide Software Licenses and Maintenance Support” includes physical mainframes in the “Mainframe Hosts currently deployed –“ section.

23. Section 6.3 , “List of Business Services to be Mapped” There are multiple services at each location. Can each of the service to be communicated with from a centralized location?

Answer: If the question is, whether the government has any objections to a centralized solution proposal, the answer is no.

24. Section 6.3 , “List of Business Services to be Mapped” Is the discovery of asset information important? For example, discover installed software for license management purposes and software utilization.

Answer: Discovery of software for license management and utilization is not a requirement.

25. Section 6.3 , “List of Business Services to be Mapped” For business services to be mapped that have locations that are outside DISA DECCs, will the capability be there to: Open firewall ports for remote discovery or - Have a virtual machine or server probe installed into the remote environment to facilitate discovery?

Answer: The government can open ports when approved and authorized by PPSM within the DISA enclave. The government is able to support infrastructure standup in remote environments.

26. Section C, 3, Background In this section DISA mentions that “transaction profiling” is critical in quickly determining the root cause of bottlenecks. Can DISA describe what is meant specifically by “transaction profiling”?

Answer: Transaction Profiling – track the flow of business transactions across IT infrastructure related to business services, detect changes in technical conditions and modify the application business map to reflect those changes. Provide visibility into the flow of transactions across infrastructure tiers and dynamically map the application topology.

27. Section 5 "scope" Does not list hardware, operating system and database. Is it your intent to provide the hardware and software for the implementation?

Answer: The government will provide required hardware, Operating systems, communications infrastructure and storage.

28. Section 6.3 , “List of Business Services to be Mapped” Service #1;

1. How many applications are supported by this service?

Answer: DISA supports customer applications and internal applications, some of which are sensitive. This information will be provided after award to appropriately cleared staff, if the information is available.

1. What is the architecture of these applications (i.e. Web, Application, and Database)?

Answer: DISA supports various architectures of customer applications and internal applications, some of which are sensitive. These applications may include architectures that include web, application and database tiers. Detailed information will be provided after award to appropriately cleared staff, if the information is available.

1. What are the network devices contractors and types that support this business service?

Answer: DISA supports many types of network devices, some of which support sensitive applications. This information will be provided after award to appropriately cleared staff, if the information is available.

1. What are the supporting infrastructures (DNS, Firewall, LDAP, TAM, etc.)?

Answer: DISA supplies data center infrastructures, some of which support sensitive applications. This information will be provided after award to appropriately cleared staff, if the information is available.

1. What type of offerings does this Service provide?

Answer: DISA supports customer applications and internal applications, some of which are sensitive. This information will be provided after award to appropriately cleared staff, if the information is available.

1. What is the network architecture for this service?

Answer: DISA supports many types of network architectures, some of which support sensitive applications. This information will be provided after award to appropriately cleared staff, if the information is available.

1. Are there any bandwidth limitations between enclaves/sites?

Answer: Yes, bandwidth varies among sites. New DISA infrastructure, currently being deployed at our larger sites, supports 10G to the WAN, however the management network shares this with production. At other sites bandwidth varies from 40MG to multiple 1G connections.

1. Do any of the services share the same infrastructure?

Answer: Yes. Applications in DISA can share the same infrastructure.

29. Section 6.3 , “List of Business Services to be Mapped” Service #2; How many applications are supported by this service? What is the architecture of these applications (i.e. Web, Application, and Database)? What are the network devices contractors and types that support this business service? What are the supporting infrastructures (DNS, Firewall, LDAP, TAM, etc.)? What type of offerings does this Service provide? What is the network architecture for this service? Are there any bandwidth limitations between enclaves/sites? Do any of the services share the same infrastructure? Can you differentiate what locations have the NIPR vs. SIPR networks?

See #28 and included answer.

Answer: DISA locations support varying types of network architectures, some of which support sensitive applications. This information will be provided after award to appropriately cleared staff, if the information is available.

30. Section 6.3 , “List of Business Services to be Mapped” Service #3; How many applications are supported by this service? What is the architecture of these applications (i.e. Web, Application, and Database)? What are the network devices contractors?

Answer: See #28.

31. Section 6.3 , “List of Business Services to be Mapped” Service #4; How many applications are supported by this service? What is the architecture of these applications (i.e. Web, Application, and Database)? What are the network devices contractors

Answer: See #28.

32. Section 6.3 , “List of Business Services to be Mapped” Service #5; How many applications are supported by this service? What is the architecture of these applications (i.e. Web, Application, and Database)? What are the network devices contractors and types that support this business service? What are the supporting infrastructures (DNS, Firewall, LDAP, TAM, etc.)? What type of offerings does this Service provide? What is the network architecture for this service? Are there any bandwidth limitations between enclaves/sites?

See #28 and included answer.

Answer: Yes.

Does Linux ES6 mean Enterprise 6.x?

33. Section 6.3 , “List of Business Services to be Mapped” Service #6; How many applications are supported by this service? What is the architecture of these applications (i.e. Web, Application, and Database)? What are the network devices contractors and types that support this business service? What are the supporting infrastructures (DNS, Firewall, LDAP, TAM, etc.)? What type of offerings does this Service provide? What is the network architecture for this service? Are there any bandwidth limitations between enclaves/sites? Can you differentiate what locations have the NIPR vs. SIPR networks?

See #28 and #29.

34. Section 6.3 , “List of Business Services to be Mapped” Service #7; How many applications are supported by this service? What is the architecture of these applications (i.e. Web, Application, and Database)? What are the network devices contractors and types that support this business service? What are the supporting infrastructures (DNS, Firewall, LDAP, TAM, etc.)? What type of offerings does this Service provide? What is the network architecture for this service? Are there any bandwidth limitations between enclaves/sites? Do any of the services share the same infrastructure? Can you differentiate what locations have the NIPR vs SIPR and Pre-prod resources networks?

See #28 and #29.

35. Section 6.3, “List of Business Services to be Mapped” Service #8; How many applications are supported by this service? What is the architecture of these applications (i.e. Web, Application, and Database)? What are the network devices contractors and types that support this business service? What are the supporting infrastructures (DNS, Firewall, LDAP, TAM, etc.)? What type of offerings does this Service provide? What is the network architecture for this service? Are there any bandwidth limitations between enclaves/sites? Do any of the services share the same infrastructure? Can you differentiate what locations have the NIPR vs SIPR and Pre-prod resources networks?

See #28 and #29.

36. Section 6.3, “List of Business Services to be Mapped” Service #9; How many applications are supported by this service? What is the architecture of these applications (i.e. Web, Application, and Database)? What are the network devices contractors and types that support this business service? What are the supporting infrastructures (DNS, Firewall, LDAP, TAM, etc.)? What type of offerings does this Service provide? What is the network architecture for this service? Are there any bandwidth limitations between enclaves/sites? Do any of the services share the same infrastructure? Can you differentiate what locations have the NIPR vs SIPR and Pre-prod resources networks?

See #28 and #29.

37. Section 6.3 , “List of Business Services to be Mapped” Service #10; How many applications are supported by this service? What is the architecture of these applications (i.e. Web, Application, and Database)? What are the network devices contractors and types that support this business service? What are the supporting infrastructures (DNS, Firewall, LDAP, TAM, etc.)? What type of offerings does this Service provide? What is the network architecture for this service? Are there any bandwidth limitations between enclaves/sites? Do any of the services share the same infrastructure? Can you differentiate what locations have the NIPR vs SIPR and Pre-prod resources networks?

See #28 and #29.

38. Section 6.3, “List of Business Services to be Mapped” Service #11; How many applications are supported by this service? What is the architecture of these applications (i.e. Web, Application, and Database)? What are the network devices contractors and types that support this business service? What are the supporting infrastructures (DNS, Firewall, LDAP, TAM, etc.)? What type of offerings does this Service provide? What is the network architecture for this service? Are there any bandwidth limitations between enclaves/sites? Do any of the services share the same infrastructure? Can you differentiate what locations have the NIPR vs SIPR and Pre-prod resources networks?

See #28 and #29.

39. Section 6.3, “List of Business Services to be Mapped” Service #12; How many applications are supported by this service? What is the architecture of these applications (i.e. Web, Application, and Database)? What are the network devices contractors and types that support this business service? What are the supporting infrastructures (DNS, Firewall, LDAP, TAM, etc.)? What type of offerings does this Service provide? What is the network architecture for this service? Are there any bandwidth limitations between enclaves/sites? Do any of the services share the same infrastructure? Can you differentiate what locations have the NIPR vs SIPR and Pre-prod resources networks?

See #28 and #29.

40. Section 6.3, “List of Business Services to be Mapped” Service #13; How many applications are supported by this service? What is the architecture of these applications (i.e. Web, Application, and Database)? What are the network devices contractors and types that support this business service? What are the supporting infrastructures (DNS, Firewall, LDAP, TAM, etc.)? What type of offerings does this Service provide? What is the network architecture for this service? Are there any bandwidth limitations between enclaves/sites? Do any of the services share the same infrastructure? Can you differentiate what locations have the NIPR vs SIPR and Pre-prod resources networks?

See #28 and #29.

41. Section 6.3, “List of Business Services to be Mapped” Service #14; How many applications are supported by this service? What is the architecture of these applications (i.e. Web, Application, and Database)? What are the network devices contractors and types that support this business service? What are the supporting infrastructures (DNS, Firewall, LDAP, TAM, etc.)? What type of offerings does this Service provide? What is the network architecture for this service? Are there any bandwidth limitations between enclaves/sites? Do any of the services share the same infrastructure? Can you differentiate what locations have the NIPR vs SIPR and Pre-prod resources networks?

See #28 and #29.

42. Section 6.3, “List of Business Services to be Mapped” Service #15; How many applications are supported by this service? What is the architecture of these applications (i.e. Web, Application, and Database)? What are the network devices contractors and types that support this business service? What are the supporting infrastructures (DNS, Firewall, LDAP, TAM, etc.)? What type of offerings does this Service provide? What is the network architecture for this service? Are there any bandwidth limitations between enclaves/sites? Do any of the services share the same infrastructure? Can you differentiate what locations have the NIPR vs SIPR and Pre-prod resources networks?

See #28 and #29.

43. Section 6.3, “List of Business Services to be Mapped” Service #16; How many applications are supported by this service? What is the architecture of these applications (i.e. Web, Application, and Database)? What are the network devices contractors and types that support this business service? What are the supporting infrastructures (DNS, Firewall, LDAP, TAM, etc.)? What type of offerings does this Service provide? What is the network architecture for this service? Are there any bandwidth limitations between enclaves/sites? Do any of the services share the same infrastructure? Can you differentiate what locations have the NIPR vs SIPR and Pre-prod resources networks?

See #28 and #29.

44. Section 6.3 Is all work to be performed in Mechanicsburg, PA and Montgomery, AL?

Answer: Yes.

45. What tools, if any, will be provided by DISA to deploy the probes to the different locations?

Answer: The government will provide required hardware, Operating systems, communications infrastructure and storage. The solution deployment strategy will be defined in the engineering solution phase based on the contractor’s proposed solution.

46. Is there a requirement that they be virtual or physical?

Answer: No.

47. What tools, if any will be provided by DISA for ongoing maintained of the probes?

Answer: The contractor will not be providing ongoing sustainment of the deployed solution. It will be transitioned to the government after implementation. The contractor will provide annual solution/software maintenance coverage.

48. Will part of sustainment be a requirement to maintain the probes to the standard STIG and IAVA levels from a centralized location or will patching be performed onsite by local personal?

Answer: The contractor will not be providing ongoing sustainment of the deployed solution. It will be transitioned to the government after implementation. The contractor will provide annual solution/software maintenance coverage.

49. Reference Section I, Contract Clauses It is requested the following clauses be deleted as they are not applicable (or an exception applies) for the acquisition of commercial item information technology products and services:

-252.225-7012, Preference for Certain Domestic Commodities (FEB 2013)

This clause will not be removed. The clause prescription at 225.7002-3(a) states “Use the clause at 252.225-7012, Preference for Certain Domestic Commodities, in solicitations and contracts, including solicitations and contracts using FAR part 12 procedures for the acquisition of commercial items, that exceed the simplified acquisition threshold.”

- 252.225-7001, Buy American and Balance of Payments Program (DEC 2012)

This clause will not be removed. An exception cannot be found to support removal of the clause.

-252.247-7003 Pass-Through of Motor Carrier Fuel Surcharge Adjustment to the Cost Bearer (SEP 2010)

This clause will not be removed at this time. DFARS 247.207 states to use the clause at 252.247-7003, Pass-Through of Motor Carrier Fuel Surcharge Adjustment to the Cost Bearer, in solicitations and contracts, including solicitations and contracts using FAR part 12 procedures for the acquisition of commercial items, that are for carriage in which a motor carrier, broker, or freight forwarder will provide or arrange truck transportation services that provide for a fuel-related adjustment. Since this office does not know if the last part applies, the clause was included.

50. PWS; Item 13; The solution discovers at level 3 for Solaris zones.

Question: What does DISA mean by level 3 for OS level discovery?

Answer: The requirements do not indicate level 3 for OS level discovery. The solution must be able to discover LDOMs and zones both whole root and sparse.

51. PWS; Which commercial and open source application component platforms (for example IBM WebSphere Application Server, MSSQL, Oracle RAC, JBoss) are used in the 16 services that must be discovered and mapped during the implementation phase?

Answer: DISA supports various architectures of customer applications and internal applications, some of which are sensitive. These applications may include architectures that include web, application and database tiers. Detailed information will be provided after award to appropriately cleared staff, if the information is available. The tool proposed by the contractor will discover and build application maps for all services in the DISA environment, not only those listed in Section 6.3. The contractor is responsible for the implementation of the services listed in 6.3, but the contractor solution will support all services in the DISA enterprise.

52. PWS; What are the communication restrictions imposed by firewalls between a future discovery server/anchor hosts and the target systems to be discovered?

Answer: The government can open ports when approved and authorized by PPSM within the DISA enclave.

53. PWS; What meta data does DISA expect to be able to discover/maintain for the main types of resources stored in the CMDB? For examples: lifeCycleStatus, location, owner, custodian, usage, etc.

Answer: Metadata related to the identity of the assets the service applications traverse, the ports/protocols, the type of traffic, the service name/profile, etc.

54. PWS; What criteria will be used for identifying and mapping business applications and services?

Answer: Business Application Discovery tools use varying means of discovery. How the business services are automatically discovered and which technology is used to automatically map the service will be proposed by the contractor. The government will verify the discovery and maps are accurate and verify the process can be repeated by the government with the same result for additional deployed DISA services.

55. PWS; CI information: Does DISA expect to augment the discovered information with information from additional sources such as network management tools, custom databases, spreadsheets and others?

Answer: Contractors may identify best practice recommendations to augment the discovered information in their proposals. If recommended augmentations are proposed and included in the engineering solution, they will be executed as part of the contractor implementation effort and included in testing cycles.

56. PWS; Does any of the 16 services included in the RFP span both the NIPRNet and the SIPRNet?

Answer: DISA Business Services are unlikely to have cross-domain communications.

57. PWS; Can you be more specific about how many environments must be installed? The current assumption is 2 pre-production (1-NIPR, 1-SIPR) and 2 production (1-NIPR, 1-SIPR). Are there any other development/test/performance environments that need to be installed?

Answer: This solution will discover and map business services pre-production, production NIPR, and production SIPR for the mid-tier requirement and pre-production and production NIPR for the mainframe requirement (the deployment will depend on the architecture of the contractor’s solution and the agreed upon engineering solution). The government will verify the discovery and maps are accurate and verify the process can be repeated by the government with the same result for additional deployed DISA services.

58. PWS; Does DISA expect that configuration and relationship information in the TADDM database will be updated from any other sources besides TADDM discovery and bulkload, for example from virtual environment monitoring agents discovering that new virtual servers have been deployed?

Answer: Contractors may identify best practice recommendations to augment the discovered information in their proposals. If recommended augmentations are proposed and included in the engineering solution, they will be executed as part of the contractor implementation effort and included in testing cycles.

59. PWS; How many MSU's in the mainframe environment? (required to size the software bill-of-materials)

Answer: Approximately 1466 – This number regularly fluctuates due to workload changes and tech refreshes. This reflects a point in time.

60. PWS; Can you specify in more detail the specifics of integration between the Application mapping solution and other ITSM solutions within the current DISA environment (i.e. BMC/Omnibus/ITM... etc)?

Answer: The requirement includes integration with DISA’s instances of ITSM. The intent is for BAM data to share data with ITSM to create relationships between existing ITSM OE records, communication device records and storage device records based on matching key data.

61. PWS; Can DISA expand on requirements for reporting of the discovered configuration and relationship information as well as change and application reporting?

Answer: The solution will provide a visual display of a discovered configuration that will include a user capability to obtain detailed information about each asset/port/ect discovered by the tool. If a configuration has changes since the last discovery, the solution will provide a user accessible audit trail, message or other indication that a relationship/CI within a service map has changed.

62. PWS; Can you detail out the type of network equipment that needs to be discovered?

Answer: A list for reference is below. This list of network equipment make/model reflects a point in time and fluctuates due to workload changes and tech refresh.

63. Requirement 19 in the table in Section 6 states “The solution discovers, monitors and displays relationships to and from network hardware assets - including routers, switches, and network appliances.” Can the government please provide an estimated range of network devices that should be discovered so that an estimate of the required licenses can be included in our proposed pricing?

Answer: See #62.

64. RFP; Page 8 – Para B.1.2

1. Clarify if the payment plan reference is to the nine “stages” contained in para 6.3.1 to 6.3.9

1. Clarify that this applies only to the Base Year payment plan schedule.

Answer a/b: The payment plan refers to the Implementation tasks in Section 6.3. Tasks in 6.3 are expected to occur in the base year.

1. Clarify that the pricing for Option Year 1 to 4 will be based on the licensing from the Base Year scope and size (mainframe and server) and that “tier pricing and discounts” are permitted to accommodate infrastructure changes.

Answer: Option year pricing includes maintenance costs for the solution. The solution licenses and maintenance proposed by the contractor will cover the entire DISA environment identified in the “DISA Environment” table in 6.1 Task 1. The mapping piece of the implementation effort relates to a subset of business services; however the technical solution licensed and deployed by the contractor during implementation will accommodate the entire environment identified in table in 6.1 Task 1.

1. Clarify if the Option Year is a single payment?

Answer: The option year cost is a single payment for annual solution maintenance.

65. PWS; Page 12 – para 6.1

1. Is the total of applications (45+13+2200) representative of the entire DISA environment?

Answer: This is a point in time estimate of the number business applications in DISA. This estimate is intended to be inclusive of the entire environment.

1. What is the total MIPS count for mainframe? What is the total OE count for servers?

Answer: Approximately 20,450 Gartner (in use number is significantly smaller) – Approximately 100 MIPS are ACE MIPS. This number regularly fluctuates due to workload changes. This reflects a point in time.

Answer: This information is in table in 6.1 Task 1 “DISA Environment”. The OE count is listed as “9850 - Operating Environments (OE's) includes all OEs (both virtual OEs and the 5650 physical hardware devices in the next line below) and 5650 – Mid-Tier Physical Hardware Devices”.

1. Are the 900 users concurrent; internal DISA only?

Answer: Users are .mil users.

1. PWS; Page 14 – para 6.3

0. What is the number of applications that are hosted at each Service area (#1 to #16) on the identified platforms?

Answer: Each entry, #1 - #16, reflects one unique complex business service per environment (NIPR/SIPR/Pre-prod where indicated). The location information identifies where infrastructure supporting the business service resides.

0. Is it DISA’s intent to only implement the solution for those applications in Service areas 1-16 during the contract Base period?

Answer: The solution licenses and maintenance proposed by the contractor will cover the entire DISA environment identified in the “DISA Environment” table in 6.1 Task 1. The technical solution licensed and deployed by the contractor during implementation will accommodate the entire environment identified in the “DISA Environment” table in 6.1 Task 1. The discovery and mapping effort completed by the contractor will be for the Services #1-16. The government will verify the discovery and maps are accurate and verify the process can be repeated by the government with the same result for additional deployed DISA services. Remaining applications will be discovered and mapped by the government using the solution delivered by the contractor.

1. PWS; Page 20 – Para 6.4

1. What is the duration for each training class?

Answer: This is contractor determined and will be included in the contractor proposal.

1. How many training sessions are required?

Answer: This is listed in 6.4 of the PWS - Two (2) instructor led training to cover Administration of the solution for 6 students at a government site. Four (4) instructor led training to cover Users of the solution for up to 20 students at a government site. Two (2) instructor led training to cover Reporting with the solution for 5 students at a government site.

1. What are the locations?

Answer: Designated CONUS DISA sites.

1. Is the contractor expected to provide the hardware/software to host the training materials?

Answer: The contractor can submit options for training in their response to the PWS.

1. Is the training classroom only, or does Government require desk-side training in an operational setting?

Answer: Training is classroom only. However, during transition from the contractor to the government, the contractor is required provide knowledge transfer sessions, which may include desk-side training in an operational setting. This is described in section 6.3.8.

1. Does Government require security clearances for the contractor Trainers?

Answer: No, however training may take place in secure locations, so all trainers must be US citizens.

1. PWS; Page 22 – Para 9 Does Government require the contractor to be physically present at all 16 Service Areas for implementation, or only at the PA, OK, AL datacenters?

Answer: No, the contractor does not need to be physically present at all 16 Service Areas for implementation.

1. RFP; Page 73 – Additional Instructions

1. Clarify if testing at PA and OK will be simultaneous or held at separate times? Is the contractor expected to be at both sites if simultaneous?

Answer: Testing for the mid-tier solution will occur at 5450 Carlisle Pike, Mechanicsburg PA 17055 and testing for the mainframe solution 401 E Moore Drive, MAFB/Gunter Annex, AL 36114. Each environment will be tested separately.

1. Clarify if testing will be held during the workweek (Mon-Fri) during the day shift.

Answer: All testing will occur during the work week.

1. RFP; Do any business applications span both NIPR and SIPR? If so, will a TADDM be allowed to communicate with both networks?

Answer: DISA Business Services are unlikely to have cross-domain communications.

1. Related, how many TADDM environments are required 3 or 4? (Dev, Test, Prod) or (Dev, Test, Prod NIPR, Prod SIPR)

Answer: This solution will discover and map business services pre-production, production NIPR, and production SIPR for the mid-tier requirement and pre-production and production NIPR for the mainframe requirement (the deployment will depend on the architecture of the contractor’s solution and the agreed upon engineering solution). The government will verify the discovery and maps are accurate and verify the process can be repeated by the government with the same result for additional deployed DISA services.

1. Is High Availability required? Please identify the “up time” for the platform performance

Answer: No, A high-availability infrastructure was not included in the funding and therefore cannot be supported.

1. Are there any production targets on the OoB network?

Answer: No, by definition, only management traffic traverses the OoB network.

1. PWS; How many different access collections (groups) will be required for the 900 users?

Answer: The government does not understand this question.

1. PWS; What is the frequency desired for scanning?

Answer: Frequency will vary per business service, from 2 times a week to once a month. The government requires the option to initiate a scan for a targeted business service off cycle, when required.

1. PWS; Are there TADDM supported commercial applications that will require L3 discovery?

Answer: The solution must be able to discover LDOMs and zones both whole root and sparse and the other environments listed in section 6 Performance Requirements.

1. PWS; Are there non-supported applications that require L3 discovery?

Answer: Must be able to discover LDOMs and zones both whole root and sparse and the other environments listed in section 6 Performance Requirements. DISA has web, database, network, OS and storage discovery requirements also listed in section 6.

1. Include custom applications where config files contents are to be captured.

Answer: Config files are not available for custom applications.

1. PWS; Is ITSM the only integration target?

Answer: The contractor is required to support integration with ITSM. The government intends on supporting additional integrations.

Additional detail: The contractor must also consider the STIG requirement for PKI authentication as part of the technical requirements. DISA has standard solutions deployed to accommodate. In the Offeror’s proposal, the contractor should indicate whether they intend to provide their own solution or intend to support integrations with DISA’s standard COTS solutions.

The Offeror should review all of the STIGs and ensure the solution provided meets all STIG requirements.

A few excerpts are below. The Offeror is responsible for addressing all of the following and proving these risks do not exist or are mitigated with technical documentation.

APP3590: Buffer Overflow APP3405: Session Hijacking APP3550: Integer Arithmetic Issues APP3560: Format String Vulnerabilities APP3570: Command Injection APP3580: Cross Site Scripting APP3600: Canical Representation Vulnerabilities APP3610: Hidden Fields APP3810: XML Injection APP3585: CSRF Vulnerabilities APP3540: SQL Injection

The government requests the Offeror validate all components of their solution are DoD STIG compliant as the contractor has the responsibility to ensure the solution meets all DoD STIG security requirements.

1. PWS; Are there direct integration requirements for ITM, OMNIbus, Managed Objects?

Answer: The contractor is required to support integration with ITSM. The government may support additional integrations where required.

1. How does event presentation from the Summary relate to Managed Objects?

Answer: The government is unclear what is meant by ‘Summary’.

1. Are the brand/models of network equipment in use at DISA natively supported by TADDM?

Answer: See the answer to question 62.

1. PWS; Are all ESXi (not ESX) hosts under Virtual Center management?

Answer: Yes.

1. What is the expectation with respect to updating TADDM during the engagement? Specifically, what is the expectation if the SW contractor releases new functionality (upgrade) during the initial implementation?

Answer: The contractor will be expected to deliver an up to date release of all solution components as a requirement of implementation.

1. Does Government expect non-traditional software product support in OY1-OY4, other than basic IBM support included with the licensing cost? For example, would DISA expect a need for software configuration analysis, recommendation and implementation services?

Answer: The contractor will not be providing ongoing sustainment of the deployed solution. It will be transitioned to the government after implementation. The contractor will provide annual solution/software maintenance coverage.

1. PWS; Is the scope of the initial implementation the entire DISA OE of 9850 systems, the 2077 specified in the 16 services or some other number of targets? Concern is that there are no z/OS targets in pre-prod in the listed business services.

Answer: Correction to #16, this should indicate pre-prod/NIPR.

Service #16 1 geographic location. Pre-prod/NIPR CONUS DISA DECCs: Mechanicsburg PA z/OS IBM Mainframe, Model 2818-H03 (210 MIPS)

1. PWS; Does DISA have standard templates that should be used to complete the various deliverables?

Answer: The contractor will submit deliverables in the contractor’s standard format and ensure it meets government requirements as described in the PWS.

1. Will we be able to get elevated authority to run specific commands on target systems? Specifically "sudo no passwd".

Answer: No.

1. Will we be able to get output from scripts ran on target systems to TADDM server?

Answer: Yes, if they are within scope of published DoD STIGs.

1. PWS; The synopsis on the FBO site mentions that real-time visualization is required for use during troubleshooting: Is real time visualization required on NIPRnet, SIPRnet and the OoB?

Answer: Yes.

1. PWS; DISA lists that it has 9,850 Operating Environments and 22 Mainframes. However, the number of server operating Environment listed in section 6.3 Task 3 that make up the 16 services DISA wishes to map is only 2,063 of the 9850 Operating Environments and only one of the 22 mainframes. Does DISA have more than 16 services that it needs to eventually map that are comprised of the remaining 7,787 Operating Environment and 21 mainframes?

Answer: Yes.

1. PWS; For purposes of scoping the quantity of software licenses needed for this capability, would DISA please clarify if it wishes the offers to provide licenses for only those Operating Environments included in the 16 services listed in the RFP? Or, Does DISA wish to acquire licenses that will address the entire population of 9,850 Operating Environments and 22 mainframes?

Answer: The contractor will propose a solution to include licenses for the entire DISA environment identified in “Section 6.1 Task 1 of the PWS which contains a table that…