Questions_and_Answers_-_6-30-2014.docx

Q1. On page 11 of the PWS it states:

At all organizational levels, TAS shall be in compliance with Homeland Security Presidential Directive 12 (HSPD-12), which is also located at https://www.commissaries.com/tas/. Based on HSPD-12, DeCA requires two system access methods using two-factor authentication. First, the employee may enter their T&A data using a government-issued computer that accepts a DoD issued common access card (CAC) with related personal identification number (PIN). Second, the employee may enter their T&A data using a contractor provided T&A terminal that includes a CAC reader capable of reading the employee CAC chip and accepting the employee PIN.

Would the government consider relaxing the requirement of two-factor authentication and allowing single factor authentication which would open up competition and provide DECA with additional vendors’ responses?

A1. The Government must comply with the HSPD-12, which requires the agency to have two system access methods, using two-factor authentication.

Q2. Given the response due date is right after the holiday weekend would DECA consider and extension to July 15, 2014?

A2. The Government is on a relatively tight schedule, as performance on this effort is to begin 15 Sep 14. At this point, our projected schedule does not allow for us to extend the solicitation an additional six business days. UPDATE: The Government has now decided to extend the proposal due date to July 15, 2014.

Q3. Page 48, Section 2.1.1 references "Section A of the solicitation"; there does not appear to be a Section A. Page 49, Section 3.1 references "Section M evaluation factors"; there does not appear to be a Section M. Please advise as to the location of these references.

A3. These are typos and have been corrected via Amendment 0001.

Q4. Page 51, Section 5.1.3 states "Under no circumstances shall [information related to the proposed price] be included elsewhere in the proposal", referring to Volume III. However, page 52 Section 6.1.2 requests "Completed pricing information in the Contract Line Items of the model contract" in volume IV. Please clarify which instruction we should follow.

A4. Added “other than in the contract line items of the model contract” to the end of the quoted statement in section 5.1.3 via Amendment 0001.

Q5. Page 50, Section 4.2 lists format and specific content for Volume 2 including three subfactors from the PWS; however the remaining tasks (Testing, Training, Deployment, Operations & Sustainment) are not mentioned; where should these be accounted for? Will these be accounted for in Line Item 9 - All other aspects of the PWS?

A5. Correct, these should be accounted for in paragraph 4.2.2(9). Also, subfactor two, referring to PWS subtask 6.5.1, is part of the Deployment task.

Q6. Page 50, Section 4.2 lists format and specific content for Volume 2 but does not include mention of any of the Functional or Technical Requirements in the PWS. Where will these be accounted for? Line Item 9 - All other aspects of the PWS?

A6. Correct.

Q7. Page 50, Section 4.2 lists format and specific content for Volume 2 including Line Item 4 - Cross Reference Matrix. Could you please clarify what information is required for the Cross Reference Matrix? Should this correspond to the evaluation factors in Section M?

A7. Attached the referenced matrix to this section via Amendment 0001.

Q8. Section 11 Delivery Schedule starting on page 18 lists 4 deliverables due with this proposal: the Program Management Plan, Configuration Management Plan, Training Plan, and Deployment Plan. The Program Management, Configuration Management, and Deployment Plans correspond with subfactors 1, 2, and 3; where should the Training Plan be addressed?

A8. The training plan is no longer due with the proposal, per PWS change with Amendment 0001.

Q9. Page 23, Section 9.5 states that the contractor "shall submit a separate Organizational Conflict of Interest (OCI) mitigation plan"; please verify what Volume this information is to be included in.

A9. RFP has been amended to specify that this be included as part of Volume IV, Contract Documentation.

Q10. Comment: Lab tests in DeCA’s test environment located at DeCA headquarters in Fort Lee, VA, to ensure TAS meets all requirements, integrates within the DeCA IT environment, and interfaces properly with EDW, DERMAS and DCPS. Testing will verify that the Contractor’s solution meets DeCA requirements including enabling access to TAS using the CAC and PIN process and ensuring the interfaces to DCPS, DERMAS, and EDW function properly. Testing also includes attaining certification as described in DoD Instruction 8510.01, “DoD Information Assurance Certification and Accreditation Process.” Section 11 Delivery Schedule Information Security, Certification, and Acceptance Support due 365 calendar days ACA.

Questions:

Is it expected to complete the C&A on the Test Environment prior to conducting the Lab and Pilot Tests?

Will C&A testing be expected on any other environments?

When is it expected to complete the C&A on the Production Environment?

A10. Yes to the first question, and no to the second question. Concerning the third question; after the Operational Test and Evaluation (OT&E) Phase (Pilot testing) which, extends over three bi-weekly pay periods (approximately two months).

Q11. Comment: Proposal page limit restrictions also make providing this documentation difficult.

Question :

There was a change in the Delivery Dates from the previous PWS to the recent PWS. The changes moved delivery of the Plans from “days After Contract Award (ACA)” to “Draft Due with Proposal” in the following areas: Program Management Plan, Configuration Management Plan, Training Plan, Deployment Plan. We ask DECA consider changing the Delivery Dates back to the original delivery dates given the challenge, from a time perspective, to produce these deliverables along with the Proposal.

A11. The PWS will be amended to remove the "Draft Due with Proposal" reflect the previous PWS of 90 days after contract award' in the following areas: Program Management Plan, Training Plan, and Deployment Plan.

Q12: Section 11 Delivery Schedule Section 6.3 Task 3 Test Readiness Review (TRR) Report due 365 calendar days ACA; TRR and PRR are listed with the same delivery date. Was this intentional?

A12. No, the PWS will be amended to reflect TRR due 60 calendar days prior to PRR.

Q13. Section 11 Delivery Schedule Section 6.3 Task 3 Production Readiness Review (PRR) Report due 365 calendar days ACA; What is the expected Go -Live dates for Lab and Pilot sites? The proposed PRR is at 365 ACA. Are there any blockout dates or procedures involved before production cutover?

A13. No Q14. Section 11 Delivery Schedule Production Readiness Review (PRR) Report due 365 calendar days ACA; Since not all the sites are listed in Lab/Pilot teams; what is the expectation to roll out to other "unlisted" sites? Will the other sites be deployed by DeCa or will contractor help be required?

A14. See complete list of site and number of time clocks per site at www.commissaries.com/tas/ line #18. The time clocks will be deployed to each of the DeCA locations by the contractor.

Q15. Comment: 6.4.3 Subtask 3. DeCA intends to conduct training at the following locations:

Tier 1 help desk training of six (6) people at DeCA headquarters in Fort Lee, VA.

Train-the-trainer program that includes all functional levels including users, supervisors, CSRs, and management for:

45 people at DeCA Headquarters 30 people in Sacramento, California 30 people in Kapaun, Germany.

Question: Is the Tier 1 help desk considered the "admin" users? Train the Trainer is for the users who will train the end users - is this the "Train the Trainer end user" group 45 people at DeCA Headquarters 30 people in Sacramento, California 30 people in Kapaun, Germany which are to be trained as the "end users"?

A15. All 105 DeCA employees will be trained as Train-the-Trainer.

Q16. RFP 6.2.1.3 CAC authentication is often part of an LDAP-based directory infrastructure; What are the Directories and User Stores, Local and Enterprise, in use in the DeCA for Authentication?

A16. See Area, Store, Headquarters locations at https://www.commissaries.com/tas/ Q17. RFP 6.2.1.3 Some LDAP use EDIPI as the unique identifier on the CAC card; What user identifier is stored in the directory(ies) listed above that allow mapping to the CAC card?

A17. EDIPI number Q18. RFP 6.2.1.3 Some authentication infrastructure include OCSP (Online Certificate Status Protocol) instead of CRL (Certificate Revocation List) for CAC certificate validation; Does the DeCA infrastructure have OCSP available for CAC Validation?

A18. Yes Q19. RFP 6.2.1.3 Multiple directories can complicate identifying the correct individual from across the directorie; Are all of the users replicated across an enterprise Active Directory or are there multiple directories, with distinct sets of users?

A19. Yes, all of the users are using replication.

Q20. RFP 6.2.1.3 Containers in Active Directory can be arranged such that users are more easily identified in an group such as "DeCA employee"; Are users that are Commissary employees in a container in Active Directory that identifies them as such?

A20. No.

Q21. RFP 6.3.1 The Risk Management Framework modifies previous common approvals under DIACAP. Does DeCA DAA intend on utilizing the prior Authorities or simply issue Authority to Operate (ATO)? Prior to grant of Authority to Operate (ATO) does the DAA intend on approving, Interim Authority to Operate (IATO) or Interim Authority to Test (IATT)?

A21. Yes, prior to the DAA granting an Autority- to-Operate the DAA intent is approving an Interim-Authority-to-Test and an Interim-Authority-to-Operate.

Q22. RFP 6.3.1 The requirement for Information Security, Certification, and Acceptance Support is set for 365 Days ACA. Is there an earlier time when System Test and Evaluation will be performed to support Certification and Accreditation? During the Lab testing cycle(s) does the government intend on receiving an ATO for Certification and Accreditation?

A22. Yes, an Interim-Authority-to-Operate.

Q23. Appendix A – DeCA Infrastructure Requirements, Network Resource Requirements

1) What is the DeCA data center (@ Fort Lee VA) network backbone bandwidth? 1 GG or 10GG?

2) What is the inbound network bandwidth to DeCA data centert @ Fort Lee? Is the inbound network highly utilized? More than 50%?

3) What is the typical outbound network bandwidth from one of the 170+ DeCA locations? Is the outbound network highly utilized? More than 50%?

A23. 1) 10GG, 2) Less than 50%, 3) Less than 50% Q24. Appendix A – Technical Requirements Microsoft has annouced that Support for Windows 7 RTM without service packs ended on April 9, 2013. Be sure to install Windows 7 Service Pack 1 today to continue to receive support and updates. Will DeCA revise the verisions of Windowns OS to be supported ion this RFP?

A24. Yes.

Q25. I understand that the Time and Attendance software solution will be provided and loaded onto servers at Ft Lee. It appears that the Ft Lee servers will be the platform for testing/evaluation etc.

. Is the plan such that the DeCA locations would then be able to access the software from these servers at Ft Lee OR is the plan one that requires the software to be loaded on servers located at the various locations around the world?

. Would DeCA servers at Ft Lee (or another location) essentially host the software for all locations to access?

A25. Yes, DeCA locations will be able to access the software from the Fort Lee and Sacramento servers

Q.26 Please confirm that DeCA will require 16,000 user licenses to cover all DeCA employees.

A26. Yes

Q27. DeCA requires a "Train the Trainer" approach.

1) Will the graduates of the Train-the-Trainer course conduct the training for 45 people at DeCA HQs; 30 people in Sacramento; and 30 people in Kapaun?

2) Are those the target audience for the Train-the-trainer course?

3) Or, is the vendor to provide the training at those locations?

A27. 1) No, the vendor will conduct the training for the 45 people at DeCA HQs; 30 people in Sacramento; and 30 people in Kapaun, as well as, the 6 DeCA HQs to receive Train-the-Trainer course Tier 1 Help Desk (Administrator Training). 2) Supervisors, Customer Service Representatives, and Timekeepers. 3) Yes.

Q28. Is the CAC reader found on the DeCA website? (Are these already deployed at all DeCA sites?)

A28. The CAC reader on the DeCA website is used to provide the CAC reader specifications that are known to work within the DeCA environment. DeCA does not have a preferred CAC reader; if the vendor’s CAC reader specification are configured with a similar speicifcation to those on the DeCA website, it will suffice. All of the DeCA laptop and desktop computers already have CAC readers deployed. However, the vendor-provided time clocks will need the CAC reader deployed with the time clocks, as well as, installed at each of the DeCA locations on the DeCA website.

Q29: The instructions for Vol I are as follows:

3.0 Volume I Executive Summary

In the executive summary volume, the offeror shall describe the significant attributes and theme of its proposal.

3.1 Narrative Summary

The narrative summary of the entire proposal should be concise, to include addressing the significant risks, and highlighting any key or unique features, excluding cost/price. The salient features should tie in with Section M evaluation factors/subfactors. Any summary material presented here shall not be considered as meeting the requirements for any portions of other volumes of the proposal.

3.2 Table of Contents

Include a master table of contents of the entire proposal.

While I understand that the TOC does not count towards page limit, are there TWO summaries within Vol I (Executive and Narrative) and is the page limit for these two summaries one (1) page?

A30. These are not intended to be two separate summaries; the narrative is part of the overall Executive summary.

Q31. 1.Page 52 of 56 of HC1028-14-R-0032 Section 6.1 Contract/Representations and Certifications. Please clarify this statement. The purpose of this volume is to provide information to the Government for preparing the contract document and supporting file. The offeror's proposal shall include a signed copy of the Contract.

There currently is no contract to sign given we are at the Proposal stage.

A31. The Standard Form (SF) 1449 is a solicitation/contract form. The offeror completes/signs block 30 of the SF1449 as part of their offer. If the CO accepts the offer and countersigns, the SF1449 becomes a contract.

Q32. Page 52 of 56 of HC1028-14-R-0032 Section 6.1 Contract/Representations and Certifications

Please Clarify 6.1.1. Based on the comment prior – does the SF1449 need to be completed and if yes can we obtain a MS Word copy?

A32. Yes, block 30 (a, b, and c) on the SF1449 need to be completed. The version currently posted to FBO is an MS Word copy.

Q33. Page 52 of 56 of HC1028-14-R-0032 Section 6.2 Other Information Required

Please clarify section 6.2.2 Government Office - This is typically supplied at Contract award – the offeror would not have knowledge of these DODAACs until the award.

A33. This subparagraph has been removed from the RFP, and 6.2.3 was re-numbered to 6.2.2 in its place.

Q34. Do the locations where TAS will be installed have existing contracts with local vendors for IT/network support? The deployment/installation costs will be decreased significantly if local support is readily available.

A34. No

Q35. For employees at store level, is there any computer equipment available for employee use (for example, a kiosk of desktops that employees have access to)?

A35. The store level employees will be required to sign-in/sign-oututilizing the vendor provided time clock; however, a store level centralized government computer will be available for submitting their other exception request (i.e., leave request, overtime request, etc.....)

Q36. Since the Production Readiness Review Report is due at 365 calendar daysACA, system Go-Live is expected at some point after 365 calendar days ACA. Is that a correct assumption?

A36. Yes

Q37. Will Go-live be a phased effort?

A37. Yes

Q38. Does the total number of time collection devices include spares to be provided at each location?

A38. No

Q39. Does the page limit for Executive Summary apply to both the Narrative & Master Table of Contents or just to the narrative portion?

A39. See paragraph 2.2.1 of the addendum to FAR 52.212-1 Instructions which states: “Each page shall be counted except the following: cover pages, table of contents, tabs, glossaries, and resumes.” The table of contents is not included in the page limitation.

Q40. Volume III - Cost/Price Section

5.1.5 Pricing Proposal

The offeror shall provide their price proposal on the Price Template (attached as object at the end of this paragraph). The price proposal shall reflect rates for the base period and all option periods, including option pricing for an additional six-month period that may be authorized IAW FAR 52.217-8. See FAR 52.217-8 which authorizes the government to require continued performance of any services within the limits and at the rates specified in the contract. The price proposal spreadsheet includes a separate line item for the additional six-month period IAW FAR 52.217-8. These prices shall be identical to the quoted pricing in the six months prior to expiration of the final option period. The total evaluated price will consist of the contractor's proposed price for the base period and all option periods. The labor rates in this section shall reflect the fully-burdened rates for each labor category and will apply to all direct labor hours. Instructions for the price template are as follows

"Summary" Tab: Input total pricing for each CLIN and period of performance, as appropriate.

There does not appear to be any line for software and hardware. Are we to add line appropriately? Or, are software and hardware costs published elsewhere in the Response.

A40. No, the pricing is to be provided in accordance with the line item structure in the SF1449 and the pricing template. This structure was developed so that it directly aligns with the tasks in the PWS.

Q41. Could you please provide additional instructions as to what information is desired in the Cross Reference Matrix included in Section 4.4.2? According to the attachment, Section 2.2.5 of the RFP provides directions on how to complete the matrix. However, Section 2.2.5 recommends each volume avoid cross referencing and be written on a stand-alone basis. Should this matrix be used in the case that this is not possible or is this matrix meant to document cross referencing WITHIN Volume II?

A41. The matrix should document cross-referencing within Volume II.

Q42. If the latter, could you please provide additional instruction as to which requirements need to be tracked and the columns that need to be included? Do we need to track only the sections of the PWS or reach paragraph in the RFP? In addition, as the number of detailed plans originally due with this proposal are now deferred to 90 days ACA is there still a need to track these requirements against a WBS Level as a detailed WBS has not been provided in the RFP or required in the proposal?

A42. Amendment 0002 has been issued to alter the cross reference matrix. The purpose of the matrix is to cross-reference between the proposal and the PWS paragraphs and provide clarity to the Government as to where in the proposal the PWS requirements are addressed.

Q43. Finally, if we are to track all requirements/paragraphs in this RFP can we please request that the Cross Reference Matrix NOT COUNT towards the volume's page limit, as the volume will already be completed in accordance with DeCAs required outline?

A43. Amendment 0002 also specifies that the cross-reference matrix does not count toward the page limit.

Q44. Referencing paragraph 5.1.5 Pricing Proposal:

There does not appear to be any line for software and hardware. Are we to add line appropriately? Or, are software and hardware costs published elsewhere in the Response.

“A40. No, the pricing is to be provided in accordance with the line item structure in the SF1449 and the pricing template. This structure was developed so that it directly aligns with the tasks in the PWS.”

My concern is that I am not sure that the answer identifies where/how software license costs would be entered. The Closest CLIN item is Software/Hardware Configuration. Should the licenses for software be included on that line item?

A44. To alleviate confusion on this subject, the Government agrees that it makes the most sense for hardware/software costs to be included within the Software/Hardware Configuration line item, CLIN 0002. It is therefore recommended that those costs be included within CLIN 0002.

Q45. Questions below are in reference to Section 6.2.2 Subtask 2. Hardware Configuration.

1.Your attached list represents the required Time clocks for this RFP. Can you identify those sites which have existing time clocks which are already wired via Ethernet cabling?

2. Your attached list represents the required Time Clocks for this RFP. Can we assume the replacement clocks will be in the exact location of the existing clocks.?

A45. DeCA does not have existing time clocks. Newly installed time clocks will require installing at all Deca locations listed at https://www.commissaries.com/tas/, “Total Quantity Time Clocks for Commissaries and Central Distribution Centers” website. However, the location of the vendor provided time clocks will be placed in a location, within DeCA Commissaries and Central Distribution Centers, that would support the vendor’s Time and Attendance System solution.

Q46. Would DeCA consider a single category 6 drop for each TAS system?

A46. Yes. Only one category 6 drop will be required per time clock.

Q47. Would DeCA consider a single Ethernet RJ45 single-gang face wall plate with a single Ethernet RJ45 port or a single-gang wall plate with a single Ethernet RJ45 port for each TAS system?

A47. Yes, only one single Ethernet RJ45 single-gang face wall plate with a single Ethernet RJ45 port or a single-gang wall plate with a single Ethernet RJ45 port for each time clock will suffice for this requirement.

Q48. Would DeCA define cable testing results?

A48. Once the time clock is installed the vendor must demonstrate that the time clock is functioning properly and communicate time and attendance data within the DeCA network.

Q49. PWS 6.3 Testing 6.3.1 Subtask 1: “The DeCA TAS Program Management Office (PMO) has selected, from its three SDA files, the following areas for inclusion in initial pilot testing:

• ZKA database: Headquarters and one Continental United States (CONUS) zone.

• ZFR database: Guam.

• ZFA database: geographic zones in Korea, Japan, and Europe.”

In order to develop a pilot test schedule could DeCA please provide more insight into which sites will participate in pilot and how many clocks will be allocated for each site?

A49. 26 Time Clocks at 12 DeCA locations: Headquarters, Fort Lee 2 Time Clocks Langley AFB, Virginia 3 Time Cocks Portsmouth, Virginia 2 Time Clocks San Onofre, California 2 Time Clocks Panzer Kaserne, Germany 2 Time Clocks Vicenza, Italy 2 Time Clocks RAF Alconbury, United Kingdom 2 Time Clocks Anderson AFB Guam 2 Time Clocks Central Distribution Center, Guam 3 Time Clocks Camp Stanley, Korea 2 Time Clocks Yokota, Japan 2 Time Clocks Yokuska, Japan 2 Time Clocks