m2P1_RFP_Questions_and_Answers_Amendment_0002_July_29.pdf

Attachment L-1 Question & Answer Template

RFP# HC1028-16-R-0020 Amendment 0002 July 29, 2016

# Reference Questions Government Response

1 2.0 General Instruction For the purpose of this solicitation, an offeror is defined as a prime contractor or Joint Venture Teaming Arrangement.

L.4.1.1 Qualifying Criteria – Table L.2 Offeror to provide certification of a Federal Risk and Authorization Management Program (FedRAMP) Joint Authorization Board (JAB) Provisional Authorization (PA) at either the High or Moderate Systems level. Certification must be current (offeror’s company name is listed on the FedRAMP website having a JAB PA in IaaS or PaaS) and in effect at the time of initial Request For Proposal (RFP) submission.

M.1.1.2 Basis for Contract Award The stated qualifying factor listed in Section M.2.1.1 will be evaluated first to determine acceptability of the proposal. If determined to be acceptable the proposal will be evaluated further;

if not, the proposal will not be further evaluated.

M.2.1 Factor 1:

Technical/Management Approach

M.2.1.1 Qualifying Criteria Rating All proposals will initially be evaluated to determine whether their proposals are acceptable in meeting the following qualifying criteria. Offerors shall meet this qualifying criteria in order to be determined to be acceptable.

Acceptable/unacceptable ratings are provided in Table M.1.

Qualifying Criteria: Offeror to provide certification of a Federal Risk and Authorization Management Program (FedRAMP)

It is stated the “The offeror is defined as a prime.”

It is also stated that “Certification must be current (offeror’s company name is listed on the FedRAMP website having a JAB PA in IaaS or PaaS)”.

By definition, only the companies listed on the FedRAMP JAB PA can submit a proposal as a prime.

Is it the Government’s intent to limit bids to only companies listed on the FedRAMP JAB PA as an IaaS or PaaS?

Will the government consider that a bid has met the qualifying criteria if the bid is from a prime offeror that is not FedRAMP JAB approved but is teamed with a company that is approved and listed on FedRAMP JAB PA as a subcontractor?

Suggest, in order to increase competition, the government change the term in Table L.2 and M.2.1.1, paragraph titled Qualifying Criteria, to read “offering team must have a company name listed on the FedRAMP website having a JAB PA in IaaS or PaaS.”

No. As stated in paragraph M.2.1.1, in order to be deemed eligible for award, the “Offeror to provide certification of a Federal Risk and Authorization Management Program (FedRAMP) Joint Authorization Board (JAB) Provisional Authorization (PA) at either the High or Moderate Systems level.

Certification must be current (offeror’s company name is listed on the FedRAMP website having a JAB PA in IaaS or PaaS) and in effect at the time of initial Request For Proposal (RFP) submission. “

The prime contractor must hold the FedRAMP JAB PA. All references to teaming agreements and joint ventures have been removed from Sections L&M via Amendment 00001 – see attached.

Joint Authorization Board (JAB) Provisional Authorization (PA) at either the High or Moderate Systems level. Certification must be current (offeror’s company name is listed on the FedRAMP website having a JAB PA in IaaS or PaaS) and in effect at the time of initial Request for Proposal (RFP) submission.

Only those offerors that meet the qualifying criteria and is determined to be acceptable will have their proposals further evaluated

2 RFP: L.7.3 FAR Part 12, Part 13, Part 14 and even Part 15— contracting through negotiation all require a Government agency to delineate the evaluation from a quantitative standpoint prior to the submitting of proposed pricing by an Offeror. In RFP: L.7.3 - Volume Organization it states that:

“unit prices will be multiplied by the government provided evaluation quantities”.

When, prior to the current submittal due date, can we expect to receive the evaluation quantities so that we can prepare our CLIN/SLIN pricing?

Will be answered at a future date.

3 L.4.1.1 Qualifying Criteria – Table L.2

From reading the Q&A's, amendments, etc., it appears as if that the prime must be "JAB PA" authorized/certified by FedRAMP. We located our vendor on the FedRAMP website as having "FISMA High Baseline Authorization & Accreditation". We e-

No, FISMA is insufficient. FedRAMP controls are more stringent and therefore the Government will not accept proposals from a Cloud Service Provider (CSP) who has anything other than FedRAMP JAB PA at either the High or Moderate Systems level approved.

mailed FedRAMP and are awaiting their response as to whether the "FISMA" suffices for "JAB PA".

Please advise us if the "FISMA" suffices for this requirement.

4 RFP: Att. J-5 - Labor Categories The RFP lists 47, but the B-table lists 48. Please clarify.

There are 48. RFP Attachment J-5 has been revised as of Amendment

5 RFP: L.7.1.3.4 - Transition Support Tasks

This section references Attachment J-10; where is this attachment located?

The correct reference should be Attachment J-6. The RFP has been revised as of Amendment 0002.

6 RFP: L.7.1.3.4 - Plug Number for Travel Associated with Transition Support

This section references “803TAT”. Where is 803TAT in the B-table?

1st character is contract year from 0- 8, with 8 being the optional 6 month contract extension

SLIN 803TAT can be found in Att J-3, B_Table_tab 52_217_8_Opt line 120

7 RFP: L.7.3 - Volume Organization This section states: “unit prices will be multiplied by the government provided evaluation quantities (as detailed in the Evaluation Quantities tab of Exhibit B-1 Cost Model”. Please provide the evaluation quantities tab.

Will be answered at a future date.

8 Att. J-6 There is a reference to “Tasks 3 through 7”.

Where is Task 7? Please clarify.

9 RFP – Page 3 – Item 0001 Base Period The period of performance is date of award through 60 months.

Dates will be determined at award

Base year has been stated as 36 months, will this be amended?

The correct base period is 36 months, with 5 one-year options.

Section B was corrected with Amendment 0002.

10 L.4.1.1 Qualifying Criteria – Table L.2 Offeror to provide certification

With regard to the RFP’s Qualifying Criteria

No, the qualifying criteria will not be of a Federal Risk and Authorization Management Program (FedRAMP) Joint Authorization Board (JAB) Provisional Authorization (PA) at either the High or Moderate Systems Level. Certification must be current (offeror’s company name is listed on the FedRAMP website having a JAB PA in IaaS or PaaS) and in effect at the time of initial Request For Proposal (RFP) submission.

M.2.1.1 Qualifying Criteria Rating All proposals will initially be evaluated to determine whether their proposals are acceptable in meeting the following qualifying criteria. Offerors shall meet this qualifying criteria in order to be determined to be acceptable.

Acceptable/unacceptable ratings are provided in Table M.1.

Qualifying Criteria: Offeror to provide certification of a Federal Risk and Authorization Management Program (FedRAMP) Joint Authorization Board (JAB) Provisional Authorization (PA) at either the High or Moderate Systems level. Certification must be current (offeror’s company name is listed on the FedRAMP website having a JAB PA in IaaS or PaaS) and in effect at the time of initial Request for Proposal (RFP) submission.

Only those offerors that meet the qualifying criteria and is determined to be acceptable will have their proposals further evaluated.

Note: Submission from contractors with Agency FedRAMP Authorization or Cloud Service Provider (CSP) Packages will not be accepted. The Contracting Officer will verify offeror status by visiting the FedRAMP site

(Sections L.4.1.1 at p 67, and M 2.1.1 at pp 89-90) we believe that the government is arbitrarily and unfairly limiting the scope of competition on this opportunity. The government’s objective of establishing a qualifying criteria around FedRAMP certification is valid insofar as it mitigates the risk to the government of schedule delays of DISA’s own ATO process after award by only qualifying vendors who’s solutions have already been subject to review against the FedRAMP controls. However, the distinction between a JAB PA, an Agency Authorization, and a CSP-provided certification arbitrarily limits the competition for this opportunity without any clear benefit to the government. Furthermor e, this distinction unfairly eliminates from competition vendors who have been unable to receive JAB PAs. The JAB process has not been available to vendors for over 8 months leaving the Agency Authorization and CSP-provided processes as the only available route to FedRAMP certification. Will the government consider opening the competition to vendors from all three categories of FedRAMP Certification?

changed.

11 L.7.1.1 The total evaluated price will consist of the proposed price for the base period, all option periods, and the option pricing for the additional six-month period.

There is no tab for the additional six month period in the Attachment J-3. Please clarify how offerors provide pricing for the optional six-month period.

Please see B_Table tab 52_217_8_Opt

12 L.7.1.3 The offeror must complete the Workload table with the closest configuration that meets or exceeds the required workload.

Please clarify what the government expects the offeror to provide with regards to the Workload table. If this is an attachment, if so, can you please provide?

Para L.7.1.3 has been updated in Amendment 0002 to refer to attachment J-3 Exhibit B-1 m2P1 cost model.

13 Various references Sections J, L, and M.

Please clarify references to Section J, Attachments J-6 and J-10.

Please provide Attachments J-9 and J-10.

Attachments J-9 and J-10 are place holders for the awardees OCCI Mitigation Plan and SCRM Plan as indicated by “(incorporated after award)”.

14 L.7.3 Exhibit B-1 m2P1 Cost Model, Attachment B-1 Cost Model

Please confirm the referenced attachment is J-3 instead of Exhibit B-1 m2P1 Cost Model/Attachment B-1 Cost Model.

Attachment J-3 is titled “Exhibit B-1 m2P1 Cost Model”

15 L.7.3 Within the Exhibit B-1 Cost Model, offerors are required to provide monthly unit prices for all contract years for all CLINs/SLINs, on the worksheet tab entitled “B-Table.”

The units of some SLINs are other than monthly.

Please clarify that the offeror shall provide pricing as specified in Attachment J-3.

Paragraph L.7.3 updated in Amendment 0002 to “unit pricing for all contract years”. Pricing must be provided as specified in Attch J-3.

16 RFP Section B CLIN 0001 The period of performance is date of award through 60 months.

Dates will be determined at award.

Please confirm the Base Period is three years instead of 60 months.

Yes, the base year is 36 months.

This has been corrected via amendment 0002.

17 PWS 6.1.10.7 (2)

The Contractor shall provide 24/7 support, 30-minute response to Severity 1 issues. A Severity 1 issue is defined as a severe problem preventing a Consumer from performing business or mission functions including data loss or data unavailability for a production workload. The Contractor shall respond to critical incidents in 30 minutes or less, Please define response, is this on-site response or on-call

On call response is acceptable as long as the responder is someone capable of adequately addressing the issue.

while providing 24/7 support to the infrastructure services.

18 PWS 6.1.10.7 (4):

The Contractor shall provide 5/10 support, 3 local business hours, for the operating location, to Severity 3 issues. Severity 3 issues are defined as having some impact to the infrastructure services but not a work stoppage.

Please define 5/10 support

19 PWS 6.1.1

Infrastructure Services Detailed Facilities Analysis

Will the government provide networking circuits between data centers if required for disaster recovery strategy, if not currently in place?

Yes, DISA will provide a replication circuit between sites. DISA will fund the circuit directly.

20 PWS 6.1.8.14

Security Requirements

Please clarify the requirement to offer Consumers the ability to control root access to infrastructure services through multifactor authentication. Is the government referring to access to the provisioning and management portal or to guest operating systems? Should this multifactor root access be CAC enabled?

Multifactor authentication is required for both provisioning services, and VPN or privileged access to the consumer’s private cloud. The Application Owner is responsible for access to the OS itself. Any privileged access to CSP or consumer root access should be PKI enabled. CAC is a preferred method of providing PKI credentials.

21 PWS 6.1.11

Monitoring, Alerting, and Logging Requirements

Will the Government allow the CSP to connect the underlying milCloud

2.0 infrastructure back to its established FedRAMP security authorization boundary for command and control traffic as well as to leverage existing security and operational management tools/systems already in place via private circuits?

Remote management is acceptable as long as it in compliance with the

SRG.

22 PWS 6.1.2.17:

Compute Requirements The Contractor shall stand up a pre-production environment…

Can it be in a Contractor hosted computing environment?

Preproduction environment must provide maximum fidelity to the production environment, and must be collocated with one of the on-prem enclaves.

23 PWS Section10 Place of Performance

Can a Contractor Facility be included as a place of performance for contractor personnel here since it’s referred to in other sections of the PWS, e.g. 6.1.14 and PWS 10?

Will be answered at a future date.

24 PWS Section 5 Scope

Related to the initial implementation of up to 50 workloads. Can DISA provide a representative size of each Virtual Machine (VM) workload in terms of GB of RAM and attached/associated storage? Example 4GB with 120GB of attached storage.

The representative size of each VM workload is specified in attachment J-6.

25 PWS 6.1.10.7 (6)

Support Services

Should the contractor assume that this requirement is a 24x7x7 requirement?

Yes.

26 PWS 6.1.1

Infrastructure Services Detailed Facilities Analysis

Are there current restrictions to space, rack dimensions and/or power that the offeror should be aware of?

Please reference the script loaded to FBO MilCloud 2.0 Industry Day Script June 2016.doc and the DECC Montgomery QA Final 16 Jun 2016.doc.

27 Solicitation Request a two week extension so that offerors may have adequate time to incorporate responses from questions and answers into their bids.

Amendment 0002 extends the proposal due date to August 22, 2016.

28 HC1028-16-R-0020-Block 10, pg.

1-Set-Aside

The Government states that the acquisition is unrestricted with a NAICS Code of 541519 and a size standard of $27.5M.

Please confirm that this was an oversight and there is no Size standard.

This it not an oversight. The size standard of $27.5M is provided for offerors so they can indicate if they are a SB or LB under the NAICS used.

No set aside applies.

29 HC1028-16-R-0020

Item Number 0001 Option, pg. 3 & Section M.1.1.5, pg. 88-Base Year Term

In reviewing the solicitation we encountered a conflicting statement around the term of the base period.

Item No. 0001 states, “the period of performance is date of award through 60 months. Section M.1.1.5 states, “The offeror shall propose unit prices for the three year base period and five 1-year options.”

Please clarify whether the base period is 3 or 5 years.

CLIN 0001 has been corrected in Amendment 0002 to reflect 36 months which is the correct base period.

30 HC1028-16-R-0020

Item Number 4001 Option, pg. 5- Option Year

Please confirm this was an oversight and Item 4001 should be m2P1-Option Year 4.

Correct, CLIN 4001 has been corrected to read “Option Year 4”.

See Amendment 0002.

31 HC1028-16-R-0020

Block 8, pg. 1-Submission Date

We would respectfully like to request an extension of 3 weeks from when the Government releases responses to questions.

Upon detailed review of the RFP and the Governments requirements, there is concern there will not be enough time for our industry leading team to effectively analyze and respond to the clarification questions our team will submit in accordance with the RFP requirements regarding DISA’s detailed security requirements. We

Amendment 0002 extends the welcome the opportunity to provide a robust and innovative response for DISA’s requirement.

32 HC1028-16-R-0020

Guaranteed Minimum, pg. 6 of 95

The Government states, “Guaranteed minimum amount represents the Government’s investment in the infrastructure for M2P1.”

Please clarify if the infrastructure is inclusive of all required services and hardware or just hardware.

The Guaranteed Minimum reflects payments against contractor achievement of specific milestones.

The payments apply towards the infrastructure and all required services, but is not intended to offset the total cost of that infrastructure.

Amendment 0002 clarifies the note on Page 6 in Section B.

33 HC1028-16-R-0020

Section E – Inspection and Acceptance, pg. 7 of 95

Acceptance Terms for

CLIN 001, 1001, 2001,

3001, 4001, 5001.

Where is acceptance criteria defined along with government dependencies?

Acceptance will be made by the appointed Contracting Officer Representatives as identified in individual delivery orders.

34 HC1028-16-R-0020

FAR Clause 52.219-4 – Notice of Price Evaluation Preference for HUBZone Small Business Concerns (Oct 2014), pg. 7 of 95

Please confirm that in order for the 10 percent price factor to be applied the HUBZone entity must be the prime offeror.

Yes, this is correct. Included because this is a required clause.

However there are no qualified HUB Zones who could submit as a prime contractor.

35 HC1028-16-R-0020

Section M.2.0 Evaluation Factors and SubFactors, pg. 89 of 95

The Government provides detail of the relative importance of Factors 1-3.

Please clarify as to how Factor 4-Price will be weighted and its relative importance in relation to Factors 1-3.

Factor 4 will not be weighted. As stated in paragraph M.2.0(2), “…all evaluation factors other than cost/price, when combined, are significantly more important than cost/price.”

36 HC1028-16-R-0020

Attachment J4, pg. 42 of 95

This bidder would like the government to describe deliverable as stated - Submission of a complete FedRAMP + SRG level 5 P- ATO package for Location

1. And Submission of a complete FedRAMP + SRG level 5 P-ATO package for Location 2.

Will the submission and

The ATO will be contractor owned and managed.

No, the government will not be reimbursing the contractor for actual expenses associated with obtaining and maintaining accreditation. The Guaranteed Minimum applies towards m2P1 infrastructure and all required services, but is not intended to resultant certification remain with the government or become contractor owned and managed.

Costs associated may not be in alignment with industry experiences. Will the government reimburse contractor for actual expenses to submit and maintain certification?

offset the total cost of that infrastructure or accreditation.

37 PWS

6.1.4 – Provisioning Requirements,

pg. 10 of 41

Please confirm as to whether provisioning service is to be load balanced between Location 1 and Location 2

The government will not dictate the offeror’s solution for load balancing.

The management of the environment is up to the offeror.

38 General What isolation is required for separation between NIPRNet and SIPRNet domains?

NIPR and SIPR will be on physically separate hardware, in physically separated locations at the operating sites. Any communication between domains must utilize the DISA cross-domain solution.

39 PWS

Section 6.1.2.8, pg. 8 of 41

The Contractor’s infrastructure services shall support guest OSs releases within 30 business days of general availability in the marketplace. DISA intends to provide a gold image of new releases for Consumers as soon as practicable.

Is the dependency on DISA to provide a DISA STIG version with all applicable security controls to the contractor? If so, the requirement may not be able to be met by the contractor if dependency is on DISA.

40 General What capability exists for a parts locker or kiosk at the government locations?

Please reference the script loaded to FBO MilCloud 2.0 Industry Day Script June 2016.doc and the DECC

41 Section J6:

Task 2 [Notional] Virtualized Legacy System, pg. 3 of 55

The COLO will be DISA designed and managed.

Please clarify the Government’s definition of COLO.

Customer owned devices installed on DECC floor space.

42 J-6 - SRF Special Audits, Inspections, Assessments, and Tests – Special Compliance Information

Please clarify who will perform these actions as outlined in the project plans? Is it the Government’s intention to perform these action or is the Offerer expected to do so.

Will be answered at a future date.

43 Section J6:

Project Tasks - General Question

What are defined SLA’s and related workflows that would initiate task to contractor for Target Dates? At what point would contactor be engaged in process?

1.Target Letter Estimate Date 2.Target Funding Date 3.Target IOE Date 4.Target IOC Date

Will be answered at a future date.

44 Section J6:

Migration Requirements Pg. 8 of 55

Are there any preferred toolsets in use at DISA today that are certified by DISA to migrate workloads and data?

What technologies are used today to migrate data and workloads into MilCloud Version 1?

Current toolsets are largely VMware provided or related. Tools will be driven to some extent by the target environment.

45 Section J6 – page 8 section 3.

Cutover requirements

Describe any system-specific post-cutover acceptance criteria:

Please define Acceptance criteria and if this is a government requirement or a contractor requirement.

46 Section J6:

8. Optional Value Add Services, pg.25

Would contractor be able to fulfill some of these roles or are these all existing DISA Services?

47 PWS

Methods to migrate workloads between sites Pg 8 of 41 –

Please confirm if existing Milcloud 1.0 applications will be mandated to move to MilCloud 2.0?

milCloud 1.0 workloads will not be mandated to move to milCloud 2.0.

Migration is a consumer choice based on the value of the offering.

48 PWS

Methods to migrate workloads between sites Pg 8 of 41 –

If existing Milcloud 1.0 applications will be mandated to move to Milcloud 2.0 please clarify who will be funding the migration?

milCloud 1.0 workloads will not be mandated to move to milCloud 2.0.

Migration is a consumer choice based on the value of the offering.

Any transitions will be funded by the Consumer via a firm fixed-priced task order.

49 PWS

Methods to migrate workloads between sites Pg 8 of 41 –

Please confirm that the migration is both for existing Milcloud 1.0 applications as well as new workloads for Milcloud 2.0-Phase 1.

milCloud 1.0 workloads will not be mandated to move to milCloud 2.0.

Migration is a consumer choice based on the value of the offering.

The Government assumes that milCloud 2.0 workload will be made up of a combination of milCloud 1.0, other DoD Legacy systems moving to Cloud, and new systems designed for the cloud.

50 Page 1.8.5 – OCI plan Does the Government foresee any potential OCI issues?

Would current incumbency by existing MilCloud 1.0 contractor prohibit them from participating in M2P1 in any capacity given their existing knowledge within DISA and Milcloud 1.0?

milCloud 1.0 is not a contract.

Multiple contracts and government employees provide the services required for milCloud 1.0. All offerors submitting a proposal must include an OCCI plan which must be approved. Incumbents providing services under MilCloud 1.0 should address potential OCI issues and proposed mitigation plan.

51 PWS

6.1.1.2 Installation Plan and

Timeline Pg. 7-8 of 41

The Government states, “hardware delivery for all hardware required for IOC no later than 8 weeks after contract for the first site and no later than 12 weeks for the second site.

Please confirm the Government will consider a different timeline should it provide a best value solution to the Government

The offeror will be evaluated as defined in section M of the RFP. The timeline is one of the evaluation factors.

52 PWS

6.1.10.10 Capacity Management

Pg. 20 of 41

Is there an SLA (RTO) for the alternate site to be fully operational in the case of a severe failure?

This will be based on CSP design, and will depend on Consumer specific designs. Need to be compliant with the CC SRG.

53 PWS

6.1.7 Network and Transport

Requirements.

Pg. 12 of 41

What is the available network bandwidth between the Montgomery and Oklahoma City DECC’s?

Circuit size has not been defined, but DISA expects to be able to provide up to 10 Gb. For more information regarding facilities please reference the DECC Montgomery QA Final 16 Jun 2016.doc.

54 PWS

6.1.2.11 The infrastructure

services shall support the automated failover of workloads between the two physical sites to support Continuity Of Operations (COOP), if applicable to the Consumer.

Pg. 9 of 41

In reference to the COOP offering, can you offer more details to the desired outcome?

What is the desired RTO and RPO for the COOP offerings?

This will be based on CSP design, and will depend on Consumer specific designs. Need to be compliant with the CC SRG.

55 PWS

6.1.7.9 External network security

Access Control Lists (ACLs)/firewall. The Contractor shall offer Consumers the ability to allow and deny external network traffic based on source and destination address, port, and protocol within their area of responsibility. Consumers shall also be able to group infrastructure elements and assign a set of ACLs

Is the requirement to offer Firewall solutions as a service to each individual workload and be offered as a service?

Please provide any additional details.

Each Consumer project or instance will be considered a virtual private cloud (VPC), or virtual data center.

Access to and from the VPC will be limited by a firewall or other Consumer control that is compliant with the SRG, and provides a deny by default access controls. This is a required function, but may be provided as a service.

to the group rather than to individual instances one at a time.

The service shall be stateful.

Pg. 9 of 41

56 PWS

6.1.10.7

Please clarify under which tab of Attachment J_3 Final the offeror is to provide the price offerings for the support services listed under Section 6.1.10.7.

Services in 6.1.10.7 are considered administrative or infrastructure overhead, and are not separately priced.

57 PWS

6.1.2.17 The Contractor shall stand up a pre-production environment that connects to the DoDIN but is separated from the production environment and data.

Please clarify under which tab of Attachment J_3 Final the offeror is to provide the price offerings for the pre-production environment stand up.

The preproduction environment is considered administrative or infrastructure overhead, and is not separately priced.

58 PWS

6.1.2.17 The Contractor shall stand up a pre-production environment that connects to the DoDIN but is separated from the production environment and data.

Please confirm that each location will require a pre-production environment to be stood up.

Is the requirement to offer Firewall solutions as a service to each individual workload and be offered as a service? Please provide additional details.

If the offeror feels that one instance of the preproduction environment is sufficient to validate operation, this is acceptable.

The firewall solution question was answered above in question 55.

59 Industry Day and Final RFP & PWS The m2P1 Industry Day in Montgomery, AL had very specific facilities requirements stated to be met, to include power consumption per cabinet as well as individual system power supply components and energy star ratings. Yet in the final RFP and PWS, there are no facilities requirements stated to be met.

Will the Government state whether there are or are

Please reference the facility script loaded to FedBizOpps.gov in folder DECC Montgomery Site Visit Information to find specifics regarding facility information.

https://www.fbo.gov/?tab=documents&tabmode=form&subtab=core&tabid=a34c04591cd0b9066debdc9585d64ce7 https://www.fbo.gov/?tab=documents&tabmode=form&subtab=core&tabid=a34c04591cd0b9066debdc9585d64ce7 not explicit facilities requirements to be met in terms of hosting the contractor’s equipment at the two DISA datacenters identified for m2P1?

And if so, what those specific requirements must be so they can be addressed in contractor’s response?

60 RFP Development There is a perceived notion that Tapestry, was involved with the requirements development for the m2P1 RFP/PWS. Can the Government verify this participation and does it preclude Tapestry from submitting a proposal package?

Participation in the preparation of the RFP documents under a Non- Disclosure Agreement would not necessarily preclude Tapestry from submitting a proposal as offerors must submit an OCCI mitigation plan with their proposal which would have to be deemed acceptable by the Government to be eligible for award. In addition, the company would have to meet the qualifying criteria.

61 General Question Would the government offer an extension -additional time will assist in contractors’ ability to thoroughly perform the necessary due diligence (OCI review, small business partnering, past performance requests, etc.) required with a contract of this magnitude?

Amendment 0002 extends the

62 Section B, page 5 of 95, item number 4001 Option

Item 4001 description states m2P1 - Option Year

3. Will the Government provide the correct item number?

CLIN 4001 corrected to read “Option Year 4” in Amendment 0002.

63 Attachment J-4, Implementation Deliverables Payment Schedule for Guaranteed Minimum Payment

The provided payment schedule sets forth payment milestones based on the minimum payment within the RFP.

Should additional funding beyond the minimum amount be funded under this contract, please

The guaranteed minimum will not be changed.

clarify whether these same milestones will apply. If these milestones will not apply, please clarify the milestones and frequency for the payment of additional funding.

64 Attachment J-6, Transition Support Tasks

This attachment notes, “Actual task orders for transition of IOC workloads will negotiated with the successful offeror after contract award.”

Please confirm these task orders will be issued as a sole source award to the offeror who is awarded the current solicitation (HC1028-16-R-0020). If these will be competitively bid, will the incumbent have the right to no-bid these task orders?

The resultant contract will be a single award IDIQ contract. All task orders will be awarded to the awardee of the contract.

65 Attachment J-7, QASP Please clarify what constitutes final overall program acceptance upon completion of all major work requirement tasks outlined in the QASP.

Will be answered at a future date.

66 PWS 6.1.10.1 Infrastructure Service Availabilities & 6.1.10.9 Off-boarding Support

Please clarify the duration contractors will be required to provide the support services outlined in 6.1.10.1.

Will any of these support services be required after the duration of the POP, or will the government assume this responsibility at that time? If off-boarding support should occur prior to POP end date, please specify.

The contractor will be required to provide these services for the life of the contract (period of performance).

At the end of the POP, reference section 6.6, the environment will terminate, and all workloads will have migrated or transitioned out of the environment.

67 PWS 11, Period of Performance PWS Section 11 notes the POP is for a three year base period with five 12 month options, however the Model Contract seems to indicate a 60 month (5 year) base with five-12 month options. Please

CLIN 0001 has been corrected via Amendment 0002 to read 36 months for the base period.

clarify.

68 PWS 12, Delivery Schedule Will CDRLs be incorporated to the award to capture the documented deliverable requirements, or will the PWS serve as the only mechanism for what is required in each deliverable? Additionally, please clarify the allotted government turnaround time for review and time allotted for Contractor updates based on such review.

There will be no CDRLs. The PWS is the mechanism used for deliverables. All deliverables will be in commercial format.

69 PWS 6.2 Task Area 1, Subtask 1.2

- Infrastructure Service Requirements For SIPRNet- Connected Workloads and Data -subparagraph 4

Government states "Implementation of a cross domain solution (CDS) will be required to support the unclassified data transfer from NIPRNet to SIPRNet."

Will the Government be responsible for providing, accrediting, implementing, and operating the cross domain gateway?

Will be answered at a future date.

70 Section L, L.2.9 - Proposal Submission

The referenced section notes, A detailed guide for utilizing the website is also being posted on FedBizOpps with the solicitation package, titled 13“DITCO Solicitations and Uploads – Vendors.”

However this does not seem to be provided with the attachments. Can the government please send?

Currently it appears the https://www.ditco.disa.mi l/vendors/ site only directs vendors to FedBizOpps instead of listing this solicitation as an option for upload. The help desk stated all solicitations are only posted on FedBizOpps.

We would like to verify

The attachment referenced is actually available on the website at the Login screen. Please utilize that link. Section L.2.9 has been revised via Amendment 0002.

The solicitation and all related amendments and documentation will be posted to FBO for potential offerors to download. The DISA website will be utilized ONLY for the upload of proposals.

the solicitation will be posted and available on the referenced DISA website and available for upload as required.

If not, please provide another method for submission.

71 Section L, L.8.4 - Small Business Participation

Please clarify on whether a minimum of 25% of the entire contract value, to include any subsequent option years and transition support services, should be awarded to small businesses.

72 Section L, Table L.2 - Qualifying Criteria

The contractor is providing a single commercial service for DISA delivered on premise. This single solution is based on a commercial offering that meets the qualifying criteria of FedRAMP JAB PA. Therefore, will the government remove the 25% small business requirement to enable the contractor to deliver the commercial solutions without the requirement to divide 25% of the commercial solution to a small business that does not have the FedRAMP JAB PA, and increases risk to the government?

Will be answered at a future date.

73 Section L, L.8.4 - Small Business Participation

“The basis for the total evaluated price of the contract will not be released prior to contract award.”

Request the government provide the basis of the total evaluated price to all bidders to enable each bidder to properly include small business participation in order to achieve the minimum quantitative requirement (MQR) of 25%?

74 Section L, L.8.4 - Small Business Participation

Per L.8.4, “the offeror’s proposed pricing will be different than the total evaluated price. The basis for the total evaluated price of the contract will not be released prior to contract award” and per section M.2.4.1 “The total evaluated price is based on quantities of each required CLIN and SLIN, including the SIPR SLINs and Transition Labor with an aggressive growth schedule by year, including option years. The quantities will not be disclosed to the offerors prior to the evaluation.”

In order for an offeror to adequately provide a FFP response, knowledge of how the basis of the TEP was developed and how many quantities will be used to calculate the TEP are needed. Quantity is likely to affect pricing. In an effort to provide the most realistic response based on actual needs and ensure cost reasonableness across all respondents, it is important this information be provided.

What is the basis of the TEP and the quantities used to calculate the TEP, and how does the government intend to evaluate all proposal submissions equally without this information being disclosed?

75 Section M, M.2.4 - Factor 4 - Price Reference section: “The total evaluated price is based on quantities of each required CLIN and SLIN, including the SIPR SLINs and Transition Labor with an aggressive growth schedule by year, including option years.

The quantities will not be disclosed to the offerors prior to the evaluation.”

Whereas contractor price proposals are based on item purchased and quantities, will the government disclose the quantities purchased to permit realistic estimates of the probable costs of performance to enable the contractor to respond to the cost proposal?

Will be answered at a future date.

76 Section M, M.2.4 - Factor 4 - Price Reference section: “The total evaluated price is based on quantities of each required CLIN and SLIN, including the SIPR SLINs and Transition Labor with an aggressive growth schedule by year, including option years.

The quantities will not be disclosed to the offerors prior to the evaluation.”

Whereas the government is not buying a commercial offering, but rather an instantiation of a commercial offering specially built for DISA on premise, the quantities of units purchased are necessary in order for the contractor to provide a firm fixed price cost proposal for this effort.

Based on this information will the government provide the quantities of items purchased for offers to enable equal competition among competitors for providing the government a price?

77 Section M, M.2.4 - Factor 4 - Price Reference section: “The total evaluated price is based on quantities of each required CLIN and SLIN, including the SIPR SLINs and Transition Labor with an aggressive growth schedule by year, including option years.

The quantities will not be disclosed to the offerors prior to the evaluation.”

Whereas the government is not providing the quantities purchased, and whereas fixed price contracts are appropriate for well-known requirements, will the government therefor change the contract type to a cost reimbursable with fee contract due to the lack of well-known requirements?

Will be answered at a future date.

78 Section M, M.2.3.1(a) Reference M.2.3.1 (a) - This section states offerors should demonstrate initiatives that show our preference for hiring veterans. Please clarify the intent of showing this information at the prime level within a small business participation plan. Should this section reference veteran owned small businesses instead, or should offerors incorporate a section to this plan that also states how they are hiring veterans at the prime level?

79 6.1.4.1 The Contractor shall provide access to a browser-based management functionality for government approval to conduct provisioning, configuring, and termination of compute and storage infrastructure resources.

What kinds of configuration changes require approval - VM sizing, IP assignment, etc?

Any change which increases the operating cost of the Consumer instance must be approved by the Contracting Officer via modification to the B-tables.

80 6.1.4.5 The provisioning service shall enforce that provisioning actions are performed by approved individuals in an organization. The workflow shall support the identification and designation of one or more approvers and the appropriate sequence of approvals required for each consumer organization. The workflow shall be tailorable in self-service manner for each consumer organization, with role based limitations for who may modify the workflow.

With regards to the statement "The workflow shall be tailorable in self-service manner for each consumer organization, with role based limitations for who may modify the workflow.”, can the government clarify if they wish to be able to modify the workflow process itself or the groups and personnel associated with each step in the pre-determined workflow process.

Each Consumer organization must be able to tailor the workflow to fit their organization requirements and identify who must be notified or provide approvals. In addition, the ability to modify the process must be limited to role based individuals with the authority to perform the change.

81 6.1.4.5 The provisioning service shall enforce that provisioning actions are performed by approved individuals in an organization. The workflow shall support the identification and designation of one or more approvers and the appropriate sequence of approvals required for each consumer organization. The workflow shall be tailorable in self-service manner for each consumer organization, with role based limitations for who may modify the workflow.

If the workflow process is to tailored, does the government expect each provisionable resource to be able to have a different process, or will the custom process be created up front for all resources to be provisioned?

In either case, how many steps does the government anticipate needing in the workflow process? What are the maximum number of steps?

The Government does not anticipate a separate flow for each provisionable resource, however there may be a separate process for each type or class of resource, including, but not limited to Servers, Storage, and Services. The maximum number of steps is not known at this time. It is not our intent to have the process be burdensome on involved parties.

82 6.1.7.8 The Contractor shall provide a self-service capability to configure global load balancing where requests are directed to endpoints that may be located in different data centers.

Can the government define which portions of this service must be automated? Since global load balancing is very complicated, is it acceptable to have self-service requests automated with manual

That is acceptable. Management of the infrastructure will be left up to the CSP.

contractor fulfillment so long as all steps are integrated into the self-service portal.

83 6.1.8.9 Multiple API keys per Consumer. Contractor shall allow Consumers to generate and own multiple API keys per Consumer. API keys must be securely stored.

Does the government require API Keys or can this functionality be replaced by user authentication? If not, what functionality of API keys is required that cannot be done through user authentication.

API keys are required.

Authentication functionality via machine to machine communication and linkage to customer account information.

84 RFP PWS 6.1.3.8 “The object storage services must offer Consumers the self-service ability to opt into native encryption on the storage services, such as server side encryption (SSE) for objects or object hierarchies within the storage service. Consumers shall be able to manage their own encryption keys and encrypt their own data prior to uploading and storing within the Contractor’s storage service.”

Question: What is meant by the requirement “Consumers shall be able to ... encrypt their own data prior to uploading and storing within the Contractor’s storage service“? The object storage system should have no insight into the generic objects that happen to contain random encrypted bytes.

Please clarify, this section provides conflicting requirements. Data Encryption is usually either the responsibility of the client application or of the server but not both simultaneously. If the application owner wants “to manage their own encryption keys and encrypt their own data prior to uploading and storing within the Contractor’s storage service” the object storage system will have no insight into how to decrypt generic objects encrypted by the tenant.

SSE could be applied on top of any existing client side encryption.

85 L.7.1.3.4 The first sentence states:

“The Offeror shall submit pricing for the Transition Support Tasks 3, 4, 5, and 6 identified in Attachment J-10”. There does not appear to be an Attachment J-10. Did the government mean Attachment J-6?

Yes, the correct reference should be Attachment J-6. Corrected via Amendment 0002.

86 RFP PWS SECTION 5

AND

Attachment J-6

Section 5 states: “The DoD anticipates that infrastructure services will need to be capable of scaling from a small initial implementation up to 50 workloads at Initial Operational Capability (IOC) to a target state supporting approximately 5,000 workloads at Full Operational Capability

(FOC).”

In Attachment J-6 tasks 3 through 6 only identify 31 hosts to be transitioned to IOC. Are there additional workloads that will be transitioned? Can the government please provide detail on the additional 19 workloads?

Additionally, can the

The initial requirement of up to 50 workloads, currently includes four Consumer projects. This list is subject to change. milCloud 1.0 workloads will not be mandated to move to milCloud 2.0. Migration is a consumer choice based on the value of the offering.

government provide detail on all 5000 workloads required to achieve FOC?

87 RFP PWS 6.1.3 “Block storage service:

Instance-independent block storage whereby the Consumer can obtain block storage volumes that are network-attached and independent of any specific compute instance.

The Consumer can then mount this storage volume on a compute instance.”

Question: Can the government provide specific details regarding the requirement for “instance-independent block storage, whereby the Customer can obtain block storage volumes that are network-attached and independent of any specific compute instance?”

Has the Government determined that a solution with storage, network, and compute integrated into a single device cannot meet this requirement?

The government has not ruled out any other solution as long as it meets the stated performance requirements.

The specific solution up to the vendor.

88 Section L.8.4.1 Small Business Participation

Can the government please confirm that L.8.4.1 Small Business Participation Commitment Document is separate and the requirements of L.8.4.2 regarding second-tier subcontractors do not apply as long as the 2 required documents are complimentary?

Yes this is correct. The Comittment Document is separate from the Subcontracting Plan.

89 L.8.4.2.

Can the government please confirm that per FAR 19.704 commercial plans meet this requirement?

Yes, a commercial plan is acceptable to meet the requirements for a Subcontracting Plan. However, all offerors are also required to submit a Comittment Document which is applicable to the m2P1 effort.

90 L.8.2 Assumptions to Solicitation Requirements

L.8.2 states: “No assumptions or exceptions will be entertained.”

Question: Given that the Government has stated a requirement for Commercial Cloud services, and Commercial Items, Products and Services are routinely procured with exceptions to Government Terms and Conditions, can the government please specify if this statement applies to the PWS only, or does it also include all clauses and terms within the RFP?

91 L.8.4 L.8.4 states in part: “All offerors, including small business, submitting a proposal as a prime contractor are required to meet or exceed the minimum quantitative requirement (MQR) of 25% or better of the offeror’s proposed pricing in awards to small businesses.”

Question: Can the government please explain how MQR will be calculated from the offeror’s “proposed pricing” in the completed J-3 attachment?

Given the Government has stipulated that Technical Acceptance is determined by being listed as a FedRAMP JAB certified Commercial Cloud Service on the FedRAMP.Gov website, and only one Commercial Cloud offering with a FedRAMP JAB is also certified as a Small Business; does the Government expect the other Large Business FedRAMP certified commercial cloud service providers to create a new/custom “DOD and Mission Partners Only” operations model, business model and pricing in order to achieve an MQR of 25% Small Business?

How does the offeror indicate which line items in the J-3 attachment are being offered by small businesses so the Government can make a determination?

92 L.8.4 L.8.4 states, “For purposes of this acquisition, the offeror’s proposed pricing will be different than the total evaluated price. The basis for Total Evaluated Price of the contract will not be released prior to contract award.”

Question: Will the government please explain the difference between proposed price and total evaluated price?

Will be answered at a future date.

93 PWS Section 5, P.6 Section 5 states in part:

“The inside network perimeter will be the Internal Cloud Access Point (ICAP). The network services provided by DISA will be the wide area transport.”

Please reference the script loaded to FBO MilCloud 2.0 Industry Day Script June 2016.doc and the DECC

Question: Can the government please provide the number and speed of the ports that will be provided/available to connect to the offeror’s on-prem solution?

94 PWS Section 5, P.6 “The inside network perimeter will be the Internal Cloud Access Point (ICAP). The network services provided by DISA will be the wide area transport.

The DISA Cloud Connection Process Guide, P.10 lists several services offered by a CAP.

The DISA Cloud Connection Process Guide P.10, Note 14 states “DoD Cloud Computing SRG:

CSP Infrastructure (dedicated to DoD) located inside the B/C/P/S “fence-line” (i.e., on-premises) connects via an Internal CAP (ICAP). The architecture of ICAPs may vary and may leverage existing capabilities such as the IA Stack protecting a DoD Data center today or may be a Joint Regional Security Stack (JRSS). On the other hand, an ICAP may have special capabilities to support specific missions, CSP types (commercial or DoD), or cloud services.”

Question: Will the services in the Cloud Connection Process Guide be offered to the Prime for use?

No, the only service provided at the ICAP will be boundary defense.

The current CAP supports off-prem CSPs. The ICAP supports an on-prem solution and the solutions are not identical.

What services will be provided to the offeror at the ICAP?

Given the known problems with the Commercial Cloud CAP, has the Government overcome those problems with the ICAP?

95 6.1.13.5 Shared Services. Does DISA require the necessary continuous monitoring capability to provide audit reporting services to the Consumer’s…