Q_and_A_final.pdf

1. The FedBizOpps listing states: “Award will be made to the offeror who presents the

Lowest Price Technically Acceptable (LPTA) offer to the Government as evaluated IAW the

RFQ evaluation methods.”; however, there were no evaluation criteria included in the RFQ document. Will you be providing offerors with the evaluation criteria referenced in the FBO listing?

A1. The evaluation will be conducted IAW FAR part 12.

2. In addition, neither the FBO listing nor the RFQ document provide instructions to offerors regarding proposal format, structure, page limits, past performance submissions, or any other kind of guidance related to the proposal. Will you be providing any instructions to offerors?

A2. FAR 52.212-1 Instructions to Offerors -- Commercial Items. Is included in the RFQ.

3. What is the basis for the travel funding of $42,000 for CLIN0005, and $33,000 for CLIN

1005?

A3. These amounts are derived from Government estimates.

4. Re: Section 12.2.1, the Solicitation states “The following type of position(s) require(s) a final Secret security clearance and eligibility when performance starts.”; however, there are no positions listed. Can you clarify the clearance requirement?

A4. The personnel working directly on this contract performing the deliverables need to have a final Secret security clearance.

5. Would an Interim or Inactive Secret clearance be acceptable if there is no disqualifying information? Note that Section 12.3.2 allows for Interim Secret IT-I access following review by the DISA Personnel Security Office—does this apply to the broader clearance requirement?

A5. An Interim or Inactive Secret clearance is not acceptable.

Task 1: Requirements Gathering

6. How many sites outside of DC Region will we be required to visit, and for how long?

A6. TBD as the work progresses. Possibly multiple trips to Boyers, PA and to Seaside, CA.

7. How many interviews are to be conducted within each of the stakeholder organizations?

At what level of the stakeholder organizations are the interviews to be conducted?

A7. TBD as needed. Up to the SES level with Secret information being discussed.

8. Is there currently a tool / system in place at DISA that is to be utilized for creating the value stream map?

A8. No.

9. Will the contractor be required to have Agile and/or Lean Six Sigma expertise?

A9. The minimum requirements on the contractor has not been posted. Review the PWS and propose the skills the contractor will need to possess to do the work.

Task 2: Requirements Traceability Tool (RTT)

10. Does DISA have a preferred RTT tool in mind, and if so, which tool are you considering?

A10. No preferred tool. We will review proposals for RTT tools.

11. As the product owners will the stakeholder organizations per the RFP, how many systems

/ networks will the RTT be connected to?

A11. For the basis of estimate, assume two networks – DISA’s network and NBIB’s network.

12. How many users will be using the RTT?

A12. For the basis of estimate, assume at least 12.

13. Is there existing infrastructure in place for implementation of the RTT?

A13. “infrastructure” is a broad term. In your proposal include what is needed to deploy the

RTT and cost.

Task 4: Cyber Threat Security Plan (“Plan”)

14. Does the Plan apply to the RTT system, or to the broader NBIS system?

A14. Cyber Threat Security Plan applies only to the work being done in the PWS. Not the entire

NBIS system.

15. Is the implementation / execution schedule of the Plan to be incorporated as part the Plan upon submission post award, or is the contractor required to propose a schedule and level of effort in the proposal for the implementation / execution of the Plan?

A15. The Cyber Threat Security Plan is a post-award deliverable. The draft is due 30 days after contract award for acceptance. That schedule is firm.

16. How will the contractor’s development and implementation/execution of the Plan be evaluated?

A16. It is not part of the evaluation criteria. It is a post-award deliverable.

17 Are there criteria for the structure of the Plan that would allow offerors to scope an appropriate level of effort for Plan development?

A17. Yes, please refer to section 6.4 of the PWS. The Cyber Threat Security Plan must address items a) through f).

18. What is the architecture make up of National Background Investigation Bureau?

A18. DISA does not have an organizational chart for NBIB.

19. Are they any Vulnerability/Threat tools already in place?

A19. Yes.

20. If not, does bid need to include procurement of software?

A21. No.

22. How will the tools / technologies that are part of security programs, which are implemented as part of the Cyber Threat Security plan, be connected with the product owners’ security program tools / technologies?

A22. DISA will not use Vulnerability/Threat tools on the RTT. The point of the Cyber Threat

Security Plan is for the contractor to identify how they will safeguard government information

IAW DFARS 252.204-7012. What vulnerability management, cyber threat intelligence, analytics monitoring, mitigation and response, and lessons learned action plans does the contractor currently use? For more information about handling Government data, see Section 12.7.7.

23. In what form will the product owners require a feed of any outputs produced by the RTT security program(s) implemented (i.e., output from vulnerability management program)?

A23. Please include the available formats in your proposal. The Government does not have a preference.

24. Is there existing infrastructure in place for implementation of the security tools / technologies?

A24. “Infrastructure” could mean a lot of things and it’s unclear what “security tools” are in question. There’s not enough information to answer this.

25. Given that the questions are not even due until Monday, April 10, 2017 at 1:00 PM CT, will you please extend the PROPOSAL DUE DATE?

A25. No.

26. Can the requirement for a Facility Security Clearance be waived?

A26. No. The work to be performed under this contract may be up to the secret level.

Specifically, contractor may be required to participate in requirement gathering meetings and activities to include topics up to secret classification. Further, to fully access Government facilities to meet with mission partners requires a Secret clearance. Therefore the company must have a final Secret Facility Clearance from the Defense Security Service Facility Clearance

Branch.

27. Will you sponsor the vendor for a Facility Security Clearance?

A27. No.

28. If the requirement is not waived, we meet this requirement with our teaming partner or subcontractor?

A28. Yes as long as the requirement is met and adhered to for the life of the contract.

29. Will you expedite the clearances?

A29. No

30. Can we bid if we do not have JPAS access ourselves?

A30. Bidding is not done through JPAS. Offerors are not prevented from bidding, but in the proposal, discuss how you will meet the requirements of the PWS.

31. Can be relatively quickly granted interim secret, could they begin work?

A31. An Interim or Inactive Secret clearance is not acceptable.

32. RFI – Was there an RFI? If, so how many responses (and specifically from WOSB)?

A32. No RFI was posted.

33. Do you have any estimate of how large an effort you consider this to be, in terms of manpower/positions or hours or requirements? (Is this type of information available from the development of the legacy system?)

A33. The legacy system did not use a similar tool and went through a different process. The program office estimated two people full time to work Tasks 1-4 in the base year. Position should be a skilled Requirements Analyst.

34. How many NBIS product owners will be involved in the process of the final requirements?

A34. The program office is not fully staffed. For basis of estimate, assume at least 12.

35. what is the level of commitment of the NBIS product owners/stakeholders?

A35. All NBIS employees within the program office have only this program to work. They are full time on NBIS.

36. Are there other contractors going to be involved with perhaps different interests or focus?

A36. Yes

37. Most of the description of the work seems to indicate that the priority is the ability to elicit and manage the requirements and work across over a dozen agencies, and THEN managing

(CM) and securing the requirements (making the tool is secondary). Does this accurately reflect your intention?

A37 The priority is to accurately document and manage the requirements. Elicit, document, and manage is the order in which the work is performed. That does not imply priority.

38. Do you have any estimate of how many requirements you are expecting?

A38. Unfortunately no. We expect it to be large enough to justify the use of a requirements tool, rather than a Traceability Matrix in Excel. The program office has captured high level capabilities of the system and completed the BPR, but these have not been derived into functional requirements for the system.

39. Is there buy-in and are there identified committed stakeholders in the organizations identified in 6.1 Task 1? Or will we be tasked to identify stakeholders and challenged to get commitment?

A39. Yes, there is commitment. The stakeholders meet monthly. You are not asked to identify stakeholders and gain their support. If a problem arises, there are two Government leads to assist.

40. How different are the requirements expected to be for the new and the is compared to the

Legacy system?

A40. Substantially. The legacy requirements are available, but we are not re-creating the old system. Generally the stakeholders identified the current process as outdated and inefficient, with a lack of automation and multiple bottlenecks in the process.

41. Are there defined business rules in the existing system and will this project require us to analyze the existing processes or systems or shall requirements be defined independent of the

Legacy system? If so will we have access to the existing system (rules, code, etc.?)

A41. There are defined business rules associated with conducting investigations, not tied to the legacy system. In other words, part of the work is to analyze Federal regulations, rules, policies, etc and make sure those requirements are captured. Analysis of the legacy system is not required.

42. Do you have a particular tool/technology in mind?

A42. No

43. Do you have expectations of using a packaged tool (like a COTS?) or is a custom tool

(whether it be something like an EXCEL or SQL based repository) an option?

A43. Offerors are welcome to propose how they will perform the work.

44. Similarly, is there any particular tool, or are there features for the tool, that you want to see? Or is the main purpose or function of the tool to accurately insecurely manage requirements and allow tracking and facilitate future development?

A44. The program office is looking for proposals on how to perform this work and the toolset needed. Our requirement is to accurately and securely manage the requirements and configuration.

45. What database technologies do you have available?

A45. In the proposal, state what you would need from the Government to make your proposal work

46. Second paragraph mentions exporting views for Government review; what kind of "VIEWS"?

A46. Considering the number of stakeholders and oversight on NBIS, we require exports from the tool that could be used for communication with leadership and external parties

47. Do you have a preference for other software for BPM?

A47. No

48. How many users do you expect to actually be entering/updating/managing requirement data in the RTT? Versus how many will require read access?

A48. Assuming this is asking about Government users, assume three will be entering/updating/managing requirement data and nine more who require read access. Assume

12.

49. Because of security concerns, how necessary is it that the RTT (the tool itself ), is accessible by a broad audience; rather than the results?

A49. It is not necessary, as long as the results can be exported for presentations.

50. Does the Agile methodology apply more to the development phase than this requirements phase/tasks?

A50. They are one and the same. Due to tight schedules, NBIS is currently prototyping while gathering requirements. The software will be developed using an agile methodology concurrently while the requirements are being captured. The task is to support this, and understand how the sprints are being conducted, lessons learned captured, and collect user feedback gained from each sprint.

51. Will any GFE and software be provided? If CFE is required will the government/DoD

Department configure the software for access to required systems and identify any other software requirements?

A51. GFE will not be provided. The Government will not configure a contractor’s system.

52. Are we responsible for independently supplying and managing all of the specific security requirements? If so, can the costs be covered in the proposal?

A52. Yes the contractor is responsible for maintaining the security of their system and

Government information. See Task 4 and 12.7.7. Offerors are supposed to bid the costs as a firm fixed price proposal. If this adds cost, then include that in your offer.

53. Are these meetings all expected to be in the Washington DC metro area?

A53. Predominately, yes.

54. Which additional locations, other than the DC Metro and Boyers, PA?

A54. Potentially a trip to Seaside, CA.

55. Do you know how often you expect stakeholders to be available for on-site meeting with the agencies in the DC metro area? Other locations?

A55. Section 9 of the PWS states the program estimates 25-50% of the time.

56. Are there expectations for renewals and any support into the development phases for

NBIS.(Which we would be COI'd on?)

A56. NBIS is in the development phase already. There is one option year on the contract.

57. Is this contract covered by the EO even if we do not have people in the listed labor categories?

A57. The agency cannot provide legal advice about which statues and regulations apply to a specific contractor. The contractor may wish to consult with legal counsel or the Department of

Labor regarding the applicability of employment laws.