Attachment_15_-_ITSS_Draft_RFP_Responses.pdf

Responses to Industry Questions regarding Draft RFP HDTRA1-18-R-0002

Questions have been organized by RFP section. The questions and responses below relate to

DRFP Section B.

# DRFP Reference Question Gov't Response 1 Section B – Supplies or

Services and Prices Is the offeror required to fill in section b or provide our own CLIN structure

Use Section B CLIN structure.

2 Draft_Solicitation_Rev1, Pgs. 32-33, Para. CLIN Delivery…

The Government has identified O&M, PDW, R&D and CTR funding sources. Will the Government allocate Contractor proposed costs against the various funding sources or will this be the responsibility of the Contractor?

The Government allocate Contractor costs against the various funding sources.

3 Draft Solicitation, SF 30 Section B, page 2, ITEM NO 0001 through 0013

The CLIN descriptions include designations for "O&M Funding", "PDW Funding", "R&D Funding", and CTR Funding" with a combination of CPFF and CPAF CLIN types across the 13 CLINS. It is not clear how the CLIN structure aligns to the SOO and cost tables. There are no crosswalks on how the technical requirements or pricing on the cost tables are distributed across these CLINS. Please clarify how Offerors should apportion the total costs reflected in the cost workbook to the SF33, Section B.

CLIN structure will be revised for the final RFP. The CLIN structure will align with and be clearly traceable to the DTRA IT Core Services Objectives identified in the IDIQ SOO, Section 4.

The questions and responses below relate to DRFP Section H.

# DRFP Reference Question Gov't Response

4 Draft_Solicitation_Rev1/ Section OCI b.1 (Page 41

/ 2nd paragraph):

Maintenance Objectivity, states "Nothing in this subparagraph shall preclude the Contractor from competing for follow-on contracts", is the government's intent to allow awardees (Prime and Subcontractors) of this RFP, IDIQ 1 (SBSA), to participate in IDIQ 2 (Full and Open)?

While this DRFP focuses on the single award, small business set aside requirement for Core IT Services, the overall acquisition strategy, as posted to FBO on 9 Nov, is to also solicit for a multiple award IDIQ in a full and open competition. The government is placing no restrictions on participation in the Full and Open eligibility, unless such participation would result in an organizational conflict of interest.

5 TOs 1-3 - 2.1 Mandatory Documents

Suggest including: DFARS 252.204- 7012(b)(2)(ii)(A): The contractor shall implement NIST SP 800-171, Protecting Controlled Unclassified Information (CUI) in Nonfederal Information Systems and Organizations, as soon as practical, but not later than December 31, Good suggestion, however, the more appropriate placement of this DFAR requirement will be within the contract clauses instead of in the PWSs.

The questions and responses below relate to DRFP Section J (Attachments) which includes the

IDIQ SOO and the Task Order PWSs. These questions are organized in order of attachment number from the Draft RFP.

DRFP Reference Question Gov't Response

Questions/Answers related to DRFP Attachment 1; SOO

6 The Draft Statement of Objectives, “Background” paragraph, states….

“Various short and long-term efforts must be undertaken to continually modernize, integrate and secure these systems. Continuous IT support must meet the needs of the Agency and other internally (to include JIDO) and externally supported customers to include first responders, Combatant Commands (COCOMS) and other U.S.

Government entities.

The CIO intent is to provide seamless and integrated communications among all supported elements, for the purposes of office automation, data collaboration and knowledge management, support of exercises, experimentation and operational support across three principle security domains:

Sensitive but

Does this RFP include providing the full scope of IT services to JIDO’s facilities within the NCR and worldwide? If so, who is the incumbent(s) currently providing those services and under what contract(s)?

While JIDO requirements will not immediately fall under this contract, the scope is intended to be "agency-wide" and therefore will include JIDO systems as well. Currently the JIDO has a separate operating IT infrastructure being supported by Booze Allen Hamilton. When this existing contract is ready for renewal the support may move to this contract as there will be ceiling and scope to accommodate.

However, there will be no mandate to transition onto this vehicle.

Unclassified (SBU), Secret and Top Secret/SCI…”

7 Attachment_1_- _DTRA_Core_IT_Servi ces_SOO_Final_Draft, Pg. 2, Para. 2.4

The Scope Statement references a "Service Catalog (Attachment 2)".

The released Attachment 2 is the PWS for Task Order 1; IT Service Integration, Provision and Operations. Will the Government be releasing DTRA's IT Service Catalog in the FRFP?

Selected excerpts from the service catalog will be included in a "Supplemental Technical and Proposal Data" package being prepared for release no later than with the final RFP.

8 Attachment_1_DTRA_ Core_IT_Services_SOO _Final_Draft.docx

Will the government provide Attachment 2 “Service Catalog”?

Will this be part of the reference library?

Selected excerpts from the service catalog will be included in a "Supplemental Technical and Proposal Data" package being prepared for release no later than with the final RFP.

9 Attachment 1 - DTRA Core IT Services SOO, Section 2.4 (Page 2 / 2nd Paragraph)

The SOO references a Service Catalog in Attachment 2, can the government clarify that its the correct attachment or is TBD based on Page 6.

Selected excerpts from the service catalog will be included in a "Supplemental Technical and Proposal Data" package being prepared for release no later than with the final RFP.

The items listed as "attachments" to the SOO will be removed in the final version.

10 4.1.1.4. Core IT Services Support Specific Objective 1.4;

Technical Management:

paragraph c. ”The measure of success for this objective will be based on the consistency with which network provides consistent, reliable, secure and effective delivery of the services available in the Service Catalog (Attachment 2).”

Will the government provide the DTRA Service Catalog referenced in both the SOO and the Task Order 1 (Attachment 2)?

Selected excerpts from the service catalog will be included in a "Supplemental Technical and Proposal Data" package being prepared for release no later than with the final RFP.

11 The Draft RFP did not include the SOO-referenced Attachment 1, Supplemental Background Information (which lists current DTRA IT systems) and Attachment 2, Service Catalog (describing specific work); hence, we cannot determine if all JIDO systems are included in the scope of this RFP.

Will government provide supplemental information including lists of current "systems" and the Service Catalog?

A "Supplemental Technical and Proposal Data" package is being prepared for release no later than with the final RFP.

This package will include all the technical data provided previously during Industry Day as well as additional technical and proposal related data.

While JIDO requirements will not immediately fall under this contract, the scope is intended to be "agency-wide" and therefore will include JIDO systems as well.

12 Attachment_1_- _DTRA_Core_IT_Servi ces_SOO_Final_Draft.

docx

Will the government provide an estimate of the acquisition timeline, OCI issues with this contract, and any other relevant information that may affect offers as they form teams and develop technical approaches to satisfy this new SOO?

A "Supplemental Technical and Proposal Data" package is being prepared for release no later than with the final RFP.

Offerors are encouraged to review all previously released technical and program information.

13 Attachment_1_DTRA_ Core_IT_Services_SOO _Final_Draft.docx

The Government has provided the J6 CIO Strategic Plan and the Cloud Strategy but will the government provide the latest version of the DTRA Strategic Plan, 2016 – 2020, along with any other plan updates?

The documents provided are the most current available.

14 Attachment 1, Section 2.3, page 1 Attachment 1, Attachment list at end, page 6

As the Supplemental Background Information and the Service Catalog are required for preparation to write the proposal, will DTRA make these documents available before the final RFP is issued?

The current plan is to release this data package not later than concurrent with the release of the final RFP.

15 SOO 4.1 As selected IT capabilities, applications, and data repositories transition from DTRA owned/operated data centers and systems to cloud services, the

Attachment 6 is the QASP for the IDIQ, and includes a metric at 4.1.3 for Seamless New Service Integration Rate, which will measure this transparency.

contractor shall ensure the transition is transparent for all end users." As part of cloud migration, user engagement is critical for success. Please clarify what is meant by "transparent for all end users." How will this be measured? What are the metrics to be used?

Also in Attachment 3, the Task Order 001 PWS, Section 11,

3.7.1 includes a metric for Seamless Cloud Integration Rate, which addresses this same issue.

16 SOO 4.1.1.2 What is the current service management tool in use? Will DTRA allow the contractor to propose a different service management tool than that being used in ITSS today?

Remedy is our current ITSM.

The contractor should decide if they want to propose other approaches/solutions.

However, changing something as fundamental as the ITSM at the start of a new contract may present more risk.

17 Attachment 1: DTRA Core IT Services SOO Final Draft, Para 4.1.1.1, Objective 1.1

Service Operations and Maintenance, only NCR and Albuquerque operations are identified for infrastructure O&M.

Request clarification on which tasks are limited to NCR and Albuquerque, and which are considered Agency-wide

In the refer SOO Objective, NCR and Albuquerque are mentioned regarding distributed IT operations. The service requirements are for agency wide support.

18 Attachment 1: DTRA Core IT Services SOO Final Draft, Para 4.1.2

Does DTRA plan to duplicate security services provided by cloud service providers? Or only provide required capabilities for cloud security not performed by CSPs

DTRA plans to assess specific Cloud Service Providers security solutions and capabilities and will either utilize and/or develop in-house monitoring and response solutions.

19 Attachment 1: DTRA Core IT Services SOO Final Draft, Para 4.1.5

Would DTRA please clarify if there are specific IT, IA, and cloud certifications?

The contractor must be fully aware of the DoD mandated requirements, such as 8570 (and it's replacement 8140).

The contractor proposed staffing plan will need to align with the requirements of these directives in order to support this requirement. Other certifications required for specific work such as the CSSP (Computer Network Defense) are stringent and should be researched.

Questions/Answers related to DRFP Attachments 1-4; SOO & Task Orders 1-3 PWSs

20 DTRA Agency-wide Core IT Services SOO & Task Orders 1-3

Will the government provide full details of all work locations, number of staff required at each location, and personnel requirements so contractors can take into consideration risks and costs associated with the proposed solutions? Will the government also provide information regarding the number of staff that are currently located in DTRA facilities and any constraints associated with providing off site personnel?

Government will provide predominant locations and historical hours or FTE - The contractor should be aware that temporary travel could be world-wide (see DTRA location at DTRA.mil).

21 Attachments 2, 3, and

If not included in the Supplemental Background and the Service Catalog, to enable vendors to provide a comprehensive mission capability approach, would the Government provide additional information/metrics on the current contract to be included in the Bidder's Library:

• Operational reports to include all operational, program management, and other metrics currently being measured in the I2TS environment;

• Metrics and workload data (for BoE, staffing development)

• Help desk call volume and average time to close, according to complexity of ticket

• Complete SW/HW inventory

• Technical roadmap for systems upgrades

• Lessons learned repository

The government will include in the "Supplemental Technical and Proposal Data" package a list of labor categories currently in use, and a summary of labor hours for a specific period of time and aligned with the three task orders included in the RFP.

This package will include all the technical data provided previously during Industry Day.

Offerors are encouraged to review all previously released technical and program information.

22 Attachments 2, 3, and 4; Section 2.1 for each, page 2 for each

Referenced paragraphs direct the contractor to comply with the Mandatory Documents listed. Is it DTRA's intent to provide the documents before release of the RFP or with release of the final

RFP?

The Applicable Documents section of each PWS will be revised and included in the final RFP release.

Questions/Answers related to DRFP Attachment 2; Task Order 1 PWS

23 Attachment 2 To adequately understand DTRA expectations, please provide the historic FTE support levels necessary to support this task order. Also please indicate if you expect the level to increase or decrease over time based on the DTRA J6 CIO Information Operations Strategic Plan

Historical labor hours related to the three task orders will be included in a "Supplemental Technical and Proposal Data" package being prepared for release no later than with the final RFP.

The IT environment at DTRA is dynamic, which is why this effort remains cost reimbursement based. The cloud migration could drive some of the core IT support requirements down, but an expanding mission could counter that with increases.

24 Attachment 2 Please identify the software COTS/GOTS tools used to operate and monitor the environment.

A "Supplemental Technical and Proposal Data" package being prepared for release no later than with the final RFP. This package will include all the technical data provided previously during Industry Day.

Offerors are encouraged to review all previously released technical and program information.

25 Attachment 2-DTRA ITSS PWS for Task Order 1, 2.1 Mandatory Documents

Is it the government’s intent to publish 2.1.1 DoD IT Security Regulations and 2.1.2 DITRA Security Regulations

The final RFP will include a specific list of applicable documents in the PWS.

26 Attachment 2 PWS for Task Order 1 – Section #3.2 -- Performance Requirement #2, IT Operations and

Are there physical and virtual servers?

The DTRA infrastructure includes both physical and virtual services but currently DTRA is predominately virtual.

Systems Administration, page 2-3, para. 1

27 Attachment 2 PWS for Task Order 1 – Section #3.2

What type of monitoring tools are being used for infrastructure (servers) optimization and performance monitoring? e.g. Solar Winds etc?

A "Supplemental Technical and Proposal Data" package is being prepared for release no later than with the final RFP.

This package will include all the technical data provided previously during Industry Day as well as additional technical and proposal related data.

28 Attachment 2 PWS for Task Order 1 – Section #3.2 -- Performance Requirement #2, IT Operations and Systems Administration, page 2-3, para. 1

What type of monitoring tools are being used for infrastructure (servers) optimization and performance monitoring? e.g. Solar Winds etc?

A "Supplemental Technical and Proposal Data" package is being prepared for release no later than with the final RFP.

This package will include all the technical data provided previously during Industry Day as well as additional technical and proposal related data.

29 Attachment 2 PWS for Task Order 1 – Section #3.2 -- Performance Requirement #2, IT Operations and Systems Administration, page 2-3, para. 1

What kind of systems/technology is in place for the current infrastructure, e.g. VMware, Microsoft virtual server, etc?

A "Supplemental Technical and Proposal Data" package is being prepared for release no later than with the final RFP.

This package will include all the technical data provided previously during Industry Day as well as additional technical and proposal related data.

30 Attachment 2 PWS for Task Order 1 – Section #3.2 -- Performance Requirement #2, IT Operations and Systems Administration, page 2-3, para. 1

What operating systems are being used for systems e.g.

windows/linux?

A "Supplemental Technical and Proposal Data" package is being prepared for release no later than with the final RFP.

This package will include all the technical data provided previously during Industry Day as well as additional technical and proposal related data.

31 Attachment 2 PWS for Task Order 1 – Section #3.2 -- Performance Requirement #2, IT Operations and Systems Administration, page 2-3, para. 1

What version of operating systems are being used to maintain the virtual and/or physical infrastructure (servers)?

A "Supplemental Technical and Proposal Data" package is being prepared for release no later than with the final RFP.

This package will include all the technical data provided previously during Industry Day as well as additional technical and proposal related data.

32 Attachment 2-DTRA ITSS PWS for Task Order 1, 3.2 IT Operations and Systems Administration

What is the current Architecture for IT Operations?

A "Supplemental Technical and Proposal Data" package is being prepared for release no later than with the final RFP.

This package will include all the technical data provided previously during Industry Day as well as additional technical and proposal related data.

33 Attachment 2, Section 3.2

Please provide a description of all servers, routers, circuits, firewalls, network security equipment, and network monitoring equipment that are monitored and operated.

Please provide quantities of the items under management in each networking environment

A "Supplemental Technical and Proposal Data" package is being prepared for release no later than with the final RFP.

This package will include all the technical data provided previously during Industry Day as well as additional technical and proposal related data.

34 Attachment 2-DTRA ITSS PWS for Task Order 1, 3.2 IT Operations and Systems Administration

What tools are currently utilized to support the NOSC?

A "Supplemental Technical and Proposal Data" package is being prepared for release no later than with the final RFP.

This package will include all the technical data provided previously during Industry Day as well as additional technical and proposal related data.

35 Attachment 2-DTRA ITSS PWS for Task Order 1, 3.2 IT Operations and Systems Administration

Are the tools currently utilized to support the NOSC, the same tools used to monitor all three networks?

A "Supplemental Technical and Proposal Data" package is being prepared for release no later than with the final RFP.

This package will include all the technical data provided previously during Industry Day as well as additional technical and proposal related data.

36 Attachment 2, Section 3.2, Section 6

In section 3.2, the government states "Service Desk requests after normal business hours (0600 – 1800) are currently covered by the NOSC." In section 6, the government states that section 3.2 and 3.3 are 24x7x365 requirements. Will the government clarify the requirement?

The Service Desk (3.4) and IT Ops / Systems Admin (3.2) have 24 hour support requirements since the DTRA workforce spans many time zones in support of operational mission objectives beyond "normal business hours". The current solution has been to consolidate these 24 hour requirements within the NOSC for support beyond the established "normal business hours". While the government hasn't mandated this specific solution, we have offered this as a working model for your consideration.

37 Attachment 2 PWS for Task Order 1 – Section #3.2 -- Performance Requirement #2, IT Operations and Systems Administration, page 2-3, para. 1

What kind of security COTS products are being used to maintain the infrastructure and/or systems?

Refer back to Industry Day presentation; posted on FBO.

38 Attachment 2-DTRA ITSS PWS for Task Order 1, 3.2.3 IT Operations and Systems Administration Security

For urgent patches, contractors are required to implement within two

(2) days, with other-than-urgent required within seven (7) days. Is the designation of ‘urgent’ determined at the enterprise level, at the local level, by geography or by some other factors?

An urgency requirement is validated by the government and may originate at any level.

39 Attachment 2: DTRA ITSS PWS for Task Order 1 - Service Integration Provision and Operations Final Draft, Para 3.3

Does DTRA intend for the contractor to actually procure items, or will all procurements go through the DTRA contracting and acquisition process?

Contractor will procure incidental materiel as Contractor Acquired Property

(CAP).

40 Attachment 2 PWS for Task Order 1 – Section #3.3 -- Performance Requirement #3, Incidental Hardware/Software

Are there any secure mobile workstations?

No.

Procurement, page 3, para. 2

41 Attachment 2 PWS for Task Order 1 – Section #3.3 -- Performance Requirement #3, Incidental Hardware/Software Procurement, page 3, para. 2

What brand of hardware is used for physical hardware (servers, racks, switches) etc?

The Supplemental Technical and Proposal Data Package will include information regarding hardware types. This package will be posted on the FBO when available no later than the release date of the final RFP.

See information previously provided during the July Industry Day. Predominately the hardware is Dell, Cisco and F5.

42 Draft RFP, PWS for Task Order 1, paragraph 3.4 Performance Requirement for Service Desk describes overall requirements for the Service Desk.

Is the government currently executing these requirements with on-site personnel at DTRA? Will the government accept alternative approaches and if yes, what constraints will be required for off-site services?

These services are currently on-site. However it is the contractor’s decision on how best to support.

43 Attachment 2, Section 3.4, last paragraph)

Will the government provide more details on the EIS system?

A "Supplemental Technical and Proposal Data" package is being prepared for release no later than with the final RFP.

This package will include all the technical data provided previously during Industry Day.

Offerors are encouraged to review all previously released technical and program information. The data package will also include information about the DTRA EIS.

44 Attachment 2, Section 3.4

To adequately understand the level of effort required, please provide the average and peak monthly number of incidents responded to by the DTRA service desk team for this requirement.

A "Supplemental Technical and Proposal Data" package being prepared for release no later than with the final RFP. This package will include all the technical data provided previously during Industry Day.

Offerors are encouraged to review all previously released technical and program information.

45 Attachment 2-DTRA ITSS PWS for Task Order 1, 3.4 Service Desk

What tools are currently used to support the Service Desk?

A "Supplemental Technical and Proposal Data" package is being prepared for release no later than with the final RFP.

This package will include all the technical data provided previously during Industry Day.

Offerors are encouraged to review all previously released technical and program information.

46 Attachment 2-DTRA ITSS PWS for Task Order 1, 3.4 Service Desk

How many users are on Windows platforms and how many are MAC users?

A "Supplemental Technical and Proposal Data" package is being prepared for release no later than with the final RFP.

This package will include all the technical data provided previously during Industry Day.

Offerors are encouraged to review all previously released technical and program information.

47 Attachment 2 PWS for Task Order 1 – Section #3.4 -- Performance Requirement #4, Service Desk, page 3, para. 1

What application is used to manage the service desk trouble ticketing system?

Refer back to Industry Day presentation; posted on FBO.

48 Attachment 2 PWS for Task Order 1 – Section #3.4 -- Performance Requirement #4, Service Desk, page 3, para. 1

What software application is being used to manage the service desk trouble ticketing system? e.g.

Remedy, HP, Atlassain?

Refer back to Industry Day presentation; posted on FBO.

49 Attachment 2 PWS for Task Order 1 – Section #3.4 -- Performance Requirement #4, Service Desk, page 3, para. 1

How many trouble tickets are handled on a weekly/monthly basis?

Refer back to Industry Day presentation; posted on FBO.

50 Attachment 2 PWS for Task Order 1 – Section #3.4 -- Performance Requirement #4, Service Desk, page 3, para. 1

Are there SLA requirements for the service desk?

The PWS includes a Performance Requirements Summary and there is a Draft QASP included in the DRFP based on this PRS.

51 Attachment 2, Section 3.4, last paragraph)

Will the government provide more details on the EIS system?

A "Supplemental Technical and Proposal Data" package is being prepared for release no later than with the final RFP.

This package will include all the technical data provided previously during Industry Day.

Offerors are encouraged to review all previously released technical and program information. The data package will also include information about the DTRA EIS.

52 Attachment 2-DTRA ITSS PWS for Task Order 1, 3.4 Service Desk

How many tickets from each network are there, on average, over a one year period?

A "Supplemental Technical and Proposal Data" package is being prepared for release no later than with the final RFP.

This package will include all the technical data provided previously during Industry Day.

Offerors are encouraged to review all previously released technical and program information.

53 Attachment 2, Section 3.4.2

How does the contractor account for external causes of work stoppage, for example a communications circuit failure, in the calculation of MTTR?

Currently accounted for on an exception bases using planned and unplanned with caveats.

54 Attachment 2, Section 3.4.3

Will the DTRA ITSS contractor be required to survey potential competitor contractor organizations, supporting DTRA, and factor the potential competitor responses into our customer satisfaction score?

Yes, The service provider will service the entire DTRA customer/user base, which includes contractor support team members. All service provision is agnostic. An end-user is an end-user.

55 Attachment 2, Section 3.4.2

How does the contractor account for external causes of work stoppage, for example a communications circuit failure, in the calculation of MTTR?

Currently accounted for on an exception bases. Alternative approaches can be discussed with winning service provider.

56 Attachment 2, Section 3.4.3

Will the DTRA ITSS contractor be required to survey potential competitor contractor organizations, supporting DTRA, and factor the potential competitor responses into our customer satisfaction score?

Yes, The service provider will service the entire DTRA customer/user base, which includes contractor support team members.

57 Attachment 2: DTRA ITSS PWS for Task Order 1 - Service Integration Provision and Operations Final Draft, Para 3.5

Does the requirement to develop and maintain lifecycle management plans for hardware and software managed by the I2TS include cloud-based applications managed by outside organizations, for example

DISA?

Any effective lifecycle management plan would need to address all applications, systems, and services provided, regardless of the source of the service.

58 Attachment 2 PWS for Task Order 1 – Section #3.5 Performance Requirement #5, Applications and Asset Management, page 4, para. 1.

What is the quantity of hardware assets and application licenses?

Refer back to Industry Day presentation; posted on FBO.

59 Attachment 2-DTRA ITSS PWS for Task Order 1, 3.5.1 Applications and Asset Management Consistency and Accuracy

The accuracy rate is based on periodic verification checks of software licenses. Are these checks conducted by the contractor internally or by DTRA?

As stated in the "Source and Frequency of Data" column;

"This metric will be based on government random inspection of asset management records."

60 Attachment 2 PWS for Task Order 1 – Section #3.7 Performance Requirement #7, Cloud Management

What cloud-based technology is currently being used? e.g.

Microsoft Azure/Amazon AWS or IBM cloud?

Refer back to Industry Day presentation; posted on FBO.

Support, page 4, para.

61 TO 1 - 3.7

Performance Req #7, Cloud Management Support

As cloud solutions are approved, these solutions must be fully integrated in the DTRA IT Enterprise and included in the management and oversight functions of the overall Service Operations umbrella. The performance requirement does not stipulate who is actually migrating services to the cloud. Is this responsibility within the scope of the CMO or this contract?

There will be close coordination between the CMO, the Cloud solution provider, and the IT Core Services provider to ensure that Cloud solutions (like non-cloud based solutions) are properly integrated into the DTRA IT environment and, once deployed, are fully supported.

As the cloud architecture evolves, migration of services will be dependent on the individual service and complexity. Although the contractor must be aware that there is eventual movement into the cloud, current operations are based on Agency controlled and operated.

62 Attachment 2-DTRA ITSS PWS for Task Order 1, 3.7.1 Cloud Management Support and New Service Transition Analysis;

and 3.8.1 Seamless Integration

The intent of the task is to ‘exclude… unfamiliarity with new or replacement service’ – the deliverables summary table (Section 4.1) indicates that informational and training materials specific to PWS Section

3.10. Should these deliverables also

apply to 3.7 and 3.8?

The question's reference is to a "NOTE" in the Section 11 Performance Requirements Summary, section of the PWS.

This "NOTE" is clarifying the performance measure to be used in calculating the "seamless cloud integration rate" metric.

The note is not intended to further define "the intent of the "task" related to this metric (in PWS 3.7);

The deliverable for PWS 3.8 (New Service Transition Analysis) is CDRL A003, and there is no specific CDRL associated with PWS 3.7.

63 Attachment 2: DTRA ITSS PWS for Task Order 1 - Service Integration Provision and Operations Final Draft, Para 3.9

Is systems functional and security testing performed prior to any formal DTRA acceptance, in lieu of, or following? Will documented performance requirements be provided to plan and support such testing? Or will this contract be responsible for developing such performance requirements prior to conducting testing?

For the most part this is an operations and maintenance of existing or provisioned systems/services. However, in any case the government will provide requirements.

64 Attachment 2: DTRA ITSS PWS for Task Order 1 - Service Integration Provision and Operations Final Draft, Para 3.8

What is the scope of responsibility on this contract for Service Design projects? Are they part of this contract, or created by other contractors and/or DTRA groups?

No.

65 Attachment 2: DTRA ITSS PWS for Task Order 1 - Service Integration Provision and Operations Final Draft, Para 3.9

Is systems functional and security testing performed prior to any formal DTRA acceptance, in lieu of, or following? Will documented performance requirements be provided to plan and support such testing? Or will this contract be responsible for developing such performance requirements prior to conducting testing?

This requirement is written to cover a range of possibilities.

Ideally, the new capability developer will conduct all necessary functional, integration, and security testing prior to proposing the new capability for introduction into the DTRA environment. In this ideal scenario the responsibility in para 3.9 become verification only based on evidence of testing performed. However, when development is done outside the "normal" channels, para 3.9 includes the scope to plan, perform, and report on all necessary functional, integration and security testing prior to introducing the new capability into the DTRA environment.

66 Attachment 2-DTRA ITSS PWS for Task Order 1, para 3.10 Transition and Change Management

What configuration management tools are currently used in DTRA?

Remedy.

67 Attachment 2: DTRA

Order 1 - Service Integration Provision and Operations Final Draft, Para 3.13

Will the government provide a copy of the incumbent contractor's "transition out" plan available to ensure our transition plan integrates?

No.

68 TO 1 page 7 Para 5, Period of Performance

Page 7 states the period of performance is “one base year-with four one-year options” Is this correct?

Yes.

69 TO 1 Pgs 11-18 (Section 11, Performance Requirements Summary)

Column 1 of the PRS does not accurately map to the Performance Work Statement. Can you please provide clarification?

The first two digits refer to a PWS paragraph, the third digit is the number of performance standards associated with the performance requirement. For example; 3.1.1 is the first performance standard associated with the PWS paragraph 3.1.

Questions/Answers related to DRFP Attachment 3; Task Order 2

70 Attachment 3 To adequately understand DTRA expectations, please provide the historic FTE support levels necessary to support this task order. Also please indicate if you expect the level to increase or decrease over time based on the DTRA J6 CIO Information Operations Strategic Plan.

Historical labor hours related to the three task orders will be included in a "Supplemental Technical and Proposal Data" package being prepared for release no later than with the final RFP.

The IT environment at DTRA is dynamic, which is why this effort remains cost reimbursement based. The cloud migration could drive some of the core IT support requirements down, but an expanding mission could counter that with increases.

71 Attachment 3-DTRA ITSS PWS for Task Order 2, Cybersecurity

Will the government have a requirement (and provide the automated tools) for penetration testing that analyze and identify real world threats and risks that may lead to a cyber security compromise?

The government has Blue/Red team initiatives. Tools to support these initiatives will be acquired, at government expense, when initiatives are exercised.

72 Attachment 3 - PWS for TO2 (Cybersecurity Support Services);

Section = Overall document; all pages

Can DTRA confirm Cybersecurity requirements include adherence to Intelligence Community (IC) Directives (ICD) for TS (and higher) enclaves/data in addition to DoD and DTRA regulations for collateral security domains.

DTRA Cybersecurity efforts include DTRA Sensitive Compartmented Information Facilities (SCIFs), and Special Access Programs.

73 Attachment 3 PWS TO2, Section 1.3 (pg 1- 2)

Re TO2, Section 1.3: How big is the current DTRA/CIO security infrastructure that needs to undergo modernization? Does the governing agency expect to grow the security infrastructure to a size larger than the previous setup?

There are a variety of tools within the DTRA cybersecurity "stack" and tools suites continually undergo upgrades, lifecycle replacement and transitions. With the exception of DTRA's ongoing transition to the DoD Joint Regional Security Stacks (JRSS), there are no "major" modernization projects current planned.

74 Attachment 3, Section 3.2

Will the government plan to provide the historical numbers of capabilities that required IA Policy and Planning services support so offerors are able to provide an accurate LOE?

A "Supplemental Technical and Proposal Data" package mentioned previously will include appropriate historical data to provide needed scaling and estimating. The package will also include information on current FTE / labor hour summaries to further establish the scale.

75 Attachment 3, Section 3.2

How may cross domain transfers are performed per month? Please provide the historical average and expected peak number per month

DTRA uses a number of Enterprise Cross Domain Services, from a number of Enterprise service providers, to transfer files, send emails, and perform Web browsing. Most of these can be used by any DTRA user and we have no way of tracking specific usage.

76 Attachment_3_- _DTRA_ITSS_PWS_for _Task_Order_2_- _Cybersecurity_Suppo rt_Services_Final_Draf t.docx Section 3.2

Can the government clarified the missing text “xxxxx”? What are our current Cyber Security analysts performance metrics

Yes, the government was using this draft RFP to seek inputs from industry for meaningful metrics. These metrics will be included in the final RFP.

77 Attachment 3 - PWS

Support Services);

Section = 3.2; page 3

Can DTRA confirm no OCI exists with "... additional tasks to include Authorizing Official Designated Representative (AODR) support..."

which is often a Government or SETA function.

The work scope as defined in the PWS is in direct support of the government SISO and AODR. The intent is for the contractor to provide risk analysis / assessments, and recommendations to the government decision maker for consideration and approval. As such, there doesn't appear to be any inherent OCI concerns.

78 Attachment 3, Section 3.3

Will the government plan to provide the historical numbers of capabilities that required A&A services support so offerors are able to provide an accurate LOE?

A "Supplemental Technical and Proposal Data" package mentioned previously will include appropriate historical data to provide needed scaling and estimating. The package will also include information on current FTE / labor hour summaries to further establish the scale.

79 Attachment 3, Section 3.4

Does DTRA provide a Governance, Risk and Compliance Tool (GRC) to support management of this requirement? If so which tool is used?

Historical labor hours related to the three task orders will be included in a "Supplemental Technical and Proposal Data" package being prepared for release no later than with the final RFP.

The IT environment at DTRA is dynamic, which is why this effort remains cost reimbursement based. The cloud migration could drive some of the core IT support requirements down, but an expanding mission could counter that with increases.

80 Attachment 3, Section 3.4

What tools are used to support continuous monitoring?

Historical labor hours related to the three task orders will be included in a "Supplemental Technical and Proposal Data" package being prepared for release no later than with the final RFP.

The IT environment at DTRA is dynamic, which is why this effort remains cost reimbursement based. The cloud migration could drive some of the core IT support requirements down, but an expanding mission could counter that with increases.

81 Attachment 3-DTRA ITSS PWS for Task Order 2, 3.4 Security, Test & Evaluation / Continuous Monitoring

Will you provide any additional details that would help the contractor to determine the level of effort required to complete the transition?

Historical labor hours related to the three task orders will be included in a "Supplemental Technical and Proposal Data" package being prepared for release no later than with the final RFP.

82 Attachment 3 PWS TO2, Section 3.4 (pg 3)

Re TO2, Section 3.4: Will awardee be taking the existing systems and including that in the new ATO as well as implementing a new DoDI

8510.01 RMF? Who is responsible

for the development and who owns the ATO?

The ATO of any system remains with the system and is not dependent nor does it require any recertification as supporting contractors change.

All existing ATOs will remain in effect.

83 Attachment 3-DTRA ITSS PWS for Task Order 2, 3.4 Security, Test & Evaluation / Continuous Monitoring

The PWS states "this task includes the continued transition and implementation of DoDI 851001 Risk Management Framework."

Please provide details of the transition to RMF including Number of systems completed / still to be transitioned?

There are currently 29 systems that have valid ATOs and 9 that are going through the RMF process.

84 Attachment 3-DTRA ITSS PWS for Task Order 2, 3.4 Security, Test & Evaluation / Continuous Monitoring

What is the number of systems that have achieved ATO?

There are currently 29 systems that have valid ATOs and 9 that are going through the RMF process.

85 Attachment 3-DTRA

Order 2, 3.4 Security, Test & Evaluation / Continuous Monitoring

What is the number of systems scheduled to be audited and audit schedule?

There are currently 29 systems that have valid ATOs and 9 that are going through the RMF process.

Our goal is to obtain 100% ATO approvals NLT 31 March 2018.

86 Attachment 3 PWS TO2, Section 3.5 (pg 3)

Re TO2, Section 3.5: Does Government want a custom dashboard to view security levels of different multiple networks or are commercial off the shelf products allowable?

The government does not intend to mandate a specific solution. The requirement is defined in the PWS, the offeror will propose a solution for evaluation.

87 Attachment 3 - PWS for TO2 (Cybersecurity Support Services);

Section = 3.5; Page 3

Will DTRA clarify the requirement to "provide multi-network access solutions that allow analysts to view multiple networks of different security levels from a secure workstation."? Our understanding is the requirement would be to 1.

Assist in evaluation of cross-domain solutions that are on the Unified Cross Domain Management Office (UCDMO) approved CDS list for collateral / TS use; 2. Assist in cybersecurity engineering and CDS authorization management of new solutions through the CDTAB, DSAWG, and CDES review processes; and 3. Implementation and operational cybersecurity sustainment of DTRA point-to-point CDS capabilities.

The implementing tasks referred to in this question are within the intended scope of PWS paragraph 3.5.

88 Attachment 3 PWS TO2, Section 3.7 (pg 4)

Re TO2, Section 3.7, "support of the DTRA I2TS IOC Cybersecurity department:" is the awardee permitted to recommend new tools for monitoring the network?

The government will entertain recommendations for new tools based on the cost verse benefits. If an offeror's solution is dependent on a specific new tool suite, the costs of implementing the new suite will be considered as part of the total proposed cost for any cost evaluations during the selection process.

89 Attachment 3 - PWS

Support Services);

Section = 3.7; page 4

Can DTRA clarify the number of CSSP subscribers which receive Tier II CSSP service from DTRA?

Currently DTRA's CSSP provides coverage for DTRA, JIDO, and an average of five (5) supporting Cleared Defense Contractors (CDCs).

90 Attachment 3 - PWS for TO2 (Cybersecurity Support Services);

Section = 3.7; page 4

Will DTRA clarify the DoDD 8140.01 & DoD 8570.01-m certification requirements for CSSP personnel associated with the Protect, Detect, Response, and Sustain teams?

The CSSP / CNDSP certifications for the respective teams are clearly stated within the DoD Directives.

91 Attachment 3 PWS TO2, Section 3.7 (pg 4)

Re TO2, Section 3.7: How many FTEs does the agency recommend, at a minimum, for each process team (i.e., Protect Team, Detect Team, Response Team, Sustain Team) in light of the 7x24x365 nature of the support?

The government will include, in the Supplemental Technical and Proposal Data Package, a summary of labor hours and labor categories currently supporting the cyber function.

92 Attachment 3, Section 3.7.3

How many FTE’s have historically provided incident response support?

Do all contractors supporting incident response require clearance at the TS/SCI level?

Historical labor hours related to the three task orders will be included in a "Supplemental Technical and Proposal Data" package being prepared for release no later than with the final RFP.

The IT environment at DTRA is dynamic, which is why this effort remains cost reimbursement based. The cloud migration could drive some of the core IT support requirements down, but an expanding mission could counter that with increases.

93 Attachment 3, Section 3.9

Confirm that the 24x7 support required is on -call 24x7 support, and that DTRA is not expecting a continuously manned 24x7x365 Security Operations Watch

The Cyber PWS reference is below:

3.9 Performance Requirement

#9, Communication Security (COMSEC). The contractor shall provide the full range of network engineering, administration and Communications Security (COMSEC) management and administration support for the Agency network domains and architectures from the Unclassified level up through Top Secret SCI, to include 24x7 support as defined by the Agency. Performance measures for this requirement are defined in applicable DoD Instructions/Regulations.

94 Attachment 3 PWS TO2, Section 3.10 (pg 5)

Re TO2, Section 3.10: What restrictions are in place regarding the contractor in replacing network monitoring sensors/equipment to ensure continuous and uninterrupted CND operations?

Restrictions vary depending on the classification and location of the network in which the sensor is located. In situations where a restriction may apply, designated government staff will provide the required support function.

95 TO 2 page 7 Para 5, Period of Performance

Page 7 states the period of performance is “one base year-with four one-year options” Is this correct?

Yes.

96 Attachment 3 - PWS for TO2 (Cybersecurity Support Services);

Section = 8; page 8

Will DTRA clarify which requirements may necessitate delineation of "selected individuals may require Top Secret or higher clearances” that also accounts for "75% of staff will require TS/SCI clearance within 6 months of contract award."?

The government will include, in the Supplemental Technical and Proposal Data Package, the current mix of clearances within the Cyber support team as a point of reference for proposal planning.

97 Attachment_3_- _DTRA_ITSS_PWS_for _Task_Order_2_- _Cybersecurity_Suppo rt_Services_Final_Draf t.docx

Can your Cybersecurity SMEs provides some metrics?.

Yes, the government was using this draft RFP to seek inputs from industry for meaningful metrics. These metrics will be included in the final RFP.

98 Attachment 3 - PWS for TO2 (Cybersecurity Support Services);

Section 11; page 10,11

Will DTRA consider Key and Non- Key personnel average availability metrics be assessed across a quarterly, semi-annual, or annual basis vice monthly given monthly data is prone to an erroneous negative skew based on planned training or vacation?

Will revisit these metrics to appropriately account for planned training and vacations.

99 TO 2 Pgs 10 -11 Section 11, Performance Requirements Summary

Column 1 of the PRS does not accurately map to the Performance Work Statement. Can you please provide clarification?

The first two digits refer to a PWS paragraph, the third digit is the number of performance standards associated with the performance requirement. For example; 3.1.1 is the first performance standard associated with the PWS paragraph 3.1.

100 Attachment_3_- _DTRA_ITSS_PWS_for _Task_Order_2_- _Cybersecurity_Suppo rt_Services_Final_Draf t.docx, 11.

Performance Requirements Summary (PRS) and paragraphs 3.5.; 3.2.;

and 3.6.; “The contractor shall develop, implement, and report security monitoring and analysts quality and performance standards.” and “Performance measures for this requirement are defined in the PRS below and focus on

xxx. (Seeking

Does the government expect these measures be established in the contractor’s final implementation plans?

The government was seeking inputs from industry regarding meaningful performance metrics in this area. After review of all inputs, these performance measures will be finalized and published in the final RFP.

contractor input for meaningful metrics in this area)”

Questions/Answers related to DRFP Attachment 4; Task Order 3

101 Attachment 4, Section 3.2

What tools are used to determine if any new security risks or vulnerabilities exist when new or modified IT systems or capabilities are introduced into the DTRA IT infrastructure?

Historical labor hours related to the three task orders will be included in a "Supplemental Technical and Proposal Data" package being prepared for release no later than with the final RFP.

102 Attachment 4, Section 3.3

Will the government plan to provide the historical numbers of capabilities that required integration services support so offerors are able to provide an accurate LOE?

A "Supplemental Technical and Proposal Data" package mentioned previously will include appropriate historical data to provide needed scaling and estimating. The package will also include information on current FTE / labor hour summaries to further establish the scale.

103 Attachment 4, Section 3.4

Will the government plan to provide the historical numbers of capabilities that required transition services support so offerors are able to provide an accurate LOE?

A "Supplemental Technical and Proposal Data" package mentioned previously will include appropriate historical data to provide needed scaling and estimating. The package will also include information on current FTE / labor hour summaries to further establish the scale.

104 Attachment 4, Section 3.5

For the internal unclassified and R&D Test environments (as well as all environments), will the government provide a summary of the hardware, software, network requirements, and number of custom applications for the offerors to provide a correct LOE?

A "Supplemental Technical and Proposal Data" package is being prepared for release no later than with the final RFP.

This package will include all the technical data provided previously during Industry Day.

Offerors are encouraged to review all previously released technical and program information. The data package will also include additional descriptive and technical information regarding the DITEC environment.

105 Attachment 4 To adequately…