Cybersecurity_Engineering_-_Industry_questions_and_answers_FINAL_RFP_19_Oct_15.pdf

Cybersecurity Engineering October 19, 2015

Subject Location Reference Question Response 1 EPW L Attachments Labor Resources Tab Could someone please verify the "Attachment L-07

RFP TEAMS Excel Pricing Workbook_Cybersecurity (9-10-2015)". If the Contract Technical Lead LCAT is selected on the Labor Resources tab, all of the Labor fields go to N/A under the "Cost Roll-up" tab.

A revised Attachment L-07 will posted to FedBizOpps in amendment 0001 to the RFP.

2 Section L L-1.5 and L-6.0 OCI Mangement Plan vs. OCI Mitigation Plan

It appears that the OCI Management Plan should reside in Volume II and then an OCI Mitigation Plan in Volume VII, Tab 4. Then there is no mention of the OCI Mitigation Plan on page 18 where I would expect a paragraph L-11.4 OCI Mitigation Plan. Are the OCI Management Plan and OCI Mitigation Plan one in the same? If so, do you want the Plan in Volume II? If not, what is the difference between an OCI Management Plan and OCI Mitigation Plan?

The OCI Mitigation Plan and the OCI Management Plan are not the same documents. The OCI Mitigation Plan must address the OCI disclosures and how the prime contractor will be in full compliance with MDA's OCI policy. The OCI Management Plan addresses internal processes and procedures for identifying, evaluating, and resolving actual or potential OCI issues and/or Personal Conflicts of Interest. Detailed information on the requirements for the OCI Mitigation Plan are found in paragraph L-1.5(e)(3). Detailed information on the requirements for the OCI Management Plan are found in paragraph L-6.0.

3 Section L L-12.1 Technical Expertise / Approach Are there any DoD Directorate 8570.01-M compliance requirement for the positions of Contract Program Manager, Technical Lead and/or Subject Matter Expert?

Per Attachment L-10 Labor Competencies, the Contract Technical Lead and Subject Matter Experts (if proposed) do require 8570.01-M certification as an IA Manager Level III.

The Contract Program Manager does not need to be 8570.01-M compliant.

4 L Attachments L-01 Past Performance Information For each PPI submitted by the Prime offeror and its subcontractors, a Client Authorization Letter must be submitted. The letter will contain the Prime contractor and contract number, etc. for the submitted PPI references. So for example, if (offeror) quotes PPI where it was a subcontractor to Company X, (offeror) will provide a Client Authorization Letter with Company X listed as the Prime with contract number, etc. Also for example, if (offeror) submitted PPI where (offerror) was the Prime, we would do a Client Authorization Letter for that submission listing ourselves as Prime. Is this correct?

Yes. Offerors should use the guidance in L-10.1.

Cybersecurity Engineering October 19, 2015

5 Sections L and M L-12.1 and M-9.1 Technical Expertise / Approach The Instruction to Offerors released with the Draft stated for Technical Tab 1: The offeror shall clearly describe their approach and understanding, including a risk evaluation, to execute all PWS requirements. The offeror shall provide a written narrative demonstrating their knowledge, comprehension, and experience with the PWS requirements. In particular, the offeror’s proposal should place emphasis on demonstrating capability for the following:

Demonstrated capability and approach for providing Ballistic Missile Defense System (BMDS) Cybersecurity Systems Engineering;

Demonstrated capability and approach for providing BMDS Cyber Threat Mitigation and Resiliency. The Instructions to Offerors released with the Final stated: The offeror shall clearly describe their approach and understanding, including a risk evaluation, to execute all PWS requirements. The offeror shall provide a written narrative demonstrating their knowledge, comprehension, and experience with the PWS requirements. In particular, the offeror’s proposal should place emphasis on demonstrating: The offeror’s approach for providing and maintaining a trained and certified workforce (Information Assurance Manager) in compliance with DoD Directive 8570.01-M. Is this change correct?

Yes.

FINAL