CCRM_Industry_Questions_-_Draft_RFP.pdf

Cybersecurity Compliance and Risk Management Response to Industry Questions July 21, 2016

RFP /

Attachment

Subject

Page #, Paragraph Reference

Question / Comment Response

RFP General It appears this procurement is for current TEAMS contract holders. Is this correct?

This procurement is open to any and all small business meeting the North American Industry Classification System (NAICS) code and Product or Service Code (PSC) requirements stated in the solicitation. TEAMS is an acquisition strategy that encompasses 31 independent contracts. This is one of the independent contracts.

This is not an ID/IQ contract, nor do offerors have to be preselected under the TEAMS acquisition strategy to bid on this work.

PWS and SSP General After reviewing the revised PWS that was released, it appears Sections L and M may no longer be fully consistent with the revised PWS. Do you plan revisions to Sections L and M as well?

Yes. The revised Sections L and M will be provided with the final

RFP.

PWS and SSP The Government released an update to Attachment J-01 CCRM PWS, which now leaves mismatched references in several other sections of the RFP.

Examples include Sections L-11.1, L-11.2, L-11.3 and M-7.1, M-7.2 and M-7.3, and Attachment L-09 Historical Information. Does the Government plan to update these and any other broken references in the Final RFP?

See response to question 2.

RFP Attachment L-

Attachment L-09 Historical Information has some "?" and "##" where there should be data regarding the quantity of specific products. Will the Government complete these fields in the Final RFP?

Yes. An updated Attachment L-09 will be provided in the final

RFP.

5 RFP Attachment L-

Attachment L-09 Historical Informaiton provides "Nominal Annual Quantity" of product deliverables. In order to assist a meaningful estimate, can the Government provide a breakout per Stakeholder in the "Nominal Annual Quantity" column of the "Bid-To Metrics and Products" table? This informaiton has been provided on most if not all other MDA TEAMS procurements.

See response to question 4.

6 Section L

Section L- 11.1, Paragraph 4.d, Lines 1-2

"Identify which CCVT, CSCA, and CA functions are applicable from PWS Figures 3.1.1, 3.2.1, and 3.3.1." Clarification: Since 3.3 is no longer CA, but is now Cyber Range OT&E, are these functions and paragraph references correct?

An updated Section L will be provided in the final RFP.

PWS Table 9.1 Table 9.1 maps the contract staffing from contract labor category to DoD 8570.01-M IA Workforce categories to CCRM PWS Figures 3.1.1, 3.2.1, 3.3.1, 3.4.1, and 3.5.1 performance objectives. The performance objectives in Table

9.1 appear to be referencing a previous version of the PWS. Please update Table based on current PWS.

An updated PWS Table 9.1 will be provided in the final RFP.

PWS 9.0.c The contractor shall submit clearance paperwork for hires upon award to immediately begin the physical and network access process. In order to get SCI billets and SAP access granted, what is the anticipated time between contract award and the start of the period of performance?

The estimated time between contract award and the start of the period of performance is approximately 15 business days.

RFP /

Attachment

Subject

Page #, Paragraph Reference

Question / Comment Response

9 PWS Section 3.3, Figure 3.3.1

Orchestrate the cybersecurity examination(s) to ensure that the implementation of security designs properly mitigate identified threats. Could the Government clarify if orchestration means performing the cybersecurity examinations (e.g., does the contractor perform the red team assessments or does it oversee an external testing agency which will perform the assessments?)

Multiple DoD organizations come together for this type of testing.

MDA arranges for a DoD Red Team to execute the test and perform the formal assessment. However, the Red Team is not the only participant. The 'orchestrate' comment is to coordinate/arrange the event and data collection following the approved plan.

General Do you have an estimated release date for the Final RFP? The final RFP is scheduled for release on or about July 31, 2016.

SSP L-2.10 Can potential Subcontractors request a copy of the bidder's Documents Library

CD?

Yes, subcontractors may request a copy. The Government will verify the company information identified in the System for Award Management website (www.sam.gov). Firms without a CAGE Code and DUNS number will not be provided a CD.

RFP Attachment L-

How many resumes are required for the three (3) labor categories identified as "key?" Are resumes required for any of the other five labor categories?

Resumes are required for the Contract Program Manager, Technical Lead (if proposed) and Subject Matter Experts (if proposed).

Resumes are not required for other labor categories.

General General The MDA home page shows the Cybersecurity and Risk Management is being done under MiDAESS Contract HQ0147-11-D-0008. Does MDA consider the HQ0147-16-R-0005 opportunity to be a "follow on" to this MiDAESS contract?

If yes, what percentage (if any) of the work described in HQ0147-16-R-0005 Performance Work Statement would be considered "new" work?

Yes, this solicitation is a follow on to MiDAESS contract HQ0147- 11-D-0008, Task Order #0009. With all the cybersecurity changes, about 60% of the updated PWS differs from the previous PWS.

RFP /

Attachment

Subject

Page #, Paragraph Reference

Question / Comment Response

PWS Table 6.1 and Table 9.0

The Draft PWS Tables 6.1 and 9.0 list, respectively, the security clearance requirements associated with each labor category and the timeline for fillnig contract positions based upon staffing "categories." These requirements are severely restrictive and argue persuasively against the liklihood that any offeror, other than an incumbent, can satisfy the clearance and staff manning timeline requirements. Specifically: a) it can take as long as 3-6 months (and an adjudicated Single Scope Background Investigation) to obtain even an Interim TOP SECRET clearance for an individual with an "active" SECRET clearance, but that is only if the contractor already has approved TS billets; b) it normally takes as long as 3-6 months (and a re-adjudicated SSBI) to obtain approval for an individual with an Interim TS to be granted Final TS; c) even with a final TS clearance in-hand, it still takes at least 30 days to obtain SCI or SAP access; and

d) a recent budget-driven decision by the Office of Personnel Management to reduce significantly the number of SSBI investigations they will conduct will only compound this problem. Based upon the foregoing, will the Government modify the security clearance requirements for this contract in such a way that a successful offeror, other than an incumbent, is afforded adequate time to obtain the necerssary clearances to fill the contract positions?

Updated security clearance requirements will be provided in the final RFP. Security clearance requirements are an integral part of this acquisition. Our market research appears to show that small business concerns can perform these cybersecurity activities (to include vulnerabilities), while satisfying security clearance requirements.

15 RFP Attachments

The Draft RFP package does not include Attachments J-11, L-11, or L-12, the latter of which is listed as a reference related to the CCRM "offer" to potential bidders to submit a request to MDA for an Organizational Conflict of Interest (OCI) determination. Will the Government please provide, at a minimum, Attachment L-12?

Please see attachments J-12 and L-05 pertaining to OCI, provided in the draft RFP. An updated attachment J-12, L-05, and L-12 will be provided in the final RFP.

16 Section L L-12.1

The offeror shall address the identification and application of the offeror and team mate capabilities in satisfying all PWS requirements. There is nothing in Section M to evaluate the Section L requirement identified. How will the Government evaluate this requirement?

Updated Sections L and M will be provided in the final RFP.

RFP /

Attachment

Subject

Page #, Paragraph Reference

Question / Comment Response

17 Section L L-12.1

The offeror shall clearly state and provide detailed rationale for its proposed technical staffing approach in meeting the requirements of the PWS, to include labor skill mix, key technical personnel, and team composition. The offeror's narrative shall substantiate its detailed skill mix, provided in the Cost/Price Volume, from both a technical capability and risk perspective. Key personnel resumes shall be submitted as provided in Attachment L-06. Key personnel for this requirement are the Technical Lead, Contract Program Manager, and Subject Matter Experts (SMEs), if so proposed. There is nothing in Section M to evaluate the Sec L requirement identified. How will the Government evaluate this requirement?

Updated Sections L and M will be provided in the final RFP.

Section L L-12.1 The offeror shall address the tracking of DoD mandated Certifications, Certificates, Security Clearances, Appointment Letters, and Acknowledgement of Responsibility agreements to contract labor positions down to individuals;

the duration that the Certifications and Certificates is good for, the continuing educational requirements to maintain the Certifications and Certificates, the continuation (no loss or down grade) of the Security Clearances, compliance with acknowledgement of responsibility agreements, quarterly manpower reporting, and etc.; to ensure each individual is meeting their position requirements (Information System Security Officers and Computer Network Defense Analyst) as of their first day filling the position and throughout their filling of the contract position; and the handling process for a DoD accuracy challenge. There is nothing in Section M to evaluate the Section L requirement identified. How will the Government evaluate this requirement?

Updated Sections L and M will be provided in the final RFP.

19 Section L Table L-1

Key personnel resumes shall be submitted as provided in Attachment L-06.

There is a reference to key personnel resumes in Subfactor 1 of the Management volume. Tab 4 of the Technical Volume is where key personnel resumes are to be provided per Table L-1. Please confirm key personnel resumes are submitted as part of the Technical Volume and there is not a requirement for resumes in the management volume.

RFP /

Attachment

Subject

Page #, Paragraph Reference

Question / Comment Response

Section L L-11.1, L- 11.2, L-11.3

Sections L-11.1, L-11.2, and L-11.3 require the whitepaper tasks to each be completed in a two month period of performance without access to Government Furnished Property. The assumption that each of the whitepaper tasks be completed in a two month period of performance without access to Government Furnished Property may limit the capability to thoroughly complete the assigned tasks. Is there any compelling reason that this assumption is stated? Would the Government consider revising this assumption to allow bidders to provide the most effective solution independent of Period of Performance?

The two month period of performance was added to support the basis of estimate associated with the scenarios. An updated Section L will be provided in the final RFP.

Section L L-11.0, Page

Section L-11.0 provides guidance for preparing the whitepapers and it references associated Basis of Approach documents. Does MDA intend for offerors to submit the Basis of Approach documents as separate documents from the whitepapers? If the answer is yes, what is the page limit for the Basis of Approach documents?

A whitepaper and its associated Basis of Approach document may not exceed the maximum page limit identified in Table L-1. For example, Tab 1 of Volume VII shall not exceed 20 pages.

Section L L-4.4 and L- 4.18

The draft RFP states "The MS Office copies of the proposal shall be an exact duplicate of the “original” paper proposal. The DVD-R’s will also be used for proposal evaluation." and table L-1 indicated the # of electronic copies is 2.

Given that the "Original" hard copy is to be submitted unbound (no three ring binder), it is our assumption that the 2 DVD-Rs may be included in a protective sleeve in any of the "Copy" three ring binder volumes? Please confirm or clarify.

The DVD-Rs can be included in the three-ring binders.

Section L L-2.10 The draft RFP states "A table identifying annual historical hours by stakeholder for the CCRM requirement is attached as Attachment L-09; also provided is the Historical Product tables for the Cybersecurity and Risk Management requirement as Attachment L-11." Attachment L-11 was not provided with the FBO release on 5/23/16. Can the government please provide this attachment for Industry to review or will it be included within the Bidder's Library Disc?

Attachment L-11 will be provided in the final RFP.

RFP /

Attachment

Subject

Page #, Paragraph Reference

Question / Comment Response

Section L L-4.2, L-4.14, and L-4.15

Section L-4.2 of the draft RFP states "The volumes identified in the table should be separately bound in three-ring, loose-leaf binders, as necessary; Volumes II, III, IV, and V may be combined (but separately tabbed) in a single binder for convenience. The contents of each proposal volume are described in the Proposal Organization paragraphs as noted in the table below." Included in table L-1 is the reference to the "original" hard copy submission.

Section L-4.14 and Section L-4.15 of the draft RFP conflict with the instructions referenced above by providing detailed instructions on the submission of the "original" volume stating "The “original” shall be formatted as follows: 1. Clearly marked as “Original”, 2. Unbound, 3. Printed on both sides, long edge (Note: pages should be printed in order to flip pages left to right)" (Section L-4.14) and "each hard copy volume of the proposal, with the exception of the original, should be separately bound in a three-ring loose-leaf binder" (Section L-4.15 ).

Please confirm offerors are to submit the "original" hard copy volume as a loose-leaf, double side printed submission. If so, will the government permit a binder clip to hold the sheets of paper together for organizational purposes?

One hard copy of each volume shall be clearly identified as "ORIGINAL." The original volume shall be formatted as follows:

1) Clearly marked as original,

2) Unbound,

3) Printed head-to-foot so that each page can be read when placed in a standard 2-hole file folder (Note: two-sided pages should be printed in order to flip pages up), and

4) Each volume shall have a cover sheet with a clearly marked volume number, "ORIGINAL", offeror's name, solicitation title, and solicitation number.

Section L-4.14 will be updated in the final RFP.

25 Section L L-4.2 and L- 4.4

Section L-4.2 states that “Volumes II, III, IV and V may be combined (but separately tabbed) in a single binder for convenience.” Section L-4.4 states that the offeror must “SUBMIT EACH VOLUME ON A SEPARATE DVD-R”. To be consistent with how the hard copies are presented, may the offeror combine Volumes II, III, IV and IV on one DVD-R with separate folders for each volume?

No, each volume must be submitted on a separate DVD-R.

Section L L-1.2, L-10.1, L-13.1

Section L-1.2 and L-10.1 state, “’Major Subcontractors’ are defined as a subcontractor whose proposed effort provides at least 10% of the proposed total price of the contract and/or, a subcontractor that performs a critical function in the performance...” Section L-13.1 states, “the term ‘Major Subcontractor’ is defined as and includes any subcontractor at any tier that contributes more than 10% of the hours as proposed by the offeror for all CLINs combined, excluding Surge CLIN.” Which definition of “Major Subcontractor” should be followed to ensure compliance with this solicitation requirements?

Paragraph L-1.2 defines "Major Subcontractor" for all instances except Cost/Price. For Cost/Price, the definition for "Major Subcontractor" appears in L-14.1.

RFP /

Attachment

Subject

Page #, Paragraph Reference

Question / Comment Response

Section L L-10.2 The draft RFP states "The offeror shall provide a consent letter for each proposed subcontractor using the format provided at Attachment L-03, Consent Letter." Should the Prime submit this for ALL proposed subcontractors, or only the major subcontractors whose past performance is being submitted in Volume

VI?

Attachment L-03 shall be submitted for any subcontractor whose past performance is being submitted in Volume VI.

Section L, Section M

Table L-1, Section L-12.1

Section L, Table L-1 specifies Resumes will be included as Tab 4 in the Technical Volume. Section L-12.1 Management Subfactor 1 mentions Key Personnel resumes. However, Section M does not mention how resumes of Key Personnel will be considered or evaluated. Will the evaluation be part of Technical or Management Volume evaluations, or some other Volume?

Additionally, what criteria will the resumes be evaluated against?

Resumes will be evaluated under the Technical factor. Updated Sections L and M will be provided in the final RFP.

RFP Proposed SBA change to 13-

CFR-125.6

The 2013 National Defense Authorization Act made changes to the limitations on Subcontracting calculations for small business set asides to include similarly situated non-small business concerns in the 50% minimum performance calculation. The proposed changes to 13-CFR-125.6 should be implemented in CY 2016. When these changes are implemented, will the Government include the changed clause in contracts not yet awarded? For contracts awarded prior to the SBA implementation, will the clause be added retroactively to small business set aside contracts?

When the Changes to Limitations on Subcontracting are promulgated in the FAR, MDA will comply with the implementing instructions.

Section L L-4.4, Table L-

Table L-1 indicates there are nine volumes contained within an acceptable proposal, however; Section L-12.0 refers to Management as Volume IX and Section L-13.0 refers to Cost/Price as Volume X. Please confirm that Table L-1 is the correct reference, if so can other references be updated?

There are nine volumes; Management and Cost/Price are volumes VIII and IX, respectively. Updated Sections L and M will be provided in the final RFP.

31 Section L & Section M General

With the release of the revised PWS on 5/31/16, there are apparent disconnects now between the requirements, the proposal structure, and the evaluation criteria. Will the government be revising Section L and Section M to capture the PWS updates?

Updated Sections L and M will be provided in the final RFP.

Section L L-5.4 L-5.4 references Section L paragraph 1.5(e) which indicates a requirement to submit either OCI Disclosure Forms, or OCI Determination Letters with the proposal. Section L is not clear as to where within the proposal these submission shall be included. Can you please clarify if these are to be included within Volume I, Tab 5 with the OCI Mitigation Plan?

They should be included as part of Volume II, OCI Management Plan as an attachment.

RFP /

Attachment

Subject

Page #, Paragraph Reference

Question / Comment Response

RFP Section H, Page 62 This section states that, "The period of time used to determine compliance with

FAR 52.219-14, Limitation on Subcontracting, will be the base contract period of performance or ordering period in the case of an Indefinite-Delivery Indefinite-Quantity (IDIQ) contract." However this contract will not be an IDIQ contract. Can the government please update this clause to be based on a contract?

Clause H-39 COMPLIANCE WITH FAR 52.219-14, LIMITATION

ON SUBCONTRACTING (FEB

2012) refers to Completion contracts and IDIQ contracts. With the resultant TEAMS contract, the base period of performance time period will be used to measure compliance with the requirements of this clause.

EPW Attachment L-

Can offerors add additional line items to account for additional labor categories/locations required to perform the work?

Yes; offerors may add additional line items to account for additional labor categories and locations to accomplish PWS requirements.

Section L L-13.5, Pricing Volume

Narrative, Should the Basis of Estimate, WBS, and overall costs of the effort be based on the entire PWS instead of the specific requirements identified in Volume VII Technical? If so, how does the total price of the effort relate to the technical proposal submission for realism and reasonableness? Assuming the answer to the first part of this question is yes, the Basis of Approach required in the Technical Volume will not match the Basis of Estimate. Is this a correct assumption?

Yes. The Basis of Estimate, WBS, and overall costs will be based on the entire PWS. The technical scenarios will be used to evaluate understanding of the requirement and how the offeror would allocate resources and hours to accomplish the scenario. The technical scenarios do not factor into the overall Cost/Price volume.

The Basis of Approach in the Technical volume will not match the Basis of Estimate.

PWS Figure 3.3.1

In figure 3.3.1, Cyber Range OT&E Engineer IASAE Level II and III Functions, there are only three words that have difference in functions to be performed for the IASAE. (Specifically in Functions 7 and 12.) In all other similar Figures for Level II and III Functions, the government has an additional Function for Level III Performance. Does the government expect to have additional Functions for IASAE Level III performance compared to IASAE Level II performance?

An updated PWS will be provided in the final RFP.

Section L L-11.1 Task item d

Reference subparagraph d states: "Identify which CCVT, CSCA, and CA functions are applicable from PWS Figures 3.1.1, 3.2.1, and 3.3.1." Revised PWS Figure 3.3.1 refers to functions for the Cyber Range OT&E and CA functions no longer appear in the PWS. Does the government intend to revise Section L11.1 to match the revised PWS?

See response for question 7.

Section L L-11.2 Task item f

Subject Subparagraph f states: "Identify which Information Assurance System Architect and Engineering (IASAE) functions are applicable from PWS Figure 3.5.1." However, in the Revised PWS, Figure 3.5.1 only references IAT and IAM functions. Does the government intend to revise Section L11.2 to match the Revised PWS?

RFP /

Attachment

Subject

Page #, Paragraph Reference

Question / Comment Response

Section L L-11.3 Task item g

Reference Subparagraph states: " Identify which IASAE functions are applicable from PWS Tables 3.3.1 and 3.4.1." The Engineer functions are listed in Figures 3.3.1 and 3.4.1, while the respective Tables specify Performance Objective Standards. Did the government intend to specify Figures 3.3.1 and 3.4.1?

Section M Section M-7.1 In TS1, the government intends to evaluate "Traceability from evaluation scenario to PWS requirements 3.1, 3.2, and 3.3" However, in the Revised PWS, Section 3.3 refers to Cyber Range OT&E, while Section 3.4 refers to Cybersecurity Risk Assessment. Does the government intend to revise Section M-7.1 to match the Revised PWS?

An updated Section M will be provided in the final RFP.

Section M Section M-7.2 In Section M-7.2, the government mentions "penetration test" and later refers to PWS requirements 3.5. In the Revised PWS, Section 3.5 refers to Training, Education, and Leader Development while Section 3.3 actually mentions penetration testing. Does the government intend to issue a revised Section M-

7.2 to match the Revised PWS?

An updated Section M will be provided in the final RFP.

Section L Sections L- 11.1, L-11.2, & L-11.3

None of the reference sections mention Training, Education and Leader Development requirements specified in Revised PWS Section 3.5. Additionally, the functions specified in Figure 3.5.1 for IAM are also not mentioned for evaluation in any of the Section L 11 Whitepapers. Does the government intend to Revise Section L 11 so that Training, Education, and Leader Development portion of the Revised PWS Section 3.5 and IAM functions are addressed in Section L?

An updated Section L will be provided in the final RFP.

PWS Revised PWS

3.5.1 (page 40)

Under section 3.5.1, the subordinate paragraph refers to Figure 3.4.1, and paragraphs 3.4.3 and 3.4.4. Did the government intend to reference Figure 3.5.1 and paragraphs 3.5.3 and 3.5.4?

An updated PWS will be provided in the final RFP.

PWS Revised PWS paragraph 3.3

(page 26)

Under Paragraph 3.3, the subparagraph is 3.5.1 and refers to functions identified in Table 3.1.1. Should it be subparagraph 3.3.1 and reference to functions identified in Figure 3.3.1?

The subparagraph should be 3.3.1, however, the reference to Table

3.1.1 is correct. An updated PWS will be provided in the final RFP.

45 EWP Attachment L-

Are offeror's permitted to add headers and footers for the Excel Pricing Workbook (EPW) to be consistent with the rest of the proposal?

Yes; offerors may add headers and footers to Attachment L-07 in accordance with Section L-4.0 Proposal Organization.

RFP /

Attachment

Subject

Page #, Paragraph Reference

Question / Comment Response

PWS Table 3 Please provide additional information concerning the requirements for Cybersecurity Risk Assessments. Specifically, how do these risk assessments correlate to CVT events, and what standards / formats / existing methodologies are expected to be used in Cybersecurity Risk Assessments?

The Bidders' Documents Library will include NIST 800-30, Guide for Conducting Risk Assessments; DoDI 8510.01, Risk Management Framework (RMF) for DoD Information Technology (IT); and the DoD Program Manager's Guidebook for Integrating the Cybersecurity Risk Management Framework (RMF) into the Systems Acquisition Lifecycle.

Section L L-13.5, page

Are offeror's required to provide a description of direct labor rates utilized for proposal submission? It is described in Section L-13.3 but there is no mention of direct labor in the narrative requirements of Section L-13.5. Please clarify where this information should be provided.

Yes, per Section L-13.5 Pricing Volume narrative (1) and (2), offerors must state whether their proposed direct labor rates and indirect rates are covered by a Forward Pricing Rate Agreement (FPRA) or approved billing rates. If covered by a FPRA or approved billing rates agreement, the offeror must provide a copy of the agreement(s). If an FPRA is not in place, state that fact and identify the applicable Forward Pricing Rate Proposal and submission date or other basis for the proposed rates.

48 PWS and Section L General

How do the stakeholders correspond with the PWS Sections (3.1, 3.2, 3.3, 3.4, and 3.5)? Similarly, how do offeror’s determine how the stakeholders should be priced per PWS Section

The PWS will be updated to include stakeholders for the applicable PWS sections in the final RFP.

PWS Section 3, Paragraph 3, Lines 4-5

"The Contractor Program Manager will reside with the Cyberspace Management Office at Schriever AFB, CO." With the team at multiple locations and Government representatives at multiple locations, communication across locations is paramount to successful completion of the requirements. Whether the PM is in one location or another seems to be more of a "how" the Government wants the job to be done rather than "what" is required to be done.

Would the Government accept a PM at a different location than Schriever?

No, the Government will not accept a CPM at a different location.

The Government Technical Lead for this contract will be located at Schriever AFB, CO. The Government and Contract leads must be situated at a common location based upon the critical nature of cybersecurity and the need for continuous communications and coordination activities.

PWS Section 3.3.1, Paragraph 1, Line 1

"The contractor shall improve independent verification and validation assessment, analysis, and reporting…" The intent of the word "improve" is not clear in this requirement. What is to be improved from; i.e., what is the baseline from which an improvement is to be measured? How will improvement be measured? Is it a one-time improvement or continuous? How do you know when you've met the requirement?

The improvement is: by performing the Information Assurance Workforce Technical (IAT) functions, as defined in Federal and DoD regulatory guidance. Performing those IAT functions would improve independent verification and validation assessment, analysis, and reporting. The improvement will be measured by the products delivered and continuously monitored. The product monitoring surveys will be provided at the Kick-Off meeting. Each delivered product will be assessed upon delivery, with near term feedback.

RFP /

Attachment

Subject

Page #, Paragraph Reference

Question / Comment Response

51 PWS

Section 3.3.1, Paragraph 2, Lines 4-7

"The CCVT Assessors are to validate and analyze the implementation and execution of DoD mandated security measures, evaluating the applicable cybersecurity controls in sufficient detail to determine whether those measures are capable of preventing, or reducing risk to an acceptable level." The requirement is unclear. What determines sufficient detail? What is an acceptable level of risk? Who determines this and how do you know when enough is enough?

See guidance provided in the Bidders' Documents Library, which includes DoDI 8510.01, Risk Management Framework (RMF) for DoD Information Technology (IT); DoD Cybersecurity Test and Evaluation Guidebook; and other NIST SP 800 documents.

PWS Section 3.2.3, Paragraph 1, Lines 1-2

"The contractor shall perform the following CSCA activities by executing the Assessor IAT Level II and III Functions, listed in Figure 3.3.1" Clarification:

The reference listed references Figure 3.3.1 but appears to be actually referencing 3.2.1. Is Figure 3.2.1 the correct reference?

Yes, Figure 3.2.1 is correct. An updated PWS will be provided in the final RFP.

53 PWS

Section 3.3.1, Paragraph 1, Line 1

"3.5.1 The contractor shall…" Correction/Typo: Paragraph number should be 3.3.1

An updated PWS will be provided in the final RFP.

PWS Section 3.3.1, Paragraph 1, Lines 1.7

"The contractor shall improve the effectiveness of BMDS weapons information system related cybersecurity risks management and reporting…" The intent of the word "improve" is not clear in this requirement. What is to be improved from; i.e., what is the baseline from which an improvement is to be measured?

How will improvement be measured? Is it a one-time improvement or continuous? How do you know when you've met the requirement?

The improvement is: by performing the Information Assurance Workforce System Architect and Engineering (IASAE) functions, as defined in Federal and DoD regulatory guidance for the BMDS IS.

Performing those IASAE functions would improve independent verification and validation assessment, analysis, and reporting. The improvement will be measured by the products delivered and continuously monitored. The product monitoring surveys will be provided at the Kick-Off meeting. Each delivered product will be assessed upon delivery, with near term feedback.

RFP /

Attachment

Subject

Page #, Paragraph Reference

Question / Comment Response

55 PWS

Section 3.4.1, Paragraph 1, Lines 1-2

"The contractor shall improve information cybersecurity integration into the system architecture, system life cycles, and accreditation processes by…" The intent of the word "improve" is not clear in this requirement. What is to be improved from; i.e., what is the baseline from which an improvement is to be measured? How will improvement be measured? Is it a one-time improvement or continuous? How do you know when you've met the requirement?

The improvement is: by performing the Information Assurance Workforce System Architect and Engineering (IASAE) functions, as defined in Federal and DoD regulatory guidance for the BMDS mission (weapon system) and MDA/BMDS non-mission (MDA Admin/Genser and BMDS RDT&E) information systems.

Performing those IASAE functions would improve information cybersecurity integration into the system architecture, system life cycles, and accreditation process. The improvement will be measured by the products delivered and continuously monitored.

The product monitoring surveys were not included in the RFP QASP, but will be provided at the Kick-Off meeting. Each delivered product will be assessed upon delivery, with near term feedback.

56 PWS

Section 3.5.1, Paragraph 1, Lines 1-2

"The contractor shall expand information cybersecurity knowledge improving the system architecture, system life cycles, and accreditation decisions …" The intent of the word "improving" is not clear in this requirement. What is to be improved from; i.e., what is the baseline from which an improvement is to be measured? How will improvement be measured? Is it a one-time improvement or continuous? How do you know when you've met the requirement?

The improvement is: by performing Cybersecurity Training, Education, and Leadership Development training functions, as defined in Federal and DoD regulatory guidance. The Training functions are aligned with the DoD 8570.01-M workforce definition Information Assurance Management (IAM) Level II and Information Assurance Technical (IAT) Level II functional positions.

Performing Cybersecurity Training, Education, and Leadership Development training functions would improve the system architecture, system life cycles, and accreditation decisions. The improvement will be measured by the training products delivered and continuously monitored. The training product surveys will be provided at the Kick-Off meeting. Each delivered product will be assessed upon delivery, with near term feedback, as well as student training survey feedback.

57 PWS

Section 3.5.1, Paragraph 2, Lines 1-3

"The contractor shall perform the functions as identified in Figure 3.4.1 containing the list of IAM Level II and IAT Level II functions, while executing task paragraphs 3.4.3, thus producing the Key Products/Technical Data identified in paragraphs 3.4.4." Clarification: The figure and paragraph references appear to be incorrect. Should they be Figure 3.5.1 and paragraphs

3.5.3 and 3.5.4?

An updated PWS will be provided in the final RFP.

RFP /

Attachment

Subject

Page #, Paragraph Reference

Question / Comment Response

PWS Section 5.0, Paragraph 1, Lines 6-8

"The NIST 800-53 security controls specified in 252.204-7012 shall be extended to include CUI information which resides on, or transits through the contractor’s (prime and all sub-contractors) unclassified information technology systems." Is the NIST 800-53 reference correct or should it be 800-171?

The NIST 800-53 should be the 800-171 as the DFARS clause 252.204-7012 was updated in December 2015 with the NIST 800-

171. The NIST 800-53 no longer applies to the contractor. An updated PWS will be provided in the final RFP.

59 PWS Section 6, Table 6.1

Table 6.1 Shows all contract labor categories having a TS/SCI requirement, except CPM and those required for PO #5. Is it the Government's intent that 1) a TS/SCI security clearance may be required by someone in each labor category or is the Government's intent that 2) each individual on the contract, with the exception of the CPM and those individuals working on PO #5, will be required to have a TS/SCI security clearance?

Each individual on the contract, with the exception of the CPM and those individuals working PO#5, are required to have a TS/SCI security clearance.

Section L L-11.0, Page 19, Paragraph 4, Lines 1-2

"Whitepaper response and an associated Basis of Approach Document." Is the Basis of Approach Document included in the page count for the Whitepaper?

Yes. See response for question 21.

Section L L-11.0, Page 19, Paragraph 4, Lines 1-3

"Whitepaper response and an associated Basis of Approach Document." Is there a specific format the Government wants us to use for the Whitepapers?

No.

Section L L-11.1, Paragraph

4.2.d, Line 1

"Requirement Crosswalk (PWS Paragraph, Directive, etc. driving this activity)" The crosswalk in the Basis of Approach Document for each scenario will map the capabilities of the offerors to respond to specific paragraphs of the PWS only as it relates to the specific scenarios. Does the Government intend to request that the offerors demonstrate their approach to respond to the entire PWS in the complete context of the ICV mission? How will this be included and evaluated in the proposal?

An updated Section L will be provided in the final RFP.

Section L Section L- 11.1, Paragraph 4.e, Line 2

"Identify which cybersecurity activities are applicable from PWS subparagraphs 3.1, 3.2, and 3.3." Are these the correct paragraph references?

An updated Section L will be provided in the final RFP.

Section L Sectoin L- 11.1, Paragraph 4.f, Lines 1-2

"Identify which Information Assurance System Architect and Engineering (IASAE) functions are applicable from PWS Figure 3.5.1." Is it correct to assume the Government intended to reference paragraph 3.3.1 instead of 3.5.1 for this whitepaper?

An updated Section L will be provided in the final RFP.

Section L Section L- 11.1, Paragraph 4.g, Line 1

"Identify which cybersecurity activities are applicable from PWS subparagraphs 3.5." Is it correct to assume the Government intended to reference paragraph

3.3 instead of 3.5 for this whitepaper?

An updated Section L will be provided in the final RFP.

RFP /

Attachment

Subject

Page #, Paragraph Reference

Question / Comment Response

66 Section L

Section L- 11.1, Paragraph 2.g and h, Line 1

"g. Identify which IASAE functions are applicable from PWS Tables 3.3.1 and 3.4.1." Are these the correct paragraph references?

An updated Section L will be provided in the final RFP.

Section L Section L- 13.5, Paragraph 10, Line 1

"Provide the Basis of Estimate (BOE) for all resources proposed." Will the BOE be utilized by the Government in their evaluation of the Technical Factor?

Yes.

Section L Table L-1, Table L-1 (Proposal Organization and Content) stipulates that offerors submit, as Tab 2 of their Volume II (Executive Summary), a Proposal Cross Reference Matrix. Section L, page 15, Paragraph L-6.2 describes stipulates that the Proposal Cross Reference Matrix “map,” at a minimum, all PWS, Section L, and Section M requirements to the page number in the offeror’s proposal. The subject RFP, like ALL Government RFPs, contains myriad “shall’s,” “should’s” and “will’s that can and should be interpreted as “requirements.” In order to ensure conformity across all proposals, will the Government consider providing, as part of the Final RFP, a standardized Proposal Cross Reference Matrix that contains all of the required PWS, Sectional L and Section M items to which the Government expects offerors’ proposals to be mapped to?

No. Each offeror must complete a cross reference matrix between the PWS, Section L, Section M, and the offeror's Proposal.

General General

Last week at the MDA Small Business Conference, Iheard the size standard for the TEAMS Cybersecurity and Risk Management has moved up to 1,250 from the 500 originally depicted in GovWin. Can you please confirm if this is true or not?

Yes. The NAICS code is 541712 and the Size Standard is 1,250 employees.

Section L Table L‐1

In reviewing the draft RFP for IT Cybersecurity and Risk Management I noticed the Small Business Compliance Plan has a page limit of 10 pages. This is twice the number which was allowed in five of the six TEAMS proposal which have been awarded. Can you give any insight into the reason for the additional pages allowed in this proposal.

The 10-page limit for this Small Business Compliance Plan was determined to be adequate for this and several other TEAMS solicitations.

General General

Can you validate whether or not, for example, if we win a Cybersecurity Management/Computer Network Defense proposal that we should no longer be eligible to Prime on an Information Technology Management & Analysis or Cybersecurity Risk Management proposal.

Attachment J-05 TEAMS OCI Policy addresses this question:

"[C]ontractors providing A&AS to the Ballistic Missile Defense System cyber security management/computer network defense area will likely be unable to also support the IT cyber security and IT management and analysis areas."

RFP /

Attachment

Subject

Page #, Paragraph Reference

Question / Comment Response

72 General General

In review of the most recently released Draft RFP for Cybersecuirty and Risk Management (HQ0147-16-R-0005), it appears to be under the IC-02 category but it reads as if it is in the IC-03 category. Can yo uconfirm what category it falls into.

The TEAMS Cybersecurity and Risk Management solicitation replaces the MiDAESS IC-02 task order.