BMDS_CSM_TEAMS_QAs.pdf

RFP /

Attachment

Subject

Page #, Paragraph

Reference

Question / Comment Response

General

Is the BMDS CSM/CND a TO under the TEAMS IDIQ vehicle or is this an F&O competition where none TEAMS IDIQ contract holders are invited to participate?

The TEAMS BMDS CSM/CND contract is not an Indefinite Delivery/Indefinite Quantity

(ID/IQ) contract. It is a Full and Open (F&O) cost plus fixed fee Completion contract.

Attachment J-01

BMDS CSM/CND

PWS

Page 9, Section

3.1

Have all BMDS Information systems undergone an initial authorization? How many information systems are re-authorized every year? How many new systems are expected to undergo initial authorization every year?

All MDA systems identified in table 3.1.3 have undergone an initial authorization and are currently accredited. Although the number will vary each year, approximately 30 systems will be reaccredited annually. Historically, another 3 to 5 new systems are added each year. This information has been added to the Attachment L-

09 Historical Information document.

Attachment J-01

BMDS CSM/CND

PWS

Page 10, Section

3.1

OMB Memorandum M-14-03, provides specific instructions for how Departments/Agencies can begin to implement an effective

ISCM program. The Memorandum specifically highlights the need to develop an Information Security Continuous Monitoring

(ISCM) strategy, and to integrate with the DHS/GSA Continuous

Diagnostics and Mitigation (CDM) Program. Does MDA currently have an ISCM Strategy that it is implementing? If yes, how much progress has been made? Additionally, Is MDA planning on integrating with and supporting the DHS/GSA CDM program? If yes, what specific tools/software does MDA plan to procure from

DHS/GSA to support the CDM Initiative?

MDA as a component of DoD complies with all

DoD guidance. Within the PWS subparagraph

2.1 Regulatory Guidelines, you may note the

NIST SP 800-137, Information Security

Continuous Monitoring (ISCM) for Federal

Information Systems and Organizations publication. MDA does have a continuous monitoring program. MDA uses the DoD defined toolset in meeting this requirement, and is integrated with the mandated DoD process.

Attachment J-01

BMDS CSM/CND

PWS

Page 10, Section

3.1

Does MDA intend to address OMB Memorandum M-14-03, specifically, establishing an effective ISCM program, with this solicitation?

See response to Question 3.

Attachment J-01

BMDS CSM/CND

PWS

Page 10, Section

3.1

What existing information systems continuous monitoring tools does MDA currently employ?

See response to Question 3.

Attachment J-01

BMDS CSM/CND

PWS

Page 10, Section

3.1

Has MDA begun the transition to RMF for its information systems?

If so, which what percentage systems have been transitioned. What specific systems have been transitioned, and which ones have not been fully transitioned? Does MDA possess an existing plan to transition to RMF?

Yes. All MDA systems will be fully transitioned to RMF not later than 31 Aug 2017. For proposal purposes, assume 100% of systems are fully transitioned to RMF.

Attachment J-01

BMDS CSM/CND

PWS

PWS Table 3.1.3, BMDS

Information

Systems

Supported, pages

15-18

This table is a mixture of networks, individual systems, suites and collections of systems. Will the government provide further details as to the number of systems within each item?

No further details will be provided. Table 3.1.3 and Attachment L-09 provide annual system requirements by CLIN. Specific or detailed knowledge does not impact the offerors pricing or ability to respond to the RFP.

Attachment J-01

BMDS CSM/CND

PWS

PWS Table 3.1.3, BMDS

Information

Systems

Supported, pages

15-18

All systems in this table are located in one of five locations:

Huntsville AL, Dahlgren VA, Ft. Belvoir VA, Colorado Springs

CO, Hanscom AFB MA. Are there other locations or systems requiring computer network defense that don't meet the threshold of

ISSO IAM Level II or III functions being required?

Table 3.1.3 identifies the program location for management of the BMDS information system, it does not reflect the physical location of the information system. The MDA/BMDS

Information Systems are distributed world-wide.

Performance of the PWS will be primarily be performed at the five locations identified in the

PWS.

Attachment J-01

BMDS CSM/CND

PWS 16-17

Can the government provide an alignment between the Information

Systems listed in Table 3.1.3, and the Stakeholders listed in

Attachment L-09?

The IS alignment metrics have been added to the

Attachment L-09 Historical Information documentation.

Attachment J-01

BMDS CSM/CND

PWS

Pages 16-18, Table 3.1.3

(BMDS

Information

Systems

Supported)

How do the Information System Names listed in this table relate/align to the Ballistic Missile Defense System elements and/or

MDA directorates listed in Section 1.1, Page 3 of this PWS?

See response to Question 9.

Attachment J-01

BMDS CSM/CND

PWS

Pages 16-18, Table 3.1.3

(BMDS

Information

Systems

Supported)

Where does each system listed in Table 3.1.3 currently stand in the certification and accreditation lifecycle? (i.e. IATT, ATO, DATO) and if ATO where do they stand in their 3-year reaccreditation effort?

See response to Question 2 and 7. The current status of each system varies constantly so a precise count will be quickly inaccurate.

Attachment J-01

BMDS CSM/CND

Page 16, Table

3.1.3: BMDS

Information

Systems

Supported continued

Does the table contain all information systems that will be required to be maintained on the BMDS CSM/CND Task?

Yes, the table contains all the Information

Systems that will be required to be maintained.

However, systems may be added and removed during the life of the contract.

Attachment J-01, L-09 and L-10

Attachment J-01,

p. 30

Attachment L-09,

p. 1-2, and

Attachment L-10, p.2

Will the government please clarify what level of clearance is required for all staff on Day One? Labor Category requirements indicate TS/SCI, Historical Information says minimum of Top

Secret at Base PoP start, and PWS notes that the contract requires access up to and including Top Secret but that TS/SCI is required for staff who need to access SCI.

Consistent with Attachment J-03, DD Form 254 and PWS Section 6, all employees must have TS clearance on the individual employees first day of performance on the contract. Employees occupying positions requiring TS/SCI must have

TS with eligibility for SCI on their first day of contract performance.

Attachment J-01

BMDS CSM/CND

PWS

23-26

Previous Q&A submission asked that for Performance Objective

#2, that the government please list the suite of technologies (i.e.

firewalls, routers, SIEM, Web Proxy, OS) the CND-A team be familiar with as part of the MDA computer Networks. This did not appear to be added to the 15 JAN 2016 version of the PWS.

After additional consideration, it was determined that this information will not be added to the

PWS. Table 3.1.3 and Attachment L-09 provide annual system requirements by CLIN. Specific or detailed knowledge does not impact the offerors pricing or ability to respond to the RFP.

Attachment J-01

BMDS CSM/CND

PWS

Page 24, Section

3.2

What data forensics tools and techniques are currently being deployed across the enterprise?

The list of necessary forensic tools required to support this RFP are contained in the Labor

Categories (Attachment J-13)

HQ0147-16-R-

0008/ Attachment

J-12 MDA OCI

Policy Memo 51

Page 1, 3rd paragraph

Would the policy that contractors who provide advisory and assistance services to the Agency cannot develop or support development of the Agency's Research and Development (R&D) efforts prohibit a contractor from participating in both the BMDS

Cybersecurity Management and Computer Network Defense contract and in the MDA BMDS Modeling and Simulation (M&S)

Application Development and Sustainment contract as described in

MDA RFI MDA15DERFI01?

Specific OCI concerns should be submitted using the processes identified in the Section L-1.5

Notice Regarding Organizational Conflict of

Interest (OCI) – Determination to Participate in

This Acquisition (JAN 2015) of the RFP. Only the OCI determination can provide a specific offeror with recommendations on organizational conflicts. All potential offerors are encouraged to submit an OCI form.

Attachment L-01

Past Performance

Information (PPI)

CSM-CND

N/A Is it acceptable for the offeror to reformat the PPI template (e.g., eliminate headings that are not relevant to the PPI being submitted, reduce spacing where appropriate, etc. to allow more space for the relevant past performance information required by the government?

No. Attachment L-01 Past Performance

Information (PPI) will be provided in Word format for ease of use but shall not be reformatted.

Attachment L-07, Excel Pricing

Workbook

Rates Tab

FBLRs Tab

Given that Ft. Belvoir was removed as a location in the Attachment

J-01 PWS, will it be removed from the Attachment L-07, Excel

Pricing Workbook, in the final solicitation?

Yes. Fort Belvoir will be removed from

Attachment L-07, Excel Pricing Workbook, in the Final RFP.

Attachment L-07, Excel Pricing

Workbook (EPW), and Attachment L-

Attachment L-07

EPW, Labor

Category Tab

Attachment L-10,

p. 2

Years of Experience on the Labor Category Tab of the Excel

Pricing work book differ from the years of experience noted in

Attachment L-10. This could cause an erroneous DL rate for the affected labor categories, particularly for the Specialist Advanced and Intermediate, where the years of experience in the EPW are 5 years less than in Attachment L-10.

The ERI experience levels stated in Attachment

L-07 and Attachment L-10 will not always be identical. The years of experience in Attachment

L-07 are for determining the ERI mean and 90th percentile rate ranges. The offerors must ensure the personnel they place in the labor competencies meet the experience requirements in Attachment L-10.

Attachment L-09, TEAMS BMDS

CSM / CND

Historical

Information

N/A There are no program-specific requirements in the PWS that allow offerors to determine the level of effort necessary to support each stakeholder referenced in the Historical information. Can you provide the criteria used to drive this level of effort so that offerors other than the incumbent may price the activities?

See response to Question 9.

Attachment L-09

Historical

Information

Page 1.

Government

Onsite

Accommodations per Location

Does the number of Government Onsite Accommodations per

Location in Attachment L-09 reflect the full scope of work in the

Attachment J-01 PWS?

No. The number of Government Onsite

Accommodations in Attachment L-09

Historical/Bid-To document only indicate workspace/desk space that can be provided to support contractors.

Attachment L-10

BMDS CSM /

CND Labor

Competencies

Pages 2-3, Figure

2: Workforce

Position

Requirements and Competency

Level

Descriptions on

The IT Career Level Experience of at least 10 and 15 years is not included in the DoD 8570.01-M IA Workforce Position

Requirements Incorporating Change4, 11/10/2015. The Experience requirements for IAM II = 5 years of management experience and

IAM III = 10 years of management experience. Is it an MDA requirement for an Analyst (Intermediate) and Specialist

(Intermediate) to have at least 10 years of IT experience? Would the government consider lowering the IT experience requirement to

5 years to reflect the updated guidance?

Over the past five years the cybersecurity threat has grown and so have the DoD cybersecurity requirements. As such, MDA's cybersecurity requirements have increased. MDA requires a higher experienced workforce to address the ever changing requirements. The Attachment L-10

Labor Competencies will not be modified.

Attachment L-10

BMDS CSM /

CND Labor

Competencies

Page 2-3, Figure

2: Workforce

Position

Requirements and Competency

Level

Descriptions on

The Missile Defense Agency (MDA) cannot afford to fail when it comes to cyber, especially with respect to computer network defense. It is essential that MDA protect critical platforms, systems and data (development, test, and in-flight) from theft or compromise. This protection extends to intellectual property

(designs, architecture, plans, etc.), and includes identifying vulnerabilities in the system, network, and in your processes and your people. To provide appropriate defenses forms a foundation upon which MDA can then successfully develop, test, and field an integrated, layered, ballistic missile defense system (BMDS) to defend the United States, its deployed forces, allies, and friends against all ranges of enemy ballistic missiles in all phases of flight.

It’s impossible for anyone to predict all future cyber needs, but given the importance of the mission and focus of MDA, would the government consider adding a Subject Matter Expert (SME) labor category to enable companies to provide the highest level of expertise while supporting MDA’s critical future requirements?

Not at this time.

Attachment L-10

Labor

Competencies

N/A Technology in general changes at a rapid pace (e.g., Moore’s Law).

Cybersecurity, on the other hand, changes exponentially. It’s continual evolution means that extensive years of experience is not truly indicative of the ability to do the work. Recommend more flexibility within the Cybersecurity-related labor categories to allow offerors to present the most cutting-edge resources available.

Would the Government consider resources who possess the skills, background, and certifications necessary to meet the ‘spirit’ of a labor category but lack only the years of experience on perhaps an exception basis?

See response to Question 22. DoD 8570.01-M is very specific about this requirement.

25 Attachment L-11 3-Jan

Will Attachment L-11 include instructions for accessing the

Bidder's Library?

Yes. The Final RFP will contain instructions for accessing the Bidders' Library.

Section L:

Instructions, Conditions, and

Notices to

Offerors

Page 6, Section

L-2.10 Bidders’

Documents

Library

In response to our request for access to the bidder’s library, we were told it would not be granted until after the final RFP is released. Does the current incumbent have access to the documents listed as in that library? If so, would the government consider providing other bidders access now to allow time for review and consideration in their offer development process?

The Bidders' Library will be available upon release of the Final RFP. Currently no one has access to the Bidder's Library.

Section L-2.10

Bidders' Library and Attachment L-page 6, L-2.10

When will the Bidders' Library be available? The Bidders' Library will be available upon release of the Final RFP.

Section L-2.10

Bidders' Library and Attachment L-page 6, L-2.10

L-2.10 states that "Request for access to the Bidders' Documents

Library shall be submitted utilizing the instructions at Attachment

L- 11." Attachment L-11 contains a list of the documents available in the bidders' library but no instructions on how to access or set up an appointment. Request that the Government provide access information.

Instructions for accessing the Bidders' Library will be included with the Final RFP.

29 Section L and

Section M page 16, Section

M-11.5

If ODC NTE values are added to Section L, please revise Section

M-11.5 accordingly to add “ODC” as follows: “The Government specified amounts for the Travel, ODC and Surge CLINs and the offer’s proposed fixed fee for the Surge CLIN.”

ODCs are not anticipated for this requirement.

Section M of the RFP will be revised accordingly.

30 Section L Page 17, L-10.0 Is it acceptable to deliver FOUO information as part of Volume VI, Past Performance? Our team has contracts we would like to use as past performance. When combining the contract value, contract number, and source agency, our customers require us to mark the data FOUO.

Yes, All information submitted in response to this RFP will be handled in the manner appropriate in source selection.

L-12.0 Volume

VIII Technical L-12.0 on p 19

The RFP is very specific on what is required for each of the

Scenario Responses as indicated in L-12.2.1 items a - h, L-12.2.2 items a-h, and L-12.2.3 items a-l. Further, the RFP requires us to identify which PWS functions and activities are applicable to the scenario. It is possible that some PWS functions or activities are not applicable to a particular scenario. Is it acceptable to the

Government that an offeror's response might not include technical approaches to those PWS functions or activities that are not applicable to the Scenario Response?

Yes. Not every subparagraph within the PWS is applicable to a scenario. Per Sec L-12.2 the offeror is to identify the functions/activities that are applicable to the scenario.

L-12.1 Technical

Sub factor 1 --

Major Weapon

System

Cybersecurity

Management

L-12.1 on pages

19 and 20

Is a Basis of Approach required for Technical Sub factor 1? The instructions on page 20 state that the Basis of Approach Document shall contain the following information: Scenario Response Title.

Sub factor 1 is not a scenario response. Please clarify if a BOA is required for Sub factor 1.

Instructions have been adjusted to clarify the expectation.

L-12.1 Technical

Sub factor 1 --

Major Weapon

System

Cybersecurity

Management

L-12.1 on pages

19 and 20

Is the Basis of Approach "Document" a separate document or part of the page count for each of the three Scenario Responses? If separate, is there a page restriction?

The Basis of Approach document is included in the page count prescribed in Section L.

L-12.1 Technical

Sub factor 1 --

Major Weapon

System

Cybersecurity

Management

20-21 , L-12.1

For the response for Technical Sub factor 1, we understand that the referenced PWS paragraphs 3.1.1, 3.1.2, 3.1.3, 3.1.4, 3.1.5 and

3.1.6 are provided to bring additional context to the 1)- 8) activities detailed on page 21. Please confirm this understanding, or specify if write-ups to the referenced PWS paragraphs are intended to be independent from the items 1) - 8) on page 21.

Your understanding is correct. See response to

Question 31 for further details.

L-12.1 Technical

Sub factor 1 --

Major Weapon

System

Cybersecurity

Management

States:

• Three highly technical state-of-the-art concepts are in the initiation phase, each having its own information system (IS).

• Ten ISs are supporting the component development/acquisition, with two ISs containing Special Access Program (SAP) information.

• Ten ISs are supporting the component implementation phases with four directly related to missile weapon construction and four directly related to radar sensor construction.

• Fifteen ISs are in the operation phase

• … two ISs supporting massive weapon fields

• … eight ISs are deployed internationally

• Two ISs are in the disposal phase

• All 40 ISs are classified as SECRET

Adding up the system counts there appear to be more than 40 – there appears to be 50 systems total. Please clarify.

There are 5 life-cycle phases involved in this scenario. Additional information is provided for some of the systems within the phases.

3 in Initiation phase

10 in Component Development/Acquisition phase

-- includes two SAP programs

10 in Component Implementation phase

-- includes 4 missile weapon construction

-- includes 4 radar sensor construction

15 in Operation phase

-- includes 2 massive weapon fields

-- includes 8 deployed internationally

2 in Disposal phase

3+10+10+15+2=40

No change made.

36 L-12.1 Technical

Sub factor 1 --

Major Weapon

System

Cybersecurity

Management

L-12.1 on page

The third paragraph on the page; numbered #4 states "Assume a new cybersecurity threat has been identified attacking the developing and implementing phase ISs." Could the government clarify what it means by "new" cybersecurity threat?

A new cybersecurity threat is defined as a previously unknown threat that impacts a system

37 Attachment L

L-12.2.1, L-

12.2.2 & L-

12.2.3

Technical Sub factor Scenarios State "See Attachment L-11

Bidders Library Scenario Response System Description." Scenario

Response System Descriptions do not appear to be included in

Reference List for Bidder's Library.

The Final RFP will contain the Reference List and instructions for accessing the Bidders'

Library.

Section L:

Instructions, Conditions, and

Notices to

Offerors

Page 21, L-12.1 para5

What is meant by "services" in the following sentence, "Assume for year two, two agreements with Services are needed for items entering the operation phase."

In this case, "Services" implies DoD Military

Services such as Army, Navy, Air Force, etc.

Memorandums of Agreements (MOAs) may be required between MDA and a DoD Military

Service.

Section L:

Instructions, Conditions, and

Notices to

Offerors

Page 21, L-12.1 para6

Is knowledge of the MDA Organizational Change Management

System required in order to respond to this requirement?

No.

Section L

Subfactors 2-4

Page 22, Section

L-12.2 Technical

Subfactors 2 through 4 –

Scenario

Responses

Please confirm that the execution of our proposed plan in the scenario white papers should not be included in the level of effort

(i.e., is not priced) for execution of the PWS.

The scenarios reflect real life activities that can be expected during the execution of the contract.

The scenarios are intended to allow the offeror to communicate their understanding and recommendations associated with the issue.

Pricing is not a factor in the white paper

41 L-12.2.1 Sub factor TS2: RFM

Controls

Executive

Recommendation

L-12.2.1 on p 22 Is it the Government's intent that the white paper response format be offeror's choice?

The white paper must meet requirements of L-

4.5, L-12.2, and scenario requirements. Specific content responses are offeror's choice.

L-12.2.2 Sub factor TS3:

Scenario Response

#2 Executive

Technical

Assessment and

Recommendation L-12.2.2 on p 23

Please clarify the fifth paragraph, TASK; as written the wording of the paragraph is difficult to understand. It currently states "Provide an unclassified technical assessment…that identifies the security program implications based the new technology to the both the radar component and weapon system." Is it the Government's intent that this should read "Provide an unclassified technical assessment...that identifies security program implications of the new technology on both the radar component and weapon system"?

The document has been updated to read:

"Program Manager (Government Senior

Executive/FOGO) that identifies the security program implications based on the new technology for the radar component and weapon system"

43 Section L, p. 24 p. 24, Resumes

In what proposal volume/tab should resumes be included? The requirement for resumes is explained under the Management

Volume under Tab 1, Workforce Management Approach, but Table

L-1 provides no indication of where Resumes should be included in the Proposal Organization and content.

Section L-4.4 Table L-1: Proposal Organization and Content has been revised to add a Technical

Tab 3 for Resumes limiting the count to 3 pages per key personnel.

44 L-13.1 Sub factor

M1 page 25, L-13.1 "Key personnel resumes shall be submitted as provided in

Attachment L-06." Are these resumes to be included in the 25 page limit for Tab 1, Workforce Management Approach? Is there a page limit for each resume? Request key personnel resumes be required in a separate tab of the Technical Volume, as with other

TEAMS proposals.

See response to Question 43.

Section L:

Instructions, Conditions, and

Notices to

Offerors

Page 32, Section

L-14.0, Volume

X: Cost/Price

The solicitation is focused on compliance with established systems and methodologies and we fully support this approach. Please confirm an acceptable justification for an offeror to be outside of the ERI range is due to them bidding in accordance with their established Estimating System with current Forward Pricing Rates.

L-14.4-Rates Tab states that for proposed direct labor rates outside these benchmarks, the offeror must provide objective evidence that the rates are reasonable and realistic in the narrative section of the cost/price volume. A Forward Pricing Rate

Agreement would be considered objective evidence.

Section L:

Instructions, Conditions, and

Notices to

Offerors

Page 32, Section

L-14.5 Pricing

Volume

Narrative

Most offerors have a Government oversight agency whose sole responsibility is to monitor contractor costs – i.e., DCMA, DCAA.

Given their familiarity with the contractor’s cost structure and their

Government function being cost oversight and control, please confirm that it is sufficient for the offeror to use their established estimating system and their already audited direct and indirect rates in the proposal as opposed to building up each indirect rate within the EPW.

Only a Forward Pricing Rate Agreement

(FPRA), DCAA/DCMA provisional billing rate agreement in or attached to the cost narrative will be accepted in lieu of not building up each rate within the EPW.

Section M -

Volume VI Past

Performance

Page 6-7, Section

M-8.2, Relevancy

Assessment

The government states that "a single relevancy rating will be assessed for each recent PPI." Understanding that each proposed qual (or PPI) will be evaluated against the relevancy requirements, will the government also provide an aggregate "relevancy" rating to recognize instances where an offeror might not be able to demonstrate coverage of the entire PWS with a single qualification, but could cover the entirety of the scope across several proposed qualifications? It is unlikely that companies (with the exception of the incumbent) will have a single past performance that covers all of the PWS requirements in one delivery effort.

No, there will not be an aggregate "relevancy rating". Relevancy will be evaluated as stated in

Section M-8.2 as defined in Table M-4.

Pricing

Spreadsheet

N/A The timing of the Proposal submission could be such that an

Offeror who had an FPRA or Approved Billing Rates in the previous Contractor Fiscal Year (CFY) no longer has one due to a very recent submission of a new Forward Pricing Rate Proposal

(FPRP) to DCMA/DCAA which must be used for all proposal pricing purposes. Please confirm the Government will accept

DCMA/DCAA Forward Pricing Rate Recommendations (FPRR) or

Forward Pricing Rate Proposals (FPRR) in lieu of an FPRA and in lieu of populating the Indirect Build‐up table.

See response to Question 46.

49 RFP Section B and Section L-

14.4

Section B, Section L-14.4

RFP Section B identifies ODC CLINs 0002, 1002, 2002, but

Section L-14.4 does not prescribe an NTE value. Will the ODC values be identified by the Government after award? If Offerors are to propose an ODC value, please revise Section L to include the

Government’s specified NTE value.

ODCs are not anticipated for this contract. The

ODC CLIN information will be removed from the RFP Section B.

50 RFP Section I page 49, Section

I

Please consider deleting FAR 52.216-11 provision from RFP

Section I (p.49). The anticipated contract allows for fixed fee.

Reference to FAR 52.216-11 will be deleted.