CSM-CND_Industry_Questions_-_Draft_RFP_questions_Final.pdf

Cybersecurity Management / Computer Network Defense December 3, 2015

Subject Location Reference Question Response 1 General Draft RFP Would a virtual (offsite) cyber IA/security solution be possible or must the SOC be on site?

Performance will be on site

2 Section L Section L-12.2 Technical Sub-factors 2 through 4

Technical sub-factors 2 through 4 seem to reflect a desire for this innovation. If so, would MDA consider updating the PWS to reflect this requirement such that these technical sub-factors are factored into the past performance, level of effort, and labor mix requirements?

The PWS contains requirements for innovation. PWS paragraph 3.1.3.d establishes the requirement for innovative cybersecurity models and 3.2.3.c establishes the requirement for innovative cyberspace model recommendations.

Per Section L -3.2, Offerors are permitted to submit a maximum of two proposals. The submission of more than one proposal is simply an opportunity to propose differing technical and/or management solutions to accomplish the PWS requirements.

3 Section M Pages 6, 7, 11, and

Sections M-8.2 and M-9.5; Tables M-5, M-6, M-7, and M-8

Based on the evaluation criteria, Past Performance accounts for 33.3% of the evaluation score and the Technical sub factor (#1) associated with the offeror’s ability to perform the PWS tasks accounts for 8.5% of the evaluation score, so almost 42% of the evaluation score is focused on the PWS which does not include a requirement for modern techniques and methodologies to proactively address evolving cyber threats. This seems to reinforce that MDA is primarily interested in compliance as an award criteria. Only 24% of the evaluation score is related to the offeror’s ability to respond to innovative and future-focused scenarios. We believe that there are opportunities to apply new and innovative solutions to MDA’s CND space that will greatly enhance MDA’s cyber resiliency. Can those be reflected in the PWS and the required work products? Was the above weighting intentional and does that reflect that MDA is valuing compliance more than resiliency? Shouldn't compliance be pass/fail and the evaluation be weighted towards the innovation and resiliency reflected in the scenarios?

Per Section M-2.1-M-2.5, this is a best value competitive source selection. The Government will select for award the most advantageous proposal representing the best value to the Government based upon an integrated assessment of technical, management, past performance and Cost and Price. The offeror’s Organizational Conflict of Interest (OCI) Management Plan, Security Plan, and Small Business Plan will be evaluated as Acceptable or Unacceptable. Per Section M-3.1, The Technical factor is more important than the Past Performance factor. The Past Performance factor is more important than the Management factor. The Management factor is more important than the Cost and Price factor. Cost and Price will be evaluated for reasonableness and realism and will be considered as part of the integrated assessment of best value. While there is a relative importance, there is no 'weighting' to the evaluation factors.

4 Section L Page 21 Section L-12.2.1 Does MDA plan to simply transition all of its DIACAP C&A packages to the RMF format as part of a compliance effort or do you also plan to utilize the risk management framework to continuously monitor your network operations, critical IT systems, IT investment/spend, and other "effectiveness" measures to enable continual improvement of your cyber security posture.

Yes, MDA is transitioning from DIACAP to RMF as required by DoDI 8510.01, Risk Management Framework. Reference PWS paragraph 2.1.f.

5 Section L Page 22 L-12-2.1(h) The heavy weight put on past performance (33% of evaluation criteria) and the dependency on specific BMDS experience in the Technical subfactors as indicated in Section : Instruction to Offerors L-12.2 Scenario Responses appear to significantly benefit the incumbent. Specifically: (1) L-12.2.1 Subfactor TS2 Task G:

Demonstrate understanding of the evaluation scenario's weapon system configuration cybersecurity perspective within your White Paper submission. (2) L-12.2.2 Subfactor TS3 Task C: Describe how you will support the management and evaluation of the PNT upgrade (design, engineering, installation, and maintenance) as a support contractor for the Missile Defense Agency. Is experience with "mission based systems" comparable to direct experience with BMDS? And if so, would the government consider modifying the language referenced above. A detailed understanding of the BMDS systems and components included in each of these scenarios provides the incumbent contractor a clear advantage for their response, as independent bidders may not have familiarity with these systems to provide the detail of the incumbent. Will this be taken into consideration when evaluating the Technical Volume scenario responses?

Per Section M-3.1, The Technical factor is more important than the Past Performance factor. The Past Performance factor is more important than the Management factor. The Management factor is more important than the Cost and Price factor. Cost and Price will be evaluated for reasonableness and realism and will be considered as part of the integrated assessment of best value. While there is a relative importance, there is no 'weighting' to the evaluation factors. Section L-12.1, Technical Subfactor 1 will be updated in the Final Request for Proposal (RFP) to clarify the scenario.

6 Attachment J-01 PWS Pages 9-12 and 22- 23.

Paragraphs 3.1 Table 3.1.1, paragraph 3.2.1, table 3.2.1, and Section 3.2.2

Performance Objective #1 seems to be specific for the Ballistic Missile Defense System (BMDS) and is primarily focused on performing Risk Management Framework (RMF) Activities as it relates to listed BMDS systems, however Performance Objective #2 seems to address the broader MDA computer networks and not solely focused on BMDS systems. Can you please confirm this to be accurate? (1) If the above is accurate, what constitutes the MDA computer networks? (2) Is support required for multiple levels of classification?

Performance Objective #1 is primarily focused on the BMDS Mission systems. Performance Objective #2 is primarily focused on the non-mission MDA Enterprise Systems. PWS 1.1 provides the high level details of both environments. Support is required for multiple levels of classification as identified in PWS Table 3.1.3.

7 Attachment J-01 PWS Page 22 Performance Objective #2 Regarding Performance Objective #2, please list the suite of technologies (i.e. firewall, router, SIEM, Web Proxy, OS) the CND-A must be familiar with as part of the MDA computer networks.

Performance Objective #2 will be revised to reflect the suite of technology in use at MDA for computer network defense.

8 Attachment J-01 PWS Page 9 Performance Objective #1 Regarding Performance Objective #1, what is the ratio of ISSOs to BMDS systems?

The number of ISSOs performing is based on the incumbent's unique approach to meeting the Government's requirements and will not be provided.

9 Attachment J-01 PWS Pages 9 and 22 Performance Objective #1 and #1 Regarding Place of Performance for Objectives #1 and #2, please confirm that Huntsville is an acceptable delivery location for all the tasks.

Performance for this requirement will take place at Redstone Arsenal, AL; Schriever AFB, CO; Dahlgren, VA; and Hanscom AFB, MA. See PWS Table 3.0 for detail of delivery locations for all performance objectives.

10 Attachment J-01 PWS and Section L

PWS Page 35;

Section L Page 27

Paragraph 9.0 and 9.1; Section L- 14.3

Three of the four technical evaluation sub-factors express a requirement for an updated approach to cyber that reflects the way DOD is moving towards an adaptive and holistic cyber posture that better addresses the current and future threat landscape. However, the current labor categories and the associated ERI data provided in the solicitation do not appear to reflect the cost of expertise in this area.

Would the government consider updating these labor categories and in particular the ERI bands to reflect the need for expertise that addresses these explicit sub-factors? As an example, many very capable cyber resources garner higher salaries without the years of experience typically associated with that level of expertise in a federal labor category.

The labor competencies and ERI rate ranges are appropriate to meet the requirements of the four technical evaluation sub-factors and the cost expertise needed. In section L-14.4 Excel Pricing Workbook (EPW) under Instructions for EPW pricing Tabs - Rates Tab, it states "For proposed direct labor rates outside these benchmarks, the offeror must provide objective evidence that the rates are reasonable and realistic in the narrative section of the cost/price volume.

11 Section L Pages 19-20 Subfactor T1: BMDS Information Systems Cybersecurity Management

This subfactor requires specific knowledge of the BMDS in order to identify current testing methods, operational risks, etc. Will there be a reading room (and access to clients for Q&A) set up in order to provide access to red-team results, current challenges, and major risks?

Technical Subfactor #1 will be updated in the Final Request for Proposal (RFP). It is not the intent of MDA to require specific knowledge of the BMDS to respond to this portion of the RFP.

12 Section M Evaluation criteria. Does MDA believe that incumbent knowledge is critical to the success of this effort to the extent that it limits the ability for someone with related and innovative experience to bring a more modern approach to MDA? We are trying to determine our ability to successfully bid on this solicitation, and if the evaluation criteria isn’t changed to reflect an open-ness to related experience outside of explicit BMDS knowledge, then we are likely not to submit a response.

It is not the intent of MDA to require specific knowledge of the BMDS to respond to the RFP. Updates will be made in the Final Request for Proposal (RFP).

13 Section L Page 14 L-9.1 OCI statement say, "Finally, contractors providing A&AS to the Ballistic Missile Defense System cyber security management/computer network defense area will likely be unable to also support the IT cyber security and IT management and analysis areas". Please identify the CSM/CDN PWS sections/areas in the PWS where there is a potential for OCI with the CS Risk Management and the other programs.

The PWS Paragraph 3.1 (Performance Objective #1) has a potential for OCI with the TEAMS Cybersecurity Compliance and Risk Management contract and the Information Technology and Management Analysis contract.

14 Attachment J-01 PWS Page 18 Paragraph 3.1.3.c How many BMDS systems must be transitioned to RMF? And how many of those are General Support Systems (GSS) and/or Major Applications (MAs).

PWS 3.1.3.c provides the offeror requirement regarding transitioning MDA systems from DIACAP to RMF.

PWS Table 3.1.3 lists the applicable MDA systems supported. All systems within DoD are being transitioned to RMF. The number of MDA systems will not remain static as programs deploy new systems based on mission requirements and retire system that are no longer needed.

15 Section L Pages 14-16 L-9.0 Volume V If the prime is a small business, how should that be addressed in the small business plan to best address the government needs?

The Small Business Section of L and M will be updated to distinguish the requirements for a Large Business and a Small Business Offeror

16 Section L Page 17 L-10.3 There is a maximum of 10 past performances. Is there a minimum? There is not a minimum number of past performance questionnaires that can be submitted.

17 Section L Page 28 L-14.3 Fringe benefits include: Accident Insurance. Please clarify what is meant by this as a fringe benefit

Accident Insurance refers to Accidental Death and Dismemberment. Accident Insurance is a type of life insurance.

18 Section L Page 14 L-9.0 Volume V Does Volume V: Small Business Subcontracting Plan only apply to large businesses? If yes, what are small business offerors required to submit under this volume?

A Small Business Subcontracting Plan is only required for Large Business offerors while a Small Business Participation Plan is required for all offerors. The Small Business Section of L and M will be updated to distinguish the requirements for a Large Business and a Small Business Offeror

19 Attachment L-12 Page 1, paragraph

OCI OCI statement say, "Finally, contractors providing A&AS to the Ballistic Missile Defense System cyber security management/computer network defense area will likely be unable to also support the IT cyber security and IT management and analysis areas". Please identify the CSM/CDN PWS sections/areas in the PWS where there is a potential for OCI with the CS Risk Management and the other programs.

The PWS Paragraph 3.1 (Performance Objective #1) has a potential for OCI with the TEAMS Cybersecurity Compliance and Risk Management contract and the Information Technology and Management Analysis contract.

20 Attachment L-09 Page 1 Historical Information Please clarify the current FTE staffing as well as anticipated, if different.

The current staffing is based on the incumbent's unique approach to meeting the Governments requirements and will not be provided. This requirement is performance based as such, the staffing will be based on each offeror's unique approach to meeting the Governments requirements.

21 Section L Technical Subfactors 2 through 4 Is it your intent for companies which have a BMDS core competency to have an advantage in the evaluation of proposals?

It is not the intent of MDA to require specific knowledge of the BMDS to respond to the RFP. Updates will be made to the PWS and Sections L&M in the Final Request for Proposal (RFP).

22 Attachment L-09 Page 1 Historical Information Can you provide the current FTE effort, by labor category? No, the FTE and labor category performing is based on the incumbent's unique approach to meeting the Government's requirements and will not be provided.

23 Section L and Attachment J-01 PWS

Scenarios It appears as though the scenarios which industry must respond to require some innovation, but the PWS requirements tend toward simple compliance. Can you provide some insight as to how innovative responses will be evaluated?

The PWS contains requirements for innovation. PWS 3.1.3.d establishes the requirement for innovative cybersecurity models and 3.2.3.c establishes the requirement for innovative computer network defense models.

The Government will evaluate each offeror's proposal in accordance with the criteria specified in Section M of the solicitation.

24 Attachment L-09 Page 1 Historical Information Does this chart contain the correct number of seats? Is it correct that Fort Belvoir, VA does not have any seats?

The Historical Information is correct. There are no seats at Ft. Belvoir. The PWS will be revised in the Final Request for Proposal (RFP) to indicate that there are no seats at Ft Belvoir, VA.

25 Section L Page 14 L-9.1 For purposes of paragraph (d)(1) of FAR 52.219-9, propose the following percentages as a minimum: Small Business subcontracts:

80%. Also Note: The above small business percentages are expressed as a percentage of the Total Subcontracting Dollars. We have not been able to find other Small business percentage goals in the RFP.

Based on this if the prime contractor chooses to have no subcontractors then 0% needs to go to small businesses. Is this a correct interpretation? Additionally, if the prime contractor wanted to build a strong and deep team by including another large company for 20%, they would have to give the rest of the whole effort to small businesses and have 0% for themselves. This does not seem to be in the best interest of the government.

Yes, this is a correct interpretation. However, Section L-

9.0 outlines the requirements for the Small Business Subcontracting Plan.

Sheet1