Government_Response_Guide_28 JUL 2026.docx

Government Response Guide July 28, 2026 Vendor Q&A and Government Response Guide Theme 1: Enterprise Scope & Workload Metrics Q: Is this a recompete? If so, what is the contract number, incumbent, annual value, and historical staffing level? (MECC answers this) A: Yes, this is a recompete. Contract: [HQ072721F0024]. Incumbent: [CSCI]. Historical Value: [$450k/12months]. Historical staffing: Approx. [1.2] FTEs or [2400] hours.

Q: Is there a transition or phase-in period with the incumbent (CSCI)?

A: Yes, an incumbent staff transition and phase-in period of 30 days is anticipated. The incoming contractor will be expected to coordinate with the incumbent personnel for knowledge transfer during this period.

Q: Will the Government provide the incumbent’s current test plans, test results, project plans, dashboards, workflows, CPAR/DARA records, and other program artifacts at award?

A: Yes. The Government will provide the awardee with access to current program artifacts, historical records, and existing workflows at the time of award to facilitate the transition. The Government retains possession of these artifacts.

Q: How many DMEA organizations, directorates, laboratories, and personnel are in scope?

A: The scope encompasses the DMEA Complex at McClellan, CA. There are approximately [10] Divisions, [1] accredited lab, and [200] personnel involved.

Q: Are there geographically dispersed DMEA facilities or contractor-operated environments?

A: Contractor employees could perform this work at McClellan, with possible onsite visits to FL, PA (other) facilities, and from their facilities or telework (as authorized by the contractor and in compliance with DMEA security/cybersecurity requirements for GFE).

Q: How many enterprise systems, processes, risks, and controls are documented and in scope?

A: DMEA tracks approximately [8] primary systems, [25] business processes, [15] active enterprise risks, and [170] controls across all frameworks.

Q: Does DMEA anticipate material changes during the base period to the number of processes, controls, laboratories, systems, or organizational units included in the ERM/RMIC program?

A: The Government does not anticipate material changes (e.g., significant additions or reductions) to the number of systems, processes, controls, or laboratories during the base period. The provided metrics represent a stable baseline. [If applicable: However, minor adjustments as part of normal continuous improvement should be expected].

Q: What is the current maturity level of the ERM/RMIC program?

A: The program is currently at a “Quantitatively Managed” level (Maturity Level 4). The Contractor is expected to maintain and help transition it toward an “Optimized” level (Maturity Level 5). (I used the CMMI levels as there are no specified maturity models for RMIC. If there is a model that should be used, please send it to me so I can select our current level from its descriptions).

Q: Does the PWS mandate a specific maturity model or CMMI?

A: The Government does not mandate a specific maturity model for the ERM/RMIC program. In the absence of a mandated model, utilizing the CMMI framework is an acceptable approach for proposal and execution purposes.

Q: Is the Government seeking additional or optional features beyond the PWS?

A: The Government is not seeking additional or optional features beyond what is explicitly required in the PWS. Offerors should focus their proposals on meeting the stated requirements.

Theme 2: Technology, Systems, and Data Integration Q: Is DMEA utilizing a centralized GRC platform? Is the contractor expected to build, buy, or migrate software?

A: DMEA does not license a commercial GRC platform. No new software procurement or massive data migration is required. Operations use existing GFE (ServiceNow, SharePoint).

Q: Can the Government provide the names or types of the 8 information technology and networking systems mentioned in the PWS?

A: For proposal purposes, a general enterprise-system category is sufficient. However, for context, the primary systems in scope include: SharePoint, ServiceNow, and MS Teams. Specific access and architecture details will be provided to the awardee post-award.

Q: What system integrations, workflow automation, and reporting are expected under PWS 3.3.1?

A: “System integration” means providing improvements to existing GFE configurations. The contractor will optimize SharePoint sites, ServiceNow workflows, and dashboards.

Q: Does the PWS dictate specific administrative privileges or require direct configuration in SharePoint/ServiceNow?

A: Contractor personnel will not be granted direct configuration or administrative rights within ServiceNow and SharePoint. System modifications and workflow configurations must be submitted as change requests to the DMEA IT Directorate.

Theme 3: RMIC, OMB A-123 & Risk Management Operations Q: How many audits, assessable units, and key controls are tested annually?

A: DMEA has [13] assessable units with [170] RMIC controls tested annually. [1] major internal assessment cycle, with [1-2] single-unit, out-of-cycle assessments, occurring each year.

Q: Is the contractor expected to conduct independent testing or merely facilitate?

A: The contractor shall execute independent testing/analysis in coordination with process owners and program manager, though the Government makes the final determination.

Q: How many findings, CPARs, DARAs, and material weaknesses are managed annually? Does the contractor perform root-cause analysis?

A: DMEA manages [8] CPARs/DARAs and [6] findings annually, with [0] material weaknesses. Yes, the contractor facilitates root-cause analysis with process owners and program manager.

Q: What current pain points should the contractor prioritize, such as manual evidence collection, outdated process documentation, recurring deficiencies, delayed CPAR closure, or limited control-health reporting?

A: While the PWS outlines the comprehensive requirements, current programmatic priorities include automating both process documentation validation and manual evidence collection. Offerors should base their technical approach on fulfilling all PWS requirements efficiently.

Q: How many risk owners and executive boards participate? Are taxonomies established?

A: Approx. [21] risk owners and [9] executive stakeholders participate. Taxonomies and impact criteria are already established under DMEA Policy 5010.40.

Q: Should required training be delivered onsite, virtually, or through a combination, and what are the estimated audience size and number of sessions?

A: Training may be delivered virtually via MS Teams, onsite, or via a hybrid approach. The contractor should anticipate two audiences with sizes of approximately 10 (leadership team) and 25 (process owner) personnel, distributed across 2 training sessions annually.

Q: What is the CDRL A008 submission cadence and Government review process?

A: As stated in CDRL A008: Shall be submitted quarterly based on Office of the Deputy Chief Financial Officer, Office of the Under Secretary of War (Comptroller) annually published guidance “Title: DEPARTMENT OF WAR OMB Circular A-123 Implementation Handbook Fiscal Year 202X". So the cadence is really dependent on the Handbook publication’s specified quarterly dates. If disapproved, the contractor shall resubmit within 7 calendar days. Following the initial submission, the Government will have 15 calendar days to review and approve or disapprove.

Theme 4: Cybersecurity & ISO Frameworks Q: Is compliance with DoDI 8510.01 (Cyber RMF), CMMC, or NIST 800-53 in scope?

A: No. Cybersecurity authorization (ATO/cATO) is out of scope. High-level IT risks are in the ERM, but deep technical security control testing is handled by DMEA’s IT division.

Q: Which organizations/labs are certified under ISO 9001 and ISO 17025? Are other ISO standards in scope?

A: The organic engineering (design, manufacturing, product support, packaging, and data package) is ISO 9001 registered. The Science and Engineering Gamma Irradiation Test lab is ISO 17025 accredited. No other ISO standards are in scope.

Q: Is there an expectation to maintain a unified catalog and map ERM/RMIC to ISO requirements?

A: No. ISO-9001 requirements are mapped to the RMIC framework where they apply within DMEA.

Q: Is a current NIST SP 800-171 DoD Assessment Methodology score in SPRS required before award or contract performance? If so, what assessment level or minimum score is required?

A: Because all CUI processing is expected to occur on GFE, an SPRS score is required prior to award.

Q: Will all CUI be accessed, processed, stored, and transmitted exclusively through Government-furnished equipment and Government systems?

A: Yes. All CUI must be accessed, processed, stored, and transmitted exclusively through the provided Government-furnished equipment (GFE) and Government systems. No CUI is authorized to reside on the contractor's corporate network.

Theme 5: Staffing, Clearances, and Submission Rules Q: What security clearance, suitability, and facility-clearance (FCL) requirements apply?

A: All onsite personnel require a CAC for CUI level access. A Secret Clearance and above is not required. An FCL is not required.

Q: Contractors need CAC cards?

A: Yes, CAC grants "logical access" (login rights) to a secure government network via Government laptop and requires a Tier 1 background check. Because a full Tier 1 investigation can take weeks or months to finalize, the government is authorized to issue the physical CAC on an interim basis as soon as the contractor's FBI fingerprint check and initial database checks return with favorable results.

Q: Will Tier 1 background investigation and CAC processing begin after notice of apparent award or only after contract award?

A: Tier 1 background investigations and CAC processing can be initiated only after official contract award.

Q: What is the specific timeline for the interim CAC process and GFE provisioning to help build a transition-in schedule?

A: Historically, the timeline from contract award and favorable fingerprint results to interim CAC issuance and GFE (laptop) provisioning is approximately 14 days. Offerors should build their transition-in schedules using this estimated timeframe for the 1 October 2026 performance start.

Q: What percentage of work is onsite? Are specific roles full-time? What about travel?

A: Approx. [5%] onsite and [95%] telework. No strict full-time mandate, but the PM/Lead Auditor must be dedicated. Travel is cost-reimbursable (2 times a year to DMEA).

Q: Does “dedicated” mean the PM/Lead Auditor may not support other contracts, or only that the individual must remain consistently assigned to this effort?

A: By 'dedicated,' the Government means that the PM/Lead Auditor must remain consistently assigned as the primary point of contact and available to support this effort during core business hours, though they are not strictly prohibited from supporting other efforts.

Q: Is the PM/Lead Auditor designated as key personnel, and must that individual be named in the quotation?

A: The PM/Lead Auditor is not designated as Key Personnel. Offerors are not required to name this specific individual and provide their resume within the quotation.

Q: Are there minimum qualifications or certifications required for the PM/Lead Auditor?

A: The Government does not mandate specific certifications for this role. The PM/Lead Auditor must have the following minimum qualifications: 5 years of experience in SOX, financial, and/or operational controls auditing in a US Government, preferrable Department of War, organization.

Q: May offerors use subcontractor past performance, key-personnel experience, or both to demonstrate relevant experience?

A: Offerors may use subcontractor past performance, and may use the experience of proposed key personnel to demonstrate relevant past performance. Subcontractor past performance will be weighted based on their proposed level of effort.

Q: Do commercial or government references carry different significance?

A: The Government will evaluate Past Performance strictly in accordance with the evaluation criteria stated in the solicitation. Commercial and government references will be evaluated equally based on size, scope, and complexity.

Q: Do the 2 trips per year to McClellan include the FL/PA trips, or are those in addition?

A: Visits to FL, PA, or other contractor-operated facilities are in addition to the estimated two (2) trips per year to McClellan, CA. Offerors should base their travel pricing on a total of 4 trips per year. To ensure parity in Volume II pricing, the Government establishes a not-to-exceed (NTE) travel plug-in value of $16,000.00.

Q: Does the Government anticipate surge requirements for the Statement of Assurance?

A: No. Workload is distributed across the year to avoid surge for testing.

Q: Are resumes excluded from the page limit?

A: Yes, resumes are excluded from the page limit.

Q: Are the Service Contract Labor Standards (formerly the Service Contract Act) applicable to this requirement?

A: The Service Contract Labor Standards (formerly the Service Contract Act) are not applicable to the labor categories under this requirement.

Q: What is the process for post-award feedback or debriefings?

A: This requirement is a commercial acquisition valued under $9 million and is being conducted using simplified procedures under FAR Part 12. As such, the formal debriefing procedures and timelines outlined in FAR Part 15 do not apply to this solicitation. In accordance with FAR 12.301(b), the Government will provide a brief explanation of the award decision to any unsuccessful offeror upon request.