Gvt_response_guide v2.docx

Integrated Vendor Q&A and Government Response Guide

Government Response Guide

July 20, 2026

Theme 1: Enterprise Scope & Workload Metrics Q: Is this a recompete? If so, what is the contract number, incumbent, annual value, and historical staffing level? (MECC answers this) A: Yes, this is a recompete. Contract: [HQ072721F0024]. Incumbent: [CSCI]. Historical Value: [$450k/12months]. Historical staffing: Approx. [1.2] FTEs or [2400] hours.

Q: How many DMEA organizations, directorates, laboratories, and personnel are in scope?

A: The scope encompasses the DMEA Complex at McClellan, CA. There are approximately [10] Divisions, [1] accredited lab, and [200] personnel involved.

Q: Are there geographically dispersed DMEA facilities or contractor-operated environments?

A: Contractor employees could perform this work at McClellan, with possible onsite visits to FL, PA (other) facilities, and from their facilities or telework (as authorized by the contractor and in compliance with DMEA security/cybersecurity requirements for GFE).

Q: How many enterprise systems, processes, risks, and controls are documented and in scope?

A: DMEA tracks approximately [8] primary systems, [25] business processes, [15] active enterprise risks, and [170] controls across all frameworks.

Q: What is the current maturity level of the ERM/RMIC program?

A: The program is currently at a “Quantitatively Managed” level (Maturity Level 4). The Contractor is expected to maintain and help transition it toward an “Optimized” level (Maturity Level 5). (I used the CMMI levels as there are no specified maturity models for RMIC. If there is a model that should be used, please send it to me so I can select our current level from its descriptions).

Theme 2: Technology, Systems, and Data Integration Q: Is DMEA utilizing a centralized GRC platform? Is the contractor expected to build, buy, or migrate software?

A: DMEA does not license a commercial GRC platform. No new software procurement or massive data migration is required. Operations use existing GFE (ServiceNow, SharePoint).

Q: What system integrations, workflow automation, and reporting are expected under PWS 3.3.1?

A: “System integration” means providing improvements to existing GFE configurations. The contractor will optimize SharePoint sites, ServiceNow workflows, and dashboards.

Theme 3: RMIC, OMB A-123 & Risk Management Operations Q: How many audits, assessable units, and key controls are tested annually?

A: DMEA has [13] assessable units with [170] RMIC controls tested annually. [1] major internal assessment cycle, with [1-2] single-unit, out-of-cycle assessments, occurring each year.

Q: Is the contractor expected to conduct independent testing or merely facilitate?

A: The contractor shall execute independent testing/analysis in coordination with process owners and program manager, though the Government makes the final determination.

Q: How many findings, CPARs, DARAs, and material weaknesses are managed annually? Does the contractor perform root-cause analysis?

A: DMEA manages [8] CPARs/DARAs and [6] findings annually, with [0] material weaknesses. Yes, the contractor facilitates root-cause analysis with process owners and program manager.

Q: How many risk owners and executive boards participate? Are taxonomies established?

A: Approx. [21] risk owners and [9] executive stakeholders participate. Taxonomies and impact criteria are already established under DMEA Policy 5010.40.

Theme 4: Cybersecurity & ISO Frameworks Q: Is compliance with DoDI 8510.01 (Cyber RMF), CMMC, or NIST 800-53 in scope?

A: No. Cybersecurity authorization (ATO/cATO) is out of scope. High-level IT risks are in the ERM, but deep technical security control testing is handled by DMEA’s IT division.

Q: Which organizations/labs are certified under ISO 9001 and ISO 17025? Are other ISO standards in scope?

A: The organic engineering (design, manufacturing, product support, packaging, and data package) is ISO 9001 registered. The Science and Engineering Gamma Irradiation Test lab is ISO 17025 accredited. No other ISO standards are in scope.

Q: Is there an expectation to maintain a unified catalog and map ERM/RMIC to ISO requirements?

A: No. ISO-9001 requirements are mapped to the RMIC framework where they apply within DMEA.

Theme 5: Staffing, Clearances, and Submission Rules Q: What security clearance, suitability, and facility-clearance (FCL) requirements apply?

A: All onsite personnel require a CAC for CUI level access. A Secret Clearance and above is not required. An FCL is not required.

Q: Contractors need CAC cards?

A: Yes, CAC grants "logical access" (login rights) to a secure government network via Government laptop and requires a Tier 1 background check. Because a full Tier 1 investigation can take weeks or months to finalize, the government is authorized to issue the physical CAC on an interim basis as soon as the contractor's FBI fingerprint check and initial database checks return with favorable results.

Q: What percentage of work is onsite? Are specific roles full-time? What about travel?

A: Approx. [5%] onsite and [95%] telework. No strict full-time mandate, but the PM/Lead Auditor must be dedicated. Travel is cost-reimbursable (2 times a year to DMEA).

Q: Does the Government anticipate surge requirements for the Statement of Assurance?

A: No. Workload is distributed across the year to avoid surge for testing.

Q: Are resumes excluded from the page limit?

A: Yes, resumes are excluded from the page limit.