HS002121R7234 0001 - Question_ Answer Matrix.xlsx
XLSX spreadsheet 24 KB Posted
- Solicitation number
- HS002121R7234
About this file
This document contains a question and answer matrix regarding a solicitation for access to publicly available electronic information and social media data. The solicitation seeks a software tool and associated training to provide Defense Counterintelligence and Security Agency analysts automated access to publicly available information on individuals, including social media data. The tool must have capabilities such as conducting broad internet scans and maintaining continuous checks on individuals as often as weekly. Thirty licenses for government users are required, with an estimated 6,000 searches and reports to be conducted annually. The government intends to award a single contract based on a tradeoff decision and has changed the evaluation criteria to technically acceptable.
The document provides responses to vendor questions seeking clarification on requirements such as the need for professional services, acceptable identity resolution methods, data retention responsibilities, and policy exemptions. It also addresses questions regarding search criteria details, language requirements, concurrent users, definition of key terms, and whether additional analysis or recommendations are required.
View the file
Other files
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
PAEI Q&A
Defense Counterintelligence and Security Agency Defense Insider Threat Management Analysis Center Combined Synopsis/Solicitation No. HS002121R7234 Access to Publically Available Electronic Information and Social Media Data Question/Answer Matrix
| Question No. | Reference Page | Question / Comment / Proposed Language | Government Response | |
| 1 | Would DCSA consider awarding multiple contracts to allow it to assess the capabilities of different systems to meet the agency’s needs? | Due to budgetary constraints, the Government intends to award a single contract. | ||
| 2 | We understand that DCSA is looking for 30 licenses for which approximately 6000 searches for specific individuals will be conducted. | |||
| Is that correct? | DCSA is anticipating the need for 30 analysts to be able to utilize the capability on anywhere from 3,000-6,000 cases per year | |||
| 3 | Our understanding is that each search for a specific individual will result in a report. | |||
| Is that correct? | That's up to the vendor on how they organize their capability. We anticipate running reports on the majority of our cases, and we will need the reports or other appropriate response for each query. | |||
| 4 | Page 3 | Our understanding is that by virtue of including dark web in the introductory paragraph on page 3 that DCSA considers information on the dark web to be public information within the context of the RFP, is that correct? | Correct. All information should be availed to members of the public without using false personas or necessarily affiliating with the individuals or groups | |
| 5 | Given the flexibility of the pricing approach allowed by the terms of the RFP in Section G1, how is the government going to determine the lowest price? As such, would the government consider changing the procurement to a tradeoff decision? | The Government intends to award based upon a tradeoff decision. (See Amendment 0001, Section G., Evaluation Factors for Award.) | ||
| 6 | Would the government consider requiring a sample report as an attachment to and in addition to the five page technical narrative, so as to allow the Agency to gain insight into the capabilities of the offeror? | The concern becomes the potential for overlooking critical aspects and information that may be overlooked but pertinent to building a broader persona of the primary actors searched | ||
| 7 | Vendor notes Section 1.13 states “Contractor’s technical solution shall have the capabilities outlined and therefore should not require customization in regards to professional services.” | |||
| In several areas of the solicitation, such as Section 1.4 and 1.8, it is not clear if the Government seeks a Contractor’s software alone (Contractor’s Tool) or if the requirements also include a Contractor (see 1.8) – suggesting the requirement for professional services. | The Government is seeking a software tool/capability and associated training on how to use the tool to set up search parameters. | |||
| 8 | Is the Government looking for Professional Services or an OSINT/PAEI SME to support 1.8 or is it technically acceptable to establish initial capabilities in the development of search criteria through on boarding and training? | The Government is seeking training to understand how to set up search criteria and ensure there is knowledge of how to utilize the Contractor's tool/solution, as well as how to modify future search capabilities in the future to meet emerging requirements and changes. | ||
| 9 | Section 1.4 states “The Contractor shall deliver an automated report of data meeting the search criteria for the primary actor(s) searched.” |
| Please clarify if it is technically acceptable if the software solution enables the analyst to generate a report or if a Contractor/Professional Services are envisioned to meet this requirement. | It is expected the tool/solution will produce this capability for DITMAC analysts to review and analyze, adding it to existing information to improve analytic product quality. | ||
| 10 | Section 3.4 suggests that some licenses will not be used until additional analysts are brought on board. Will the Government consider a user license model wherein a license can be used at different times by more than one user? | DoD regulations do not authorize the sharing of passwords, if that's what this means. However, if an analyst departs, we will need to have a follow-on analyst take on that license. | |
| 11 | Please advise approximately when new DITMAC analysts referenced in Section 3.4 will be brought on board and if the estimated quantity of searches/reports provided includes these new analysts. | This would be for new hires and replacements of departed analysts, or in the event that future analytic requirement grows. | |
| 12 | Aside from the RFI (HS0021-21-SS-PAEI), please advise what other market research the Government has conducted, including any solution demonstrations, vendor briefings, webinars, etc., to learn about PAEI capabilities. | Aside from Sources Sought Notice HS0021-21-SS-PAEI, the Government's market research methods including viewing demonstrations, reviewing similar requirements and recent procurements within DCSA, and reviewing systems such as the System for Award Management and the Federal Procurement Data System. | |
| 13 | Please itemize the anticipated volume of searches to be conducted and the anticipated volume of reports to be generated referenced in Section 1.1. | Approximately 6,000 reports per year. After each query, the Government expects to receive a report. | |
| 14 | Section 1.8.1 requires “The capability to broadly scan the internet based on a known primary actor”. Please detail the search criteria generally available on a known primary actor. | This is variable, but may include limited information such as name and current/previous addresses | |
| 15 | Section 1 (Access to PAEI and Social Media Data): Please advise the minimum number of social media platforms required for a Vendor’s solution to be considered technically acceptable. | There is no minimum number - the solution sought will have all requirements met, particularly a wide range of search criteria and capabilities, identity resolution capabilities, and solution results as indicated | |
| 16 | The Government specifies 30 user accounts. Can you specify the number concurrent users you expect? This impacts the number of nodes that wed expect to allocate to support the portal. | At this time, we anticipate there could be approximately 30 personnel using this capability at any given time. | |
| 17 | Can you define the term “known primary actor”? Are these individuals for whom the Government already has baseline information (real name or internet pseudonym, IP addresses, location, associations) for whom the wishes to monitor on internet activity, or are these individual that the Government seeks to identify based on specified internet activities. | The Government will have limited information (full name and perhaps additional data, such as current or former addresses) available | |
| 18 |
Does the Government have any defined language requirements for PAI searches? Will the government provide analysts with linguistic skills or is language a contractor provided requirement?
If so, are there specific languages that are of interest or should be a priority?
| At this time there are no additional languages necessary for the contract. |
| 19 |
Does the Government require any geospatial resolution?
| Not at this time. | ||
| 20 | Can the Government specify retention requirements for date that the contractor aggregates on the Government’s behalf? | The Government will retain responsibility for retention of query data and resultant reports. The Contractor shall retain license/user information and metrics required for the production of audit reports described under section E.3. |
| 21 | Because of the nature of the requirement, the solution may aggregate data or content that would otherwise be screened or forbidden based on standards for NIPRnet. Will with Government make appropriate policy exemption and/or provision for this fact. | The Government scoped this to try to ensure we maintain standards with policies and requirements for privacy, civil liberties, and IT standards and configurations. |
| 22 | Would the Government consider provisioning accounts for users in a misattributed non-DoDIIS environment, to reduce restrictions on content and potential exposure of users and risk to Government networks. | Not at this time. This would require additional consideration for things like cover plans and determination that insider threat activities are investigative services, which they are currently not considered. It is scoped as it is because of current limitations and standards. |
| 23 | DCSA has indicated that they will be seeking continuous checks on some individuals as often as weekly. Will each such continuous check constitute an additional search to be part of the approximate 6000 searches/reports or would DCSA consider these continuous checks to be part of the one search/report of the primary actor? | Under our current caseload, this would fit as an additional search. This would be somewhat defined based on the criteria of the vendor. |
| 24 | While this effort is primarily focused on insider threats, has the Government considered associated relationships via PAEI reporting which could be provided to other Federal Agencies (i.e. FBI Joint Terrorism Task Force (JTTF) Officers in order to conduct threat assessments for terrorism, TOC, or other criminal activity? | Activities undertaken by the JTTF and other legal activities will be supported by MCIOs and coordinated through those channels. At this time, it is beyond the scope of activities included in this effort. |
| 25 | The technical requirements describe the need for various raw internet scans as well as monthly audit reports to be provided. Does the Government additionally require expertise (law enforcement training) to provide detailed reports/analysis of the scan results along with potential recommendations? | The Government has law enforcement expertise available to it to evaluate consolidated data. |
| 26 | Regarding the table in RFP paragraph E.1.1 indicating a quantity of 30 Government licenses/user accounts and approximately 6,000 PAEI searches/reports per year, and the additional requirement in RFP E.1.5.5 for “The capability to not only conduct a single check on an individual for existing information but to maintain continuous checks with frequency no less than weekly on a known actor during the period of time the individual’s case remains open” will the Government please clarify the number of searches required? Given the requirement for continuous checks, would 6,000 searches per month for a total of 72,000 annually, or 6,000 searches per user per month for a total of 180,000 annually be more appropriate? | The Government prefers to use 30 licenses for searches. However, if the vendor prices based on reports, we anticipate 3,000-4,500 cases submitted to the DITMAC annually, with some which will not require searches at all and some which will require continuous search capabilities to determine changes in activities or behaviors by individuals. We do not anticipate, between initial searches and continuous searches, the requirement to exceed 6,000 total searches for the year, at least initially. |
| 27 | Regarding the table in RFP paragraph E.1.1 indicating a quantity of 30 Government licenses/user accounts and approximately 6,000 PAEI searches/reports per year, does 6,000 searches reflect the number of subjects being searched and/or the frequency of the search on a given subject(s)? | The Government prefers to use 30 licenses for searches. However, if the vendor prices based on reports, we anticipate 3,000-4,500 cases submitted to the DITMAC annually, with some which will not require searches at all and some which will require continuous search capabilities to determine changes in activities or behaviors by individuals. We do not anticipate, between initial searches and continuous searches, the requirement to exceed 6,000 total searches for the year, at least initially. |
| 28 | Our understanding is that companies that solely produce Commercial-Off-The-Shelf (COTS) products do not require CMMC certification, therefore will the Government please consider removing the requirement? | The clause at DFARS 252.204-7021, Contractor Compliance with the Cybersecurity Maturity Model Certification Level Requirement, has been removed; however, the Government reserves the right to include it prior to award if found applicable to the apparent awardee's proposed solution. |
| 29 | Is this new work or existing work? If this is existing work will the Government share the name of the incumbent vendor? | New. |
| 30 | Based on the requirements and technical expertise necessary to provide the Government with the expected results, LPTA as an evaluation criteria potentially introduces risk to the Government and vendor for non-performance. Will the Government consider changing the evaluation criteria to best value/technically acceptable to reduce risks for both parties? | The Government has changed the Evaluation criteria for this solicitation. Please review Section G. Evaluation Factors for Award. |
| 31 | Are there current commercially available tools being used for this effort today, if so, will the Government provide a list of the vendor tools? | This is a new requirement. |
| 32 | Can the Government clarify/provide the estimated LOE? For example; Is this requirement in support of the initial background investigation process, or the continuous monitoring requirement, or the audit phase or all three? | This supports the insider threat mission, not support the personnel vetting initiative. |
| 33 | What "initially limited data sets" will be provided to "conduct extremely accurate identity resolution"? | This is variable, but may include limited information such as name and current/previous addresses |
| 34 | Will the government define what extremely accurate means to them? | The value in conducting these types of queries is in knowing that the results are accurate and can be used to help the evaluative process. Extremely accurate leaves very little room for error. We realize that providing additional data up front will increase the accuracy. Some of that depends on what the Government has available for use. |
| 35 | Can training be delivered via a Learning Management System or is instructor led training required? | Training may be delivered via an online Learning Management System; however the Government's preference for this requirement is instructor led training. The initial training as shall be instructor led training. Instructor led training may be provided virtually. |
File details come from the government source that posted it. Updated .