HSCECR-14-R-00001_Amd_5.pdf

(x)

HSCECR-14-R-00001

x x copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted; or (c) By separate letter or telegram which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGEMENT TO BE RECEIVED AT

THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by telegram or letter, provided each telegram or letter makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

x

Washington DC 20536 Attn: William Quigley

ICE/DM/DC-DC

801 I Street NW, Suite930 Office of Acquisition Management Immigration and Customs Enforcement ICE/Detent Mngt/Detent Contracts-DC

Washington DC 20536

ICE/DM/DC-DC

801 I Street NW, Suite 910 Office of Acquisition Management Immigration and Customs Enforcement ICE/Detent Mngt/Detent Contracts-DC

06/05/2014000005

13. THIS ITEM ONLY APPLIES TO MODIFICATION OF CONTRACTS/ORDERS. IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

12. ACCOUNTING AND APPROPRIATION DATA (If required) is not extended.is extended, Items 8 and 15, and returning

Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended, by one of the following methods: (a) By completing

The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offers

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

FACILITY CODE CODE

10B. DATED (SEE ITEM 13)

10A. MODIFICATION OF CONTRACT/ORDER NO.

9B. DATED (SEE ITEM 11)

9A. AMENDMENT OF SOLICITATION NO.

CODE

8. NAME AND ADDRESS OF CONTRACTOR (No., street, county, State and ZIP Code)

7. ADMINISTERED BY (If other than Item 6)CODE 6. ISSUED BY

PAGE OF PAGES

4. REQUISITION/PURCHASE REQ. NO.3. EFFECTIVE DATE2. AMENDMENT/MODIFICATION NO. 5. PROJECT NO. (If applicable)

1. CONTRACT ID CODE

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

06/05/2014

CHECK ONE A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE CONTRACT

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority) appropriation date, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(b).

E. IMPORTANT: Contractor is not, is required to sign this document and return __________________ copies to the issuing office.

ORDER NO. IN ITEM 10A.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

THE PURPOSE OF AMENDMENT 000005 TO SOLICITATION HSCECR-14-R-00001 IS AS FOLLOWS:

1) To provide Questions and Answers (SCA Applicable positions included)

2) Revise and replace Attachment 6, Page 2

3) Provide information that relates to OCIO Standards.

Period of Performance: 09/06/2014 to 09/05/2019

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)15A. NAME AND TITLE OF SIGNER (Type or print)

15C. DATE SIGNED 16B. UNITED STATES OF AMERICA 15B. CONTRACTOR/OFFEROR 16C. DATE SIGNED

(Signature of person authorized to sign) (Signature of Contracting Officer)

STANDARD FORM 30 (REV. 10-83)

Prescribed by GSA

FAR (48 CFR) 53.243

NSN 7540-01-152-8070

Previous edition unusable

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

Questio n

Number:

RFP

Reference Question/Comment

1.

Attachment 6,

11. MULTI-

LINGUAL

TELEPHONIC

VOICE

RECOGNITION

VERIFICATION

REPORTING

SYSTEM

“g. Desired languages at a minimum are English, Spanish, French, German, Greek, Korean, Japanese, Dutch, Kurdish, Armenian, Swahili, Polish, Italian, Indonesian, Mandarin, Cantonese, Fuzhou, Haitian Creole, Vietnamese, Cambodian, Khmer, Thai, Lao, Russian, Farsi, Arabic, Hindi, Urdu, Portuguese, Canjobal, Kiche, Somali, Bengali, Punjabi and Gujarati.”

a. What specific languages are presently supported by the incumbent contractor? OAQ – ISAP II lists the following. English, Spanish, Chinese (Mandarin, Cantonese, Fuzhou), Creole (Haiti), Vietnamese, Cambodian, Lao (Laos), Russian, Arabic, Hindi (India), Urdu (Pakistan), Portuguese, Canjobal/Quiche, Somali, Hindi (Bengali, India).

b. To our knowledge, no known TELEPHONIC VOICE RECOGNITION / VERIFICATION REPORTING SYSTEM supports these cumulative languages. May proposers utilize contacted translation services to accommodate this broad language support requirement? The Government requires the support for the languages presently supported by the incumbent contract (listed in the answer above). However the vendor should be capable of expanding future languages at Government discretion.

The Government would like more voice support for this requirement.

2. General

From our experience, many leading manufacturer’s offer multiple models of the specified technologies and also offer optional/alternate/additional forms of monitoring technology. We have several questions here:

a. In addition to the primary proposal/responses, may proposers include separate technical information and separate pricing under a separate “Optional” section of their proposals for post award consideration as unspecified options for additional/optional methods? Offerors may include multiple technology submissions as part of their response. Any difference in pricing should be clearly identified using the format in Section B. Any additional technology submissions will count towards the 60 page limit identified in Section L of the RFP. As referenced in Section L offerors may not submit more than one proposal.

b. If not, how would ICE recommend proposers to identify/propose/price multiple models, options and alternatives in response to this solicitation?

See above.

3.

Applicability of the Service Contract Act.

The RFP does not address whether the Case Specialist position or Administrator position are subject to the Service Contract Act. It would appear that the nature of these positions makes them applicable to the Service Contract Act. Would you please clarify if the SCA is applicable to the ISAP III contract? If so, what labor categories are applicable? The RFP contains FAR Clause 52.222-41. The Service Contract Act applies to both the Case Specialist and Administrative Assistant positions. The occupation codes are 27101 for Case Specialists and 01280 for the Administrative Assistants.

4.

Section L, INSTRUCTION

S TO

OFFERORS,

“The 60-day transition-in period will be required to ensure an orderly transition from the existing contract with no degradation of service.” We respectfully note that no contractor in the history of the industry, including but not limited to the incumbent ICE contractor on the prior/incumbent contract has ever deployed this volume of units within “60 days.” Such an

Number:

RFP

Reference Question/Comment

SPECIAL

NOTES TO

OFFERORS,

item 5 unreasonable transition scheme appears indicative to favor and/or grant preference to the incumbent contractor. To enable competition, will ICE please amend the transition timeline to provide for a more reasonable 90 to 120 day transition timeline? The Governments intent is not to favor any contractor over another. The 60 day phased transition is intended for the convenience of the Government and the participants in the program. The number of field offices required on the ISAP III should allow for an easier deployment than the previous contract.

5.

Attachment 6,

1. GPS ANKLE

BRACELETS

AND

TRACKING /

MONITORING

SYSTEM

a.Is ICE seeking a 1-piece body attached GPS device or a multi-piece GPS device? 1-piece.

b. If proposers offer both a 1-piece body attached GPS device model and a multi-piece GPS device mode, may they propose both models pricing each model separately for evaluation by ICE? Yes. See answer to Question 2 above. The Government preference is for a 1-piece GPS device. The price will be evaluated for reasonableness.

c. The requirement “4. Signal Range Extender – On an as needed basis, the contractor shall provide a signal range extender to participants to use at their home or office, at no additional cost. A Signal Range Extender shall provide a reliable Radio Frequency (RF) link that serves as a transmitter.

When the client comes within range of a signal range extender, he or she is then monitored via RF technology while the tracking unit enters a low power state which conserves battery power while maintaining participant monitoring. The transmitter shall emit a composite RF signal at least once every 30 seconds. The signal content shall identify the Participant, power status, tamper/removal status and be encrypted to discourage duplication” is only involved in multi-piece GPS models. To enable proposal and ICE evaluation of both 1-piece GPS models and multi-piece GPS models, will ICE please clarify by amending this requirement, such as follows? “4.

Signal Range Extender – If proposing a multi-piece GPS model, On an as needed basis, the contractor shall provide a signal range extender to participants to use at their home or office, at no additional cost. A Signal Range Extender shall provide a reliable Radio Frequency (RF) link that serves as a transmitter. When the client comes within range of a signal range extender, he or she is then monitored via RF technology while the tracking unit enters a low power state which conserves battery power while maintaining participant monitoring. The transmitter shall emit a composite RF signal at least once every 30 seconds. The signal content shall identify the Participant, power status, tamper/removal status and be encrypted to discourage duplication”” Language is revised in attached page.

6.

2.

MONITORING

EQUIPMENT:

GPS ANKLE

BRACELET, b.

Transmitter Technology & Specifications, “1. The system must offer a “Locate Now” function that will enable the transmitting unit and monitoring system to have a continuous reporting mode with automatic location updates in real time or at a minimum of once per minute. This function will be accessible via secure Internet web browser and smart phone mobile application with turn-by-turn directions to device’s location. The “Locate Now” function will remain active for two (2) hours, after which time the GPS unit will resume normal operations.” As presently written this requirement is needlessly restrictive potentially prohibiting evaluation of advanced GPS

Number:

RFP

Reference Question/Comment

iii. GPS Transmitter Tracking Specifications systems that track this intensively in a default mode. In lieu of a manual “Locate Now” mode, will ICE accept and evaluate advanced GPS systems that in default mode to automatically captures location at a minimum of once per minute and reports this information making it accessible via secure Internet web browser and smart phone mobile application with turn-by-turn directions to device’s location at all times, not merely remaining active for two (2) hours? If so, will ICE please amend this requirement as follows? “1. The system must offer a “Locate Now” function, or tracking technology with a commensurate default tracking interval, that will enable…” Agreed on restrictive wording. The language update is acceptable.

7.

Technology & Specifications,

iii. GPS Transmitter Tracking Specifications

“1. All software must be compliant with ICE OCIO standards.” Will you please include a copy of the “ICE OCIO standards” with the answers to vendor questions? Two links have been attached below.

DHS 4300A –

http://www.dhs.gov/xlibrary/assets/foia/mgmt_directive_4300a_policy_v 8.pdf

NIST SP 800- http://csrc.nist.gov/publications/PubsSPs.html

8.

Attachment 6, 2.

MONITORING

EQUIPMENT:

GPS ANKLE

BRACELET, b.

Transmitter Technology & Specifications,

iii. GPS Transmitter Tracking Specifications

“4. Signal Range Extender – On an as needed basis, the contractor shall provide a signal range extender to participants to use at their home or office, at no additional cost. A Signal Range Extender shall provide a reliable Radio Frequency (RF) link that serves as a transmitter. When the client comes within range of a signal range extender, he or she is then monitored via RF technology while the tracking unit enters a low power state which conserves battery power while maintaining participant monitoring. The transmitter shall emit a composite RF signal at least once every 30 seconds. The signal content shall identify the Participant, power status, tamper/removal status and be encrypted to discourage duplication.” As presently written this requirement is needlessly restrictive potentially prohibiting evaluation of advanced GPS systems that track indoors using more highly advanced methods than RF. In lieu of a manual “Signal Range Extender”, will ICE accept and evaluate advanced GPS systems that track indoors using more highly advanced methods than RF with OUT the need for in home equipment such as a “Signal Range Extender”? If so, will ICE please amend this requirement as follows? “4. Signal Range Extender – On an as needed basis, the contractor shall provide a signal range extender, or advanced indoor tracking capability using more highly advanced methods than RF, to participants …” Yes, this is reasonable.

9.

2.

MONITORING

EQUIPMENT:

GPS ANKLE

BRACELET, b.

Transmitter

“7. The transmitter shall not require an external battery. The transmitter shall have an internal power source capable of functioning continuously for at least six (6) months. It shall transmit a signal to indicate when its internal power supply is low. The Contractor shall provide replaceable power sources for use in the transmitter when the contractor becomes aware that such replacements are necessary. The Contractor shall install replacement power sources within 24 hours.” As presently written this requirement is http://www.dhs.gov/xlibrary/assets/foia/mgmt_directive_4300a_policy_v8.pdf http://www.dhs.gov/xlibrary/assets/foia/mgmt_directive_4300a_policy_v8.pdf http://csrc.nist.gov/publications/PubsSPs.html

Number:

RFP

Reference Question/Comment

Technology & Specifications,

iii. GPS Transmitter Tracking Specifications needlessly restrictive potentially prohibiting evaluation of advanced 1-piece GPS systems that have sealed, internal, non-replaceable, rechargeable batteries capable of functioning continuously for approximately 24 hours on a single 1.5-hour charge. To enable proposal and ICE evaluation of both 1-piece GPS models and multi-piece GPS models, will ICE please amend this requirement as follows? “7. The transmitter shall not require an external battery. The transmitter shall have an internal power source capable of functioning continuously for at least six (6) months. It shall transmit a signal to indicate when its internal power supply is low. The Contractor shall provide replaceable power sources for use in the transmitter when the contractor becomes aware that such replacements are necessary. The Contractor shall install replacement power sources within 24 hours. or as an alternative, 1-piece GPS systems that have sealed, internal, nonreplaceable, rechargeable batteries capable of functioning continuously for approximately 24 hours on a single 1.5-hour charge?” This language has been revised in previous Amendments to delete the comments in question. Additionally information related to replacement parts has provided in section c. Spares and Maintenance.

10.

Attachment 6,

7. REMOTE

ACCESS TO

MONITORING

SYSTEM

“d. The remotely accessible system shall have an adequate security infrastructure to prevent unauthorized users from gaining access to participant data, ensuring that it meets current ICE OCIO compliance standards.” Will you please include a copy of the “ICE OCIO compliance standards” with the answers to vendor questions? The monthly scan information is attached to this amendment. Additionally, two links have been attached below.

DHS 4300A-

http://www.dhs.gov/xlibrary/assets/foia/mgmt_directive_4300a_policy_v 8.pdf

NIST SP 800- http://csrc.nist.gov/publications/PubsSPs.html

11.

Attachment 6,

8. REMOTELY

ACCESSIBLE

DATABASE

“a. The following minimum specification for database fields, functions, and reports are as follows:…” to enable proposers to identify compliance and any budget in advance any potential develop necessary, will you please identify if each of these filed is alphanumeric and the specific maximum character length necessary? The Government does not have this information.

12. General

Do the cars at C sites have to be “owned” by the contractor’s Corporation?

No. Would it be acceptable to reimburse Contractor’s staff in accordance with the FTR for mileage incurred by POVs during the performance of home visits? The Government requires that the contractor be able to conduct home visits within the requirements of ISAP III. In addition, why are cars necessary at every location, considering that public transit options are available in several major metropolitan cities? (NYC, SF, LA, and others) As long as the contractors are able to fulfill the requirements of ISAP III within the required time frames, the offeror solution may be acceptable.

http://www.dhs.gov/xlibrary/assets/foia/mgmt_directive_4300a_policy_v8.pdf http://www.dhs.gov/xlibrary/assets/foia/mgmt_directive_4300a_policy_v8.pdf http://csrc.nist.gov/publications/PubsSPs.html

Number:

RFP

Reference Question/Comment

13.

Instead of having administrative personnel based in every office, is there an option of having administrative hubs, as most of the work is electronically based and retrievable through a network? The offeror must comply with the requirements of ISAP III as outlined in the Statement of Work.

14. General

Instead of having offices in high-rent locations, is there an option of having offices only where an ERO office is in excess of 10 miles from the assigned Participants? No. The proximity of the contractor locations is to minimize inconvenience to the Government and the participants.

This is for the following reasons:

a. Having offices in NYC, SF, and in any number of high-rent locations is cost-ineffective, poses a security risk for staff as well as other building tenants and the community.

b. In addition, in high-rent locations, zoning laws and other regulations will prove difficult in finding acceptable office space. Considering that in the Government’s response to Question 36, the ERO offices are kept secret for security purposes, there is significant level of risk to staff, tenants and members of the community in areas where non-secure, non ERO offices are present. Minimizing the number of offices thus would be cost-effective and reduce overall risk.

15. General

Please confirm that a prime offeror that is a small business need not develop and submit Section V - Subcontracting Plan. Correct. FAR Clause 52.219-9 Small Business Subcontracting Plan, does not apply to small business concerns. The Government would like to know how much work the prime intends to perform on the contract. That information may be included in Section V- Subcontracting or elsewhere in the submittal.

16. General

The Seniority List provided is unsuitable to determine vacation costs as it is not divided by city location; wage determinations vary by county/region therefore vacation wages vary as well. In addition, it does not indicate whether it only contains CS/AA staff or if PMs are included as well. Without clarification, only the incumbent can properly bid the vacation/holiday pay element of pricing. The list contains CS/AA and PMs.

Can ICE please instruct the incumbent contractor to provide a list broken out both by location and by job title? This information is considered proprietary and confidential.

17.

Reference Section B, Section in Entirety, page 2-22:

We respectfully request that the Government consider creating separate CLINs for Alert Management in relation to Telephonic Reporting and GPS.

This request is based on the varying level of effort required to manage alerts based on technology type. Creating separate CLINs for Alert Management regarding Telephonic Reporting and GPS offers the

Number:

RFP

Reference Question/Comment

Government more value by distinguishing between Alert Management for disparate technology types.” The Government does not want to create separate CLINs for Alert Management for Telephonic Reporting and GPS.

18. General Will DHS consider extending the proposal due date? The proposal due date is not being extended at this time.

OCIO Standards

The Contractor shall provide all information from any managed device to ICE, as requested, and shall assist, as needed, to perform periodic vulnerability assessments of the network, operating systems, databases, and applications to identify vulnerabilities, propose mitigations and remediate any findings.

Vulnerability assessments/scans shall be included as part of compliance with the continuous monitoring of the system.

All systems and network devices shall be scanned monthly using a general purpose vulnerability scanner. In March 2011, the Chief Information Security Officer (CISO) Council agreed to use Tenable Nessus as a general purpose vulnerability scanner for DHS. The contractor shall use a general purpose vulnerability scanner (e.g. Tenable Nessus) to scan the network and servers. The collection of continuous monitoring data or vulnerability scan results shall contain the DHS-required data elements, which ICE will provide to the contractor. DHS periodically updates requirements or changes data element requirements. The contractor shall make any changes necessary to comply with the new DHS requirements within 15 business days of notification. The following report formats shall be provided to ICE by the 5th of each month:

1. If using Nessus, the Nessus raw format (aka .nessus format) shall be provided to ICE. If not using Nessus, CSV or OVAL format shall be provided to ICE.

2. In addition an easily readable format of scan results shall be provided in the PDF format to ICE.

These monthly scan reports/data using a general purpose vulnerability scanner shall provide, at least, the following fields:

• FISMA ID

• Hostname

• CPE

• Date of Last Scan

• Device Role

• CVE

• CVSS

• CCE

• CCE Name

• Compliance

• Anti-Virus

• Last Definition File Update

• Name of Last Patch

• Date of Last Patch

• Credentialed

In addition to using a general purpose vulnerability scanner (e.g. Tenable Nessus) the contractor shall deploy tools to perform the following types of scans:

• Application Security Scans – the Application Security Scanner shall be able to identify potential application security vulnerabilities such as Input/Output validation issues (e.g. Cross-site scripting, SQL Injection, code execution), configuration mistakes and other application related vulnerabilities/issues. As an example, ICE uses HP WebInspect for scanning web applications.

• Database Security Scans – the Database Security Scanner shall be able to identify potential database security vulnerabilities, such as SQL injection, excessive user and group privileges, unpatched databases, default/missing passwords and other database related vulnerabilities/issues. As an example, ICE uses DbProtect and AppDetectivePRO for scanning databases.

The contractor shall perform vulnerability scans using an Application Security Scanner and a Database Security Scanner as requested by ICE and provide the scan reports to ICE within 5 business days from the time of the request. The contractor shall identify vulnerabilities, propose mitigations and remediate any findings as part of continuous monitoring and maintenance of the system. The application and database scanners shall provide, at least, any related CVE (with CVSS scoring) and CCE related information to vulnerabilities identified.