IVA_SOLICITATION_QUESTIONS_and_ANSWERS_06252013.pdf

In

Solic ndividua citation al Ident

H n Que tity Ver Suppo

HSFE80

Jun estions ification ort Serv

0-13-R-ne 25, 2013 s and n and A ices

-0005

Answ

Authenti wers ication

Solicitation HSFE80‐13‐R‐005 Identity Verification and Authentication Questions and Answers

2 | P a g e

1. After reviewing the questions and answers that you’ve posted, I see there seems to be a new requirement that was not supplied in the original RFP.

I’ve copied the following from the Q&A:

Question: Is the FISMA compliance required to be maintained at low, moderate, or high level of security?

Response: The FISMA compliance is to be maintained at a high level of security.

Can you provide clarity on this requirement? Specifically I would like to know if the current platform has received a FISMA High Certification and Accreditation (C&A), and if you can provide a copy of the current System Security Plan covering security assessment and control selections?

Response: This is not a new requirement as it was previously in the SOW. It was moved from another portion of the SOW. Refer to attachment 2.a and 2.b. The current platform is a FISMA high certification and accreditation.

2. Please clarify FEMA’s understanding of an ‘identity score’, describe any experience researching or utilizing an identity score as well as how you differentiate an identity score from your current solution.

Response: Scoring requirements have been removed from the solicitation; therefore will no longer be part of the evaluation. FEMA will require the outcome of “pass/fail” with reason codes provided by the contractor.

Refer to revised SOW for details.

Additionally, the response item #14 notes the requirement for a FISMA High security level.

14. 5.1 Identity Verification and Authentication Services

� Is the FISMA compliance required to be maintained at low, moderate, or high level of security?

Response: The FISMA compliance is to be maintained at a high level of security.

Is this correct that the awarded vendor must have a NIST 800-53 Certification and Accreditation to the "High" level? The most common requirement in the federal space for similar projects has been to maintain a FISMA Certification and Accreditation (C&A) at the "Moderate" level as outline in NIST 800-53. Would you be able to clarify this? Will waivers be provided to allow for vendors to increase their current C&A from "Moderate" to "High"?

FEMA Response: FISMA compliance will need to be High. Waivers will not be provided and any offeror would need a new ISA.