DHS_Responses_to_Industry_Comments_and_Questions_-_Draft_PWS_and_FRD.pdf

DHS Responses to Industry Comments and Questions – HSPD-12 Draft PWS and FRD

Vendor A

PWS/FRD Reference Vendor Comment/Question IMD / OCSO Disposition or Response

1. PWS Section 2.0, Subsection 2.1, Task 1

PWS Language: “Shall be capable configurable to support both slapped or rolled prints for personnel background screening to

USVISIT IDENT, FBI

IAFIS and/or OPM.”

Question: Under what circumstances would fingerprint data be sent to IDENT vs. FBI IAFIS vs. OPM for adjudication?

Suggestion/ Recommendation/ Leading Practice: Clarify the role of IDENT in the architecture versus direct submission of fingerprints to either FBI or OPM.

The role of the two systems is for the express purpose of exchanging data between the IDMS and IDENT to pass fingerprint information to the FBI IAFIS and to receive FBI criminal history data and other encounter information provided by IDENT.

2. PWS Section 2.0, Subsection 2.1, Task 1

PWS Language:

“Provide interfaces, connectors, and/or tools to integrate with Component ICAM solutions, logical and physical access control systems, and authoritative and consumer data sources (e.g., Active Directory, HR, ISMS, US-VISIT

IDENT), and database and directory integration services (e.g., Identity Hub).”

Question: Is an exhaustive list of external systems that require integration available?

Suggestion/ Recommendation/ Leading Practice: Provide a complete list of subsystems in the architecture that are currently integrated with the HSPD-12

IDMS/CMS.

An inclusive list of all external systems is not available. Sample of external systems were provided in the PWS.

3. PWS Section 2.0, Subsection 2.1, Task 1

PWS Language: The Contractor shall design and present a plan to modernize the DHS IDMS/CMS with the assistance of the program.

Question: What is the current software platform, database platform, and architecture for the HSPD-12 IDMS/CMS?

Suggestion/ Recommendation/ Leading Practice: Provide technical details on the current IDMS/CMS solution to include COTS product name/version, programming language, operating system, database and/or directory platform.

The current platform is based on the incumbent contractor, XTec, Inc.’s, AuthentX solution.

4. PWS Section 2.0, Subsection 2.1, Task 1

PWS Language: Provide interfaces, connectors, and/or tools to integrate with Component ICAM solutions, logical and physical access control systems, and authoritative

Question: What is "Identity Hub"? Does this refer to a specific COTS product, internally developed solution, or general concept for a to-be-developed system?

Suggestion/ Recommendation/ Leading Practice: Define the term Identity Hub in specific technical detail.

Refer to the Authoritative Attribute Exchange Service (AAES) in the FICAM Roadmap.

and consumer data sources (e.g., Active Directory, HR, ISMS, US-VISIT IDENT), and database and directory integration services (e.g., Identity Hub).

5. PWS Section 2.0, Subsection 2.1, Task 1

PWS Language: Deliver a standards based Enrolment and Issuance Workstation Station, with local personalization, identity enrolment, printing and end-to-end lifecycle management capabilities to support the lifecycle issuance and management of PIV, PIV- I, PIV-C, FAC and other credentials.

Question: What is the form factor of the FAC credential? Is this a smart card, prox card, or other form factor?

Suggestion/ Recommendation/ Leading Practice: Define the form factor of the FAC credential.

Smart card is the form factor.

REVISED PWS TO DELETE “FAC”

6. PWS Section 2.0, Subsection 2.1, Task 1

PWS Language: Deliver a standards based Enrolment and Issuance Workstation Station, with local personalization, identity enrolment, printing and end-to-end lifecycle management capabilities to support the lifecycle issuance and management of PIV, PIV- I, PIV-C, FAC and other credentials.

Question: Here PIV-I and PIV-C requirements are described. However, these requirements are not detailed in the FR. As the inclusion of PIV-I and PIV-C credentials can have extreme impact for PACS and LACS applications, has the agency drawn up detailed requirements for these credential types?

Suggestion/ Recommendation/ Leading Practice: Consider requirements for PIV-I and PIV-C credentials carefully and draw up detailed needs in the FR.

See Compliance Documents. The Contractor shall refer to OMB, NIST, FICAM, and DHS for specifications, standards, and guidelines that must be complied with in order to meet the requirements of this PWS.

Final version of the FRD will provide the additional requirements for PIV-I and PIV-C.

REVISED FRD TO STATE:

Federal Identity, Credential and Access Management (FICAM) Roadmap and Implementation Guidance, Version 2.0, December, 2011.

7. PWS Section 2.0, Subsection 2.1, Task 1

PWS Language: Provide no less than 99% system uptime measured on a monthly basis (no more than 7 hours per month unplanned outage)

Question: What are the uptime requirements for all of the other integrated systems?

Suggestion/ Recommendation/ Leading Practice: With so many integrated external systems, uptime requirements for this system might include a notion of the dependency on those systems for full functionality.

Critical systems have a 99.95% uptime requirement.

8. PWS Section 2.0, Subsection 2.1, Task 1

PWS Language: Comply with the interpretation of the U.S. Common Policy and integrate with the US Treasury (Entrust Backend) PKI to facilitate PIV card and credential issuance and management.

Question: Is the current PKI solution, as hosted by Treasury, currently issuing PIV-I or PIV-C certificates?

Suggestion/ Recommendation/ Leading Practice: Clarify the current role of the hosted PKI solution at Treasury in issuing non-PIV certificates.

No.

9. PWS Section 2.0, Subsection 2.3, Task 3

PWS Language: PIV Card Printer (Example:

Datacard SP75+)

Question: Is DHS solely using a local printing solution? Or, is any form of central printing currently in use?

Suggestion/ Recommendation/ Leading Practice: Explicitly indicate local card printing as a hard requirement for this solution.

Or, open up the possibility of central or regional card printing.

Yes, No.

10. PWS Section 2.0, Subsection 2.8.2

PWS Language: Support for PIV Derived Credentials to mobile information technology (IT) platforms (such as smart phones and tablets) that do not provide easy or practical support for a smart card form factor to allow high-level applications on the mobile IT platform to authenticate the credential holder to remote systems per NIST Special Publication 800-157 (Draft).

Question: Does DHS have an enterprise strategy or platform for mobility and is this available? Is the current PKI solution at Treasury capable of issuing derived credential certificates?

Suggestion/ Recommendation/ Leading Practice: SP800-157 is not yet published.

DHS might consider leaving out this requirement until the publication is finalized and more is known about the compliant issuance process. If this requirement persists, consider providing detail on the DHS approach to mobility, current platforms, current rules, etc.

Yes (in draft) and it is not available.

No (pending release of NIST SP 800-157)

11. PWS Section 2.0, Subsection 2.8.2

PWS Language: Support for integration, lifecycle IDMS integration and management of DHS credentials and credentialing systems such as SecureID, One Time Password (OTP) devices, and other credentials (e.g. RADIUS, TACACS, TACACS+).

Question: Is an exhaustive list of the current OTP solutions in place at DHS available? Are each of these currently integrated with the current IDMS/CMS solution? Is there a target Level of Assurance (SP800-63) for each of these OTP solutions?

Suggestion/ Recommendation/ Leading Practice: Clarify the role of OTP in the current DHS architecture, including the systems in place, their level of integration with the current IDMS/CMS solution, and the target LOA of the OTP issuance process.

No list available. No OTP device currently integrated with the IDMS.

Solution must support integration with various OTP solutions as determined by the Government.

12. PWS Section 4.23, Subsection 4.23.1 through 4.23.8

PWS Language: Not applicable.

Comment: All tasks identified appear to be out of the scope of the solicitation. These sections appear to be inconsistent with the rest of the document and the stated intent of this effort would the government please clarify whether or not this was intended to be part of the scope.

REVISED PWS to include Terms and Conditions for information systems which are hosted, operated, maintained, and used on behalf of DHS at non-DHS facilities.

Section 3.11.21 of the RFP is applicable to systems which are hosted, operated, maintained, and used on behalf of DHS at non- DHS facilities.

13. PWS Section 2.0, Subsection 2.8.1

PWS Language: Solution supports communication with or acting as an Enterprise Data Connector for ICAM— related activities such as account provisioning and deprovisioning, attribute management and communication, and authorization.

Question: Does DHS currently have a provisioning and deprovisioning system or automated process?

Provisioning/deprovisioning at DHS is Component specific. Some are automated and some are semi-automated.

14. PWS Section 1.0, Subsection 1.1

PWS Language: [The IDMS] supports the issuance of the PIV card to all qualified DHS personnel, as well as a Facility Access Card (FAC) for personnel who need short-term physical access but do not require a PIV card.

Question: What PACS systems are currently supported?

PACS systems are varied by Component and/or Government facility.

15. PWS Section 1.0, Subsection 1.1

PWS Language: [The IDMS] supports the issuance of the PIV card to all qualified DHS personnel, as well as a Facility Access Card (FAC) for personnel who need short-term physical access but do not require a PIV card.

Question: What is the format of the Facility Access Card?

Format will be provided upon award.

16. PWS Section 1.0, Subsection 1.1

PWS Language: [The IDMS] supports the issuance of the PIV card to all qualified DHS personnel, as well as a Facility Access Card (FAC) for personnel who need short-term physical access but do not require a PIV card.

Question: Do all PACS systems support the same FAC cards?

No.

17. PWS Section 1.0, Subsection 1.1

PWS Language: [The IDMS] supports the issuance of the PIV card to all qualified DHS personnel, as well as a Facility Access Card (FAC) for personnel who need short-term physical

Question: Must the new system be backward-compatible with the existing FAC cards?

Yes.

18. PWS Section 1.0, Subsection 1.1

PWS Language: [The IDMS] supports the issuance of the PIV card to all qualified DHS personnel, as well as a Facility Access Card (FAC) for personnel who need short-term physical

Question: Does the current IDMS integrate with any of the PACS systems? How?

No

19. PWS Section 1.0, Subsection 1.1

PWS Language: [The IDMS] supports the issuance of the PIV card to all qualified DHS personnel, as well as a Facility Access Card (FAC) for personnel who need short-term physical

Question: Must the PACS systems support PIV cards from non-DHS federal agencies?

Yes

20. PWS Section 1.0, Subsection 1.1

PWS Language: [The IDMS] supports the issuance of the PIV card to all qualified DHS personnel, as well as a Facility Access Card (FAC) for personnel who need short-term physical

Question: What types of authentication (one-factor, card+PIN, biometric) are required to be supported for physical access?

All, based on NIST 800-116.

21. PWS Section 2.0, Subsection 2.1, Task 1

PWS Language: Provide interface, connectors, and/or tools to integrate with Component ICAM solutions, logical and physical access control system, and authoritative and consumer data sources.

Question: Are there direct network connections available between all of the various components? (IDMS, CMS, PACS, etc.)

No.

22. PWS Section 2.0, Subsection 2.1, Task 1

PWS Language:

Integrate a Unique ID for DHS and the transition of Federal Agency Smart Credential Number (FASC-N) to Universally Unique Identifier (UUID) to support PACS.

Question: What is the expected time frame for this transition? Should the FASC-N be supported indefinitely post-transition to support other agency's cards who haven't made this transition?

REVISED TO PWS TO STATE:

“Support both the Federal Agency Smart Credential Number (FASC-N) and Universally Unique Identifier (UUID) for PACS.”

23. PWS Section 2.0, Subsection 2.1.3

PWS Language: 1.

Provide Operations, Maintenance and Support for IDMS, CMS, EIWS and Light Activation Stations.

• O&M requires multi-person control which the Contractor must be capable of providing;

Government resources can be provided to assist with physical access to data center and system resources.

2. Reduce the Government’s burden related to (Vendor did not complete sentence)

Question: These statements are a bit confusing, would the government please provide additional clarification as to what is intended here?

To comply with DHS Data Center and PKI’s Two Person Integrated requirements, more than one person may be required to access and maintain the system. Contractor needs to work with the Government to facilitate system management.

24. PWS Section 2.0, Subsection 2.1.3

Comment: Based on the platform description detailed in this draft a GOTS (Government Off-the-shelf) solution has been identified that will meet your needs. The GOTS solution has proven effective and reliable in a similar requirement/ environment. Would reduce the overall cost of the program and help demonstrate DHS compliance with OMB/GAO directives to leverage existing government capabilities whenever feasible and practical.

Question: Would the government consider an existing and proven GOTS solution as part of a response to your requirements?

Yes, if compliant with open standards and relevant guidance, for example, HSPD-12, FIPS 201, FICAM, etc.

Vendor B

PWS/FRD Reference Vendor Comment/Question IMD / OCSO Disposition or Response

1. PWS: Page 42, para 9.0

PWS Language: The Contractor shall refer to the HSPD-12 Identity and Credential Management Contract for documents that provide specifications, standards and guidelines that must be complied with in order to meet the requirements of this IDIQ.

Question: When will bidders be provided with these specifications, standards and guidelines?

Specifications, standards, and guidelines will be provided during the integrated baseline review.

2. PWS: Page 4, para 1.3

Question: Does DHS have a central IDMS?

COTS or GOTS? What brand of COTS?

DHS has a centralized PIV IDMS. It is a COTS product provided by the incumbent contractor.

3. PWS: Page 8, para 2.4

PWS Language: Shall leverage existing infrastructure, such EIWS and Component store and forward systems.

Comment: Please clarify the requirement. Make use of the existing infrastructure and Component print capture devices and backend data bases (store & forward) systems that currently support fingerprinting services.

4. PWS: Page 14, 2.3.2.1 Operator’s Manual

PWS Language: Process and document changes identified by the IDIQ COR within 10 business days.

Question: Could this requirement be addressed within the set of scheduled updates?

This could create an evolving door of processing with varied timelines.

Documentation will be reviewed on an annual basis to ensure accuracy andto ensure that it meets the PM’s approval. Including the annual reviews, the contractor shall process and document changes to the documentation identified by the COR within 10 business days.

5. PWS: Page 14, 2.3.2.2 Maintenance Manual

PWS Language: Process and document changes identified by the IDIQ COR within 10 business days.

Question: Could this requirement be addressed within the set of scheduled updates?

This could create an evolving door of processing with varied timelines.

Documentation will be reviewed on an annual basis to ensure accuracy and to ensure that it meets the PM’s approval. Including the annual reviews, the contractor shall process and

6. PWS: Page 15, 2.3.2.3 User Training Manual

PWS Language: Process and document changes identified by the IDIQ COR within 10 business days.

Question: Could this requirement be addressed within the set of scheduled updates?

This could create an evolving door of processing with varied timelines.

Documentation will be reviewed on an annual basis to ensure accuracy and to ensure that it meets the PM’s approval. Including the annual reviews, the contractor shall process and

7. PWS: Page 16, 2.4 Task 4 – Operations and Maintenance (O&M) Support Plan; Help Desk

PWS Language: The Contractor may receive calls from enrollment officials, DHS Components, Component or DHS HQ Help Desks or DHS Service Support Desk. The Contractor shall be available during the hours of operation of the fixed or mobile enrollment/card issuance location.

Question: What are the hours of operation for fixed / mobile enrollment / card issuance locations (in east coast time)?

REVISED PWS TO STATE:

IMD has established the Service Support Desk to provide tier/level 1 assistance to troubleshoot IDMS related questions. The Contractor may receive calls from enrollment officials, DHS Components, Component or DHS Service Support Desk. The Contractor shall be available during the core business hours of the DHS Service Support Desk, Monday through Friday from 6:00 a.m. to 8:00 p.m. EST, except for recognized holidays. The Contractor shall maintain accurate and timely records of calls received and provide the report to the COR upon request. The Contractor shall provide tier/level 2 and 3 help desk support and problem diagnosis documentation for tier/level 1 help desk in the form of Help Desk Scripts (i.e., feedback and lessons-learned from all activities within scope of this PWS, to include the installation and de-installation of Contractor’s technical solution).

8. PWS: Page 24, Para 4.1 Security

PWS Language:

Contractor access to classified information may be required under this PWS. The details will be provided in a Department of Defense (DD) Form 254, which will be provided to the Contractor at the time of IDIQ award. Furthermore, a Top Secret (TS) facility clearance will be required.

Question: Will this require access to proscribed data? If so, will the DHS consider issuing a NID to perform work?

Access to proscribed data is required.

DHS will not consider issuing a National Interest Determination (NID) for this requirement since there are several U.S.

companies available with the capacity, capability, and technical expertise to satisfy the acquisition.

9. PWS: Page 24, para 4.7

PROGRAM

MANAGEMENT PLAN

PWS Language: The Contractor shall provide a final Program Management Plan to the COR not later than 15 business days after the Post Award Conference.

Question: Deadline in this paragraph differs from the deadline in the table on page 43.

Which deadline for delivery is correct?

REVISED TO STATE:

The Contractor shall provide a final Program Management Plan to the COR not later than 15 calendar days after the initial Integrated Baseline Review (IBR).

10. PWS: Page 24, para 4.8 Business Continuity Plan

PWS Language: The BCP Plan shall be due 15 business days after the date of IDIQ award, and will be updated on an annual basis.

Question: Deadline in this paragraph differs from the deadline in the table on page 43.

Which deadline for delivery is correct?

REVISED PWS TO STATE:

The BCP Plan shall be due 30 business days after the date of IDIQ award, and will be updated on an annual basis.

11. PWS: Page 43, table item

PWS Language: Due by:

Final: 15 business days after initial IBR.

Question: PMP para 2.6.1 states 15 business days after the PAC. Which is correct?

The Contractor shall provide a final Program Management Plan to the COR not later than 15 business days after the initial Integrated Baseline Review (IBR).

12. PWS: Page 43, table item

PWS Language: Due by:

Draft: 15 business days after TO award.

Question: Para 4.8 says after IDIQ award.

Which is correct?

The BCP Plan shall be due 30 business days after the date of IDIQ award.

13. PWS: Page 43, table item

PWS Language:

Updates: Contractor shall update the CONOPS up to four times per year as mutually agreed upon with the COR.

Question: Since this item is about the Data Management Plan, shouldn't CONOPs be replaced with Data Management Plan?

Updates: Contractor shall update the Plan up to four times per year as mutually agreed upon with the COR. Update summary report quarterly.

14. PWS: Page 43, table item

PWS Language:

Updates: Contractor shall update the CONOPS up to four times per year as mutually agreed upon with the COR.

Question: Since this item is about the Training Plan, shouldn't CONOPs be replaced with Training Plan?

Updates: Contractor shall update the Plan up to four times per year as mutually agreed upon with the COR. Update summary report quarterly.

15. PWS: Page 43, table item 22 Operator's Manual

PWS Language: Due by Draft: 30 business days

Question: Shouldn't this be relative to when the solution is complete instead of based on contract award?

No

16. PWS: Page 43, table item 22 Operator's Manual

PWS Language:

Updates: Contractor shall update the Operator's Manual within 10 business days of any process/ document changes.

Question: Could this requirement be addressed within the set of scheduled updates?

This could create an evolving door of processing with varied timelines.

Updates: Contractor shall review the Operator’s Manual documentation annually with the DHS HSPD-12 Program Manager.

Contractor shall update the Operator’s Manual within 10 business days of any process/ document changes. Update Summary report quarterly.

17. PWS: Page 43, table item 23 Maintenance Manual

PWS Language: Due by after TO award;

contract award?

18. PWS: Page 43, table item 23 Maintenance Manual

PWS Language:

Updates: Contractor shall update the Maintenance Manual within 10 business days of any process/ document changes.

Question: Could this requirement be addressed within the set of scheduled updates?

This could create an evolving door of

Updates: Contractor shall review the Maintenance Manual documentation annually with the DHS HSPD-12 Program Manager.

Contractor shall update the Maintenance Manual within 10 business days of any process/ document changes. Update Summary report quarterly.

19. PWS: Page 43, table item 24 User Training Manual

PWS Language: Due by contract award?

No

20. PWS: Page 43, table item 24 User Training Manual

PWS Language:

Updates: Contractor shall update the User Training Manual within 10 business days of any process/ document changes.

Question: Could this requirement be addressed within the set of scheduled updates?

This could create an evolving door of

Updates: Contractor shall review the User Training Manual documentation annually with the DHS HSPD-12 Program Manager.

Contractor shall update the User Training Manual within 10 business days of any process/ document changes. Update Summary report quarterly.

21. PWS: Page 51, Table Performance Requirements Summary Item 2

PWS Language:

Interfaces must maintain compatibility among system components in the operational environment.

Question: What interfaces? Do we need them identified?

Interfaces compatibility.

Interfaces are identified in PWS background section and in the FRD Section 1.1.4.

22. PWS: Page 51, Table Performance Requirements Summary Item 2

PWS Language: Achieve Cost and Schedule goals.

Question: Who sets these? Is this collaborative or from our IMS?

DHS sets the performance objectives.

23. PWS: Page 51, Table Performance Requirements Summary Item 3

PWS Language:

Documentation for deliverables must match the DHS specific system processing and operational procedures.

98% accuracy.

Question: When must they meet this standard?

When delivered? How will this be measured?

Standard must be met upon delivery of final product

24. PWS: Page 51, Table Performance Requirements Summary Item 4

PWS Language: Achieve Cost and Schedule goals.

Question: Who sets these? Is this collaborative or from our IMS?

DHS sets the performance objectives.

25. PWS: Page 51, Table Performance Requirements Summary Item 4

PWS Language: Data must be 100% accurate.

Proposed language change: "make the data at least as accurate as the source data".

Data must be 100% accurate or as accurate as the authoritative source data.

26. FRD: 1.1.3, The IDMS shall support on-line operations

Comment: Please define in more detail REVISED FRD TO STATE:

The IDMS shall support on-line operations for identity, lifecycle, and PIV management as well as systems’ O&M and connections.

27. FRD: 1.1.4, Interface to External Systems

Comment: ISMS - Please provide interface specifications to this system

Interface specification documents for external systems will be provided during the integrated baseline review

28. FRD: 1.1.4, Interface to External Systems

Comment: IDENT - Please provide interface specifications to this system

Interface specification documents for external systems will be provided during the integrated baseline review

29. FRD: 1.1.4, Interface to External Systems

Comment: PACS - Please provide the various PACS systems in place

Interface specification documents for external systems will be provided during the integrated baseline review

30. FRD: 1.1.4, Interface to External Systems

Comment: LACS - Please provide the specific LACS components with which you need authorization to interface

Interface specification documents for external systems will be provided during the integrated baseline review

31. PWS: 2.1 Data Requirements and Appendix C

Comment: The Details of the required data elements are very sparse. Some items call out the spec and the standard (ie 2.1.1.13 portrait calls out SP800-76 table 6) but others, For example Eye Color says the source is IDSM, and it is a text field. However there is little or no other guidance. Please provide specifics on all data elements.

Table represents data stored by current IDMS.

32. FRD: 2.2.3 PIV Card capabilities

FRD Language:

Personnel identification for both internal DHS processes as well as with external partners

Comment: Please provide the details on the internal and external processes described

Use of PIV card, for both internal and external processes, will be governed by FIPS 201 and other appropriate standards

33. FRD: 2.2.4 :Web Services

Comment: Please provide details on these web services and interfaces

Government will provide specifications upon award, but will consider the vendor’s approach in developing enhanced interfaces.

34. FRD: 2.2.5: Segmented Database

Comment: Please provide details on how you want this segmentation done and what the security and business needs are.

Data shall be segmented, logically and/or physically as required, to ensure access is restricted to authorized personnel.

35. FRD: 2.2.7: Integrate via web services with ISMS

Comment: Please provide the interface specification for appropriate interfacing

Government will provide specifications upon award, but will consider the vendor’s approach in developing enhanced interfaces.

36. FRD: 2.2.8: Integrate with DHS infrastructure

Comment: Please provide infrastructure requirements, rules and regulations.

Government will provide specifications upon award.

37. FRD: 2.2.9: Provide capabilities to manage person data associated attributes.

Comment: Please provide clarification Vendor shall provide capabilities, tools, and processes to manage person data attributes.

38. FRD: 2.2.11: Integrate and interface with Component.

Comment: Please provide the interface specification

Government will provide specifications upon award, but will consider the vendor’s approach in developing enhanced interfaces.

39. FRD: 2.2.12: Deliver capabilities…Where applicable the solution shall integrate with other credentialing system.

Comment: Please provide details on these other systems

Currently, credentialing solutions outside of the DHS IDMS/CMS are component-managed. The Government’s intention is to consolidate these stove-piped credentialing systems and integrate with the enterprise CMS, over time.

40. FRD: 2.2.21: Interface with…

Comment: Please provide system interface specifications

The Government will provide specifications upon award, but will consider the vendor’s approach in developing enhanced interfaces.

41. FRD: 2.2.23: Provide workflow…and other credentialing

Comment: What “other credentialing” is required, and please provide the specification

PIV-I, Facility Access Credentials (FAC), and derived credentials.

42. FRD: 2.2.26: Provide workflows…existing DHS data sources.

Comment: Please provide the system interface specifications to the other sources.

The Government will provide specifications upon award, but will consider the vendor’s approach in developing enhanced interfaces.

43. FRD: 2.2.33: Comply with DHS processes.

Comment: Please provide the policies and processes requested.

Outside of reference documents listed in PWS, government will provide requested polices upon award.

44. FRD: 2.14 IDENT

Integration

Comment: Please provide the IDENT specification

Interface specification documents for external systems will be provided during the integrated baseline review

45. FRD: 2.14.3.1: Interface with ISMS

Comment: Please provide the ISMS specification

The Government will provide specifications upon award, but will consider the vendor approach in developing enhanced interfaces.

46. PWS: 1.3 Paragraph 2, PWS Language: "The Program Manager established in this IDIQ shall oversee and provide direction and guidance to the Project Managers of the subsequent IDIQ delivery/task orders".

Question: Does this mean that the awardee cannot perform subsequent Task Orders?

Comment: Does it mean that the IDIQ recipient would have management responsibilities over other task order recipients?

The IDIQ is a single award vehicle, the IDIQ awardee will be expected to perform all Task Orders awarded under the vehicle.

47. General Question: Does DHS have a central IDMS?

COTS or GOTS? What brand of COTS?

DHS has a centralized PIV IDMS. It is a COTS product provided by the incumbent contractor.

48. General Question: Does DHS have a central CMS?

COTS or GOTS? What brand of COTS?

DHS has a centralized PIV CMS. It is aCOTS product provided by the incumbent contractor.

49. General Question: Does DHS have a central PIV issuance system? COTS or GOTS? What brand of COTS?

DHS has a centralized PIV issuance system. It is a COTS product provided by the incumbent contractor.

50. General Question: Does the current IDMS integrate with PACS?

Not at this time, however PACS integration is an objective of this solicitation.

51. General Question: Which PACS brands does the IDMS integrate with?

Not available, however integration with multiple PACS brands is an objective of this solicitation.

52. General Question: What Hardware Security Module does DHS have now?

Luna SA.

Vendor C

PWS/FRD Reference Vendor Comment/Question IMD / OCSO Disposition or Response 1 FRD: 1.1.1 The FASC-N and EDIPI are both listed as identifiers for IdAM. Are these the primary identifiers in use? Does DHS assign an EDIPI to end-users, or is it simply a supported identifier due to integration with DoD personnel? Does DHS have a unique identifier in use that is assigned to all personnel, or if not, does DHS oppose the creation of such?

DHS assigns an EDI-PI to each unique identity. It is considered the unique identifier.

DHS assigns a FASC-N for each issued PIV card.

2 FRD: 1.1.1 Do individuals who are assigned a FAC have an associated record in the Identity Management System, or just in the PACS? Is there a use case, such as on-boarding, where it would be desirable that an end-user with a FAC would be listed in the IdMS? Do any non-PIV personnel require logical access?

All individuals issued credentials by the IDMS have an identity record. Yes, certain non-PIV personnel require logical access.

3 FRD: 1.1.1 Is the certificate that is contained on the DHS PIV the same PKI certificate that is used for logical access? Is this PKI certificate intended to also be utilized now or in the future for physical access?

The PIV Authentication certificate is a mandatory certificate on the PIV, and is used for logical access and physical access.

4 FRD: 1.1.1 Would the biometrics collected by DHS’ IDENT system be available for use in the PACS for authentication purposes? If not, is this a desirable end-state for DHS to help eliminate multiple enrollments?

No. Fingerprints for PIV are stored in the current IDMS, not IDENT. This information can be made available at the time of award.

5 FRD: 1.1.1 Do the DHS components share a single PACS and LACS system, or does each component implement their own PACS & LACS infrastructure?

Each DHS Component implements its own PACS & LACS infrastructure.

6 FRD: 1.1.1 Is an Intrusion Detection System part of the existing PACS infrastructure?

Each DHS Component implements its own PACS infrastructure.

7 FRD: 1.1.4 Is it a requirement for the IDMS to interface with every PACS within DHS and its components?

Yes.

8 FRD: 2.1 Does a Unique ID already exist for DHS, or would one need to be created? Is such an identifier intended to be unique and shared across all DHS components?

DHS assigns an EDI-PI to each unique identity. It is considered the unique identifier.

9 FRD: 2.1 Is the PIV schema used on the DHS PIV Card equivalent across all DHS components? Are there any custom fields on the schema that have been defined?

There is a single PIV data model for DHS.

10 FRD: 2.2 Is an asymmetric CAK part of the current PIV Card schema? If not, what is the timeframe for this object to be integrated onto the PIV Card?

Yes.

11 FRD: 2.2 Are there any credentials, other than the PIV or FAC, that are currently in use for physical access in an electronic manner? If so, are they managed only in the PACS?

Yes. Yes.

12 FRD: 2.2.10 This section states that DHS will provide the Primary hosted site, and the contractor will provide all other environments, However, section 3.5.2 states that a primary, secondary, and a third site (SCIF Level) will be provided by the contractor. Please clarify the hosting requirements for the contractor and for DHS.

The vendor will provide primary, secondary, and production test environments in DHS data centers.

13 FRD: 2.2.14 Is the contractor responsible for credentialing consumables (i.e. cards, laminate, shipping)?

No.

14 FRD: 2.2.17 Is this system also required to function as the ePACS? It is not clear why the 16,000 buildings are a factor in the IDMS unless they have to be defined as data elements that can feed the ePACS solution. What is the expected control functionality desired? Does the solution need to include a product like SAFE within it?

No. The IDMS must issue credentials to DHS personnel and interconnect with DHS PACS.

15 FRD: 2.2.19 Can the government please clarify the targeted agencies?

No.

16 FRD: 2.2.21 Is this to be a new workflow engine for the BI processes?

No.

17 FRD: 2.3 Do the PIV Cards utilize the 125kHz or 13.56MHz band for authentication to PACS devices? What frequency do the FAC cards use?

DHS utilizes tri-interface cardstock for PIV and FAC, which employ both 125kHz and 13.56MHz antennas.

18 FRD: 2.3 Do existing PACS readers support reading the 200-bit FASC-N? If not, what is the timeline to support this?

Outside of scope of this IDIQ.

19 FRD: 2.4.2.4 Is there existing hardware used for card, biometric, and PIN verification upon login?

Outside of scope of this IDIQ.

20 FRD: 2.4.2.4 The requirement states – “Require all users to use card, biometric and PIN verification upon login.”

This requirement may be problematic – if a PIV is required for self-service, initial enrollment, or even enrollment scheduling, the user may not have a card at this point, and thus authentication cannot be completed. Please clarify.

Require all administrative users to authenticate using their PIV card upon login.

21 FRD: 2.8.1.10 Is local card personalization just for physical card topology? If any part of the electrical card profile is left available for personalization, what are those attributes available for personalization?

Yes.

22 FRD: 2.8.1.11 What is the use case that requires a printed card reference number?

REVISED FRD TO DELETE:

The MSN, CIN, and IIN are printed (engraved) by the card manufacturer.

23 FRD: 2.15.2 The numbering system restarts at 2.15.1.1 right after this item.

REVISED FRD TO CORRECT

NUMBERING

24 FRD: 2.2.14 Is the contractor responsible for credentialing consumables (i.e. cards, laminate, shipping)?

No.

25 FRD: 2.2.17 Is this system also to function as an enterprise PACS to support 16,000 facilities?

No.

26 FRD: 2.2.19 Can the government please clarify the targeted agencies?

No.

27 FRD: 2.2.21 Is this to be a new workflow engine for the BI processes?

No.

28 PWS: 1.2 Do Light Activation Stations require Smart Card Readers, or is this hardware already part of the standard PC build?

Smart Card Readers are required for Light Activation Stations.

29 PWS: 2.1 Is it the goal of DHS to have the IDMS integrate with current background systems or have this contract replace the current system?

IDMS must integrate with ISMS, the current system.

30 PWS: 2.1 Would there be a requirement for non-PIV credentials, such as a visitor Facility Access Card to have an asymmetric CAK for card validation?

Yes.

31 PWS: 2.1.1 Would solution hosting be provided by DHS, or would the contractor establish such a hosting environment?

The vendor will provide primary, secondary, and production test environments in DHS data centers.

32 PWS: 2.1.2 Will the network that connects the EIWS and light activation stations be an existing DHS network?

Yes.

33 PWS: 3.2.4 Automated package tracking? Then rule based alerting?

Yes.

34 General What equipment will be considered GFE? Any equipment provided by the government, not procured from the vendor (i.e.

workstations, readers, printers, etc.)

35 General Will there be a small business utilization requirement?

Yes.

36 General Will an architectural diagram of the current solution be made available?

No.

37 General Will a list of GFE, COTS, incumbent proprietary, GOTS for the current solution be made available?

List of GFE will be provided.

Vendor D

PWS/FRD Reference Vendor Comment/Question IMD / OCSO Disposition or Response 1 PWS Section 1.2 Will the target DHS HSPD-12 solution include federated authentication in conjunction with PACS access for all DHS components?

The solution must support federated authentication for both PACS and LACS across DHS and with external partners.

2 PWS Section 1.2 Will DHS clarify the timeline for transition from current to target solution?

The transition schedule and process is requested from the vendor as part of their technical approach.

3 PWS Section 1.2 Will DHS identify the list of materials / equipment for the core infrastructure that the incoming contractor would be required to purchase?

This information is included in the Pricing Model.

4 PWS Section 2.1, Task 1 Will DHS consider using the services of a HSPD-12 Shared Service Provider (SSP)? Or will program implementation take place within DHS, and executed by DHS personnel and contractors?

No. Program implementation will take place within DHS.

5 PWS Section 2.1, Task 1 Will S/MIME (encrypted and signed email) be in scope for this contract? If yes, will DHS define the delegation authority for data recovery tokens? Also, will DHS clarify how the contractor would manage the repository to store public keys for digital certificates?

This IDIQ supports the issuance of PIV cards with all of the required PKI certificates, per current and future standards. It is required that these certificates support S/MIME functionality, and that the solution support on-card key history store.

6 PWS Section 2.1, Task 1 Will DHS define the hours of operation for the issuing service?

To be determined based on the component facility. Hours of operation will generally extend between 6 a.m. and 8 p.m. ET.

7 PWS Section 2.1, Task 1 Will DHS define the relevant portions of Identity Hub development that are in scope?

The IDMS/CMS are in scope, which will integrate with a DHS Identity Hub.

8 PWS Section 2.1, Task 1 Will DHS clarify the Component ICAM solutions that will integrate with this effort?

Each DHS Component has its own ICAM architecture either planned or in place, all of which must integrate with this solution.

9 PWS Section 2.13, Sub- Task 3

Will DHS define the hours of operation and location of CMS services required?

To be determined based on the component facility. Hours of operation will generally extend between 6 a.m. and 8 p.m. ET.

10 PWS Section 2.2, Task 2 Will DHS define the existing workforce profile for employees that will require train-the-trainer training by location and headcount per location?

Train-the-trainer training is for the DHS IMD communications/training and mission operations teams, located in Washington DC.

Headcount is approximately 25 individuals.

11 PWS Section 2.8.1 Will DHS provide example Human Resources and Other Human Capital Management processes for integration?

Human Resource/Capital Management process can be discussed during the integrated baseline review.

12 PWS Section 2.8.2 Will DHS specify the target platforms for Mobile IT solutions? If so, what are they?

DHS is currently testing or piloting all mobile platforms (iOS, Blackberry, Android, and Windows) at this time.

13 PWS Section 2.8.2 Will DHS clarify how the automated update to IDMS will occur to the supporting active directories (AD) data stores since the government is requiring mandatory PIV?

The IDMS is required to interconnect with dependent systems such as Active Directory to support LACS.

14 General Suggestion: Will DHS clarify if the IDIQ will be single or multiple awards?

Single award.

15 General Suggestion: Will DHS provide a sample task with the RFP to support pricing?

The first task order to be awarded with the IDIQ has been included in the RFP. A Pricing Model has also been included in the RFP.

16 General Suggestion: We ask that DHS provide as GFE the proprietary software to manage the IDMS database. Part of the scope of this procurement is to assume responsibility for the management of IDMS. But that software is proprietary and was written another vendor (Xtec) and would be costly to the Government to have the incoming contractor re-write this software.

DHS is not providing the current vendor’s proprietary software as GFE to the awardee.

The awardee shall provide its own solution/software.

17 General Suggestion: We encourage that DHS clarify its future plans for its existing CMS technology Xtec/Entrust solution and whether it will be part of the future target solution.

This procurement is a re-compete of the current solution. The awardee is responsible for providing its CMS.

18 General Suggestion: We suggest that DHS clarify whether the incumbent will manage the existing PIV infrastructure or whether they would be required to replace it. The incumbent already has the Card Reader/IDMS/PIN reset infrastructure in place.

The awardee shall provide enterprise PIV card maintenance capability.

19 General Suggestion: To help DHS determine its strongest and best candidate for award, we recommend that DHS require respondents to provide evidence of successful relevant projects of similar size, scope, and complexity within the Federal Government.

Past Performance is included as a non-price factor.

20 General Suggestion: Please clarify the authoritative identity data sources it is considering for solution integration relative to LACS.

The IDMS is required to interconnect with multiple authoritative data sources in support of PIV card issuance and LACS support.

21 General Suggestion: Please define the following for management of IDMS: define roles to manage the system, define who has access and define what accesses an individual would have.

The solution must provide access management that utilizes Role-Based Access Control to provide access to authorized individuals and deny access to unauthorized individuals.

22 General Suggestion: Section 4.13, Intellectual Property, references FAR 52.227-14 and then states that all IP developed under this contract will be the “sole property” of the Government; however, this FAR clause maintains ownership with the Contractor who developed the IP and unlimited rights to the Government. Suggest that the Government revisit this requirement to revise to accurately reflect their intention/requirement for IP.

The Intellectual Property section has been revised to remove the first paragraph and changes the FAR clause reference from 52.227-14 to 52.227-17.

23 General Suggestion: Please clarify what type of contract is contemplated. Section 2.6.1.2 of the PWS requires a very detailed WBS which lends itself to a cost plus while Section 11.0, the performance requirements summary with tables including AQLs and positive/negative incentives including non-payment and/or remedial work at the contractors expense seem to indicate FFP. Please clarify or de-conflict as appropriate.

This is an Indefinite Delivery Indefinite Contract that will allow the issuance of Labor Hour (LH), time-and-material (T&M) and firm-fixed price (FFP) task orders. The initial task order award is a hybrid LH/T&M/FFP contract type.

Vendor E

PWS/FRD Reference Vendor Comment/Question IMD / OCSO Disposition or Response 1 PWS: Section 1, page 1 Paragraph 1 includes a reference to Version 1 of the FICAM Roadmap and Implementation Guidance. Should it be Version 2?

Version 2.0, December, 2011

2 PWS: Section 1.1, page 2, bullet 1

What is the current validation infrastructure(s) for the Department of Treasury PKI? For instance, what are the current endpoints for certificate revocation lists (CRLs), online certificate status protocol (OSCP) servers, responders/repeaters, server certificate validation protocol (SCVP) servers or endpoints, and/or other infrastructure?

The validation infrastructure for the DHS PKI will be discussed during the integrated baseline review.

3 PWS: Section 1.1, page 2, bullet 8

Will the winning vendor have access to the current Global Platform master card management key as well as the derivation algorithm’s derivation data format and source?

The vendor will have access to the Global platform key, algorithm and data necessary to generate key materials.

4 PWS: Section 1.2, page 3 Reference "The Contractor shall support and manage the transition from the existing solution and provider (the incumbent Contractor)." Is the new Contractor responsible for supporting the existing solution while designing and developing the new solution?"

No. The incumbent will manage current system until the transition is complete.

5 PWS: Section 1.2, page 3 Of the 300,000 PIV cards mentioned in this section, is there an estimate as to how many are existing, pre-issued PIV cards?

300,000 PIV cards are existing.

6 PWS: Section 1.2, page 3 Is "(up to 16,000)" a reference to up 16,000 light activation stations or 16,000 component locations? If locations, what is the number of required light activation stations?

Up to 16,000 DHS Component facilities.

Light activation stations are required to supplement EIWS locations for PIV card maintenance activities for all PIV cardholders in these facilities, but there is no specific number requirement.

7 PWS: Section 1.3, Page 5 As the list does not include DHS 4300B, is the PWS limited to only non-classified PKI?

Yes.

8 PWS: Section 2.1 Task 1, page 9 and Table 1, page 51.

Bullet two on page 9 requires system uptime of no less than 99%. Table 1 on page 51 requires system uptime of no less than 99.9%. Could the Government please clarify?

The uptime requirement is 99.95%

9 PWS: 2.8 Optional Tasks, Reference "established in Task 2.1." The PWS does not contain a Task 2.1. Could the Government please clarify?

These additional services shall build upon the infrastructure services established in RFP Section 3.6.1.

10 PWS: 2.8 Optional Tasks, Is there a timeline associated for the implementation of the optional tasks?

Not at this time. Note: These tasks have been renamed in the RFP and are no longer termed “optional.”

11 PWS: Section 4.9, page

Section 4.9 references PWS section 2.5.11.

However, the PWS does not contain a Section

2.5.11. Is the Government's intent that the

PWS point to Section 2.6.11?

The Project Manager shall provide progress reports to the Contracting Officer and COR via electronic mail.

12 PWS: Section 9.0, page 44 and Section 4.8, page

Page 44 of the Draft PWS states that the Draft Business Continuity Plan is due 15 days after TO award. Page 26, Section 4.8 states that the BCP is due 15 days IDIQ award. Are these the same date? If not, which date is the correct one?

The BCP Plan shall be due 30 business days after the date of IDIQ award, and will be updated on an annual basis.

13 PWS: Section 9.0, pages 43 through 48

Several Task have deliverables indicated after TO award (such as Task 1, Task 3, Task 4, and Task 6). How soon after IDIQ award does the Government intend to award each of the Task Orders?

The IDIQ contract and first TO are being awarded concurrently.

14 PWS: Section 9.0, page 44 and Section 4.8, page

Is the Draft or the Final BCP due 15 days after award?

See #12

15 PWS: Section J, L, and M Could the Government provide a draft of Section J, L, and M?

The final instructions and evaluation criteria are incorporated into the RFP.

16 PWS: Contract Structure What cost structure does the Government intend for the program (firm fixed price, cost plus, time and materials, or other)?

This is an Indefinite Delivery Indefinite Contract that will allow the issuance of labor hour (LH) time-and-material (T&M) and firm-fixed price (FFP) task orders. The initial task order award is a hybrid LH/T&M/FFP contract type.

17 PWS: General Will the winning vendor have access to the current PIN Unblocking Key (PUK) for each card as well as the derivation algorithm’s, derivation data format and source?

The vendor will have access to all relevant information required to maintain the current PIV cards, as needed.

18 PWS: General Will the winning vendor have access to the existing database and HSM with supporting information to be able to export current data required for the migration to the new system?

The vendor will have access to the PUK, algorithm and data necessary to generate key materials.

19 PWS: Government Evaluation

Will the Government request offerors to provide a product demonstration as part of the Government's evaluation process?

Yes.

20 FRD: 3.1.3 "Enable secure…