HSHQDC-13-R-00047_Amendment_000002_Attachment_1_-_14_June.pdf

June 14, 2013

RFP HSHQDC-13-R-00047 – Amendment 000002

Vendor Question Government Response

1. RFP Paragraph 2.3 / Page 4

Observation: The RFP states in 2.3 IDIQ Contract Volume that orders may be placed "over the course of ten (10) years."

What is the estimated Contract start date for pricing purposes?

The estimated contract start date is September 27, 2013.

2. RFP Paragraph 2.5.2/FAR 52.217-9 / Page 14

Observation: Under FAR 52.217-9 Option to Extend the Term of the Contract (Mar 2000) it is stated that “(c) The total duration of this contract, including the exercise of any options under this clause, shall not exceed 10 years."

Is the correct POP for the IDIQ 10 years?

Yes, the period of performance for this IDIQ includes a base period of one (1) year and nine (9) one (1) year option periods.

3. RFP Paragraph 2.6 / Page 22

Observation: 2.6 IDIQ Contract Period of Performance shows a base period of one (1) year and nine (9) twelve month options.

Attachment 5 is 9.5 years only with no base period.

Will the Government update and correct Attachment 5 to reflect a Base Year and nine option years consistent with 2.3 and 2.5.2?

Attachment 5 reflects a base period of one (1) year, nine (9) one (1) year option periods for a total performance period of 10 years. There is also a six month option in accordance with FAR 52.217-8 (if exercised).

4. RFP Paragraph 4.0 / Page 3

Attachment 6, PWS for Task Order 1, in para

4.0 Period of Performance (page 3) states that

the “Base Period” of Performance “for this PWS” is "September 27, 2013 through September 26, 2014".

Is the correct POP for Task Order 1 9/27/13- 9/26/14? Is this the Base Year of the IDIQ Contract?

The anticipated period of performance for the first Task Order is September 27, 2013 through September 26, 2014. The anticipated base period of performance for this IDIQ is September 27, 2013 through September 26, 2014.

5. RFP Attachment 5, Worksheet 2 Column D

Will the quantity of hours in worksheet 2, column D, constitute the labor to be awarded in Task Order 1 for the Base Year?

Yes.

6. RFP Attachment 5, Worksheet 2, Line Items

Is it the Governments intent for the EIWS Computers (line 32) to be purchased or refreshed beyond the base period? Such refreshment is not reflected.

Does the Government intend for the offeror to price in the refresh of the Infrastructure HW beyond the base year?

It is suggested that the Government review the Units priced. Some of the monthly pricing items (20, 23, and 30 for example) would appear to need to be “Each”.

The Government intends to refresh the infrastructure based on the Contractor’s O&M plan. The Government needs to sustain the IT asset at the current capability and performance levels including:

corrective hardware/software and replacement of damaged or obsolete IT equipment beyond the base year.

Pricing model updated to reflect the technical refresh of the EIWS – 80 units per year.

These items have been reviewed and appropriate changes have been made.

7. Observation: 3.11.2 TRAVEL (page 52) states “Contractor personnel will be required to travel within the Continental United States (CONUS) in support of the requirements of this IDIQ.”

3.6.1.2 Subtask 1.2 –CMS Design, Build, Test, and Implementation (page 36) states “4.

Establish distributed and manageable network of EIWS and light activation/update stations that support the issuance and card lifecycle management requirements for DHS populations within the Continental United States (CONUS) and deployed abroad overseas.”

Will the Government identify all locations required to be supported by Contractor, CONUS and OCONUS?

Will the Gov provide additional clarification on pricing OCONUS locations, as Attachment 5 only references any CONUS/OCONUS locations as “Government Site”?

Will the Government provide a plug number for Pricing Travel?

The CONUS and OCONUS locations to be supported by the Contractor will fluctuate. The Government will identify CONUS and OCONUS locations required to be supported by the Contractor as determined by population and mission requirements after contract award. These locations can be changed and moved in order to support mission needs.

Government Site includes DHS Headquarters in Washington, DC, DHS Component sites, and DHS service provider sites (e.g., “no less than 300 DHS locations”). Specific performance locations will be defined at the delivery/task order level. It is anticipated that there may be Task Orders under this IDIQ for work OCONUS.

Travel is included as a line item since it will be a CLIN in the awarded contract, but it is not being used for evaluation purposes. The Contractor shall not propose costs for travel since the Government will determine the amount to fund for the travel

CLIN.

TO1 modified to say: All travel must be approved by the COR in advance and comply with the Federal Travel Regulation. The location of this travel will be to Stennis, MS, Clarksville VA, and Parkersburg, WV. The number of trips and duration will be as needed by the Government. The Government will not reimburse the Contractor for local travel.

The Government will identify other travel requirements to be supported by the Contractor after contract award.

8. RFP 2.6 IDIQ Contract Period of Performance Attachment 5 Evaluation Pricing Model

Section 2.6 of the RFP shows a 10 year period of performance while the Evaluation Pricing Model tab in Attachment 5 shows 10.5 years.

Is the POP 10 or 10.5 years? Please clarify the Contract Period of Performance.

Contract period of performance reflects a base period of one (1) year, nine (9) one (1) year option periods, which are to be exercised in accordance with FAR 52.217-9. A six month option to extend services in accordance with FAR 52.217-8 (if exercised) is also incorporated into the model.

9. Attachment 5 Evaluation Pricing Model Excel File – Column D

What does the quantity 150 in D31 represent?

How does D32 differ from D31? What is the difference between the EIWS workstations and EIWS computers (CPUs)?

The D31 (150) represents 150 ASA1000 PIV Card Processing Units. D32 (400) represents 150 ASA1000, 75 Dell Optiplex 7900, and 175 HP Compaq Pro 6300 PIV Card Processing Units/Desktop Computers. EIWS includes all of the equipment identified in Task 3. The EIWS computers (CPUs) represent the desktop computer as the ASA1000, Dell Optiplex 7900, and HP Compaq Pro 6300.

10. Attachment 5 Evaluation Pricing Model Excel File – Column D

Certain FFP portions of the price page have a value of 12. This would suggest a monthly charge but these are not charged on a monthly basis. Examples are D20 and D22. Why do they extend all to 10.5 years?

The revised pricing model provides more clarification on units/interfaces to be provided.

11. Attachment 5 Evaluation Pricing Model POP, Cells G2 a& H2

The OY1 states that it begins in 9/27/13. This would mean the BY is only two months or less.

Should the OY1 really begin on 9/27/14?

Corrected to reflect OY1 as 09/27/2014 - 09/26/2015.

12. Attachment 5 Evaluation Pricing Model Line 22

Why are lines 26-30 on the IDIQ sheet not in the Evaluation Pricing Model?

Evaluation Pricing Model updated.

13. Attachment 5 Evaluation Pricing Model Columns D, E, & F RFP Section Tab B on Page 129

Is the Evaluation Pricing Model BY equal to the first task order that will be issued on this

IDIQ?

Yes.

14. Attachment 5 Evaluation Pricing Model

Four labor categories on lines fourteen through seventeen of the IDIQ Contract tab are not included in the Evaluation Pricing Model.

These labor categories are needed for fulfilling the requirements of Task Order 1. Will the

Not all labor categories listed in Attachment 5, Worksheet 1, are listed in Attachment 5, Worksheet

2. Based on the Government’s estimation of work required under Task Order 1, it has been determined that these labor categories will not be required to complete work included in Task Order 1. Therefore, these categories were not included in the Pricing government consider including these categories in the Evaluation Pricing Model?

Model.

15. Attachment 5 Evaluation Pricing Model

Does the government expect that any labor will be included in the FFP line items?

No.

16. RFP Factor 5: Price (Volume III), Page 124

Will the Government provide clear guidance on which requirements in the RFP:

1) Are to be provided on the first day of operation and need to be included in the evaluation price model.

2) Should be handled as future T&M tasks instead of being provided in the evaluation price model because they are:

a. Based upon draft and/or un-published standards such as FIPs 201-2 special publications for Derived credentials which we have prepared for with four different design models, two of which are prototyped but have a sliding scale of security and price points.

b. Enhancement capabilities beyond credential provisioning that will require interactive requirement sessions to choose a proper design for the enhancement capability to meet specific DHS needs such as task 8 Enterprise IDMS and CMS.

c. Not to be evaluated because they are not needed or desired by DHS for initial operation.

All items and services incorporated into the evaluation pricing model for the base period are to be provided as soon as all transition and post-award activities, such as a post-award conference and kick-off, meeting have been completed.

All services at this time are planned to be T&M. If future tasks are incorporated, it is expected that this will result in an increased effort in labor categories already incorporated into the IDIQ contract. The Government will negotiate with the Contractor on level of effort if/when those future tasks arise.

17. Pricing Table – FFP CLINS

There are currently eight (8) FFP CLINs on the Pricing Table for the core credentialing requirements and 5 FFP CLINS for Enterprise components and some services that we believe should be FFP are missing. We recommend a consolidation into fewer FFP CLINs because it is difficult to determine what specific requirement tasks or elements map to each FFP CLIN as is evidenced by the multiple use of the same RFP section references in many of these CLINs. We suggest the Government consider:

Noted. CLINs in the pricing model updated to incorporate recommendations.

1) A single FFP CLIN for core credentialing service that the Government maps RFP requirement sections to. This is the primary CLIN that is inclusive of all, or some subset of the following per Government direction: hardware, software, licenses, labor to operate and maintain, IDMS, CMS, interfaces, Program Management, Help Desk, Security, and break fix.

2) A single FFP CLIN for transitioning the IDMS/CMS (Notional pricing only).

3) A single FFP CLIN for transitioning the existing 405 EWIS to be compatible with the IDMS/CMS (Notional pricing only).

4) A single FFP CLIN for the contractor proposed training plan

5) A single FFP CLIN for EIWS deployment and Maintenance with specific guidance from the Government for:

a. When the 400 CPUs are to be replaced on the existing EIWS equipment in the field

b. When the 150 new EIWS stations will be deployed

6) A single FFP CLIN for Purchasing Light activation stations and provide guidance of what size lots will be purchased in what timeframe so we can provide the appropriate volume discount pricing

7) A single FFP CLIN for Labor categories to be used for T&M tasks.

A single FFP CLIN for Enterprise services to be defined and priced after Government & Contractor requirement sessions to be deployed on a mutually agreed upon date after initial operating capability.

18. Pricing Model – Labor Hours

The RFP states that Task Order 1 will be equivalent to the Evaluation Model base year.

How does the Government intend to address fluctuations in Labor Hours specific to the system each Vendor is proposing?

Would the Government consider eliminating the direct linkage of TO 1 to the Evaluation Model?

The Government has determined that the Pricing Model as currently designed is the most effective way for evaluating pricing of the IDIQ contract. In addition, because of time constraints, the Government has to award the IDIQ contract and first TO concurrently; therefore, the TO award will be based on the Pricing Model’s base year pricing.

The Government has revised the solicitation to allow offerors to propose additional labor categories to be incorporated into the IDIQ contract, which can be used for future task orders.

19. RFP 5.2.3.1 Proposal Content, Page 120 Volume III Business & Pricing

The RFP has been revised to allow vendors to include a pricing explanation/narrative, not to exceed

Would the government consider allowing additional page count in Volume III for a pricing explanation/narrative, or allow offerors to include such detail on a separate tab on the pricing spreadsheet (Attachment 5)?

five pages.

20. General Question EIWS Field Deployments and Technical Support

Does the Government anticipate the need for offeror personnel traveling to Government sites to Should offerors include onsite troubleshooting and break-fix for EIWS in the FFP CLINS for those items? If so, can the government provide historical data for onsite troubleshooting and break-fix for the past 24 months?

The Government does not anticipate the need for offeror personnel to travel to Government sites outside of the Washington DC commuting area for onsite troubleshooting and break-fixing of EIWS.

21. General Question Light Activation

Was it the Government’s intent to include the purchase of the 16,000 Light Activation kits in the evaluation pricing model? If so which in Fixed Price CLIN should they be contained?

Would the Government consider purchasing the Light Activation kits in lots of 1,000 or greater to take advantage of volume discount pricing?

A FFP CLIN for the Light Activation Stations has been incorporated into the Pricing Model.

22. Attachment 5 – Evaluation Pricing Model Rows 20, 21, & 22

Where should the vendor enter ongoing O&M costs for these rows?

CLINs for O&M LH and FFP costs have been incorporated into the Pricing Model.

23. The Pricing table spreadsheet (Attachment 5), tab labeled “IDIQ Contract Pricing Tab”, contains only one CLIN to price IDMS/CMS Hardware, which references RFP Sections:

3.6.1, 3.6.1.1, 3.6.1.2. The Contractor suggests DHS expand the CLIN to be inclusive of all costs associated in the build and installation of an IDMS/CMS Turnkey solution:

a. IDMS Hardware

b. CMS Hardware

c. HSM

d. Backup IDMS Hardware

e. Backup CMS Hardware

f. Backup HSM

Noted. CLINs in the pricing model updated to incorporate recommendations for hardware and software.

g. Data Center Installation

h. Network Connectivity Testing

i. ICCB Approval

j. Regression Testing

k. C&A Support

l. Card Inventory Management

m. Appointment Scheduling

n. Light Activation

o. Segmentation

24. The Pricing table spreadsheet (Attachment 5), tab labeled “IDIQ Contract Pricing Tab”, contains only one CLIN to price the Software/Licenses, which references RFP Sections: 3.6.1, 3.6.1.1, 3.6.1.2. The Contractor suggests DHS expand the CLIN to identify all the Software/License costs associated with the IDMS/CMS Infrastructure: Specifically, the CLIN items should be:

a. IDMS Licenses

b. CMS Licenses

c. PKI Licenses

d. Middleware

Noted. CLINs in the pricing model updated to incorporate recommendations for software licenses.

25. The Pricing table spreadsheet (Attachment 5), tab labeled “IDIQ Contract Pricing Tab”, contains a CLIN which references RFP Sections: 3.6.1, 3.6.1.1, 3.6.1.2, 3.6.5. The aforementioned RFP Sections identify ten (10) interfaces, yet the Pricing Table allows bidders to price twelve (12) Interfaces. The Contractor suggests DHS clearly identify which interfaces and the quantity the Contractor is expected to price.

Noted and corrected. CLINs in the pricing model updated to identify interfaces and quantities.

26. The Pricing table spreadsheet (Attachment 5), tab labeled “IDIQ Contract Pricing Tab”, contains a CLIN for EIWS Maintenance, yet RFP Section 3.6.3 does not specify the level of maintenance DHS seeks for these EIWS. The Contractor suggests DHS clearly identify the level of maintenance (hot swap, next day, 2 days, etc.) the Contractor is expected to price for the EIWS.

See 3.6.3.1 - The Contractor shall provide to the Government the terms and conditions of their warranties and maintenance support for all EIWS in clear and understandable terms.

27. At the pre-proposal meeting, it was suggested that transition cost may be removed from the RFP in an amendment on June 10, 2013. If that

The Pricing Model has been revised to remove transitions costs for a migration transition approach.

All costs for a hard cut over are required to be incorporated into the offeror’s price.

is the case, how does the Government expect to evaluate the total cost of ownership, if both direct and indirect costs associated with any type of transition, whether hard cut over or not, are not included in the evaluation?

28. Attachment 5 and Responses to Industry Comments and Questions on the Draft PWS and FRD

IDIQ Contract Pricing and Evaluation Pricing Model tabs (Attachment 5), and page 28 (Industry Comments and Questions on the Draft PWS and FRD).

On the IDIQ Contract Pricing tab of Attachment 5, TS/SCI Clearances are required for the Program Manager, Information Technology Senior Consultant, Subject Matter Expert, Systems Architect, and Information Engineer, Principal positions. On the Evaluation Pricing Model tab of Attachment 5, however, only the Program Manager, Information Technology Senior Consultant, and Project Manager (depending upon the particular task) require TS/SCI clearances.

Page 28 of the Government’s Response to Industry Comments and Questions on the Draft PWS and FRD states that clearances up to Top Secret may be required and will vary depending upon the position. Please clarify.

Positions requiring TS/SCI are identified in Attachment 3. However, Government may require additional positions to have access to classified information to satisfy a program’s objective and or requirements not yet known.

29. RFP, 3.16 Deliverable Section 8, Page 74

The Integrated Master Schedule (IMS) "due by" field states: “Submitted with proposal.

Final: 10 calendar days after post award conference. Updates: Weekly, to be briefed at the weekly status briefing.” However, there are no instructions in section L or evaluation criteria in section M related to the IMS. Please confirm that it is either a post award deliverable or instruct offerors where it belongs in the proposal and how it will be evaluated.

Please confirm that if it is to be included with the proposal, that it will be excluded from the current page count.

The draft IMS shall be submitted with the proposal as part of the Technical Approach and will not be a part of the page count.

30. RFP 3.11.5, Page 53

Paragraph 3.11.5, Business Continuity Plan (BCP), states that the document is due 30

The BCP Plan shall be due 30 calendar days after the date of IDIQ award.

calendar days after IDIQ award, which agrees with the table of deliverables. The Q&A has several questions relating to the schedule for the BCP and the answer given by the government is 30 business days after IDIQ award. Which is correct, calendar days or business days?

31. IDIQ PWS and Task Order 1 PWS

It is unclear what the relationship between the IDIQ PWS and the Task Order 1 PWS (Attachment 6) and what is to be awarded and priced for this submittal.

a. The TO 1 PWS has a one year period of performance. If the PDR is 120 days after award. This would indicate a limited time to perform delivery activities and O&M during the base period. Please confirm the PDR timeline.

b. The TO 1 PWS makes reference to providing a solution as required in Section 2 of the DHS-IDIQ PWS. The section is terms and conditions and does not really describe what is to be provided. Please confirm language.

c. The TO 1 PWS calls for a development environment per sections 2 and 4 of the IDIQ PWS. The development environment is described in section 3.5 of the IDIQ PWS.

d. The TO 1 PWS refers to a section 8 of the IDIQ PWS. There is no section 8 in that document.

e. Section 2.2 of the TO 1 PWS says that the first card issuance Workstations are to be installed within 90 days to the TO award. According to the IDIQ PWS this is when the CDR is set to occur. Please confirm these milestones.

a. The PDR shall be held within 45 calendar days of Task Order Award

b. TO1 language updated to point the reader to the correct IDIQ section.

c. TO1 language updated to point the reader to the correct IDIQ section.

d. TO1 language updated to point the reader to the correct IDIQ section.

e. TO1 PWS updated to reflect the first fully compliant card be issued within 10 business days after the completion of the IDIQ’s PRR.

32. RFP Deliverables, 3.16 and 3.6.3.2.1, 3.6.3.2.2, & 3.6.3.2.3, Page 77

The PWS references for #22 (Operator’s Manual), #23 (Maintenance Manual), and #24 (User Training Manual) are 3.6.3.2.1, 3.6.3.2.2, and 3.6.3.2.3, respectively. This section of the PWS is for the EIWS. Are there similar manuals associated with the IDMS and the CMS and if so, what are the delivery requirements for them?

See RFP section 3.6.1.4 for technical support documentation. Subtasks will be added to the RFP Deliverables.

33. RFP – ISMS Services, 3.6.1.3, Page 36

Paragraph 3.6.1.3, Subtask 1.3, IDMS Services and Support, item #6 calls for SELC documentation per “PWS section 3.6.5”. This section is the test section and does not call for any documentation. Please clarify.

Corrected to read as PWS section 3.6.6

34. RFP – Deliverables, 3.16

Deliverables #3, #4, #6, #7, #9, #11, #12, #25, and #26 call for a draft to be submitted 5 business days prior to PDR and a final 10 business days prior to CDR. PWS paragraph

3.15.1.2 states that the government has 10 business days to review deliverables and make comments and the contractor has 5 business days to incorporate comments and resubmit. Is it the intent of the government that the draft of these documents be submitted for review and comment, the contractor incorporate the comments and then resubmit 5 business days prior to the PDR. This would mean that the documents would be submitted 20 business days prior to the PDR. Since the PDR is 45 calendar days after award, this leaves roughly 12 calendar days to develop the documents.

Please confirm this timeline.

The intent is for the Government to review submitted drafts/finals and provide comments back to the Contractor within 10 business days. Should it be necessary for the Contractor to make corrections, the Contractor shall make corrections within 5 business days after receiving the draft/final document from the Government.

PWS paragraph 3.15.1.3 also applies.

35. RFP – Review Timeline, 3.15.1.2, Page 72

Does PWS paragraph 3.15.1.2 also apply to the submittal of the final documents? Does the contractor have to allow for a second 10 business day review, a 5 business day comment incorporation period and 10 business days prior to CDR?

Correct. PWS paragraph 3.15.1.3 also applies.

36. RFP – Deliverables, 3.16, Page 73

The System Test Plans and Test Cases, deliverable #25, and the Integration Test Plans and Test Cases, Deliverable #26, are due at the same time as the draft design documentation is due. Could these test plans and test cases be done later when the design is more mature?

Please confirm timeline.

Refer to PWS paragraph 3.15.1.3.

37. Attachment 5 Pricing

The following labor categories are priced in Attachment 5, IDIQ Contract Pricing but do

The Government revised the Pricing Model to include the listed labor categories.

not have associated hours in the Evaluation Pricing Model tab. Please confirm that the government does not wish to evaluate these categories in the total evaluated price.

• Computer Systems Analyst (Contractor Site)

• Information Engineer, Principal (Government Site) TS/SCI Level

• Subject Matter Expert (Government Site) TS/SCI Level

• Systems Architect (Government Site) TS/SCI Level

38. Attachment 5 Pricing

The following, Hardware, Licenses, and Interfaces are priced in Attachment 5, IDIQ Contract Pricing but do not have associated extended prices in the Evaluation Pricing Model tab. Please confirm that the government does not wish to evaluate these items in the total evaluated price.

• Enterprise IDMS, Software / Licenses

(RFP 3.6.8, 3.6.8.1)

• Enterprise IDMS, Interface (RFP 3.6.8, 3.6.8.1)

• Enterprise CMS, Hardware (RFP 3.6.8, 3.6.8.2)

• Enterprise CMS, Software / Licenses (RFP 3.6.8, 3.6.8.2)

The Government revised the Pricing Model to include Enterprise Hardware, Software, and Interface CLINs.

39. Attachment 5 Pricing

There were several PWS Paragraphs not Specifically referenced in the Price Model- IDIQ Pricing to include the following:

• 3.6.4 Task 4 O&M and Support Plan (Also to include help desk paragraph under 3.6.4)

Tasks 1 through 7 including their subtasks are now incorporated into the Pricing Model.

• 3.6.7 Task 7 – IDMS/CMS Ongoing Implementation Readiness

• 3.6.1.3 Subtask 1.3 – IDMS Services and Support

Please confirm that this scope is not evaluated in the pricing model.

40. Attachment 5 Pricing

Please confirm that the all labor is to be included in the labor hour CLIN Type items and that the FFP CLIN Type items are limited to material, licensees, hardware, interface fees, annual maintenance fees, etc.

Labor CLINs are for all labor and FFP CLINs are for all hardware software licenses, interfaces, annual maintenance, etc.

41. Attachment 5 Pricing

Based on industry day discussions, this offeror concurs with the government’s original decision to prescribe labor hours for all offerors. It is our opinion that this method will yield the most comparable evaluated price among the field.

The Government has decided to not allow offeror’s to propose different labor hours or labor categories for the Pricing Model. However, the Government has included an addition the RFP allowing offeror’s to propose additional labor categories and rates, which will be evaluated separately from the Pricing Model, but will allow the Contractor flexibility in pricing and level of effort for future task orders.

42. RFP – IMS – 3.16 Deliverables

The PWS does not contain language that bounds the time frame or scope of the IMS.

Please confirm that the IMS is constrained to Task 1, Year 1, rather than the entire 10-year

IDIQ.

Refer to PWS paragraph 3.6.6.5 – “. . . the schedule shall contain milestones, exit criteria, and activities from contract award to contract completion.

43. RFP – Attachment 3 – Pages 1 & 4

The description for the SME and Transformational Change Practitioner (Senior) labor categories are identical except the SME role has a TS clearance requirement. Is this correct?

Corrected. Labor description should be read as:

Provides support in business, information, performance, transactional and data warehouse data modeling and development, enterprise application integration and systems integration, data conversion, data extraction, transformation and load. Assists other project members with enterprise engineering, business analytics, identity management solutions, customer relationship management solutions, system integration business process re-engineering and application development. Provides data center planning and support.

44. RFP – Attachment 6 – Page 123

With respect to Step 1, Factor 2 of the evaluation criteria vendor qualification, we strongly recommend reconsideration to not change the FIPS 201/PIV issuance qualification and keep it as currently written

The Government has determined that removing the FIPS 201 requirement is in its best interest in assessing past performance. To mitigate the risk of removing FIPS 201, the Government has incorporated a requirement for the offeror to be on the GSA Qualified HSPD-12 Service Provider List.

The Government considers it too restrictive to tie for the following reasons: There is a significant difference between issuing PIV and non-PIV types of credentials which includes security requirements, background checks, adjudication workflow, PKI requirements, network configuration, card topology and system interfaces, among other considerations. We strongly recommend maintaining this criteria and adding qualification in all SIN 132-62 service areas as a prerequisite in order to minimize the risk to the government. This approach is also consistent with what is stated in Section 3, page 117, that past performance references should not only be recent, but also relevant to DHS in terms of similar complexity and magnitude.

qualifications to SIN 132-62 since this procurement is open market and not being conducted under GSA Schedule 70.

Factor 2 rewritten to read as:

In assessing Step 1, Factor 2, the Government will evaluate the offeror’s Volume I submission to determine whether or not the offeror (or one of the offerors if a teaming arrangement is proposed) has experience implementing an identity/credential management solution across a distributed enterprise environment and be a certified integrator on the GSA Qualified HSPD-12 Service Provider list.

45. RFP – Attachment 3 – Pages 1 & 4

In order to assure that the key personnel and staffing are experienced and qualified for the various labor categories and roles specified – and to provide a fair cost comparison of rates for each labor category across bidders - we recommend that there be minimum requirements established for personnel which could include years of experience in HSPD-12 operational programs and certain professional certifications such as the PMP, CISSP, or CSCIP, along with equivalency in education.

After further consideration, the Government has decided not to incorporate minimum qualifications and experience for the labor categories. The Contractor will be responsible for ensuring all of its personnel can perform the skills and duties described for the labor category positions.

46. RFP – Attachment 5 – Page 118

The pricing table only allows for the Transition task to be priced as T&M with hours set by the government. We believe this creates unnecessary risk for the Government and may not allow for an accurate evaluation of the actual cost of the transition. Would the Government consider having the Transition priced as firm fixed price (FFP) which would allow bidders to provide a solution which would accommodate the innovation and efficiency called out for on Page 114 of the

PWS?

The Government is no longer evaluating transition in its Pricing Model since the transition approach will not be decided until after contract award. The Government has incorporated a new Worksheet for transition pricing; however, this information is being requested for information purposes only.

47. RFP – 3.6 – Page 31

As the 8 PWS tasks in the RFP do not map directly to the 6 pricing categories in pricing table, the table does not provide a comprehensive representation of the work needed to perform the PWS, creating risk for the government and doesn’t support an

Pricing tables rearranged by PWS Tasks.

The Government has determined that there is not enough information provided in the IDIQ or TO PWS in which all vendors can reasonably proposal firm-fixed price, which is why all services are priced on a T&M basis. Since under a T&M arrangement, the Government is paying for effort and not a evaluation of actual delivery costs. How does the government intend to address the possibility that the hours needed to complete the PWS tasks may realistically exceed the hours presented in the pricing table?

Recommend that the Government consider making more of the PWS Tasks deliverable based and FFP since experienced and qualified HSPD12 vendors have performed these tasks previously.

deliverable for the services, the Government anticipates that additional hours may be required after award and will increase the funding and hours, if/when appropriate.

48. Pricing

Where in the pricing table should the bidder include the cost of performing the C&A and any security controls, on the IDMS/CMS system?

C&A and security control work is considered services and shall be performed within the existing labor category rates and hours.

49. Pricing

Please specify the period of performance for the base year and option year 1. It appears that the base year and Option 1 could run concurrently?

The period of performance for the first Task Order is September 27, 2013 through September 26, 2014.

The base period of performance for this IDIQ is September 27, 2013 through September 26, 2014.

The Pricing Model’s period of performances have been corrected.

50. Pricing

The pricing table supplies the number of hours for the transition of EIWS and IDMS/CMS, creating unnecessary risk for the Government and not allowing for an actual cost evaluation of the transition. Will the Government consider the EIWS and IDMS/CMS transition to be priced as FFP, to reduce risk to the government and allow for the innovation and efficiency called out for on Page 114 of the

PWS?

The Government is no longer evaluating transition in its Pricing Model since the transition approach will not be decided until after contract award. The Government has incorporated a new Worksheet for transition pricing; however, this information is being requested for information purposes only.

51. RFP – 3.6.1.2 & 3.6.1.3

1. Could the Government either provide a place in the pricing table to price the light activation stations or identify where in the pricing table the Contractor is expected to include in this price? Also, please specify the quantity upon which pricing should be based.

2. Please specify the hardware and software that should be included in the Lightweight Activation stations in order for them to be properly priced; For example, “Lightweight Activation stations shall consist of a single finger fingerprint scanner, PWS 3.6.1.2 and pricing model revised to include the Light Activation Station.

a contact smartcard reader, smart card middleware and any other software required by the vendor’s solution to add PIN Reset and Certificate Update capabilities to existing Windows-based DHS workstations.”

52. RFP – 3.6.1.1, Page 35

Where in the pricing table should the bidder include the labor hours required to accomplish the system customization required to move from a COTS to GOTS solution?

System customization is considered services and shall be performed within the existing labor category rates and hours.

53. Pricing

1. In the pricing table spreadsheet, IDIQ

Contract Pricing Tab, IDMS/CMS Interfaces, References RFP Sections 3.6.1, 3.6.1.1, 3.6.1.2, there are 10 system interfaces identified, while the Pricing Table requests 12 Interfaces. Can the government explain this discrepancy?

2. We recommend that the Government clearly identify which interfaces are required, and the quantity, so that pricing can enable an actual cost comparison.

Noted and corrected. CLINs in the pricing model updated to identify interfaces and quantities.

54. RFP – 3.6.1.1 & 3.6.5, Pages 35 & 43

RFP appears to require that the test environment be located in a government-operated data center (3.6.1.1) and in a contractor-provided data center (RFP 3.6.5). Which is correct?

PWS paragraph 3.6.1.1 corrected to reflect the production test installed at a contractor site.

55. RFP – 3.16 – Table of Deliverables – Page 79

Is the final or draft supply chain risk management plan due 30 business or calendar days after TO Award? If the final plan is due 30 business or calendar days after TO Award, when is the draft plan due?

PWS paragraph 3.11.23 and Table of Deliverables corrected to reflect calendar days.

56. Attachment 5 – Evaluation Pricing Model Rows 4 & 5

Attachment 5’s Evaluation Pricing Model tab requires the Project Manager to have a TS/SCI clearance, but Attachment 3 does not. Which artifact is correct? Recommend that all clearance requirements be changed to TS with ability to attain SCI.

Attachment 5 corrected to reflect that the Project Manager does not require a TS/SCI. Clearance requirement will remain TS/SCI.

57. RFP – 5.2.4.3.1 – OCD Evaluation Checklist

The PWS requires the offeror to demonstrate the system’s capabilities and workflows to issue and manage other credentials: PIV-I, Visitor Cards (i.e., Facility Access Cards (FAC)), and others. Could the Government please clarify “others”?

“Others” could be in the form of credentials used by other DHS Components or Government agencies.

58. RFP – 5.2.4.3.1 – OCD Evaluation, Page 116

Could the Government please clarify the phrase “identify and address orphan accounts, data and attributes orphan Accounts”?

Orphan identity or attribute records refer to those that cannot be easily or distinctly linked to a specific individual.

DHS has numerous federated systems and data sources that store account and person information.

As the DHS seeks to improve identity management and streamline access, the solution must be capable of linking disparate accounts to the associated person identity. In the event an orphan record is discovered during the data linking process, the proposed solution shall provide capabilities to identify these inconsistencies and based on defined business rules remediate or provide notifications for appropriate action.

59. RFP – 5.2.4.3.1 – OCD Evaluation, Page 116

How does the Government plan to evaluate centralized PIV card printing during the OCD?

Does the Government plan to observe the OCD from local and remote production sites?

The Government can evaluate centralized printing capabilities through discussion/presentation.

Government will observe local production capabilities.

60. RFP 3.11.18 – Security Authorization Terms and Conditions, Pages 59 & 60

Can the government clarify the role it expects the Contractor to play? Is it the intent of the government to have the Contractor work directly with the ISSO and support security authorization activities, e.g. participation in security control assessments and that the Contractor will support addressing the results of the independent assessment and verification? Can we assume that the ISSO will provide the results of the independent assessment and verification to the Contractor?”

The Contractor will work closely with the System Owner and ISSO to support security authorization activities and resolve any POA&Ms. The ISSO and Assessor will discuss and provide the results of any independent assessment and verification.

61. RFP, 3.11.20 – Continuous Monitoring Terms and Conditions, Pages 60-61

The PWS indicates that, at a minimum, the contractor shall implement the following processes:

This is discussed in DHS 4300A, which will be provided after award.

• Asset management

• Vulnerability management

• Configuration management

• Malware management

• Log integration

• Security Information Event Management

(SIME) integration

• Patch management

• Providing near real-time security status information to the DHS SOC

Can the government clarify which processes will have to be provided by the contractor and which will be provided by DHS? Is there a list of specific solutions, processes, products, and/or tools that DHS has already implemented in support of continuous monitoring and that the IDMS should be integrated with as part of continuous monitoring?

62. RFP, 3.11.22.1 – Security Operations Terms and Conditions, Page 63

Does the government expect that the Contractor provides 24x7x365 staff to monitor the network and all of its devices or is this a service that is provided by the existing DHS SOC or NOC? Please provide further guidance.

This RFP section is applicable to DHS systems hosted in non-DHS Data Centers.

63. RFP, 3.11.22.2 – CIRS Terms and Conditions, Does the government expect that the Contractor provides CIRT services under this IDIQ? How does the Contractor CIRT services relate to the CIRT services in place at DHS and is the scope of service limited to the IDMS system?

This RFP section is applicable to DHS systems hosted in non-DHS Data Centers.

64. RFP, 3.11.10, Intellectual Property, Page 56

The referenced FAR clause, 52.227-17, specifies that the Government must be granted the same rights to software (data) not first developed under the contract as the Government would have to software first developed under the contract (subparagraph (c)(2)). This may not be possible for commercial software packages (e.g., database management engine, Windows operating system, etc.). We recommend allowing delivery of commercial software under the terms of FAR clause 52.227-19, and existing

Noted. DHS is reviewing and will issue any changes via an amendment to the solicitation to be issued at a later date.

works under FAR clause 52.227-18.

65. Attachment 6

The task order #1 which is part of the RFP does not address in detail all of the work elements that would be included in executing the task, and, therefore, creates a risk to the government that not all costs will be captured in a bidder’s pricing submission. For example, we believe that the cost of transition, which could include the very expensive cost of reissuing up to 300,000 PIV credentials should be factored into the overall program cost of ownership equation.

To assist in providing more specificity to the subtasks that could be encompassed by Task Order #1 we are presenting the table below to help identify the task elements that should be bid and evaluated in order to provide a fair cost comparison and reduce the risk to the government (this list is not meant to be all inclusive but suggestive of some major work elements to be considered)

The Government is no longer evaluating transition in its Pricing Model since the transition approach will not be decided until after contract award. The Government has incorporated a new Worksheet for transition pricing; however, this information is being requested for information purposes only.

The vendor’s recommendations were considered when the Government revised the Pricing Model.

Continuation of Comment 65:

Task Description Options Cost Extended Cost Task 1 - Identity and Card Management System

Build Turnkey Infrastructure Hardware

• Includes: IDMS/CMS

Servers IDMS Licensing, CMS Licensing, PKI Licensing, Appointment Site Licensing, Card Stock Inventory Licensing, C&A Support, Light Activation Stations

1. Transition to Turnkey Solution

2. Rip & Replace and Re-Issuance of 300,000+ DHS Personnel

Task 2 – Enrollment and Issuance Workstations

(EIWS)

EIWS hardware, software and licenses

1. Support the Current 405 DHS

EIWS

2. Provide 405 New EIWS to DHS

Task 3 – EIWS Maintenance

EIWS Maintenance N/A Maintenance on 405 DHS EIWS

Task 4 – 1. US Treasury PKI N/A

Interfaces: IDMS must support data exchange interfaces with 9 systems.

2. ISMS

3. IDENT

4. CJIS

5. Component &Enterprise

PACS

6. Component & Enterprise

LACS

7. Card/Credential Management System (CMS)

8. Hardware Security Module

9. Enrollment & Issuance

Workstations (EIWS)

10. Light Activation Stations

Task 5 – Technical Support and Training Documentation

Labor to operate and maintain infrastructure as well as to deliver and update training documentation

List out all the current Labor positions listed in current pricing table

Make this Firm Fixed Price based on XXX amount of hours needed.

Task 6 Deliverables & Reporting Requirements

N/A

66. The RFP stated that for the OCD, “The system must be a live operational system and not a mock-up…” Can DHS please clarify what “live operational” mean?

A system that is functional and working correctly as it was intended – beyond the testing and development phase.

67. RFP – Task 3 DHS PIV Card Enrollment and Issuance Workstations (EIWS) Paragraph 3.6.3, Page 39

The Contractor shall propose hardware that complies with the DHS Technology Reference Model (TRM) requirements, FIPS 201, NIST supporting special publications, and other referenced federal standards.

Question: Does this mean that only products on the FIPS 201 Approved Products List (APL) can be ordered under this IDIQ contract?

The Contractor shall propose equipment, parts and material from the relevant approved GSA approved products list for HSPD-12.

68. RFP – Task 7 IDMS/CMS Ongoing Implementation Requirements Paragraph 3.6.7, Page 48

The solution shall support the ongoing evolution and extension of the Department’s HSPD-12 and ICAM objectives to include: 2.

The Contractor shall propose equipment, parts and material from the relevant approved GSA approved products list for HSPD-12 at the time of proposal submission.

Support future alternative biometric standards, specifically iris capture, storage, and matching.

Question: In supporting the evolution of HSPD-12 objectives, does an alternative iris biometric capture, storage, and matching system have to be certified on the GSA Approved Products List prior to the time of implementation of this task?

69. General

Clarification: At the pre-proposal conference it was stated that “The products used must be certified on the GSA Approved Products List, and the integrator must be certified on the GSA Qualified HSPD-12 Service Provider list.” Is this correct, and is this statement explicitly stated in the RFP document?

Factor 2 has been rewritten to read as follows:

In assessing Step 1, Factor 2, the Government will evaluate the offeror’s Volume I submission to determine whether or not the offeror (or one of the offerors if a teaming arrangement is proposed) has experience implementing an identity/credential management solution across a distributed enterprise environment and be a certified integrator on the GSA Qualified HSPD-12 Service Provider list.

70. RFP 3.6.1 and Attachment 6, Page 31

Attachment 6 is a Performance Work Statement (PWS) for Task Order (TO) #1, however, the instructions of the solicitation do not include a tab for including the bidder’s approach for meeting the requirements of the

TO PWS.

a. Please advise if bidders are required to include their approach to meeting the requirements of the PWS for TO #1.

b. If so, where would DHS like this information to be inserted (volume, tab)?

Bidders are not required to include a separate approach to meeting the requirements of the PWS for

TO #1.

71. RFP Section 4, Page 117-118

The solicitation requires a Subcontracting Plan and includes the DHS Subcontracting goals for FY13. Can the Government clarify whether it is expecting the Subcontracting Plan to meet and exceed the DHS’ subcontracting goals?

An Offeror cannot receive a rating higher than acceptable unless it meet or exceeds the DHS subcontracting goals. An Offeror can receive a rating of acceptable if its goals are meaningful and it provides an adequate rationale for not meeting the DHS subcontracting goals.

72. Suggestion at the DHS’s IDMS pre proposal conference held 6/6/13 to include education, experience or certifications to the labor categories.

This offeror recommends that DHS does not restrict industry by defining what education, experience or certifications should be

The Government has not incorporated experience or education requirements for labor categories.

possessed within the defined labor categories.

Keeping the labor categories as they are now will allow industry to provide a best value offer to DHS.

While we were working on the pricing for “Task 3 – DHS PIV Card Enrollment and Issuance Workstations (EIWS)” of the RFP, we observed the following:

• If DHS allows the bidders to price the EIWS components based on their own interpretation, a lot of vendors may propose a much lower evaluated price by making a variety of self-serving assumptions, for example: the existing devices are still under warranty, Support & Maintenance, Replacements, Upgrades and so forth.

• This will create an unlevel playing field for the bidders.

To mitigate such issue and to better level the playing field, we respectfully recommend that DHS specifies some sort of replacement schedule.

From PWS 3.6.3 - The Contractor shall provide a phase-in approach that integrates GFE EIWS equipment into the IDMS/CMS solution by initially using existing equipment with a planned replacement cycle, over a four-year period, rather than an upgrade or replacement of the GFE EIWS infrastructure, to include the replacement of current computers (CPUs). If not feasible, identify the transition period required to accommodate procurement of long-lead-time components based on 400 EIWS to be deployed.