HSHQDC-13-R-00047_-_Amendment_000003_-_Attachment_1.pdf

RFP HSHQDC-13-R-00047 – Amendment 000003

Vendor Question Government Response

1. The Functional Requirements Document distributed with the DHS’s HSPD-12 Products and Services RFP includes the following statements:

1. The present Identity Management System

(IDMS) was designed in 2008 and has remained basically unchanged since its inception. New more capable methods are now available that must be evaluated and implemented to move the IDMS process into compliance with HSPD-12; Office of

Management and Budget (OMB)

Memorandum M-11-11, Continued

Implementation of Homeland Security

Presidential Directive (HSPD)-12 – Policy for a Common Identification Standard for Federal

Employees and Contractors, February 3, 2011

(“M-11-11”); and Federal Identity, Credential and Access Management (FICAM) Roadmap and Implementation Guidance, Version 1.0, November, 2009.

2. The Functional Requirements Document

(FRD) defines the functional requirements for a commercial-off-the-shelf (COTS) IDMS which will manage DHS identity data and access to the CMS. This document serves as a basis for mutual understanding between the user community, the COTS software vendors, and system developers. It provides the basis for development of criteria for system tests on candidate COTS products.

The above statements imply that the DHS is seeking an IDMS that:

1. Is currently marketed and sold as a commercial IDMS product;

2. Is currently in production as part of

FIPS 201 compliant PIV and PIV-I solutions.

3. Is maintained and supported as a commercial product (release/version management, regular software updates and bug fixes across multiple client instances);

4. Works out-of-the-box with multiple

FIPS 201 compliant card management systems and other solutions components;

DHS intends to procure a COTS solution (e.g.

IDMS, CMS, enrollment) that is customizable, conforms to HSPD-12; OMB M-11-11; FICAM

Roadmap and Implementation Guidance; and the

National Information Exchange Model (NIEM).

5. Includes an integration framework to minimize the required labor to integrate with adjacent DHS systems.

Could you confirm that the DHS intends to procure a COTS IDMS product from a commercial software vendor, versus a custom, or otherwise proprietary IDMS solution from a federal integrator? We understand that federal integrators are needed on most teams

(as the prime) for their expertise and knowledge of DHS systems, and would thus work with commercial IDMS software vendors, not in place of them.

2. From the RFP: “The IDMS shall integrate with the following:

US Treasury PKI (manages DHS PKI

Certificate Authority) for certificate issuance and management.

Will DHS accept proposals that will use other

Shared Service Provider Certificate

Authorities as the source for DHS HSPD-12 credentials?

(Solicitation Reference: Section 3.1, Page 27)

No. For the DHS PIV Card, DHS uses the US

Treasury PKI for certificate issuance and management. DHS would consider use of other providers for PIV-I, derived and other credentials.

3. The RFP states “Capable of issuing, tracking and managing PIV credentials for HSPD-12 to include: HSPD-12 PIV, PIV-I, Visitor

Cards, etc.”.

For the PIV-I credentials, which Certificate

Authority will issue the PIV-I credentials?

(Solicitation Reference: Section 3.6, Page 32)

For the PIV-I, DHS does not have a Certificate

Authority. The offeror should include an approach within their proposal.

4. The RFP states “Issue a FIPS 201 compliant card which includes PIV Authentication

Certificate, PIV Digital Signature Certificate, PIV Asymmetric Card Authentication

Certificate (also known as Card

Authentication Key (CAK)), and PIV

Encryption Certificate (on card escrow and server)”.

Does the escrow (on server) pertain to the certificate authority or to the card management system?

Escrow of historical private keys is handled by the

Treasury PKI and also required per NIST 800-73 specifications.

The offeror’s proposal shall meet the requirements as stated, and can propose additional capabilities where relevant.

(Solicitation Reference: Section 3.6, Page 33)

5. May the vendor provide resumes to show capability for each of the listed labor categories - in addition to the existing requirement for key personnel resumes?

(Solicitation Reference: Section 5, Page 117)

Should the vendor so choose, it may include resumes to show capability for the listed labor categories.

Any resumes provided by the vendor besides those for the proposed Key Personnel will be included in the page count limitations for the vendor’s Technical submission.

6. Will the DHS provide standard software that would normally be enterprise level licenses for the EIWS laptops or desktops, such as

Windows, Office, Adobe Acrobat, etc, or should the vendor include those elements in pricing the workstations?

(Solicitation Reference: Section 3, Page 39)

DHS will not provide enterprise level licenses for standard software for the laptops/desktops used to operate the EIWS.

7. Does the DHS have standard enterprise software licenses for MS Windows, SQL

Server, Oracle and Java that the vendor can utilize in our solution, or does the vendor need to include those items in our pricing of components?

(Solicitation Reference: Section 3, Page 31)

DHS will not provide enterprise level licenses for standard software for MS Windows, SQL Server, Oracle and Java.

8. The FRD describes a requirement for

Biometric 1:N matching within the IDMS.

Does the current IDMS support this requirement? Is this a feature of the IDENT system, or a new desired capability?

(Solicitation Reference: Attachment 1, Page

11)

The current IDMS has the biometric 1:N matching, but the functionality has not been implemented. The proposed solution needs to support the biometric 1:N matching. IDENT’s biometric 1:N matching capability is outside of scope of this IDIQ.

9. IDIQ Contract Period of Performance, states each contract is 12 months in length, but the dates installed in Attachment 5 provide dates out of sync with Section 2.6. Attachment 5 does not have dates listed and the dates listed in Option Period on starts with 9/27/2013.

Please provide clarification as to the proper

PoP date for the Base Period and the following Option Periods.

Please see HSHQDC-13-R-00047 – Amendment

000002, Attachment 1 (Question 11).

(Solicitation Reference: Section 2, Page 22)

10. Does the DHS have a standard suite for enterprise servers that the vendor needs to adhere to for the server hardware? Does DHS have available hardware or are vendors to price with our solution?

(Solicitation Reference: Section 3, Page 31)

The vendor should provide its proposed server hardware as part of its proposal.

11. Are resumes outside of the page count for the

Technical and Past Performance submission page limitations?

(Solicitation Reference: Section 5, Page 113)

Per solicitation section 5.2.4.3.1, resumes for proposed Key Personnel are not included in the

Technical and Past Performance submission page limitations.

12. Section 3.2 Scope states that “Under this

PWS, the Contractor shall provide the core infrastructure that will be installed at the DHS

Data Center locations…”. An IDMS/CMS solution may comprise of server based software that resides on commercially available virtual or physical servers, and utilizes either local or remote storage. Will the

Contractor be required to price and provide the hosting servers, storage, switches, appliance environment, or will DHS utilize the hosting environment specifications provided in the proposal as requirements to provision existing DHS data center servers and storage? Additionally, will the Contractor physically perform the physical installation/racking of the equipment in the data centers? Please explain the breadth of the scope regarding Contractor provided hardware installation into the DHS data centers, and server/storage configuration to support the ISMS/CMS server based services.

(Solicitation Reference: Section 3.2, Page 28)

The contractor shall assume that no infrastructure components/services will be supplied by DHS at the data centers. The Government reserves the right to utilize services provided by the DHS OCIO Data

Center Program Office..

PWS 3.6.1.3 revised to add “Provide necessary personnel, process, and technology to support complete application support. Service includes, but is not limited to, the initial application baseline, application changes, porting, quality assurance, installation, integration, end user training, application code testing, application migration, database and middleware support, monitoring, change management, and application security authorization support.”

13. PWS section 3.6.3 specifies a

“Uninterruptable Power Supply/Source

(UPS), battery backup”. Please define the

Estimated Runtime requirement so that we don’t undersize or oversize the UPS.

(Solicitation Reference: Section 3.6.3, Page

29)

PWS 3.6.3 revised to add: Estimated runtime is the duration necessary to power down the EIWS computers in an orderly manner.

Back-end (e.g., IDMS, CMS, and HSM)

Uninterruptable Power Supply/Source (UPS) capabilities shall be integrated with the services provided by DHS data centers.

14. Section 3.6.3.2.1 Operator’s Manual has a

Help Desk section. Regarding the Service

Support Desk, the Contractor is to provide

Tier 2 and Tier 3 (along with the HW/SW mfgs). Tier 1 DHS SQ SSD support is provided by another contractor. What trouble ticket system will the contractor under this contract be required to use? Will DHS support the ability for the contractor to access this trouble ticket (from a Tier 2/3) perspective from the contractors facilities?

(Solicitation Reference: Section 3.6.3.2.1, Page 30)

The Government is implementing a trouble ticket system for the HSPD-12 Program to use. DHS will consider providing the ability for the contractor to access the trouble ticket solution from the

Contractor’s facilities.

15. PWS section 3.6.5 states “…completing product and interface testing to ensure that the developed system functions properly…” What provisions will DHS make to support at the

Contractor’s location “interface testing” and

“integration testing” of the IDMS/CMS with non-production versions of: US Treasury PKI, ISMS, IDENT, CJIS, PACS, LACS, and

HSM?

(Solicitation Reference: Section 3.6.5, Page

43)

The Government will provide the necessary systems to verify functionality in a test capacity for US

Treasury PKI, ISMS, IDENT, CJIS, PACS, LACS.

The HSM test capability will be provided as part of the offerors proposal.

16. In referencing a Project Management Plan, does the Government mean Program

Management Plan for the broader contract or a plan specific to Task 1?

(Solicitation Reference: Section 5.2.4.3.1.Vol

II. Tab B. Section 2, Page 117)

PWS, Section 2, updated to read as “Program

Management Plan.” The referenced Program

Management Plan is required at the IDIQ level.

17. Are contractors to keep proposal valid and hold prices firm for 30 or 90 days from the date specified for receipt of offers?

Per section 5.2.4.2, proposals shall be valid for a minimum of ninety (90) days.

(Solicitation Reference: Section 5.1(c), 5.2.4.2, Pages 106 and 112)

18. The initial Business Continuity Plan (BCP) is due 15 calendar days after award and the final is due 30 calendar days after TO award. PWS paragraph 3.15.1.2 specifies that the government shall have 10 business days to review draft documents and the contractor shall have 5 business days to incorporate comments. Could the Government please provide clarification for delivery requirements as converting business days into calendar days does not allow for adequate time to deliver the

BCP?

(Solicitation Reference: Section 3.15.1.2, 3.16, Pages 72 and 73)

PWS 3.11.5 updated to reflect business days. PWS

3.16 revised to reflect business days after IDIQ award.

19. The draft CONOPS is due 30 calendar days after TO award and the final is due 5 business days prior to PDR. The PDR is required 45 calendar days after TO award. Utilizing the review times specified in PWS paragraph

3.15.1.2, could the Government please provide clarification for delivery requirements as converting business days into calendar days does not allow for adequate time to deliver the

CONOPS?

3.16, Pages 72 and 75)

The PDR shall be held within 45 calendar days of

Task Order Award. Draft CONOPS is due 30 calendar days after TO award. Final CONOPS is due

5 business days prior to PDR.

PWS 3.15.1.2 revised to say “The COR will have 5 business days to review deliverables and make comments.”

20. The draft Training Plan is due 60 calendar days after TO award and the final is due 10 business days prior to CDR. The CDR is required 90 calendar days after TO award.

Utilizing the review times specified in PWS paragraph 3.15.1.2, there is not enough time between the draft and the final. Could the government please provide clarification for delivery requirements?

3.16, Pages 72 and 76)

The draft Training Plan is due 60 calendar days after

TO award. Final Training Plan is due 10 business days prior to the CDR.

PWS 3.15.1.2 revised to say “The COR will have 5 business days to review deliverables and make comments.”

21. The initial IBR is due 10 calendars days after

TO award. This is 5 calendar days prior to the

PAC. Can the Government please confirm that the IBR is due prior to the PAC?

3.16, Pages 73 and 77)

PWS 3.6.6.8 and 3.16 revised to reflect the IBR will be held within twenty (20) calendar days of the TO award.

22. Generally, workstations include the CPU.

Does the enrollment/issuance workstation include the EIWS CPU?

(Solicitation Reference: Attachment 5, IDIQ

Contract Tab)

000002, Attachment 1 (Question 9).

23. In which Proposal Volume and Section should offerors include the IMS?

(Solicitation Reference: Section 3.16, Page

74)

000002, Attachment 1 (Question 29).

24. PWS Section 3.6.3.1 Subtask 3.1 (EIWS

Warranties and Maintenance Support) requests that the Contractor provide terms and conditions of their warranties and maintenance support for all EIWS, to include services, service levels, and pricing, and that the Contractor should provide good faith estimates for maintenance support of system and subsystem elements. Could the

Government please confirm that no pricing should be included in the Technical Volume response.

(Solicitation Reference: Section 3.6.3.1)

The vendor should provide their proposed O&M solution as part of the technical approach. As stated in the RFP, no pricing information shall be included in the offeror’s technical submission.

25. The IDIQ PWS, paragraph 3.6.6.5 –

Integrated Master Schedule, page 45, states that the contractor shall work with the

Government to identify and quantify schedule risk in hours, days or weeks of delay and

The three point duration estimates are not identified as a requirement for the draft IMS The risk analysis will be a part of the Risk Management Plan.

provide optimistic, expected, and pessimistic durations for each IMS activity and event.

Could the Government please confirm that the three point duration estimates are not required for the draft IMS submitted with the proposal and that the schedule risk analysis will occur after award.

(Solicitation Reference: Section 3.6.6.5, Page

45)

26. Which mobile platforms (e.g. Android, iOS, BlackBerry, Windows) and which key stores

(e.g. SIM, NFC, microSD, native operating system) are required for derived credentials. Are any higher priorities than others?

To be determined - pending release of NIST SP 800-

157. The solution shall be scalable to support evolving requirements for mobile platforms.

27. What additional credential types would DHS like managing, e.g. SecurID tokens or virtual smartcards?

Please see DHS Responses to Industry Comments and Questions - Draft PWS and FRD, Vendor N

(Question 6).

28. The section states: “Provide an open, non-proprietary, FIPS 201 compliant, industry standards-based interface and authentication for all DHS PIV equipment.”

Question: Is it possible to provide clarification on what is meant by this requirement?

(Solicitation Reference: Section 3.11.2, Page

18)

Open standards following the relevant guidance of

HSPD-12; OMB M-11-11; FICAM Roadmap and

Implementation Guidance; and the National

Information Exchange Model (NIEM).

29. The description for the SME and

Transformational Change Practitioner

(Senior) labor categories are identical (except for clearance requirement). Is this correct?

(Solicitation Reference: Attachment 3)

000002, Attachment 1 (Question 43).

30. The RFP states that 3 past performance references shall be submitted. It is unclear if these are to be from the proposed Prime contractor. Based on the importance of these services, will the Government stipulate that at least two of the past performance references

Past performance references may be submitted from both the proposed prime and subcontractors. The prime contractor must submit a minimum of two references. Per the RFP, the minimum number of references is three, however the offeror may submit more than that if it wants to submit more than one be from the prospective Prime.

(Solicitation Reference: Section 3, Page 117) subcontractor reference. RFP section 5.2.4.3.1 has been updated to reflect this information.

31. “Deliver a light footprint card update, unblock and activation station which leverages existing GFE workstations and can coexist, without causing conflicts, with other DHS middleware (for example, Microsoft CAPI, ActivClient, etc.).”

Question:

Is the light activation just client software?

(Solicitation Reference: Section 3.6.1, Page

33)

Light activation is a combination of client software, smartcard and biometric readers as well as necessary drivers which are integrated to a PC platform.

32. DHS states that a C&A is required and is the responsibility of the vendor. Would the

Government consider making that a separate

CLIN?

(Solicitation Reference: Attachment 5)

After consideration, the Government has determined that the C&A should not be included as a separate

CLIN.

33. In multiple places throughout the RFP, notably in Sections 3.6.1.2 and 3.6.1.3, the

Government references light activation stations, and procuring up to 16,000. The

Government also requests that the

Government plan for the O&M support and the deployment strategy associated with these light activation stations. The Government however does not provide a place in the pricing table to price the hardware/software associated with the light activation stations.

Could the Government either provide a place in the pricing table to price the light activation stations or identify where in the pricing table

(and the quantity where the Contractor is expected to include this price?

000002, Attachment 1 (Question 21).

34. RFP appears to require that the test environment be located in a government-operated data center (3.6.1.1) and in a contractor-provided data center (RFP

3.6.5). Please clarify.

(Solicitation Section: 3.6.1.1, 3.6.5, Pages 35 and 43)

PWS 3.6.1.1 has been revised to state “Be a secure and scalable HSPD-12 compliant solution that consists of a (1) production primary and (2) production backup at DHS designated Data Centers, and (3) production test installed at a contractor site.

35. Could the Government please clarify the phrase “identify and address orphan accounts, data and attributes orphan Accounts”?

(Solicitation Section: 5.2.4.3.1, Page 116)

Orphan identity or attribute records refer to those that cannot be easily or distinctly linked to a specific individual.

36. The section states: “The Contractor shall include as part of the design, storage of all data and reports. The data will become part of the Department’s IDMS/CMS. The final structure of the IDMS/CMS will be determined by the COR and Contractor”

Can you please clarify what data and what reports are being referred to here?

(Solicitation Section: 3.6.1, Page 32)

Data on DHS identities and system reports.

37. The PWS paragraph states: “Support for PIV

Derived Credentials to mobile information technology (IT) platforms (such as smart phones and tablets) that do not provide easy or practical support for a smart card form factor to allow high-level applications on the mobile IT platform to authenticate the credential holder to remote systems per NIST

Special Publication 800-157 (Draft).”

The 800-157 is referenced in the FIPS 201-2

(Draft) document.

NIST does not have the referenced document published on their site. Can you provide guidance on this requirement?

(Solicitation Section: 3.6.8.2, Page 49)

This document is available via the following link:

http://csrc.nist.gov/documents/nist-mobile-security-report.pdf

38. Section 3.11.22 requires security, security operations center and etc. There is no Task

Order Associated with these requirements.

Will there be definitions of which task orders these are associated with, where funded and

See PWS 3.11.21 on required protections for DHS systems hosted in non-DHS Data Centers since this is a compliance requirement. Future TOs will provide requirements and identify funding information.

http://csrc.nist.gov/documents/nist-mobile-security-report.pdf http://csrc.nist.gov/documents/nist-mobile-security-report.pdf when due?

(Solicitation Section: 3.11.22, Pages 62 and

63)

39. Line 8 of the deliverable table states that the

Integrated Master Schedule is submitted with the proposal. But the IMS is not identified as an item for proposal submission in the instructions to offerors (RFP Section 5.2). Is the IMS required to be submitted with the proposal? If so, please confirm that it is a schedule for Task Order 1 performance. Also, if the IMS is required with the proposal please identify where in the proposal outline it should be included and what the allowable page count will be.

(Solicitation Section: 3.16, Page 74)

40. Attachment 6 to the RFP is the PWS for Task

Order 1. A response for this Task Order is not identified as an item for proposal submission in the instructions to offerors. Is a response for Task Order 1 required to be submitted with the proposal? If so, please provide additional page count in the technical volume to address this item.

(Solicitation Section 5.2.4.3.1, Page 112)

A technical proposal specific to Task Order 1 is not required as part of the offeror’s HSHQDC-13-R-

00047 proposal. As stated in the solicitation, the offeror’s base year pricing for the Evaluation Pricing

Model (Attachment 5, Worksheet 2) will serve as the pricing for Task Order 1.

41. Please confirm that the three past performance citations may come from the Offeror's team

(Prime and subcontractors) and are not limited to only the Prime offeror's past performance.

(Solicitation Section 5.2.4.3.1, Page 117)

Please see the response to question 30, above.

42. Instructions for the Small Business Plan includes a requirement to state the proposed total dollar amounts and percentages to be subcontracted for each category. This is to be an IDIQ contract and the total dollar value of the contract will be determined by the award of individual task orders. Will the

Government accept the Small Business

Subcontracting Plan listing only target subcontracting percentages?

(Solicitation Section: 5.2.4.3.1, Page 118)

Yes.

43. Regarding font size, the RFP states: “No reduction is permitted except for organization charts or other graphic illustrations.”

Will the Government please confirm that tables are included as other graphic illustrations?

Also, will the Government allow use of a font style other than Times New Roman for graphic illustrations?

(Solicitation Reference: 5.2.4.3.2, Page 119)

Yes, tables are included in the category of “other graphic illustrations.”

The Government will allow use of a font other than

Times New Roman for graphic illustrations.

44. Can the cleared personnel (TS/SCI) be provided by an offeror’s teammates

(subcontractors) or must they be provided by the Prime Contractor?

The offeror may submit cleared subcontractor personnel, provided the subcontractor has a TS/SCI

FCL. The prime contractor may sponsor its subcontractors for an FCL if it does not currently have it, but the prime must ensure that the appropriate cleared personnel are provided at all times in the contract.

45. Attachment 5 (Evaluation Pricing Model tab) has a Project Manager (Government Site) and

Project Manager (Government Site) - TS/SCI

000002, Attachment 1 (Question 56).

Level listed. These are both referencing the

Attachment 5 (IDIQ Contract Pricing tab)

Project Manager (Government Site) labor category. Should a Project Manager

(Government Site) - TS/SCI Level be added to the Attachment 5 (IDIQ Contract Pricing tab)?

46. The Evaluation Section in the RFP states that the Task Order Pricing will be based on the

Base Year Pricing included in the offeror’s

Evaluation Pricing Model.

According to the Task Order PWS, the Period of Performance for the Base Period is

September 27, 2013 – September 26, 2014.

However, In the Evaluation Pricing Model tab of Attachment 5, September 27, 2013 –

September 26-2014 is the Period of

Performance for Option Period 1.

Will the Government please clarify the Period of Performance for each period?

(Solicitation Reference: Attachments 5 and 6)

000002, Attachment 1 (Question 49).

47. It was mentioned during the [Pre-Proposal]

Conference that the workstations would run on the physical network of DHS, but would

NOT be part of the DHS domain. Can you please clarify this?

The current workstations operate within the DHS local area network (LAN) that connects to the servers through the DHS OneNetwork wide area network

(WAN). The workstations are dedicated, hardened appliances with machine certificates that are not part of the domain.

48. The government stated in an earlier response to a question in the DHS responses to Industry

“Light activation stations will include GFE workstations and laptops (e.g. Dell, HP). The vendor shall provide FIPS 201 APL compliant readers and software, where relevant as part

000002, Attachment 1 (Question 21).

of their solution.”

Question - Will there be a pricing line item for the contractor supplied hardware associated with the vendor supplied hardware for the light activation stations?

49. The PWS indicates that key personnel will need to work on site as work requires. Would the Government please provide its onsite work requirements? Would all or some key personnel need to work on site full time while non-key personnel would work on site part time? Which personnel could work from remote locations either part time or full time?

Please explain.

(Solicitation Reference: Section 2.1.2)

Providing space is available, key personnel would be required to work at the Government location. See

PWS 3.13 for additional details. Other personnel to be assigned to the Government’s location can be discussed during the Post Award Conference.

Attachment 5 revised to add pricing table for both

Government and Contractor sites.

50. Would the Government please confirm that each offeror’s solution must be capable of issuing and managing at least 300,000 PIV cards by the proposal submission date?

(Solicitation Reference: Section 3.2, Page 28)

At the date of proposal, the solution must “be capable of issuing and managing at least 300,000 PIV cards.”

At PDR, the solution will be reviewed to determine its capability to issue and manage at least 300,000

PIV cards. At acceptance, the solution will tested for compliance that solution is capable of issuing and managing at least 300,000 PIV cards. Additionally, and as stated in the PWS, the solution shall be capable of issuing PIV-I and other cards, when required.

51. Would the Government please confirm that each offeror’s CMS/EIWS solution must be capable of meeting PIV Card Issuer requirements set forth in NIST SP 800-79 by the proposal submission date?

(Solicitation Reference: Section 3.4.2, Page

30)

At proposal, the Contractor’s solution shall comply to OMB, NIST, FICAM, and DHS specifications, standards, and guidelines. At PDR, the solution will be reviewed to determine its compliance with specifications, standards, and guidelines. At acceptance, the solution will be assessed for compliance with specifications, standards, and guidelines.

52. Would the Government please confirm that each offeror’s CMS/EIWS solution must be capable of meeting identity proofing, registration, issuance, maintenance, and privacy requirements for PIV cards as set forth in FIPS 201 by the proposal submission date?

(Solicitation Reference: Section 3.4.2, Page

At the date of proposal submission, the Contractor’s solution must be capable of meeting identity proofing, registration, issuance, maintenance, and privacy requirements for PIV cards as set forth in

FIPS 201. At PDR, the solution will be reviewed to determine its capability of meeting identity proofing, registration, issuance, maintenance, and privacy requirements for PIV cards as set forth in FIPS 201.

At acceptance, the solution will be assessed for compliance with FIPS 201.

53. DHS has indicated that they plan to soften the

"gate 1" evaluation criteria requiring that bidders have explicit experiencing issuing

PIV credentials. This change will likely increase the number of bids received from a manageable number of truly qualified bidders to a much larger number. Has DHS considered the dramatic increase in time and resources required to review that number of proposals and the subsequent demonstrations?

In addition, has DHS considered the potential impact to award schedule and specifically a potential inability to award before the end of the fiscal year?

(Solicitation Reference: Section 6.1, Page

122)

000002, Attachment 1 (Question 44).

54. The management section requires resumes of key personnel to be included and counted in the page count. Would the government specify the length of resumes to be included, or alternatively, let resumes be included in an appendix as long as key personnel qualifications and experience are discussed in depth in the Management section?

117)

Per RFP Section 5.2.4.3.1, requested resumes are not included in the listed page counts for the Technical

Proposal.

55. IMS: According to the proposal the IMS will have to be submitted with the proposal. Is it the intent of the government to have the Draft

IMS included as a separate attachment so that it will not count against the page count?

(Solicitation Reference: Sections 3.16 and

5.2.4.3.2, Pages 74 and 119)

56. Would the Government please confirm that each offeror’s proposed CMS solution must consist of components sourced only from

GSA APLs by the proposal submission date?

(Solicitation Reference: Section 3.6.1.2, Page

36)

By the proposal submission date, offeror’s CMS must be on GSA’s APL. See PWS 3.6.1 - The

Contractor shall propose equipment, parts and material from the relevant approved GSA approved products list for HSPD-12.

57. Would the Government please confirm that each offeror’s proposed EIWS solution must consist of components sourced only from

GSA APLs by the proposal submission date?

39)

By the proposal submission date, offeror’s EIWS must be on GSA’s APL. See PWS 3.6.1 - The

Contractor shall propose equipment, parts and material from the relevant approved GSA approved products list for HSPD-12.

58. The RFP calls for each offeror to provide a bill of materials, but Attachment 2 only contains lists of EIWS and IDMS hardware and no middleware or software. How does the Government plan to perform a fair and reasonable comparison of offerors’ solutions without taking middleware and software costs into account?

73)

The Government does not intend to provide middleware or software. Attachment 5, IDIQ

Contract Pricing, Cells A35, A49, A57, A59, and

A62 will account for software costs (DHS defines middleware as software that serves as an intermediary between systems software and an application).

59. Security authorization for an ATO is a process that can take 6-10 weeks dependent on multiple factors and stakeholders. Does the government expect that the security authorization process and ATO approval is included as part of the 120 calendar days of the Task Order?

(Solicitation Reference: Sections 3.11.18 and

3.6.1, Pages 59 and 31-34)

60. Is the requirement for data segmentation based on DHS Component and role logical segmentation or is there a requirement for physical segmentation? And how many physical segments are required?

The current solution supports data segmentation in accordance with DHS Component structure (e.g.

CBP, DHS HQ, FEMA, FLETC, ICE, TSA, USCIS

and USSS), security and business needs. The solution shall be capable of segmenting all

34)

Component data, logically and/or physically.

Therefore, physical segments equal 8 (1-CBP, 2-

DHS HQ, 3-FEMA, 4-FLETC, 5-ICE, 6-TSA, 7-

USCIS and 8-USSS)

61. How many EIWS and LA workstations are to be delivered in Task Order 1?

34)

PWS 3.6.3 - The Contractor shall provide a phase-in approach that integrates GFE EIWS equipment into the IDMS/CMS solution by initially using existing equipment with a planned replacement cycle, over a four-year period, rather than an upgrade or replacement of the GFE EIWS infrastructure, to include the replacement of current computers

(CPUs). In addition the phase-in approach, DHS is planning procure 80 EIWS.

62. Specifically, which of the following DHS

Data Center infrastructure components and services will be supplied by DHS? (if yes to any of the following please provide product models, Software versions, and quantities available)

1. Racks

2. Load Balancers Hardware, Software, and Support

3. XML Gateways, Hardware, Software, and Support

4. Firewalls Hardware, Software, and

Support

5. Switches Hardware, Software, and

Support

6. SAN Storage System Hardware, Software, and Support

7. Tape Backup System Hardware, Software, and Support

8. VPN Hardware, Software, and

Support

9. Server Operating System Software and Support

10. Server Virtualization Software such as VMWare and its Support.

11. Patch Management Software Services and Support

12. Backup and Recovery Hardware, Software, and Support

13. Disaster Recovery Hardware, Software, Services, and Support

14. Database Hardware, Software, and

Support

15. SOC Hardware, Software, Services and Support

16. Anti-Virus and Anti-Malware

The contractor shall submit its proposed infrastructure components and services with its

Technical Proposal. The contractor shall assume that no infrastructure components/services will be supplied by DHS at the data centers. The

Government reserves the right to utilize services provided by the DHS OCIO Data Center Program

Office.

Software and Support

17. Remote Management of EIWS

Software, Services, and Support.

(Solicitation Reference: Sections 3.6.1 and

3.6.1.1, Pages 34 and 35)

63. In regards to what was discussed in the Pre

Proposal Conference; will the Government provide instructions for how the Offeror is to submit their proposed transition plan?

(Solicitation Reference: Section 3.6.2, Page

38)

The contractor shall discuss its proposed approach to transitioning/migrating data from one identity management system to another, which includes anticipated complexity, risks, requirements, and solutions, as part of its Management Factor submission.

64. Please provide a list of the current DHS software under license that can be leveraged by the Offeror.

(Solicitation Reference: Section 3.13.1, Page

71)

DHS will not provide enterprise level licenses.

65. Is the government requiring automated authentication of identity documents? If so, which documents should be authenticated automatically, and should the contractor provide the document authentication devices?

(FRD Reference: Section 2.7.1.3, Page 11)

No.

66. What activities from the list below does the 2 minute performance requirement include?

Biometric verification of the card holder?

Local Printing of PIV Card?

Encoding of non-certificate data?

Encoding of PIV Authentication certificate?

Encoding of Digital Signature certificate?

Encoding of asymmetric Card

Authentication certificate?

Encoding of PIV Encryption certificate?

Encoding of up to 20 historical PIV

Encryption certs?

(FRD Reference: Section 3.8.1, Page 17)

Biometric verification of the card holder

Encoding of non-certificate data

67. Reference Section indicates the proposal validity shall be a minimum of 90 days. In

Section 5.1 Instructions to Offerors subparagraph (c), the instruction states that the period for acceptance of offers is 30 days and that the offer will remain firm for that period. Please clarify the intended duration of proposal validity.

(Solicitation Reference: Section 5.2, Page

112)

Per 52.212-1(c), (included in Section 5.1 of the RFP)

“The offeror agrees to hold the prices in its offer firm for 30 calendar days from the date specified for receipt of offers, unless another time period is specified in an addendum to the solicitation.” Section

5.2, entitled Addendum to FAR 52.212-1 Instructions to Offerors—Commercial Items (Feb 2012), states that proposals shall be valid for a minimum of ninety

(90) days. As such, the offeror’s proposal shall be valid for a minimum of 90 days.

68. Within the Test Engineer description, it states that the Test Engineer “May participate in all phases of risk management assessment and software/hardware development under the direction of a Senior Test Engineer.

Attachment 3 does not include a Senior Test

Engineer. Is it incumbent on the Offeror to propose a separate “Senior Test Engineer” if deemed necessary?

No. Attachment 3 revised to change “a Senior Test

Engineer” to read as “Program Manager.”

69. Attachment 3 job descriptions do not include a preferred level of experience for the identified labor categories. Additionally, Attachment 5 Pricing Tables specifies a level of experience (e.g., mid-level) for some of the positions. Other than the skill levels identified in Attachment 5, does the

Government have a preference for skill levels associated with the identified labor categories?

(Solicitation Reference: Attachments 3 and 5)

000002, Attachment 1 (Question 45).

70. If the contractor determines additional labor categories may be necessary to accomplish

PWS tasks, will the Government accept these

000002, Attachment 1 (Question 41).

inputs and allow the Offeror to insert additional rows into the pricing worksheet in order to provide fixed rates?

71. Do the restrictions given under (C) (1) apply to 1st tier subcontractors on the Proposer’s team?

(Solicitation Reference: HSAR 3052.209-72

Organizational Conflict of Interest (Jun

2006))

72. Given that the scope includes “Managing, monitoring and control, and performing activities to conduct a seamless and expedited transition from the current to target solution with minimal disruption to business operations while insuring data integrity,” what shortfalls have been identified with the existing IDMS and CMS? [If there are no issues, we would expect to see the clarification “as required” to this statement.]

Do any of these imply data integrity issues within the current IDMS and/or CMS? If so, what are these?

(Solicitation Reference: Section 3.2, Page 48)

There are no data integrity issues within the current

IDMS and/or CMS. PWS 3.2 was revised to say –

“As required, managing, monitoring and control, and performing activities to conduct a seamless and expedited transition from the current to target solution with minimal disruption to business operations while insuring data integrity.”

73. Has an ATO for the current IDMS and CMS been established? If not, why not? What is the schedule?

(Solicitation Reference: Section 3.2, Page 29)

The current IDMS has an ATO.

74. Do the current PIV EIWS meet DHS objectives? If not, why not? Has acceptance testing been performed on the PIV EIWS workstations? If so, are results available for

Proposers?

(Solicitation Reference: Section 3.3, Page 29)

Current PIV EIWS meet DHS objectives. Results of

PIV EIWS testing are not available to Proposers.

75. Will the contractor be responsible for maintaining proprietary GOTS products? If so, is requisite documentation available for

Contractor use? And, over what timeframe

There are no proprietary GOTS products to be maintained by the Contractor. It is expected that that transition from all proprietary systems is to be complete by February 2014. The proposer will not be will this maintenance be required? At the

Bidders’ Conference, the Government panel indicated that the Incumbent would be funded to provide support through February 2014, does this imply that the Transition from all proprietary systems is to be complete by

February 2014? Or will the Proposer be responsible for Incumbent maintenance costs after that time? If this is the case, has the

Government negotiated a maintenance rate that Proposers should use?

(Solicitation Section 3.6.1, Page 31) responsible for the incumbent maintenance costs.

76. Will the Government extend the proposal due date given that (a) Amendment 2 has not yet been released and that (b) the responses to

Questions are not expected until June 21st, which may result in publication of an

Amendment 3?

Per Amendment 000002 posted to FBO on

06/14/2013, the proposal due date/time has been extended until July 08, 2013 at 04:00 PM ET.

77. See Vendor A question 24 and government response, which GOTS solutions (which

Agency) have been identified that would meet

DHS’s needs?

(Reference: "DHS Responses to Industry

Comments and Questions - Draft PWS and

FRD" Vendor A Question 24)

No GOTS solution has been identified by DHS.

However, DHS would consider an existing and proven GOTS solution as part of a proposal.

78. What is the scope of the Transition? Is the scope limited to the IDMS system? In accordance with the Bidders’ Conference, the incumbent will be retained only through

February 2014. Who will be responsible for maintaining the card issuance workstations

(EIWS) after that time?

The scope of the transition will be determined subsequent to award based on the offeror’s proposed transition approach that integrates GFE EIWS equipment into the IDMS/CMS solution by initially using existing equipment with a planned replacement cycle, over a four-year period, rather than an upgrade or replacement of the GFE EIWS infrastructure, to include the replacement of current computers

(CPUs).. Per PWS 3.6.3, the Contractor will be responsible for maintaining the card issuance workstations (EIWS) after February 13, 2014.

79. [Please confirm] whether or not the EIWS

Workstation pricing in the Amendment 2, Attachment 5 (lines D35-M35), should include an iris capture camera. On the one hand, we observe clear guidance from DHS that only the equipment listed in the

Performance Work Statement, Section 3.6.3, Iris capture camera is not required as part of the

EIWS pricing since the item is not on the approved

GSA approved products list for HSPD-12. OCD #18 revised to remove iris.

Task 3, need to be included. On the other hand, the Operational Capabilities

Demonstration (OCD) (point 18) calls for demonstration and discussion of iris and the

Functional Requirements document (FRD)

(2.2.37) says the system needs to “support” iris.

To support DHS to receive the information it requires, we recommend the Government clarify if an iris camera should be included and if known, in which base year iris capture is expected to become an operational requirement for the Offeror.

80. “The workstations shall include but are not limited to the following:

1. Laptop with 17” screen and built in SCM card reader

2. Laptop Docking Station

3. Mouse

4. Flatbed Document Scanner (Example:

Epson Flatbed Scanner)

5. 10 Digit Fingerprint Scanner (Example: L-

Scan Crossmatch Guardian)

6. Biometric Fingerprint Authenticator

(Example: Hampster IV)

7. SCM Card Reader

8. Digital Camera (Example: Cannon

Powershot S31S, high resolution web cam)

9. PIN pad

10. PIV Card Printer (Example: Datacard

SP75+)

11. Fingerprint parsing

12. Uninterruptable Power Supply/Source

(UPS), battery backup”

Is DHS requiring the same model equipment as listed or will functional equivalents that are on the GSA FIPS-201 Approved Products List

(APL) be acceptable?

38)

The Contractor shall propose EIWS equipment, parts and material, to include alternate products, from the relevant approved GSA approved products list for

HSPD-12.

81. Please define the term “hard cut over” used in the both the original question and the

Government answer.

(Reference: HSHQDC-13-R-00047 –

Amendment 000002, Attachment 1, Question

A hard cutover is where DHS begins using the new

IDMS and the old IDMS becomes unavailable to

DHS users with no transition of data between the systems.

27)

82. There does not seem to be any place in the worksheet to enter annual recurring costs for these three items whether they are hardware, software, or labor. Where should the

Contractor put these recurring costs?

(Solicitation Reference: Attachment 5 (06/14 version), Evaluation Pricing Model tab, Rows

12,13,14 and also rows 27 and 28)

Recurring costs should be identified under O&M.

83. In the IDIQ tab, the descriptions in cells A39, A40 and A41 mention support and maintenance. However, the descriptions in the

Evaluation tab in cells A35, A36, and A37 do not contain any reference to O&M, support, or maintenance.

Will the Government please clarify if O&M support, and maintenance is expected in these tasks?

(Solicitation Reference: Attachment 5 (06/14 version), Evaluation Pricing Model tab)

CLIN titles in the IDIQ Contracting Pricing were added to the Evaluation Pricing Model

84. In two (2) places (security, and dev test environments a reference is given as 3.11 through 3.22; however there is no section

3.22. What are the correct references for both

places (security, and Dev& test environments)?

(Solicitation Reference: Attachment 6 (06/14 version))

3.22 should read as 3.11.22. Attachment 6 has been updated.

85. Security requirements for Contractor Site

Production Test and Development, Test and

Pre-Production systems identified in this section. Do the various security requirements

(eg, SOC and intrusion detection) apply to the test and development systems at the contractor site?

(Solicitation Reference: Section 3.6.5, Page

43)

No.

86. The timeframe for standing up a fully operational system in 120 days for

Deliverable # 18 – Operational Readiness

Review) is overly optimistic in our experience. Likely, DHS procedures to progress the system through development lifecycle staging environments will take significant time. Functional testing and subsequent system security testing, especially when considering the sensitive nature of the data being processed, will take additional time. Will the DHS consider changing this schedule to enable non-incumbent bidders a more reasonable timeframe to meet this deliverable?

76)

The Government has dependencies that require a solution to be in place 120 days after award.

Additionally, vendors should have experience implementing an existing IDMS solution, which we are assuming will expedite the standing up of a fully operational system.

87. a. Row 15, Interface, Connections to

Component PACS (quantity of 8) (what brands, make/model are we expected to support?) Applying the same price to all 8 quantities may or may not make sense depending on whether the PACS are the same or different.

b. Row 16, Interface, Connections to

Component LACS (quantity of 8) (LACS is a generic description. Specifically, what logical access control systems are to be interfaced, and what is each system’s respective interface?)

c. Row 17, Interface, Connections to

Authoritative or Non-Authoritative

Biographic/Biometric Attribute data

Stores (How many data stores, what type of data stores, what interfaces?).

d. Row 10, Software Licenses – is the

Bidder required to price PKI, or will these be provided by DHS through Treasury?

(Solicitation Reference: Attachment 5, Evaluation Pricing Model tab)

PACS systems are varied by Component and/or

Government facility, therefore the offeror should propose pricing interfaces, such as standard web-based, vendor specific. The pricing should include integration costs

Each DHS Component implements its own LACS infrastructure, therefore the offeror should propose solutions that allow for the IDMS to connect Active

Directories, such as LDAP, web-based, vendor specific.

Connections to Authoritative or Non-Authoritative

Biographic/Biometric Attribute Data Stores determined through future Task Orders. The offeror should price for interface development as a one-time cost to develop and deliver an interface with a monthly cost to O&M the interface. Attachment 5 has been updated to include a separate CLIN for

O&M for this interface. Separate CLINs for O&M for all other requested interfaces have also been added to Attachment 5.

The Bidder is required to price PKI as part of software licenses under Task 1.

88. The inclusion of a number of line items in the amended Exhibit 5 Pricing Spreadsheet as

FFP efforts puts an undue burden on any competitor to price. There is no specification for the bidders to determine the level of effort to implement the interface(s) newly specified

Attachment 5, Cells A20 through A22, should reflect a one-time cost to develop and deliver an interface.

For the three HSPD-12 Blanket Purchase

Agreements that expired on February 14, 2013, DHS pre-negotiated firm-fixed price interfaces for PACS and LACS without knowledge of the specific PACS in the exhibit; whereas the incumbent, given its current implementation and knowledge of its interfaces, has a competitive advantage. Specifically in the Evaluation

Pricing Tab:

a. Row 15, Interface, Connections to

Component PACS (quantity of 8) (what brands, make/model are we expected to support?)

b. Row 16, Interface, Connections to

Component LACS (quantity of 8)

(LACS is a generic description. Specifically, what logical access control systems are to be interfaced, and what is each system’s respective interface?)

c. Row 17, Interface, Connections to

Authoritative or Non-Authoritative

Biographic/Biometric Attribute data

Stores (How many data stores, what type of data stores, what interfaces?).

We respectively request the DHS review all of the FFP items in the pricing table and where there are no clear specifications for vendors to work towards, return those items to T&M efforts. We are not suggesting that all development be made T&M – for example interfaces to ISMS and IDENT systems are known and, therefore, not an issue.

(Solicitation Reference: Attachment 5, Evaluation Pricing Model tab) and LACS products to be integrated at that time.

89. Task 8 states that the contractor shall provide a design, level of effort estimates, and resources necessary…