Responses_to_PreCheck_Expansion_Q-A_1-12-2016.pdf

Final PreCheck Expansion Questions 1/12/2016

# Subject of Question

Document/Section (Ex.

SoW 4.1, Attachment 1, Pg 3, etc.)

Question and Answer

Column 1 Column2 Column3 Column4

1 Submission Date Extension

Version 2.1, Dec. 29, 2015

RFP, Anticipated Acquisition

Milestones, Phase 2, Written Proposals Due, Volumes I-IV, page 4

Question: Per the release of Amendment 2, we are asking for a 30 day extension to the current submission date of January 13, 2016. Additional time is required to respond thoroughly to the new

Volume III, Independent Verification and Validation (IV & V) written document.

Answer: See Admendment A0003 for revised date.

Standard Operating

Procedures for IV&V

Attachment D of OIT IAD

IV&V Process, Section 1.2, Question: One of the assumptions in section 1.2 is that the Offeror will provide the Standard

Operating Procedures of the Offeror's and Offeror's subcontractors IT and operating systems. Please be more specific regarding which Standard Operating Procedures the Government is interested in.

Answer: The Government is interested in all IT SOPs for systems that will access, process, and/or house TSA test data during the conduct of the S&T testing.

3 Documentation Reviews

Attachment D of OIT IAD

IV&V Process, Section 2.0, Table 1, page 2

Question: The description for Documentation Reviews contains "etc.", while the sentence prior to the table states that all documents will be provided in Volume III of the proposal. Please provide the full list of documents that need to be included in Volume III and remove the "etc." in order to be consistent with the assumptions listed in section 1.2.

Answer: See admendment "etc." will be removed. Additional documentation may be security artifacts that provide system specific information to clarify how the test cases are fully implemented on the system that will process TSA data during the S&T testing.

4 DHS S&T Testing

Version 2.1, Dec. 29, 2015

RFP:Element 6:

Evaluation Elements, Element 6, page 14 and, Question: Please confirm if the Volume IV written document will be evaluated as part of the Pass /

Fail?

Answer: TSA will not evaluate the Volume IV materials as part of the Pass/Fail process. As stated in the revised RFP, at page 18, Element 6, DHS S&T Testing: “The Volume IV documentation shall serve solely for post-award informational purposes of the Offeror’s Technology and Technical

Capabilities and not serve as part of the Pass/Fail RFP criteria for this Element or as any part of

Contract Award selection.

5 IV&V

Version 2.1, Dec. 29, 2015

RFP: pages 9-10, 14

Question: /clarification: Page 14 of the RFP states that contractors will be evaluated on the

"current/existing" capabilities and that some capabilities may not exist and will need to be developed by the offeror.

Given that the entire system may not be available at the time of IV&V and S&T testing, will the

IV&V testing include only the "current/existing" capabilities?

If so, will the list of required information (e.g., list of HW/SW/configuration files) only include systems in the "current/existing" that will be used in the S&T test?

Additionally, will the 4 plans (Incident Response, System Security, SOP, Contingency) only need to reflect the "current/existing" capabilities?

Answer: The IV&V will only evaluate the security foundation of any IT system that will process

TSA data during the S&T tesing. Yes, requests for information will apply to parts of any system that will process TSA data during the S&T testing. Also, the plans will need to reflect the capabilities for any system that will have process TSA data during the S&T testing.

6 IV&V

Version 2.1, Dec. 29, 2015

RFP: page 17

Question/clarification: Could the Government define what constitutes a Pass for IV&V?

Answer: Upon completion of the IV&V, TSA will make a holistic risk determination on whether the system can process TSA test data for the S&T testing.

7 IV&V

Version 2.1, Dec. 29, 2015

RFP: page 17

Question/clarification: Will waivers for any findings from the IV&V be allowed?

Answer: No; All results obtained from the IV&V process will conclude with single holistic risk determination ton whether the system can process TSA test data. This determination will not involve any "waivers."

8 IV&V

Version 2.1, Dec. 29, 2015

RFP: page 17

Will offerors have an opportunity to retest if any findings from IV&V result in a Fail rating?

If so, how many retries are allowed?

Answer: No; this determination will not involve any retesting.

9 IV&V

Version 2.1, Dec. 29, 2015

RFP: page 11

Questions/clarifications: The RFP states "The IV&V process will include a site visit and interviews to assess systems that are not presently accounted for in the DHS Information Assurance Compliance

System (IACS) and where a Security Authorization (SA) has not been performed on the systems."

Will systems with an existing TSA ATO be exempt from any IV&V activities?

Answer: No; systems with an existing TSA ATO will not be exempt. This IV&V process covers any system that will process TSA data for the S&T tests.

10 IV&V

Attachment D of OIT IAD

IV&V Process, Section 3.0, Question/clarification: Will the personnel provided as part of the "Team Composition" be required to undergo a TSA personnel security background investigation prior to handling the data provided during the S&T test?

Answer: Pre-award, the personnel appointed to be part of the "Team Composition" will not need to undergo a TSA personnel security background investigation. If the offeror is selected for award, all personnel will undergo TSA's process to be successfully vetted by TSA.

11 IV&V

Attachment D of OIT IAD

IV&V Process, Section 2.0, Questions/clarifications: Can the Government provide a list of TSA-approved commercial-grade scanning tools or define what comparability to the named tools means?

Will an offeror be considered to fail if the Government does not approve its chosen scanning tool?

Answer: The Offeror shall employ commercial-grade vulnerability scanning tools such as Nessus, Web Inspect, AppDetective, and Nipper, or use tools that are comparable to the aforementioned tools.

12 IV&V

Attachment D of OIT IAD

IV&V Process, Section 2.0, Will the Offeror be required to conduct its scans in the presence of the Government in order to demonstrate that the configuration presented for S&T testing is the version that was scanned?

Answer: No; Government presence is needed when the Offeror conducts scans; however, during the

Government on-site visit, Government spot checks for verification will occur.

13 IV&V

Attachment D of OIT IAD

IV&V Process, Section 2.0, Question/clarification: If the offeror chooses to use Nessus, will the Government provide a scanning profile?

If not, can the Government provide more information as to which scanning profile should be used?

Answer: The government will not provide a scanning profile. Each Offeror shall have their own scanning profile and follow the guidelines as outlined in the appropriate Defense Information

Systems Agency Security Technical Implementation Guides (DISA STIGs).

14 IV&V

Attachment D of OIT IAD

IV&V Process, Section 5.2.1, Question/clarification: The attachment references the "TSA IA Handbook". Will a copy of the handbook be made available to offerors prior to proposal submission?

Answer: TSA IA Handbook will not be provided. The TSA standard password complexity is as follows:

• Not contain the user's account name or parts of the user's full name that exceed two consecutive characters

• At least 12 characters in length

• Contain characters from three of the following four categories:

o English uppercase characters (A through Z) o English lowercase characters (a through z) o Base 10 digits (0 through 9) o Non-alphabetic characters (for example: !, $, #, %)

15 IV&V

Attachment D of OIT IAD

IV&V Process, Section 5.2.1, Question/clarification: The attachment references "cleared users" multiple times. How will users be cleared for access?

Answer: TSA expects the Offeror to have proper access control and access control lists (ACL) which follow an important defense strategy such as least privilege. The data that a user has access to should be determined by the user needs to perform their tasks. User access should be reviewed and controlled as long as the user has access.

16 IV&V

Attachment D of OIT IAD

IV&V Process, Section 5.2.1, Question/clarification: The attachment indicates that administrative access rights may be granted to a limited number of people. How many people may be granted administrative access rights for purposes of the S&T testing?

Answer: During testing, up to three (3) DHS S&T DA-E personnel should be granted administrative access rights. TSA expects the Offeror to make this decision by implementing important defense strategies such as least privilege and/or separation of duties. This will ensure that minimum access necessary to perform an operation is controlled and will limit damage that can result from error or unauthorized use. Administrative accounts must be separate from the users standard account and should require unique identifiers.

17 S&T Testing Attachment E - CRADA;

Question/clarification: The CRADA states that one of the Obligations of Offeror is to "follow the guidance in the Test Plan to the extent possible" (bullet 5). As Offerors will need to make a significant investment in order to get to the testing phase, will the Government make the test plan available now, so that Offerors may be prepared for testing - or also determine if they should no longer pursue this RFP if a review of the test plan indicates that their system may not pass the test?

Answer: The pass/fail digital S&T plan will be provided to offerors.

18 Attachment 29, Item #62

The FedRAMP program operates through the use of 3rd Party Assessment Organizations (3PAO’s).

These 3PAO’s are themselves accredited by the FedRAMP office through the American Association for Laboratory Accreditation (A2LA) using ISO/IEC 17020:2012 standards. In the operation of the

FedRAMP program, the 3PAO provides all relevant materials regarding the cloud service provider, including the Security Assessment Plan (SAP) and Security Assessment Report (SAR). In the operation of the FedRAMP program, agencies do not perform physical facility assessments, these are performed by the 3PAO. Agencies then make a risk-based determination based on the SAR. The full set of documentation in available to the Agency via the FedRAMP PMO. Therefore, attachment

29 item #62 is in conflict with the original solicitation which allows for the use of FedRAMP authorized cloud service providers. AWS respectfully requests that TSA agree to leverage the

FedRAMP process and artifacts in lieu of Data Center tours for all those that have fully completed

FedRAMP review. TSA is of course welcome to engage respective cloud providers and their 3PAO for clarifications as needed.

Answer: If the Offeror’s system is residing on a FedRAMP approved Cloud Service Provider (CSP), whether with a JAB P-ATO or Agency sponsored ATO, TSA understands that a CSP data center will not be accessible. The scope in this case will entail the locations of the system demonstration of the

Offeror.

19 IV&V

Page 1 of Attachment D states, “As its Volume III of the proposal, the

Question: The Offeror shall provide security documentation of any of its IT and operating systems

(including an Offeror’s subcontractors’ IT and operating systems) that will process Government test data, which contains sensitive personally identifiable information (Sensitive PII) during the RFP process, that includes … A list of hardware and software for the Offeror's IT and operating systems and the configuration files for firewalls and routers that would handle any Government test data”

(emphasis added). SureID, Inc. and its partners are very concerned that the information being requested, at this pre-award stage, includes highly sensitive and confidential cybersecurity details of our companies’ respective IT and operating systems. Disclosure of this information, particularly via email transmission in the clear, could pose a significant risk to our companies’ current and future business. The details of the configuration files are highly sensitive for us and our partners – as is a list of our hardware and software for our IT and operating systems.

Rather than having offerors provide this information at this time, in the clear, we respectfully request that TSA (a) reconsider the pre-award timing of offerors’ submission of this information, (b) reconsider whether TSA could accept, at this pre-award phase, less documentation/details, (c) clarify whom in the Government will have access to the information, for how long, and how the information will be stored, protected and destroyed, and (d) provide offerors with a secure, encrypted manner for this information to be submitted and stored while in TSA’s custody.

Answer:

- Given the nature of the data that TSA is providing (which contains SSI and SPII), TSA cannot reconsider the Offerors submission of the requested security documentation or system configurations.

- At the Offerors request, TSA will provide a list of individuals who will have access to the Offerors system security documentation for the duration of the review period. TSA will adhere to NIST SP

800-88 Guidelines for Media Sanitization on how the information shall be protected and destroyed.

- The Offeror will submit their information to TSA using their secure, encryption method of choice.

20 Contingency Plan RFP Attachment D, IV&V

Process, section 1.2, page 1

What level of Contingency Planning is required for the IV&V and S&T Testing given that offerors may not yet be demonstrating full operational capabilities?

Answer: The IV&V team will assess whether the Offeror has the capability to protect and restore any system that houses TSA data in the event of an interruption or catastrophic disaster.

Disposition of Restricted Access

Data

RFP Attachment E, Article 3, Item 3.10

Clarification/question: Instead of sanitizing the media containing the Restricted Access Data at the end of the DHS S&T test, can assurances be made that the Restricted Access Data has been purged and that the sanitization requirement will be met at a later date as part of the normal lifecycle of the system?

Answer: No; to ensure proper disposal of TSA data provided for the S&T testing, TSA expects the

Offeror to meet sanitization requirements for any media containing TSA data within 30 days. The

Offeror will also provide TSA with sanitization evidence, certificates, etc. that thoroughly lists the methods and resources utilized within 30 days.

Disposition of Restricted Access

Data

RFP Attachment E, Article 3, Item 3.10

Clarification/question: Does this sanitization requirement apply to subcontractor systems as well?

In Appendix A under "Obligations of Offeror with Respect to Testing of Evaluation", item 8 suggests that subcontractor data brokers need to provide assurance that data and search histories have been purged but not sanitized.

Answer: Yes, the sanitization requirement applies to all subcontractor systems as well as any entity that will have access to, process or house TSA data.