Attachment 01 - ITSSS Questions and Answers.pdf

Attachment 01 – Questions & Answers

Q&A for HTST03-11-R-CIO556

Question # Reference Question Answer

1 General Is the subject solicitation the same as

HSTS03-09-R-CIO907 (RFI) and

HSTSO3-10-R-CIO552-RFP (reference attached)? If yes, why is it being re-competed?

RFP #HSTS03-10-R-CIO552 was cancelled in its entirety (16

Nov 2010) and HSTS03-11-R-CIO556 (posted 02 Dec 2010) is a new, wholly independent, solicitation. HSTS03-11-R-CIO556 should be reviewed and approached as independent of

HSTS03-10-R-CIO552. Any similarity between the two shall be ignored and offers shall respond to this and only this solicitation.

2 RFP ITSSS version 23, pages 87 and 88, Staffing Approach

Section L.4.1 discusses the requirements for Volume 4 – STAFFING

Approach but does not list resumes as a requirement. Resumes provide a strong mechanism for verifying the strength of each candidate.

Question: How is the Government going to evaluate staff experience for

“relevancy, currency and coverage” without resume submissions?

As stated in M.5.2 Factor 4--Staffing Approach—Task Order # 001, ” The Government will evaluate each offeror’s Labor Resource Table to determine how well the Offeror will staff to perform IT security support services required in the attached Task Order #001 Statement of Work (SOW). Using this Table, the Government will evaluate the offeror’s proposed labor mix and proposed level of effort to rate the Offeror’s understanding of the technical requirements. TSA will evaluate labor mix by assessing the appropriateness of resources assigned to deliverables and work products by considering labor categories and levels of effort. TSA will evaluate the staff experience for relevance, currency, and coverage.”

3 RFP ITSSS version 23, pages 87 and 88, Staffing Approach

Section L.4.1 discusses the requirements for Volume 4 – STAFFING

Approach but does not list resumes as a requirement

Question: Can the offeror propose

Resumes are not required to be submitted with the offerors proposa, however, Offerors are required to demonstrate their understanding of the requirement by submitting a well written proposal with adequately detailed information, that clearly demonstrates compliance with the solicitation requirement and allows a meaningful review by the TSA resumes that are cross referenced to the tables required in Volume 4?

evaluators.

4 RFP Section H.14 Key and Non-Key Personnel

The key personnel section has been removed from the previously cancelled solicitation and the key personnel stated for this contract reads that they will be identified on “individual task orders.” Key personnel provide a means to ensure the quality of personnel to be delivered.

Question: How is the Government going to ensure quality of personnel to be delivered to meet TSA’s requirements for Task Order 1

(Volumes 4 and 5)?

Please see the answer to Question #2.

5 RFP ITSSS version 23, pages 87 and 88, Staffing Approach

Section L.4.1 discusses the requirements for Volume 4 – STAFFING

Approach but does not list resumes as a requirement. Resumes provide a strong mechanism for verifying the strength of each candidate.

Question: How is the Government going to evaluate staff experience for

“relevancy, currency and coverage” without resume submissions?

Please see the answer to Question #2.

6 H.14 Key and Non-Key

Personnel

Key Personnel requirements have been omitted from the RFP. Are key personnel required for this response either at the ID/IQ or Task Order #001 level?

Key personnel are not required at either the IDIQ or Task

Order level.

7 B.4.1(4) Program

Management Support;

G.3 Contractor’s

Program Manager

The Government requests the awardee to provide a Program Manager to support this program and in B.4.1 the

Government stipulates charges for a

Program Manager is to be spread across all LCATs. Section B further states these “program manager” support costs are differentiated from individual task order “Task Order

Manager” or “Project Manager” support costs, which are billed as hourly rates against individual task orders for direct support to the effort performed under those task orders.

The Government has not provided an

LCAT for a “Task Order Manager” or

“Project Manager” for Task Order

#001. Was this an omission? If not, will future Task Orders have the flexibility to add additional LCATs such as a “Task Order Manager “or “Project

Manager” as the ID/IQ does not

It was not an omission. There will be no requirements in the future for task order managers nor for project managers

LCATs.

include this LCAT either?

8 Section L, FAR 52.216-1, page 79, final paragraph, sentence 2;

Section L.4 sentence 1, Section L page 79 sentence two reads:

“The first phase will evaluate the

Offeror’s Business Management

Approach (Volume 1), Past

Performance (Volume 2) and Price

(Volume 3) at the IDIQ level, based on the requirements found only in the

IDIQ Statement of Work.”

Section L.4 page 87 sentence one reads: “Offerors shall submit a response of not more than 15 pages for the Staffing Management Approach response associated with the Task

Order #001 Statement of Work (SOW).

Please clarify if the Statement of Work provided is for the IDIQ or Task Order

#001?There’s confusion related to the

Statement of Work as it appears as though the Statement of Work is for

Task Order #1 and not the IDIQ.

The work required in Task Order #001 is included in

Attachment A, Statement of Work. Attachment A discusses both the requirements for the overarching contract as well as

Task Order #001.

9 Section M, 52.212-2, page 92 and Section M, M.3 page 94, paragraph

2, final sentence

Section M 52.212-2 page 92 and

Section M.3 page 94 state for Phase 2 the Evaluation will factor Volumes 4 and 5 equal in weight.

Please see the revision to Section M.5.1. The language has been corrected to state, “Phase 2 responses will be rated on an Acceptable/Unacceptable basis, and Factor 4—Staffing Approach and Factor 5—Price – Task Order #001 will be equal in weight.” All corrections are highlighted.

Section M.5.1 Order of

Importance, page 96, sentence 1 Section

M.5.1 Order of

Importance, page 96, sentence 1

Section M.5.1 page 96 states “Within

Phase 2, Factor 4 – Staffing Approach –

Task Order #001 is more important than Factor 5= Price- Task Order

#001.”

Which evaluation factor for Phase 2 will be used in the evaluation of responses to ITSSS?

Factor 4: Staffing Approach – Task Order #001 and Factor 5:

Price – Task Order #001.

10 Attachment D – Labor

Categories;

1.2 Risk Management

Analyst

Does the Government’s intend to provide “Contractor Qualifications” for the Risk Management Analyst LCAT as it has for the other LCATs provided?

Please see the revision to Attachment D – Labor Category

Descriptions, Section 1.2.

11 Section L, L.5 Volume 5

– PRICE – Task Order

#001, page 88 , 89, and

This section of the RFP provides a

Labor Template for Task Order #001, however, the sections do not coincide with the RFP. The provided Labor

Templates are:

CLIN 0001 Information Assurance Compliance Section

– Base Year

CLIN 0002 Information Assurance Governance Section

– Base Year

CLIN 0003 Information Assurance Technical Services Section – Base Year

CLIN 0004 Information

Please see the revised labor table on page 88, Section L.5

VOLUME 5 – Price – Task Order #001. All corrections are highlighted.

Assurance Division Section – Base Year

CLIN 0005 Cyber Critical Infrastructure & Planning Section – Base Year

These tables also include a column for

“Resume X-ref (volume and page no.’s)

Should the Labor Template read:

CLIN 0001 Information Assurance Compliance & Policy

– Base Year

CLIN 0002 Information Assurance Technical Services - Base Year

Can you confirm or advise on the template structure?

Also can you advise on the column for

“Resume X-ref (volume and page no.’s”?

12 H.13ff, p. 27 The RFP states that, “The Government shall not supervise contactor employees. The contractor shall determine work schedules and work methodology for its employees….All individual employee assignments, and daily work direction, shall be given by the applicable employee supervisor….” Labor categories 1.9

Please see the revisions to Sections 1.9 and 1.10 in

Attachment D – Labor Category Descriptions.

and 1.10 in HSTS03-11-R-CIO556

Attachment D require management or supervisory experience, but do not include explicit managerial or supervisory duties. All of the labor categories listed in HSTS03-10-R-

CIO552 Attachment D that included

‘manager’ in the title and explicit managerial responsibilities have been eliminated. Can the Government clarify how work schedules and work methodology should be assigned, directed, managed, verified and validated without contractor management, leadership or supervision on site?

The government expects that the contractor effectively manages the resources necessary to fulfill the requirements of this contract. The government does not believe that managing these resources requires that an individual be on-site.

13 H.25, H.26 The statement in H.25 indicates that a list of required insurance will follow, but none does. Can the Government clarify its insurance requirements for contractors other than that included in

H.26?

H.25 has been corrected to clarify the types of required insurance. All corrections are highlighted.

14 H.29 The statement says that “TSA SSI Office policies and procedures [are] described in the attached SSI Quick Reference

Guide.” There is no guide included with

HSTS03-11-R-CIO556 or HSTS03-10-R-

Please see Attachment I –SSI Quick Reference Guide.

CIO552; can the Government supply a copy of this document?

15 RFP IDIQ Contract SF

1449 Block 8, Task

Order #001 SF 1449

Block 8 and RFP, and

Section L, page 78 of 96

The SF 1449s provide a proposal due date of 1/14/2011. Section L provides a due date of 1/10/2011. What is the correct proposal due date?

The correct due date is Monday, January 10, 2011.

Documentation will be corrected to reflect the correct dates.

16 RFP, Section L3, Page 81 of 96

This section states in part “Volume 2 proposals shall be limited to 3 pages

(not including Attachment F Past

Performance Questionnaires.)”. Are past performance questionnaires to be included in Volume 2? If yes are they to be copies of the questionnaires fully completed by the evaluator or ones that have only Sections I and II completed?

Past Performance Questionnaires should be filled out as outlined in Section L.2, page 81 “Offerors shall submit a copy of the Past Performance Questionnaire (see Attachment F) to the Program Manager or Government Contracting Officer at the corporation or agency listed by the Offeror as a reference.

The firms listed by the Offeror as a reference shall submit their completed questionnaire via email to:

ITSSSinfo@dhs.gov, as instructed in Attachment F. The

Offeror shall not submit any other documents in addition to the Past Performance Questionnaire and the information required by this solicitation in Table 1. Submission of additional past performance-related documents shall render the Offeror’s entire proposal submission non-responsive, and no portion of the Offeror’s submission will be evaluated.”.

17 Attachment F, Past

Performance

Questionnaire

The Past Performance Questionnaire

(PPQ) provided as Attachment F has two sections identified as “II”. Will the

Government issue a corrected PPQ to

Please see the revised Attachment F. Please note that this minor correction should not have delayed the submission of

Past Performance Questionnaires to chosen references.

mailto:ITSSSinfo@dhs.gov indicate a Section III?

18 RFP, Section L.4.1 –

Labor Template Table for Task Order #001 –

Without Labor Rates, The template as shown contains a column titled “Highest Education and

Degree Achieved” and a column titled

“Professional Certifications Attained”.

There is no identified requirement for names or resumes of personnel to be assigned to this contract. Are entries in these columns to be the intended levels of personnel to be placed in the position? Please clarify.

Please see the response to Question #11. The labor table has been revised appropriately.

19 RFP, Section L.5 – Labor

Template for Task order

0001 (sic) – Labor Rates

Included, Page 88 of 96

There are columns in this template title “Resume X-ref(volume and page no’s)”, “Highest Education and Degree

Achieved”, and “Professional

Certifications Attained”. There is no requirement for resumes indicated in

Section L instructions nor are there any key personnel positions identified.

There are also no indications as to where to include resumes in the proposal if they are required. Please clarify instructions for this template and on the issue of resumes.

Please see the response to Question #11. The labor table has been revised appropriately.

20 RFP, Attachment A –

IDIQ SOW, Section

1.3.1.1.1 – Deliverable

How many FISMA scorecards are typically developed each month or

Approximately 12 formal scorecards per year. However, there are daily drafts conducted as well.

Table, Page 3 year?

21 RFP, Attachment A –

IDIQ SOW, Section

1.3.1.1.2 – Deliverable

Table, Page 7

How many sets of C&A documentation are typically required each year?

Approximately 40 – 50 sets of C&A documents/year.

22 RFP, Attachment A –

IDIQ SOW, Section

1.3.1.1.2 – Deliverable

Table, Page 8

How many POA&M closure documentation packages are typically required each year?

Between 1500 – 2000 POAM item closures. Numbers will change as agency improves their security posture.

23 RFP, Attachment A –

IDIQ SOW, Section

1.3.1.1.3 – Deliverable

Table, Page 9

How many Risk Management

Scorecards packages are typically required each month?

One/month

24 RFP, Attachment A –

IDIQ SOW, Section

1.3.1.2– Deliverable

Table, Page 10

How many waiver/exception requests and policy inquiries are typically reviewed and responded to each month or year?

For Exception/Waivers, approximately 20/month or 240/year.

For policy inquiries, approximately 40/month or 480/year.

25 RFP, Attachment A –

IDIQ SOW, Section

1.3.1.2– Deliverable

Table, Page 11

How many requests to support development of IT security related documentation are typically generated each year?

The Policy team typically receives 5/month or 60/year.

26 RFP, Attachment A –

IDIQ SOW, Section

1.3.1.2– Deliverable

How many requests to research and document technology or other security matters are typically generated each

The Policy team typically receives 20/month or 240/year.

Table, Page 11 year?

27 RFP, Attachment A –

IDIQ SOW, Section

1.3.1.3– Deliverable

Table, Page 13

How many sets of C&A documentation are typically required each year? Is the requirement identified in this table in addition to the requirement identified in the section 1.3.1.1.2 Deliverable

Table?

Please see the answer to Question #21.

Yes, the requirements in the 1.3.1.3. table are in addition to those listed in Section 1.3.1.1.2.

28 RFP, Attachment A –

IDIQ SOW, Section

1.3.2.1.1– Deliverable

Table, Page 17

How many Forensics/Malicious Code

Analysis Reports are typically generated each year?

Approximately 275/year.

29 RFP, Attachment A –

IDIQ SOW, Section

1.3.2.3– Deliverable

Table, Page 23

How many requests for FRD development or FRD comments are typically generated each year?

Unknown, metrics have not been kept on either development of or comments to FRD documentation.

30 RFP, Attachment A –

IDIQ SOW, Section

1.3.2.3– Deliverable

Table, Page 23

How many requests for SSP comments are typically generated each year?

Unknown, metrics have not been kept on either development of or comments to SSP documentation.

31 RFP, Attachment A –

IDIQ SOW, Section

1.3.2.3– Deliverable

Table, Page 23

How many requests for creation of security architectural models are typically generated each year?

As needed. Please see the requirements set forth in Section

1.3.2.3.

32 RFP, Attachment A –

IDIQ SOW, Section

How many requests for TRM package comments are typically generated each

Unknown, metrics have not been kept on either development

1.3.2.3– Deliverable

Table, Page 24 year? of or comments to TRM packages.

33 RFP, Attachment A –

IDIQ SOW, Section

1.3.1.3, Page 11

Please define the acronym “PTA”. Privacy Threshold Analysis

34 RFP, Section L.5, Pages

88, 89 and 90 of 96;

and, SF 1449 for Task

Order #001, Section 1.

The Section L.5 instructions include 5 templates under the heading Labor

Template for Task Order 0001(sic) –

Labor Rates Included. These templates correspond to CLINs 0001, 0002, 0003, 0004, and 0005. However, the SF 1449 identifies only 2 CLINs for Task Order

#001 and the titles of those 2 CLINs do not correspond to any of the 5 titles of the templates in section L.5 of the RFP.

Please clarify.

Please see the response to Question #11. The labor table has been revised appropriately.

35 SF 1449 for Task Order

#001

This SF 1449 is an MS Word document and was published and posted with track changes on and with a number of indicated changes. Can you confirm that all the indicated changes are correct and we can “accept all changes” before the SF 1449 is signed and submitted with our proposal?

Attachment H has been reposted without tracked changes.

36 RFP, Attachment A –

IDIQ SOW, Section

What is the typical monthly or yearly These are “weekly activity reports” and cover all the

1.3.2.1.2– Deliverable

Table, Page 19 number of cases that require reports? appropriate cases for the week.

37 RFP, Attachment D –

Labor Category

Descriptions, Section

1.11

The hours identified for the Secure

Communications Analyst are “Core hours with emergency on call status”.

What is the average number of times that the emergency on call provision is utilized per month or year?

Once per Quarter.

General Question

The time line to perform comparisons is constrained, and the format of the document provided does not allow for automated search; please provide a summary spreadsheet of changes between the current and previous RFP in order to expedite analysis

Please see the response to Question #1.

ITSSS SOW Page 9, Sec

1.3.1.2

What is expected workload performance threshold for this position?

How many policy / doctrinal revisions are appropriate for an FTE?

The expected workload performance threshold is outlined in

Section 1.3.1.2 of Attachment A, Statement of Work.

Please see the answers to Questions #24 & 25.

Attachment D

There is a significant change in the scope of key personnel for this solicitation; the changes in technical scope between the SOW and professional qualifications are not

Please see the response to Question #38.

readily discernable. Explain the government's reason for changing from 13 Key Personnel to "Individual order".

Sections L.3 and L.5, Page 82 and 89 of

Solicitation

There are no instructions for the contractor to provide a quote on

ODCs; please clarify how the government expects ODCs to be captured in the IDIQ and Task Order

001 Price sections.

If needed, ODC’s should be added as a line item under the column “Labor Category (LCAT)”. “N/A” should be entered into all other columns.

L.3.5.1d, Page 86 of

Solicitation

If we are an interested vendor regarding the TSA TTAC OCE RFI, is this considered an OCI? The Contract is not listed on the OCI contracts list.

We do not give any offeror a pass on possible OCI by not including all possible TSA IT contact and IT-related contracts awarded or executed within the past two years. All offerors have an affirmative responsibility that requires complying with the ITSSS solicitation.

ITSSS SOW Page 8 and 9, Sec 1.3.1.4.2;

The basic work week criteria are built upon core hours and a 40-hour work week; what are the weekly deliverables for the ISSO

Administration and Outreach requirements?

Please see requirements set forth in Section 1.3.1.4.2.

ITSSS SOW Page 9, Sec

1.3.1.2

What is expected workload performance threshold for this position? How many policy / doctrinal revisions is appropriate for an FTE?

The expected workload requirement is outlined in Section

1.3.1.2 of Attachment A, Statement of Work. On the question of number of revisions, see, SOW 1.6 General Deliverables and

Delivery Schedule paragraphs 1.6.1 Acceptance Criteria and

1.6.2 Government Review. There are no specified

requirements for each deliverable (i.e., a contract deliverable requirement and data item description) it is left up to the

Offeror to submit its deliverables in “contractor format” or

“best commercial practice”. Offerors are required to demonstrate their understanding of the requirement by submitting a well written deliverable/proposal with adequately detailed information that clearly demonstrates compliance with the solicitation requirement and allows a meaningful review by the TSA evaluators.

ITSSS SOW, Page 16 and

17; Focused Operations

Analysis support

With 80+ operational systems, how many systems fall under the purview of a given Focused Operations Analyst?

Do focused Operations Analysts support operational test and evaluations during ST&E's for developmental systems?

TSA Operational Systems are not assigned to an individual

Focused Operations Analyst. A Focused Operations Analyst will perform investigative activities on any TSA system or asset when directed to do so.

No.

Attachment D at large

The government uses the qualifier

"strong" throughout the 'Contractor

Qualifications" explanations; what constitutes strong in the government's estimate? Can the government provide a gradation of experience pertinent to

Attachment D?

The Government has removed the term “strong” as a qualifier from all Contractor Qualifications explanations.

M.4.2 Sub-factor 1;

page 95 of the

Is the government open to allocation of capabilities based on the use of software platforms to improve

In accordance with RFP Section M. 1, FAR 52-212-2 Evaluation

Commercial Items (Jan 1999); M.2 Basis of Award; and M.4

Evaluation Factor Details – Phase I Sub-factor 1 – Technical

Solicitation Compliance and Focused Operations? Approach. The TSA will evaluate an offer that meets the requirements of this Solicitation, that addresses all risks and offers mitigation for those risks such that the proposal may be determined to be the best value to the Government.

Section L, Page 78

The due date reflected on the SF 1449 for this solicitation says 14, January

2011@ 3:30pm ; the subject page says

10 January, 2011. Please clarify which dates is correct

Please see the answer to Question #15.

Section L.4.1, page 87

Within the current Staffing approach, pls confirm that there is no requirement for resumes from Key /

Non-Key Personnel. Key Personnel resumes are generally required; will they be for this submission?

Resumes are not required to be submitted with the offerors proposa, however, Offerors are required to demonstrate their understanding of the requirement by submitting a well written proposal with adequately detailed information, that clearly demonstrates compliance with the solicitation requirement and allows a meaningful review by the TSA evaluators.

General Question

Can the government provide breakdown of off-duty hours, levels of effort or on-call support, preferably by

Task?

See above, Response to Question #1; also SOW Section 1.10

Hours of Work; RFP section G.4 Observance of Legal Holidays and Administrative Leave; See also RFP Section I 52.212-5

Contract Terms and Conditions Required to Implement

Statutes or Executive Orders -- Commercial Items (Apr 2010) .

General Question

Can the government provide breakdown of SOW task areas by geographic location?

The principal place of performance of this contract is TSA

Headquarters – Washington DC metropolitan area See SOW

Section 1.9; see also RFP Section G. 7 Government Furnished

Equipment/Facilities/Workspace. See above, Response to

Question #1.