Questions_and_Answers_for_HSTS04-17-R-CT3014_rev_1.xls
XLS spreadsheet 101 KB Posted
- Attached to
- Integrated Logistics Support (ILS) Services for te Transporation Security Administration
- Solicitation number
- HSTS04-17-R-CT3014
View the file
Other files
Show all 35
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Questions_Clarifications
| Question # | Section | Section Title | Par Ref. | Page # | Reference Text | Comment/Question for the Government | Government Response | |
| 1 | RFP Part F, Section F | 176 | Attachment F – Labor Category Descriptions and Minimum Qualifications. An Attachment F does not appear to have been uploaded to FBO. | Attachment F will be uploaded to FBO | ||||
| 2 | RFP Part B | Section B | B.3.5.17 | 5200.228.001 Insurance for Contractor Performance at the Airport (Jul 2015) | Please provide further information regarding Insurance Requirements applicable to this procurement’s scope of work and airport access requirements per RFP Part B – Contract Clauses, Section 3 – Special Contract Requirements, Paragraph B.3.5.17 – 5200.228.001 Insurance for Contractor Performance at the Airport (Jul 2015). | The intent of the clause recognizes that every airport in the nation may mandate insurance requirements for contractors who come onto the airport property for various kinds of work. TSA does not establish the individual airports’ procedures or insurance coverage elements or amounts. It is each prospective offerors responsibility to ensure that they have obtained up-to-date information directly from any airport that they will be working at, and to be in compliance with respective airport insurance requirements. | ||
| 3 | Section 1 | Part A: Ordering Years 1-5 | A.4.1.2 | 6 | Per Section A.4.1.2 and Attachment D Price Template, the quantity required for CLINs 5001B and 5001C is 12 months. Should this be corrected to 8 months per Section A.5. | An updated Attachment D with an 8 month POP for period 5 will be provided with Amendment 1 | ||
| 4 | Section 1 | Part A: Catastrophic Response and Additional Support | A.4.4.2 | 16 | Section notes "No profit or fee will be paid on costs for Materials and Travel." Request the Government confirm that contractors can add indirect burdens to invoicing, per disclosure statement. | Yes, offers can apply burdens, just not fee/profit, to materials and travels | ||
| 5 | Section 3 | Part B: Government Property Management | B.3.1.1 | 36 | Is the contractor required to comply with B.3.1.1 requirements when shipping TSE for depot repair? | Yes | ||
| 6 | Section 3 | Part B: Insurance for Contractor Performance at the Airport | 67 | Request the Contracting Officer provide the actual types and amounts of insurance (for the work defined in the PWS) required by each federal airport. | See response to Question 2 | |||
| 7 | N/A | Part C: Transportation Security Equipment Database | C.7.6 | 86 | What version of the IBM Maximo product is used by the incumbent contractor? | Specific information on the incumnbent's databases will be provided at contract award and during the transition period | ||
| 8 | N/A | Part C: Aegis Secure Keys | C.7.13.9 | 95 | How many Apricorn Aegis Secure Key encrypted thumb drives will be provided as GFE to the new contractor? | None. The contractor is required to procure these items. | ||
| 9 | N/A | Part C: Aegis Secure Keys | C.7.13.9 | 95 | What is the recommended size of the Apricorn Aegis Secure Key encrypted thumb drive? | The approved thumb drive type and sizes can be provided. See attachment 10 | ||
| 10 | N/A | Part C: Waste Disposal | C.8.9.1 | 122 | Request the Government provide historical data on types and quantities of hazardous equipment and components disposed under the current contract. | Offerors should contact the OEMs for technical information on the maintenance | ||
| 11 | Section 2 | Part E: General Proposal Requirements | E.2.7 | 166 | Request the Government provide the SF 1449, which will be required for signature. | This has been uploaded to FBO | ||
| 12 | Section 2 | Part E: Tab 2-Past Performance (Factor 3) | E.2.7.2.2 | 167 | Request the Government define the date that the PPQs are due to the Government. | PPQs are due by the proposal due date | ||
| 13 | Section 2 | Part E - Tab 2-Past Performance (Factor 3) | E.2.7.2.2 | 168 | Regarding past performance contract summaries, the government states, "Offeror shall submit this information with their offer in the format provided in Attachment B (Past Performance Data)". Will the government change the format per the evaluation criteria and instructions, e.g., customer name, recency, and contractor performance in areas of cost control, business relations, management of key personnel, and utilization of small businesses? | No | ||
| 14 | N/A | Attachment B, PP Data | N/A | 1 | Item (5) on Attachment B reads, "Offeror may also submit past performance information regarding predecessor companies, key personnel who have performed under relevant contracts, and Subcontractors that will perform major or critical aspects of the requirements as a past performance submission(s)." This information is an RFP instruction and not part of a contract summary write-up. Can it be deleted from the attachment for Past Performance Data 1-5? | Yes, Attachment B has been updated to remove item 5 | ||
| 15 | N/A | N/A | N/A | N/A | Upon the successful completion of the authority to operate security requirements, will the government provide historical and open ticket data from the TSE database as GFI? | Yes | ||
| 16 | Pricing Schedule | A.4.1 | When the MacH systems come off warranty, does TSA plan to be the owner of the parts for the supplier to use for repair? If so, will TSA be buying replenishments as the parts are used? | The Contractor is responsible for providing all parts required in accordance with C.8.6, Supply Support. | ||||
| 17 | Sustainment of TSE | A.4.2.1 | Can TSA publish a list of official NSSE for the last 48 months? | |||||
| 18 | Disincentives | B.3.4.7.1 | Is it TSA's intent to include non-relevant downtime in the calculations for service performance, and included in the determinations of incentives and disincentives? This may drive a significant cost increase for both spares and manpower response/coverage, and service providers have very limited to correct and/or prevent. | Yes | ||||
| 19 | Part C | C.7.13.7 | Paragraph 1 | Can the government confirm that requirements in this section for “TSA Data” apply only to systems hosted with a cloud service provider? | Yes | |||
| 20 | Part C | C.7.13.7 | Paragraph 1 | Can the government confirm that “TSA Data” in this section refers to PII, SPII, SSI, SBU, and CII as also mentioned in section C.7.13.14 on page 97? | Yes | |||
| 21 | Attachment 3 | Section 5.3.1, #2 | Will the service provider be penalized for disincentives related to Operational Availability even when the error may be caused by the TSA (now including non-relevant tickets in the calculation)? | See response to Question 18 | ||||
| 22 | Attch_D,_Price_Temp; AND C.8.14.1 Innovation Task Force | Pricing Tables; AND, C.8.14.1's 1st paragraph | "To date, MacDonald Humfrey Automated Screening Lanes have been integrated with TSA AT equipment at multiple locations, and support of this technology is included in this contract. Other technologies are currently being considered, and any support required for these technologies beyond ticket dispatch to the OEM will be the subject of separate contract negotiations." | In the Pricing Table, SLINs x001AI and x001AK refer to the ATXrays with ASL. In Section C.8.14.1, the Government refers to the MacDonald Humfrey units, but these units are not included in Maintenance or Failure Data. Would the Government please confirm that these SLINs are only for the ATXray with the MacDonald Humfrey ASL attached? | Confirmed. | |||
| 23 | C.7.13.11 Mobile Device Policy and Parameters | 1st paragraph, bullet 6 | "-Mobile devices shall only be utilized as a source of input to the TSE database and cannot access or search TSE maintenance database for TSA data;" | In Section C.7.13.11, the Government states that mobile devices “shall only be utilized as a source of input to the TSE database and cannot access or search TSE maintenance database for TSA data”. Typically, security permissions for users are set once the user has authenticated i.e. “accessed” the database. Would the Government please consider removing this restriction to allow Offerors to meet the Information Security requirements contained in the RFP to enable authenticated and appropriately permissioned users to input data into the TSE Database? | 1st paragraph, bullet 6 has been removed; please reference DHS 4300A Sensitive Systems Handbook Attachment Q2 Mobile devices in regards to Mobile Device Policy and Parameters | |||
| 24 | C.7.13.11 Mobile Device Policy and Parameters | 1st paragraph, bullet 6 | " -Mobile devices shall only be utilized as a source of input to the TSE database and cannot access or search TSE maintenance database for TSA data;" | DHS has approved the use of mobile devices through the inclusion of Mobile OS, Mobile Device Management Platforms, and mobile apps on their Approved Products List. The Government's "data input" requirement increases the usage restrictions over existing DHS policy. Adopting DHS' policy would enable a more effective operation support approach. Would the Government consider utilizing DHS' policy / requirements? | 1st paragraph, bullet 6 has been removed; please reference DHS 4300A Sensitive Systems Handbook Attachment Q2 Mobile devices in regards to Mobile Device Policy and Parameters | |||
| 25 | C.7.13.11 Mobile Device Policy and Parameters | 1st paragraph, bullet 6 | " -Mobile devices shall only be utilized as a source of input to the TSE database and cannot access or search TSE maintenance database for TSA data;" | By restricting mobile devices to input only the Government has created a barrier to the Offeror’s ability to perform. With the current requirement, a mobile device could not receive any data from the TSE Database. This means that Offerors may be prevented from efficiently managing communications with field staff depending on their solution. This may also impact the ability of an Offeror to meet other Contract requirements such as Technician Response Time as new tickets could not be sent to the device. Would the Government please consider lifting this restriction, allowing Offerors to propose a solution compliant with DHS Information Assurance requirements? | 1st paragraph, bullet 6 has been removed; please reference DHS 4300A Sensitive Systems Handbook Attachment Q2 Mobile devices in regards to Mobile Device Policy and Parameters | |||
| 26 | B.3.1.6 Incident Reports | "The contractor is responsible for safeguarding government property at all times (e.g. in shipment, rigger warehouses, manufacturer’s depot, loading/unloading to/from site locations including installations/decommissions, etc.)." | Would the Government please confirm that this only applies to depot shipments (i.e., in-shipment to/from manufacturer's depot, loading/unloading at manufacturer's depot, and at the manufacturer's depot)? | Yes | ||||
| 27 | Att 3, Section 4.3 TSE Failure Relevancy; AND Att 7, Section 4 Operational Availability (Ao) | Att 3, 4.3, bullet 2, Non-Relevant; AND Att7, 4.3, SLA Performance Requirement, 2nd par, bullet #2. | "• Non-Relevant – Failures verified to be caused by an unintentional or intentional external occurrence in the operational environment not related to the inherent performance reliability of TSE. This could include baggage processing irregularities or operator mishaps that physically damage the TSE. In this case, the inherent reliability of the TSE is unrelated to the failure." ; AND "2. Subtract the sum of the operational downtime for all relevant and non-relevant critical (Priority 1 (P1)) and all relevant non-critical (Priority 2 (P2)) failures for the same TSE units used in Step 1 for a technology at an airport during the reporting period. " | With inclusion of non-relevant critical work orders into the Ao calculation for compliance and penalties, there is the potential that Offerors will be penalized for "external occurrences" outside the Offeror's control. Would the Government consider removing the impact of non-relevant work orders in penalty calculations since, as defined in Attachment 3, section 4.3, non-relevant failures/causes are "not related to the inherent performance reliability of TSE"? If the Government keeps this requirement, would the Government consider placing a limit on the penalties? | No; No | |||
| 28 | Section E.2.7.2.4, Tab 4 – Representations and Certifications | 1st paragraph | "E.2.7.2.4, Tab 4 – is for the Representations and Certification (pages are limited to clause 52.212-3). | |||||
| The Offeror shall provide its representations & certifications (FAR 52.212-3) in this section of Volume II." | There are other required certifications such as the following: |
E.1.2 52.209-7 Information Regarding Responsibility Matters (JUL 2013) E.1.5 3052.209-70 Prohibition on contracts with corporate expatriates (Jun 2006)
| Would the Government please advise where all other required certifications are to be provided in the proposal response.as pages in the referenced section are limited to clause 52.212-3. | These shall also be included in Tab 4 of Volume II | |||||
| 29 | E.2.7.2.3 Tab 3 - Socio-Economic Considerations (Factor 4) (limit 10 pages) | 2nd paragraph | "prepare and submit a proposed small business subcontracting plan, in accordance with FAR 52.219-9." | So Offerors may be compliant with the Volume II, Section 3, Socio-Economic Considerations requirements, would the Government consider increasing or eliminating the 10 page count restriction so that Offerors can use Contractor standard small business and master subcontractor plans and be compliant with FAR 52.219-9 requirement. | yes, the page count for the SB subcontracting plan has been eliminated | |
| 30 | B.3.4.7.1 Disincentives | (a) 5th paragraph | "The date the Contractor receives the SI paperwork is the … official on or off contract date and shall be used when calculating invoices." |
"If the Contractor receives the DD1149 but not the SI paperwork during the reporting period, then the Contractor shall use the date on the DD1149." Would the Government please clarify if the on or off contract date be (a) the receipt date of the SI paperwork or (b) the SAT date identified on the SI paperwork, once received? Maintenance will begin once the asset is placed in operation, which can occur any time after the SAT date. The SAT date on the SI paperwork would more accurately reflect the date the asset is put back into operation. The SAT date identified on the SI paperwork. This will be amended.
The date the Contractor receives the SI paperwork is the second date to be recorded in the Contractor’s database; this date is the official on or off contract date and shall be used when calculating invoices.
| 31 | E.2.5.4 Submission | 3rd paragraph "(c)" | "Screening operations could delay delivery of proposals to the Government up to 14 days. | To avoid the potential 14 day delay in receiving Offeror proposals via email, would the Government consider eliminating the email requirement and in its place requiring DVDs with the hardcopy delivery containing the soft copy of the proposals? | Hard copy delivery will be coordinated as outlined in Amendment 1 | ||
| 32 | E.2.7 General Proposal Requirements | Table: Volume II: Price and Other Proposal Information; Section 1: Cover Page; bullet 4 | "Signed SF1449" | Could the Government please clarify the location of the Government provided SF1449? | This has been uploaded to FBO | ||
| 33 | A.4.7 Labor Categories for Services; AND Price Template Tab: Labor Rates | A.4.7, 2nd paragraph (the table) | There appears to be a missing column for Ordering Period 5. Could the Government please clarify if Offerors should modify the Labor Category table and Pricing Sheet to add columns for Ordering Period 5? | The Offerors should include an Ordering Period 5, which will be added as an amendment | |||
| 34 | C.8.1.2.2 PM Periodicity Requirements | general | Would the Government please define periodicity requirements for quarterly Preventive Maintenance? | Every 91 days | |||
| 35 | B.3.4.7.1 Disincentives; and C.8.8.2.2 TSE Located Riggers Warehouses and Other Local Storage Locations | Part B) (a) 5th paragraph; and Part C) 1st paragraph | Part B: "The Contractor’s database shall have the ability to adjust the date an asset is brought on or removed from the contract. An approved DD1149 indicates the intent to move a unit, and the date on the DD1149 is the first date to be recorded in the Contractor’s database as the “as-of” date for adding or removing the unit from the contract. However, several days or weeks may elapse between the DD1149 date and the actual date the unit departs its current location and / or arrives at a new location. If the TSE moved from one deployed location to another, the unit will be taken off contract as of the date on the decommissioning checklist provided by the SI and will be placed on contract only after the Contractor receives the Site Acceptance Test (SAT), Readiness Acceptance Test (RAT), or Operational Readiness Test (ORT) from the System Integrator (SI). The date the Contractor receives the SI paperwork is the second date to be recorded in the Contractor’s database; this date is the official on or off contract date and shall be used when calculating invoices. If the Contractor receives the DD1149 but not the SI paperwork during the reporting period, then the Contractor shall use the date on the DD1149. Any differences between that date and the subsequent SI document will be invoiced (credit or debit) on a quarterly reconciliation invoice."; Part C: "TSE stored at Rigger’s warehouses or at other local storage locations will be considered deployed and in service for up to 90 days. The Contractor shall make all efforts to continue to service the TSE in accordance with applicable PM, CM and RS or RLT requirements. The Contractor shall notify the COR and Radiation TM immediately if local TSA restricted access prevents a scheduled RS or RLT. After 90 days at the Rigger’s Warehouse / local storage or upon written notification from the COR, whichever occurs earlier, the Contractor will remove the unit from the sustainment CLINs." | Section B (Ao Disincentives) indicates that the Offeror will remove the unit from invoicing once the SI paperwork (Decommissioning Checklist) is received and that units not at deployed locations are not invoiced for. Section C (Riggers Warehouse) indicates that the unit will remain on Contract for up to 90 days after a unit is shipped to a Riggers Warehouse. Will the Government please clarify if Offerors are required to add all Riggers Warehouses to their deployed locations list and track them within the TSE Database or is there a conflict between these two requirements? | Offerors need to have the capability to track TSE that is moved from an on-contract location (e.g. airport, TSIF; does not include TSALC) and invoice for the first 90 days in that location | ||
| 36 | Att 7, Section 5 Average Parts Availability Time (PAT), Invoice Development; AND RFP Part B - Contract Clauses, Section B.3.4.7.2 Incentives | Att 7: 2nd paragraph under Invoice Development; RFP Part B: (a) Last sentence | Att 7: "… the Average PAT Metric will be calculated quarterly …"; RFP Part B: "Incentives will be invoiced and paid quarterly" | Could the Government please confirm that the PAT incentive will be earned based on monthly PAT? The SLA Performance Metrics document indicates that the PAT incentive will be based on a quarterly PAT. Section B.3.4.7.2 in the RFP states that the PAT incentive will be earned based on monthly PAT, but paid quarterly. | Earned monthly and invoiced quarterly; the SLA Performance Metrics Attchement will be modified | ||
| 37 | E.2.8 Wage Determination Information | 1st paragraph | Attachment G-J.5 Wage Determinations provides Occupation Classification Code (OCC) 23530 “Machinery Maintenance Mechanic” for use in accordance with the Service Contract Act of 1965, FAR 52.222-41. Attachment G indicates a Date Replaced for the referenced Classification Code of 6/19/2012. and a Date of Last Revision of 7/8/15 and 12/29/15. It is our understanding that there are more current Wage Determinations for this Occupational Classification Code. Could the Government please provide an updated Attachment G? | An updated Attachment G will be provided | |||
| 38 | Attachment 7 | TSA ILS SLA Performance Metrics Section 4 Opperational Availability | Ao will evaluate the operational availability of TSE in relation to All relevant and non-relevant CRITICAL failures and all relevant non-critical relevant failures (includes corrective maintenance, depot maintenance, and telephone customer support work orders). | The requirement represents a dynamic change adding all non-relevant failures to the Ao support requirements on the current ILS performance metrics. The change would represent a significant cost impact when supporting the TSE. Will TSA consider reverting to the current Ao methodology including just the relevant critical and relevant failures? | The Government requires quick response to any equipment that is fully inoperable regardless of relevency. | ||
| 39 | Attachment D | Price Template Pricing Table | Rapiscan quantity pricing table indicates a quantity of systems 771 | A) Does TSA plan to deploy any other systems from their storage facilities? ; B) If the response to A) is yes can TSA disclose potential future sites and quantities? ; C) If the response to A) is no at this time and it is determined at a later date additional systems will be fielded; how will TSA wish to handle systems deployed from storage to the ILS contract? | The government reserves the right to deploy equipment at it's discretion | ||
| 40 | Attachment D | Price Template Pricing Table | Rapiscan quantity pricing table indicates a quantity of 75 ASL systems | A) Does ASL refer to only the use of McDonald Humphrey or will it include future ASL manufacturers as they are deployed?; B) Are there future projections to deploy ASL lanes and if so does TSA have a projected location and quantity? | Per C.8.14.1, Innovation Task Force: Other technologies are currently being considered, and any support required for these technologies beyond ticket dispatch to the OEM will be the subject of separate contract negotiations. | ||
| 41 | Attachment G | Wage Determination | Information found in Attachment G Wage determination provided as part of the attachments in this RFP should be used as the minimum standard for wages. | A) If the information provided is not the most current information should we utilize the most current 2017 available pursuant to the DOL website? Example line 4 East 34th St Heliport indicates a labor rate of $23.95 and the most current wage determination provide a labor rate of $26.35. B) Will the Wage determinations in the out years be modified as changes are made to the DOL website? | See response to Question 37 | ||
| 42 | N/A | Pre-Proposal Conference | Please provide the names and titles of the presenters at the Pre-Proposal Conference. | The Contracing Officer, Lindsay Alexander, and OAPM ILS Branch Manager, Thomas Reigeluth | |||
| 43 | RFP page 74; B.3.5.21, G | G. EMPLOYEE TERMINATION. The Contractor shall notify the Contracting Officer and the Contracting Officer’s Representative within 48 hours when an employee performing work under this contract who has been granted access to government information, information systems, property, or government facilities access terminates employment, no longer is assigned to the contract, or no longer requires such access. The Contractor shall be responsible for returning, or ensuring that employees return, all DHS/TSA -issued Contractor /employee identification, all other TSA or DHS property, and any security access cards to Government offices issued by a landlord of commercial space. | For Cloud Service Provider (CSP) solutions, TSA has not required the CSP to notify TSA when personnel not working directly on the project are terminated. Please confirm that TSA continues to hold this interpretation for this solicitation. | This section applies to Contractor personnel that are vetted and support the contract | |||
| 44 | RFP page 123; C.8.9.2 | C 8.9.2 The Contractor shall ship the inoperable hard drives, with a copy of the completed and signed TSA Form 1412, via any traceable means (i.e., tracking number) through a mail or parcel carrier (e.g., U.S. Postal Service, Federal Express) packaged in a way that does not disclose its contents or the fact that it contains sensitive information (double-wrapped in a non-opaque wrapper) to TSA Springfield Warehouse at the address below: |
TSA Springfield Warehouse ATTN: Jason Lockley / David Funk 6810 Loisdale Rd Building A, Door 19
| Springfield, VA 22150 | For Cloud Service Provider (CSP) solutions, TSA has not required the CSP to send inoperable hard drives to TSA but the CSP does follow data cleansing requirements. Please confirm that TSA continues to hold this interpretation for this solicitation. | Hard drive sanitaization applies to the components of the deployed Transportation Security Equipment | ||||||
| 45 | Att_D | Pricing Tables | If the MacDonald Humfrey ASL is still covered by manufacturer's warranty, will the Government please clarify how the AT X-ray ASL combination is invoiced? | For AT - MH ASLcombinations where the MH ASL is under warranty, then the AT is invoiced under either X001 AH or X001AJ. For combinations with both AT and MH ASL both on this contract, invoice the combination under X001AI.or X001AK. | ||||
| 46 | Att_D and RFP A5 Period of Performance | Pricing Tables | The POP for OY5 is for 8 months however Attachment D template (rows 173 to 185) is set up for a 12 month POP. Could the Government please provide an updated Attachment D Price Template to adjust OY5 to the 8 month POP? | An updated Attachment D with an 8 month POP for period 5 will be provided with Amendment 1 | ||||
| 47 | RFP Part C, Section C.7 | Section C.7 | C.7.13.20 | Software Guidance | Please provide a listing of all TSA approved security software, per RFP Part C – PWS, Section C.7 – Sustainment Support Program Management, Paragraph C.7.13.20 – Software Guidance. The approved security software listing is maintained by the Enterprise Architecture Division; and | Offerors may contact the government via the TSA_EA_TechSP@tsa.dhs.gov e-mail address. Offerors will state that they are submitting a proposal in connection with this solicitation and can then inform the government what products they plan to propose. They will then be told if it has been previously approved or is currently in use. If not currently approved or in use, the government could also vet the proposed product(s) and provide timely approval (or disapproval). | ||
| 48 | RFP page 53; B.3.5.4, (b) | (b) The Contracting Officer will provide the non-disclosure form (DHS Form 11000-6), as necessary, to the Contractor when circumstances warrant. NDAs are required to be signed by all Contractor personnel when access to SSI is necessary for performance of the contract. By signing the NDA, the recipient certifies in writing that they will take the necessary steps to prevent the unauthorized disclosure and use of information. | For Cloud Service Provider (CSP) solutions, TSA has not required the CSP's personnel not working directly on the project to sign NDAs. Please confirm that TSA continues to hold this interpretation for this solicitation. | As stated in the clause, NDAs are required to be signed by all Contractor personnel when access to SSI is necessary for performance of the contract | ||||
| 49 | Section 3 | Part B: Staff-Like Access Determination for Contractor Employees | B.3.5.6 | 55 | Please clarify whether this clause applies to Contractor program support employees who do not have access to sensitive information, such as administrative functions like finance, contracts. | This clause applies to any contractor employee that will require access to TSA facilities, information systems, or sensitive but unclassified information. This includes contracts involving work on TSA equipment at airport checkpoints. | ||
| 50 | RFP page 32; B.2.2, (c) | (c) Contractor employees working on this contract must complete such forms as may be necessary for security or other reasons, including the conduct of background investigations to determine suitability. Completed forms shall be submitted as directed by the Contracting Officer. Upon the Contracting Officer's request, the Contractor's employees shall be fingerprinted, or subject to other investigations as required. All Contractor employees requiring recurring access to Government facilities or access to sensitive information or IT resources are required to have a favorably adjudicated background investigation prior to commencing work on this contract unless this requirement is waived under Departmental procedures. | For Cloud Service Provider (CSP) solutions, TSA has not previously required the CSP’s personnel not working directly on the project to complete a background screening. Please confirm that TSA continues to maintain this interpretation for this solicitation. | This clause applies to any contractor employee that will require access to TSA facilities, information systems, or sensitive but unclassified information. This includes contracts involving work on TSA equipment at airport checkpoints. | ||||
| 51 | B.3.1.1 Government Property Management | 1st paragraph | "The Contractor shall not relocate and/or ship Government Property without prior notification to and approval from the Government Property Administrator (GPA). The GPA has authority only to provide instructions concerning the relocation and shipment of such property. These instructions do not constitute a “change” to the contract’s requirements within the meaning of that term as defined by the “Changes” clause of this contract. The Contracting Officer’s Representative (COR) shall be included on all correspondence between the Contractor and GPA." | Prior to shipment of a unit to the Depot, the Government must approve the shipment. The GPA is only available during normal business hours Monday through Friday to approve these shipments. Would the Government consider removing the downtime associated with waiting for approval to ship a unit from the Ao calculations as Offerors could incur up to 48 hours of downtime over a weekend? | No. In accordance with attachments 3 and 7, all administrative and logistics time is included in the Ao calculation. | |||
| 52 | RFP page 93 | C.7.13.7 Federal Risk and Authorization Management Program (FedRAMP) | In the RFP, it states, "Private sector solutions shall be hosted by a Joint Authorization Board (JAB)-approved Infrastructure as a Service (IaaS) Cloud Service Provider (CSP) (http://cloud.cio.gov/fedramp/cloud-systems) and shall follow the Federal Risk and Authorization Management Program (FedRAMP) requirements." Given the SOW Certification and Authorization requirements will TSA accept a FedRAMP Agency approved CSP for a private sector solution? This has been acceptable on other TSA procurements. | Yes. However, the type of FedRAMP solution (GovCloud vs. Commercial) is dependent on the TSA data that will be in the cloud. | ||||
| 53 | RFP page 93 | C.7.13.7 Federal Risk and Authorization Management Program (FedRAMP) | In Section G, the SOW states, "Private sector solutions shall be hosted by a Joint Authorization Board (JAB)-approved Infrastructure as a Service (IaaS) Cloud Service Provider (CSP) (http://cloud.cio.gov/fedramp/cloud-systems) and shall follow the Federal Risk and Authorization Management Program (FedRAMP) requirements." TSA's Cloud Computing Strategy continues to evolve. Would TSA be open to Software-as-a-Service (SaaS) or Plarform-as-a-Service (PaaS) solutions if they were part of the TSA Cloud Computing Strategy? | Yes. However, the type of FedRAMP solution (GovCloud vs. Commercial) is dependent on the TSA data that will be in the cloud. | ||||
| 54 | RFP page 93 | C.7.13.7 Federal Risk and Authorization Management Program (FedRAMP) | In Section G, the SOW states, "Private sector solutions shall be hosted by a Joint Authorization Board (JAB)-approved Infrastructure as a Service (IaaS) Cloud Service Provider (CSP) (http://cloud.cio.gov/fedramp/cloud-systems) and shall follow the Federal Risk and Authorization Management Program (FedRAMP) requirements." Will TSA accept Agency-Sponsored FedRAMP solutions? | TSA may leverage the Agency-sponsored/approved FedRAMP but may conduct it's own review and evaluation. | ||||
| 55 | RFP page 93 | C.7.13.7 Federal Risk and Authorization Management Program (FedRAMP) | In Section G, the SOW states, "Private sector solutions shall be hosted by a Joint Authorization Board (JAB)-approved Infrastructure as a Service (IaaS) Cloud Service Provider (CSP) (http://cloud.cio.gov/fedramp/cloud-systems) and shall follow the Federal Risk and Authorization Management Program (FedRAMP) requirements." Is JAB-approved required or preferred? TSA has accepted non-JAB solutions previously. | JAB P-ATO is preferred. TSA will accept Agency P-ATO as well. | ||||
| 56 | RFP page 53; B.3.5.4, e. | Breach. In accordance with 49 C.F.R. Part 1520.9(c), the Contractor agrees that in the event of any actual or suspected breach of SSI (i.e., loss of control, compromise, unauthorized disclosure, access for an unauthorized purpose, or other unauthorized access, whether physical or electronic), the Contractor shall immediately, and in no event later than one hour of discovery, report the breach to the Contracting Officer and the COR. The Contractor is responsible for positively verifying that notification is received and acknowledged by at least one of the foregoing Government officials. | Please confirm that SSI information will not be stored in the solution. | The solution is provided by the Offeror; this section references the Contractor's responisibilty to report any actual or suspected breach of SSI immediately, and in no event later than one hour of discovery to the Contracting Officer and the COR. | ||||
| 57 | B.3.5.21, H | H. PERSONNEL CHANGES. The Contractor shall notify the Contracting Officer’s Representative (COR) in writing of any changes needed in building, information systems, or other information access requirements for its employees in order to meet contract requirements not later than one day after any personnel changes occur. This includes name changes, resignations, terminations, and transfers to other Contractors. The Contractor shall provide the following information to the COR: full name, social security number, effective date, and reason for change. | For Cloud Service Provider (CSP) solutions, TSA has not required the CSP to notify TSA when personnel changes occur for those employees not working directly on the project. Please confirm that TSA continues to hold this interpretation for this solicitation. | This paragraph is addressing contractor employees who require access to building, information systems or other information access in order to meet contract requirements. | ||||
| 58 | RFP page 89; C.7.13.1; C.1.1 | C.7.13.1 C.1.1 Information Technology Security Requirements |
Controls The Contractor shall comply with all Federal, Department of Homeland Security (DHS) and Transportation Security Administration (TSA) security and privacy guidelines in effect at the time of the release of the RFP, as well as those requirements that may be added during the contract.
The Contractor shall comply with all DHS and TSA security controls to ensure that the Government's security requirements are met. These controls are described in DHS MD 4300A and TSA MD 1400 series security policy documents and are based on the current National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 standards.
| The Contractor shall include this guidance in all subcontracts at any tier where the subcontractor is performing the work defined in this PWS. | For Cloud Service Provider (CSP) solutions, are you willing to accept FedRAMP compliance in lieu of requirements listed in C.7.13.1; C1.1.? | In addition to FedRAMP compliance, the CSP must meet requirements C.7.13.1; C1.1 | ||
| 59 | RFP Page 90; C.7.13.3 | C 7.13.3 IT Training Requirements |
The Contractor shall maintain a list of all employees who have completed training and shall submit this list to the contracting officer representative (COR) upon request, or during DHS/TSA onsite validation visits performed on a periodic basis.
All Contractor employees, requiring system access, shall receive initial Organizational Security Fundamentals Training within 60 days of assignment to the contract via the Online Learning Center (OLC) and/or TSA provided CD disks. Refresher training shall be completed annually thereafter for Organizational Security Fundamentals and TSA Privacy training. Non-compliance will result in the suspension of user accounts at the Government’s discretion.
| Role Based training is required for contract employees with Significant Security Responsibility (SSR), whose job proficiency is required for overall network security within TSA, and shall be in accordance with DHS and TSA policy. The Contractor will be notified if they have a position with Significant Security Responsibility. | For Cloud Service Provider (CSP) solutions, TSA has not required the CSP to conduct IT training for employees not working directly on the project. Please confirm that TSA continues to hold this interpretation for this solicitation. | If the CSP is covered by FedRAMP, then only employees not associated with the baseline FedRAMP solution will be required to take TSA appropriate trainings. | ||
| 60 | RFP Page 91; C.7.13.4; C.1.1.1 | C 7.13.4 C.1.1.1 Information Technology Configuration Management (hardware/software) |
Hardware or software configuration changes shall be in accordance with the DHS Information Security Performance Plan and the DHS Continuous Diagnostics and Mitigation (CDM) Program to include TSA’s Configuration Management policy. The Cybersecurity Division (IAD) shall be informed of and involved in all configuration changes to the contractor’s IT environment including systems, software, infrastructure architecture, infrastructure assets, and end user assets. TSA IAD and the TSA COR shall approve any request for change prior to any development activity occurring for that change and shall define the security requirements for the requested change. The COR will provide access to the DHS Information Security Performance Plan.
| The Contractor shall ensure all application or configuration patches and/or Requests for Change (RFC) have approval by IAD, Enterprise Architecture (EA), and the TSA COR prior to controlled change release under the security policy document, TSA Management Directive (MD) 1400.3 Information Technology Security and TSA Information Assurance (IA) Handbook, unless immediate risk requires immediate intervention. Approval for immediate intervention (emergency change) requires approval of the TSA IAD, at a minimum. | For Cloud Service Provider (CSP) solutions, TSA has not required the underlying CSP to create a TSA-specific maintenance and upgrade schedule for the core CSP offering. Please confirm that TSA continues to hold this interpretation for this solicitation. | Correct, if CSP is covered under FedRAMP, they follow FedRAMP's process for Change Management. Anything built on top of the FedRAMP solution, still must follow DHS/TSA's requirements. | ||||
| 61 | C.7.13.8 | C 7.13.8 All services, hardware and/or software provided under this task order shall be compliant with applicable DHS 4300A Sensitive System Policy Directive, DHS 4300A Sensitive Systems Handbook, TSA MD 1400.3 Information Technology Security, TSA IA Handbook, Technical Standards (TSs) and Standard Operating Procedures (SOPs). The Contractor solution shall follow all current versions of TSA and DHS policies, procedures, guidelines, and standards, which shall be provided by the Contracting Officer. Authorized access and use of TSA IT systems and resources shall be in accordance with the TSA IA Handbook. | For Cloud Service Provider (CSP) solutions, are you willing to accept FedRAMP compliance in lieu of requirements listed in C.7.13.1; C1.1.? | In addition to FedRAMP compliance, the CSP must meet requirements C.7.13.1; C1.1 | ||
| 62 | C 7.13.9 | C 7.13.9 Data Stored/Processed at Contractor Site | ||||
| Unless otherwise directed by TSA, any storage of data shall be contained within the resources allocated by the Contractor to support TSA and may not be on systems that are shared with other commercial or government clients. | For Cloud Service Provider (CSP) solutions, TSA has accepted multi-tenant architecture solutions for other projects. Please confirm that TSA continues to hold this interpretation for this solicitation. | No. TSA data must not be shared or integrated with another tenant. | ||||
| 63 | RFP page 100; C.7.13.20 | The Contractor shall support or perform the installation of forensic software servlet agents on supported Operating Systems on all TSA contract supported devices and environments per TSA engineering, security, and configuration standards. The Contractor shall test and upgrade the servlet agents as directed by the IAD. | ||||
| The Government shall provide the Contractor with a forensic software server that shall not belong to the Contractor’s system boundary. The Contractor shall support or perform the installation of the server. The server shall be reachable from TSANet over the Internet and shall be primarily used for authentication and proxy functions. The server shall be properly configured to reach all assets with the agent installed on the network. | For Cloud Service Provider (CSP) solutions, TSA has used the CSP's forensic software and the results are shared with the TSA SOC. Please confirm that TSA continues to hold this interpretation for this solicitation. | No. This will be something that we will have to work with each individual CSP to ensure that TSA Focus Ops can perform forensics. Whether utilizing TSA's current TSA software or on CSP's forensic software is yet to be decided until we know of the proposed solution. | ||||
| 64 | RFP page 67; B.3.5.16, e. | Breach Response. The Contractor agrees that in the event of any actual or suspected breach of PII (i.e., loss of control, compromise, unauthorized disclosure, access for an unauthorized purpose, or other unauthorized access, whether physical or electronic), it shall immediately, and in no event later than one hour of discovery, report the breach to the contracting officer, the Contracting Officer’s Representative (COR), and the TSA Director of Privacy Policy & Compliance (TSAprivacy@dhs.gov). The Contractor is responsible for positively verifying that notification is received and acknowledged by at least one of the foregoing Government parties. | The prime will notify TSA within one hour of learning of the Cloud Service Provider (CSP) breach. Is this acceptable to TSA? | Yes | ||
| 65 | RFP page 99; C.7.13.19 | The Government, through the CMaaS vendor, shall provide the following support for operations and maintenance of the CDM solution sensor kits: |
· Patching (Controlled through a CMaaS Windows Server Update Service (WSUS))
· Hardware troubleshooting & Risk Management (RMA)
· Application maintenance (done from the Government/TSA Management Enclave)
· Vulnerability scanning For Cloud Service Provider (CSP) solutions, TSA has used the CSP's continuous monitoring and the results are shared with the TSA SOC. Please confirm that TSA continues to hold this interpretation for this solicitation. For CDM tools, the results would automatically get sent to the DHS CMaaS solution. The monthly scans that are required by DHS’ Performance Plan would send it to the designated ISSO and System Owner for the system. If you are a Cloud Service Provider under a FedRAMP P-ATO, those Continuous Monitoring results would go directly to the FedRAMP repository where customers would have access to.
File details come from the government source that posted it. Updated .