Questions and Responses 16-21.pdf

TRANSPORTATION SAFETY AND SECURITY II (TRANSS II)

SOLICITATION HTC711-12-R-R011

QUESTIONS & RESPONSES

Questions 16 – 21

16) Reference: Solicitation, Section 2, Page 35, Paragraph Sub-Factor C.

Question: Should the Small Business Subcontracting Plan be included in the Technical Capability Proposal?

Response: Yes.

17) Reference: Solicitation, Section 2, Page 35, Paragraph Sub-Factor C.

Question: Will the Small Business Subcontracting Plan count in the Technical Capability proposal page limit?

Response: Yes.

18) Reference: Solicitation, Section 4, Page 36, Paragraph (b) (13).

Question: Should Attachment 5 be included in the Price Proposal?

Response: Attachment 5 should be included in the Technical Capability Proposal.

19) Reference: Solicitation, Section 4, Page 36, Paragraph (b) (13).

Question: Should the Financial Institution release letter be included in the Price Proposal?

Response: The financial institution release letter should be included in the Technical Capability Proposal.

20) Reference: Section Sub-Factor B, Information Assurance & Cyber Security, Page 35.

Question: The security requirements in the SANS Critical Security Controls recommend that one:

“Operate critical services on separate physical host machines, such as DNS, file, mail, web, and database servers.” Must a respondent comply with this stipulation in order to meet this program’s security concerns? A more typical implementation for a program of this size would be to separate services such as these using virtual, rather than physical, hosts.

Response: The question relates to Critical Control 11: Limitation and Control of Network Ports, Protocols, and Services, and the specific recommendation was stated as a Configuration/Hygiene control.

With respect to the specific question, many of the controls are dynamic and work together to comprise a defense in depth architecture for an organization. The specific recommendation for physical separation and segmentation of the listed services (DNS, file, mail, web) is usually the most secure architectural construct from a security engineering standpoint. However, it is realized that some organizations elect to separate services via virtual hosts. This method has higher risk and that additional risk would need to be considered in the organization's overall security program, threat environment, and in light of the sensitivity of the information being processed/stored in the organizations IT environment, and other control and risk mitigation mechanisms employed within the defense in depth architecture.

21) Reference: Section Sub-Factor C, Small Business Subcontracting Plan, Page 35.

Question: Proposal Instructions for Volume I – Technical Capability request a Small Business Subcontracting Plan (for Large Businesses only) as Sub-Factor C. However, this plan typically contains the overall bid price and dollar amount goals by small business class. The Proposal Instructions for Volume I – Technical Capability direct offerors that “this volume shall exclude any reference to the price aspects of the proposal”. Should the Small Business Subcontracting Plan be placed in Volume III - Price Proposal?

Response: The Small Business Subcontracting Plan should be included in Volume I.