Questions_and_Answers_1.pdf

SOLICITATION: HTC711-13-R-D012

SINGLE MOBILITY SYSTEM (SMS)/COALITION MOBILITY SYSTEM (CMS)

Questions and Answers

Number Question Answer

Is it possible to know the closing date for the solicitation Single Mobility System

(SMS)/Coalition Mobility System (CMS) Solicitation Number: HTC711-13-R-D012? The closing date for the solicitation is 2pm on 29 Jul 2013.

Regarding Exercise Operations Support (1.4.3,4 and 1.4.3.9), can the government provide a list of previous year’s exercises, both timeframe and duration in order to estimate staffing requirements estimates for future support?

Please refer to sections 1.4.3.4 and 1.4.3.9 of the PWS. These sections identify the anticipated support requirements to include the estimated # of exercises, estimated duty hours and frequency. In addition, section 1.4.3.9 of the PWS has been updated to include additional verbiage on the projected work to be performed. This task is a Labor Hour task therefore all work will be on an as needed basis and billed only as used/required.

Were the hours for PWS, 1.4.7, Task 7 (Optional Task) included in the Estimated Workload

Data (pg 84 of RFP)?

No, the hours for 1.4.7 (SMS Migration to a virtual environment supporting Infrastructure, Platform, and/or Software as a Service.- OPTIONAL TASK) are not captured on pg 84.

This task is in the PWS because it will likely occur sometime during the course of the 5 yr contract period; however, the level of effort for this task will be negotiated when

Government decides to execute this option due to the unpredictability of the environment in which SMS will migrate to.

Reference: Section C - Performance Work Statement. Paragraph 1.4.2.1.1.7 Situational

Awareness and Collaboration states that the projected level of effort for this task is for

11,520 hours. The period of performance for this CLIN 0007 is from 1 October 2013 through 30 September 2015. Please clarify if the 11,520 estimated hours written in the

PWS is for the entire task (two years) or if it should be 11,520 per year (23,040 total hours for CLIN 0007).

The 11,520 estimated hours are per year.

Reference: Section L – Instructions, conditions and Notices to Bidders.

Is a cover letter allowable for each volume and is it excluded from the page limits?

Yes, Cover letters are allowed for each volume, however cover letters are inclusive in the total page limits identified within section L - Instructions, Conditions and Notices to

Bidders.

6 When does the current SMS ATO expire? Current SMS ATO expires 28 Feb 2015.

7 When does the current CMS/CTL ATO expire?

Current CMS/CTL ATO expires 1 Sep 2014; however, CMS/CTL is currently requesting a new 3 year ATO with a start date of 1 Aug 2013 which will replace the current ATO.

8 Does the DAA fall under TCJ6? Yes

In section1.4.8.1., it states "Prior to all SMS/CMS software releases, the source code shall be scanned with a Static Code Analysis Tool (Fortify 360 scanning tool, IBM Appscan, etc)," and deliverables listed as "1.4.8.2.b SMS DISA Application Security and

Development Checklist , 1.4.8.2.d CMS DISA Application Security and Development

Checklist ." However, according to the Application and Development STIG/Checklist, Static analysis tools are valuable if the code is very large, but it is not a replacement for manual code review. There should be manual code review for exposed code, such as network-facing code and mobile code. Does any of the SMS/CMS code require a manual code review to meet STIG compliancy? Is there any legacy code as part of SMS and/or

CMS that will require manual review?

There is currently no requirement for a manual code review to meet the

DIACAP requirements for either program.

Section 1.4.8.4, "Many of the controls for CMS are inherited from the sub-Contractor commercial cloud provider; however, the prime Contractor is responsible for ensuring the commercial cloud provider continues to meet these requirements." Will the contractor be required to test the inherited controls provided by the cloud subcontractor or will the test results be handed over from the cloud sub-contractor?

No the contractor will not be required to test the controls inherited from the commercial cloud provider. The documentation required of the commercial cloud provider will be available through FedRAMP.