QandA RFI Compliance for CISA Vulnerability Disclosure Platform - Follow up VDP1.xlsx

XLSX spreadsheet 33 KB Posted May 26, 2020

Attached to: Vulnerability Disclosure Platform - Request for Information (RFI)
Solicitation number: ID08200VDP1
Issued by: General Services Administration Federal Acquisition Service Assisted Acquisition Services Region 8

View the file

Other files

File	Type	Posted
VDP DRAFT PWS.pdf	PDF	May 12, 2020
CISA VDP Draft Schedule.xlsx	XLSX spreadsheet	May 12, 2020
VDP Request for Information.pdf	PDF	May 12, 2020

On GovTribe

Work with this file

Download the original file
Contacts named in this file
Similar government files
Ask GovTribe AI about this file

Try for free Login

Text version

The file's text, extracted by GovTribe without its formatting.

ID08200VDP1

	Question #	Question	Answer
	1	Can the government confirm that provider solution can be offered through any government GWAC such as NASA SEWP or any existing GSA contract?	The government is requesting feedback from industry partners to identify potential solutions, including their feedback on if existing platforms are available via GWAC, NASA SEWP, and/or GSA e-Buy.
	2	Can the government clarify exactly what needs to be included in the response to this RFQ?
●	Company Information & Survey?
●	Capabilities Statement- Scope says do not include capabilities information but there is an ask for a Capabilities Statement
●	Section C.2 Scope- do each of the requirements need to be responded to?
	Please refer to section V in the RFI . The intent is to collect contractor information and evidence of an existing SaaS platform.

Section J, Attachment A, which is referenced in Section C2 of the Draft PWS will likely be an excel sheet attached to the contract, a participating agency list that is broken down by each contract year of task order. However a list is not provided for this RFI.

Responders are not to fill out the quote in attachment “CISA VDP Draft Schedule.xlsx”, this document is a draft for reference.

3	I saw a reference to a “submit” button on the link https://feedback.gsa.gov/jfe/form/SV_dgwlXB0PWONeiy1 which is confusing. Can the government confirm that RFQ submission be submitted via the link or can it be submitted via email to diana.zoppi @gsa gov?	Submission to the potential RFQ/RFP is undetermined at this time. Please monitor Beta.Sam and GSA e-Buy for additional information in the future.
4	The VDPP Program Support document of the solicitation page 3 references Contract Number and Capability Statement Website.

Question: Can the contract number be a NASA SEWP GWAC contract number that the platform provider is on? Can the contract number be GSA contract number that the platform provider is on?

Question: Are you looking for the platform provider’s website for the capabilities statement?

Contract numbers referenced can be NASA SEWP, GWAC, or GSA Schedule.

The government is seeking additional information regarding potential vendors for this requirement and the capability of vendors possessing an existing SaaS platform.

	5	Would the Government please provide clarity on which department within CISA will be the contract and product owner?	As defined in C.1 of the PWS, "The Platform will be centrally managed by the CISA Cybersecurity Quality Services Management Office (QSMO) "
	6	Would the Government please clarify what “questions” are to be responded to in the referenced five-page limitation?	The Government is primarily interested in the market's capability to provide and display an existing SaaS platform.
	7	Does the Government have any recommendations for how to demonstrate existence of a platform that requires authentication? Would the
login screen URL be sufficient?	Yes.
	8	Related to SOW C.4.1 Task 1 – can CISA please list any active DHS programs which would present an OCI for the VDP effort?	Currently there are no known OCI.
	9	Related to SOW H.1 – can CISA please confirm that Key Personnel and others supporting the Platform will require a DHS CISA EOD?	CISA currently anticipates that no DHS EOD will be required for the Key Personnel or others supporting the platform.
	10	When is the anticipated final RFP release?	RFP is anticipated to be released the summer of 2020.
	11	Is/has there been a vendor providing this Service to date?	This is a new requirement from CISA.
	12	Is this a new requirement?	Yes
	13	Will the customer provide a description of the current IT environment?	No additional information is available at this time.
	14	Will CISA provide a list of DHS and CISA security standards and compatibility requirements prior to/within the final RFP?	CISA is currently reviewing personnel security requirements. The Platforms security policy are governed by DHS Sensitive Systems Policy Directive 4300A as defined in C.4.1.3
	15	Will CISA consider hosting a virtual industry day for potential bidders?	A virtual industry day for this requirement is not anticipated. Those with existing SaaS platforms may be considered for a due diligence session.
	16	Is there an initial list of FCEB agencies to be "on-ramped" upon contract award? Will CISA provide the initial FCEB list?	CISA is currently working with FCEB agencies to identify agencies that will be participating at the time of award. CISA intends to include that listing in Attachment A - FCEB Agencies List with the solicitation.
	17	Does CISA have a defined budget for this effort?	No additional information is available at this time.
	18	Can CISA confirm whether or not the Service Provider will be required to manage and issue payments concerning the optional bug bounty program?	The Service Provider would be expected to facilitate payment if an agency elects to start a bug bounty program utilizing the optional CLIN x003,
	19	Will the Service Provider be responsible for the promotion and expansion of the VDPP SaaS platform into additional FCEB agencies?	No.
	20	How will CISA work with the service provider to reconcile ATOs and other operational/security requirements with FCEB agencies?	As stated in C.4.1.2. "The service provider shall operate and administer the Platform, including providing the hosting and management for the platform". The Platform will not reside within the security boundary of any agency.
	21	Is it required that the SaaS platform be FedRAMP certified? If so, what Impact Level should it hold?	No FEDRAMP certification is required. As defined in C.4.1.3 "The service provider shall ensure that the Platform receives a CISA ATO, and then ensure that the ATO is maintained throughout any future system upgrades. The Platform’s anticipated initial Federal Information Processing Standard (FIPS) 199 rating is Low Confidentiality, Low Integrity, and Low Availability. "
	22	Does CISA desire the SaaS platform to be installed on CISA servers as an on premise service or a hosted service?	As stated in C.4.1.2. "The service provider shall operate and administer the Platform, including providing the hosting and management for the platform".
	23	Will the SaaS platform be required to connect to the CISA network environments for security scans?	No.
	24	Is the intent for the SaaS platform to discover vulnerabilities and/or will all issues be entered manually by internal or external resources?	As stated in C.2 "The scope of this contract is to provide CISA and participating FCEB agencies access to an existing, commercially available SaaS platform, termed the Platform, which will be a managed central platform to facilitate the submission and tracking of vulnerabilities discovered in internet-accessible information systems, termed FCEB systems. "
	25	Can CISA please elaborate on the source(s) of the vulnerabilities?	No additional information is available at this time.
	26	Of the FCEB agencies that will be “on-ramped” will they share the same tenant and information or is there a segregation of the information needed?	As stated in C.4.1.3 "This anticipated rating assumes the service provider is able to effectively segregate data in the platform to ensure that only the instantiation of the service attributed to this requirement is accredited, and that any vulnerability reporter data captured in this instantiation is minimized. "
	27	Will there be a requirement for CAC card logins compatibility?	The Government will consider this requirement for the solicitation.
	28	GSA references this as a follow-up to RFI posted back in December 20, 2019 on behalf of CISA. Can the results of this initial RFI request be shared?	This RFI, in conjunction with the results from the previous RFI, a part of ongoing market research. The results of the previous RFI will not be shared.
	29	What is your enterprise architecture approach (e.g. taxonomy)? For example, will each FCEB Agency participant have their own VDP program page with their own scope, or will there be one master VDP page where individual FCEB agency scope is included.

How will non-FCEB Agencies be architected into this? CISA anticipates that the each FCEB Agency will have their own page. As stated in C.4.1.2:

"Create an agency specific page that lists all FCEB system in scope of the agency’s VDP."

The scope is limited to FCEB agencies.

30	Section D.1 dictates “Vulnerability Reports Average time to assign to FCEB Agency” SLA’s. Does this SLA belong to the vendor, or CISA program office?	The AQLs in D.1 are intended for assess performance of the Service Provider.
31	Section C.4.1.2 states that the vendor must “Ensure that the Platform is updated to account for inclusion of a new FCEB Agency, and that service provider staff are versed in an agency’s VDP.” Can GSA elaborate on “versed in an agency’s VDP”? Does this imply training and Program Management relationships?	As defined in C.1 of the PWS, "CISA recently released draft Binding Operative Directive (BOD) 20-01, which identifies the requirement that each FCEB agency develop and publish a vulnerability disclosure policy (VDP) and maintain supporting handling procedures for identified vulnerabilities." Most VDPs for the FCEB agencies will likely be similar in scope, there may be nuances that must be considered for vulnerability reporting. Through the agency onboarding process, the Service Provider shall be prepared to ensure the platform reporting process works with the agency's VDP.
32	What is the maximum number of programs that will participate in this platform? The RFI references FCEB agencies as well as non-CFO act agencies. H1 wants to ensure the superusers from each participant are adequately supported and trained and needs to understand maximum volume of superuser to PM relationships.

What is the expected ramp-up/phasing to achieve full program participation?

Is there a pilot component of the program? The Government is currently estimating 98 agencies (23 CFO Act, 75 Non CFO Act). Note that this number can slightly change as new agencies are created or decommissioned.

The ceiling is being estimate to support all agency in any given contract year.

No pilot period is anticipated.

33	What type of customization will participating programs be at liberty to implement for their agencies? What is the degree of standardization versus customization for participating programs?	No additional information is available at this time.
34	Besides delivery and ongoing support of a fully functioning VDP, what other types of support or services might be desirable, either to integrate into solution or as optional add-ons (for example, vulnerability remediation)?	No additional information is available at this time.
35	Are there instances in which customers will be interested in adding on a vulnerability management function, and if so, what is GSA’s strategy for that?	No additional information is available at this time.
36	C3.4 states that CISA “Manages the administration of agency superuser credentialing to the system.” Does this mean that CISA is responsible for superuser relationships? In what capacity? Does this mean that CISA is simply responsible for approving superuser credentialing? Does the “system” reference the platform?	CISA will be responsible for approving super users. In the quoted text, system refers to the Platform.
37	C3.3 Does CISA intend for the platform to purely be capable of a bug bounty program, or is the intention for the agencies to monetarily reward VDP findings? These should be two different programs and two different pages.	As addressed in Section C.4.3, the Platform shall include optional functionality for FCEB agencies to establish a bug bounty program to incentivize/reward security researchers for identifying valid vulnerabilities. FCEB agencies can elect to establish bug bounty programs by utilizing the optional Clines on this contract.
38	C3.1 states that the platform “Permits participating FCEB agencies to add or remove FCEB systems at any time.” Can GSA elaborate on potential program volume as well as program fluctuation?	No additional information is available at this time.
38	Can you point vendors to “related DHS or CISA security policies and guidance” (section C.4.1.3) to ensure compliance prior to responding to this draft PWS?	Additional security requirements could become clear during post award conversations. The ATO for the system will be governed by the most recent revision of National Institute of Science and Technology (NIST) Special Publication (SP) 800-37 Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach, NIST SP 800-53 Security and Privacy Controls for Federal Information Systems and Organizations and DHS Sensitive Systems Policy Directive 4300A
40	Two SLA metrics are defined relating to triage - notably: “95% triaged within 1 business.” Is this specifically referencing triaging a report after the researcher has provided enough information for the triage team to reproduce the issue? Otherwise, this SLA will be missed because there is back and forth conversion that needs to occur between the triage team of the vendor and the researcher themselves before the report can be marked as “triaged.”	The Government will consider this feedback when drafting the final solicitation.
41	Does CISA intend to reward bug bounties to researchers for particularly compelling reports on an optional basis, or does CISA intend to run a separate bug bounty program?	CISA does not intended to run a bug bounty program. Agencies can elect to utilize the Platform to facilitate a bug bounty program.
42	Does the bug bounty functionality referenced in the PWS refer to public programs, private programs, or both?	The primary goal would be to utilize the public use case. If the vendor offers an ability to support private use cases, agencies could consider that approach when establishing the program.
43	Is the customer only interested commercially packaged solution or would the customer be open to hearing about a current capability being provided on a government contract developed, maintained, and sustained by LM? The capability is not commercially packaged.	As stated in C.1 "CISA requires access to an existing, commercially available Software as a Service (SaaS) platform". It is unclear if a developed platform on another Government contract meets that requirement.

File details come from the government source that posted it. Updated May 26, 2020.