E1 Industry Day Q_A.pdf

Question Answer

Do we know how many certificates they are looking to manage for this project? If you had any information related to expected volumes that would be greatly appreciated.

USMC PKI issues approximately 250,000 NPE certificates and 16,500 NEATS and SIPR User Tokens annually.

Under what NAICS do you plan to assign this effort? 541519

Will you allow the VAR exception for NAICS 541519?

Applying the employee standard will not be applicable to the requirement.

Is it possible that some of the technical positions (NetOps) can be supported remotely?

All positions are required on-site. Telework may be allowed, but is on a case-by-case basis.

In PWS section 3.2.b, there is a mention of supporting Zero Trust. Would the PKI team be leading this effort or be a supporting entity?

Supporting entity.

In addition to Zero Trust, would the support or inclusion of Identity Credentialing and Management (ICAM) work also be expected?

Supporting entity.

In PWS Section 4.2.1, there is mention of LRA audits. Does the Program Office envision a need for third party (outside the current organization) auditors?

No.

Reference PWS Section 4.8, will the Place of Performance for the reference optional CLIN be MCB Quantico and servicing the identified areas or does the Government require on-site representation at those sites as well?

All positions are on-site.

Section 4.2.1 indicates that Personnel shall possess a DoD/NSS PKI Registration Authority, Local Registration Authority, and Key Recovery Agent training certificates. To enable competitive bidding, will the government consider providing a transition period to enable the new vendor’s staff to complete the training?

At this tiem, DoD/NSS PKI Registration Authorities, Local Registration Authorities, and Key Recovery Agents shall be fully certified prior to on-boarding.

Section 4.1.7 identifies a need for a training facility. How many times per year will this venue be needed?

15 times per year -- Once per month, with some double ups.

Is the course material already developed? More information regarding this requirement will enable bidders to provide more competitive quotes. Course material is developed.

Since this is a performance based acquisition, would the Government consider using Key Performance Indicators and target metrics the vendor is expected to meet?

The PWS has some metrics within the tasks, and we also have a PRS with metrics.

Will the Government be providing Government Furnished Equipment (GFEs) to the successful Offeror? Information concerning GFP is in the PWS.

Would the Government consider releasing the historical LOE for this requirement as the incumbent Contractor is the only competitor with this knowledge, thereby limiting competition?

Various historical information will be provided for informational purposes only, adn the PWS will contain the available Govt workspaces.

Would the Government please provide current Organizational Charts for MCCOG to level the playing field? At this time, release of the slides is still pending.

Will Offerors be required to submit Past Performance references? Solicitation factors are not finalized.

Where is the anticipated Place of Performance? The place of performance is identified in the PWS.

Does your company have the ability to self-backfill CONUS and OCONUS locations during times of vacancies, vacations, call-outs, etc. that meet the security requirements? Is the OCONUS work in Okinawa Japan temporary travel or a full time position(s)? The work in Okinawa is a fill-time, on-site need/full-time.

The Contractor shall utilize the Government Sensitive Compartmented Information Facility for all Top Secret / Sensitive Compartmented Information work as needed, see DD Form 254 for specific locations authorized. Where is the Government SCIF Located? Information will be provided upon award.

How many seats will be available at the Government Facility? This information was recently aded to the PWS

This contract will require the Contractor to have a Secret Facility Clearance and will require certain Contractors to obtain and maintain classified access eligibility. The Contractor shall have a valid Secret Facility Clearance prior to classified performance. Where must the Contractor's Facility be located?

All work will be performed on site. Requirement is for the vendors to have a CAGE Code and FSO.

Are resumes required for Key Personnel? Resumes are not required.

What is the anticipated Period of Performance?

Period of performance is anticipated around third quarter 2026; five performance periods are anticipated.

Does the Government intend to release a draft Solicitation? Yes.

Given Small Business (SB) prime contractors deliver similar services on Department of Defense efforts, has the Government made a determination on the Small Business Set Aside (SBSA) status for this effort? If not, when will the SBSA status for this opportunity be determined?

The Government intends to issue the solicitation as a 100% small business set-aside.

Has the Government considered utilizing Seaport Next Generation SBSA or the General Services Administration (GSA) One Acquisition for Integrated Services Plus (OASIS+) Women Owned SB Intelligence Services Domain (Relevant Category: 50408) to procure these services?

Yes, these vehicles were considered but market research results deemed open market as a better solution.

Will the Government provide the opportunity for interested offerors to conduct one-on-one sessions with relevant Government stakeholders?

Other than opportunities provided at Industry Day, we do not anticipate one-on-one sessions.

What is the anticipated Solicitation release date? Summer 2025.

Will the Government provide the slides presented at the Pre-Solicitation Conference?

Yes, as soon as they have been screened for release by the appropriate authority.

was the incident of human users left off of the list? No, it was on the previous slide.

will the PKI industry day slide deck go in the post conference posting?

Yes, as soon as they have been screened for release by the appropriate authority.

Is there an OCONUS requirement for RA Operations? No, RA Ops is exclusively at MCB Quantico.

How many SIPER tokens per year? ~14,000.

What is the OOT? There are two LRA Authorities issuing certificates.

Is there a reason MCCOG is doing Triannual audits?

JFHQ-DoDIN conducts tri-annual audits on RA Operations -- required by the CPS and RPS. Marine Corps PKI performs bi-annual audits on Marine Corps LRAs, again a requirement of the CPS and RPS.

Is there an LRA at MARFORRES? No.

is there going to be a tool going forward or is Remedy going to be used throughout contract?

We currently use Remedy. We leverage the USMC provided E-ITSM tools.

Does MCCOG support MARSOC with this requirement? Yes.

does the PKI team maintain its own hardware or do they need to find resources elsewhere? PKI maintains its own everything.

Did you get a root from DoD? No.

Are you doing validation testing for the software? We have a lab.

When you are in a deployment phase, what is the organization structure to pass information?

Marine Corps PKI is co-located with the Marine Corps Cyberspace Operations Group (MCCOG). We leverage communications with the Battle Staff.

the CA's that you mentioned so far, are they different than DoD? USMC CAs are for internal USMC consumption only.

regarding the help desk, is that 24/7 tier 1,2, or 3, and what tool do you use to capture?

The USMC PKI help desk is 5x8, it is not a 24 hour operation.

Do personnel have to come into the office to do the work? Yes, all work is done on-site.

The RA responsibilities, are they issued from the DoD PKI? Yes, DoD and NSS PKI.

Is there a specific tool to collect all metrics for CMC tool? No, nothing dictated, whatever the vendor provides.

In line with compliance does not equal sustainment, do you have products that leverage security?

We rely on what MARFORCYBER provides (e.g. ACAS, HBSS, Defender, Tanium, etc.) USMC PKI Workstations are non-domain work stations. Only PKI personnel can touch them.

have you seen any BYOD requirements No.

On mobile devices, are we Soft Cert or Purebred? DoD/DISA Purebred.

Since this will be FFP, are you going to give more information on the training events required?

Yes, there will be more definition provided. We are currently looking at 15 sessions per year.

Will there be staffing plans provided?

No however the Government will be providing historical staffing levels. This is a mature system, nothing needs to be developed, however the Government wishes to hear what industry has to offer. Feedback is very important.

is Marine corps PKI considered in sustainment?

Yes, we are in sustainment. There are new requirements all the time that we have to adjust to.

Why is the Marine corps still on Microsoft certificate authorities?

We have a project in place to move off of MS Certificate Authorities.

Are you transitioning to quantum cryptography?

Yes, Our intent is to transition PQC via algorithm evolution.

for the web app supporting enrollment, is that a product?

it is not homegrown, we use what comes down from

DISA PKI/PKE.

Are responsibilities exclusively for PKI product analysis?

Yes, mainly PKI product analysis and ancillary requirements

Is there anything on high/high or SIPR and below? SIPR and below.

Will you be sending a conformed RFP prior to official RFP? Likely the Government will issue a draft RFP.

What is your timeline to release the RFP? Likely this summer.

Are materials and ODC's going to be a plug number or how will that be presented?

We are looking at Cost Reimbursement for Travel, no

ODC.

What are the on-site support requirements? 100% in office only work.

Does the Government have a ratio of Conus/OCONUS work?

Historically, 2 personnel for OCONUS, everyone else CONUS. Dropping one OCONUS site.

Where will training need be? Historically, it has been within 10 miles of Quantico.

Will Overtime be allowed? Overtime will not be allowed.

Are the LRA's going to be co-located with the MEF G6's?

I and II MEF is with the G-6, III MEF is with 3 Network Battalion. HQMC LRA is at the Pentagon.

Who trains the registration authority? DISA.

does PKI do the audits?

JFHQ-DoDIN conducts tri-annual audits on RA Operations -- required by the CPS and RPS. Marine Corps PKI performs bi-annual audits on Marine Corps LRAs, again a requirement of the CPS and RPS.

Can you answer historically how many people have supported this requirement in the past? Historically, it has been 25-26 contractors.

Is the Government physically shipping tokens under this requirement? Yes.

Why is the CSFC PKI on this solicitation and not the CSFC contract?

Directed by HQMC DC-I. USMC PKI is the only authorized CA operator in the Marine Corps.

Will you establish a reading room that will provide references, SOP's and order of business? No.

Will Travel and ODC be a plug number? Yes.

How many training classes in 1 year? 15 classes/year.

In the event of an OCI, will you accept an OCI mitigation plan? The solicitation will likely address this.

Will a transition-in phase be required?

There will not be a transition-in period. the contractor shall be fullt staffed and be fully mission capable on day one of period of performance.

How will knowledge be transferred? Current SOPs and documentation.

Have you made a determination on small business set aside and/or subK requirements?

Currently, the intent is to solicit with a small business set aside, no sub-contractor plan required.

Has the Government considered SeaPort NxG SBSA or the GSA Oasis+ WOSB intelligence services?

Yes. The Government considered all GWACS available, however posting the solicitation on SAM.GOV ensured maximum competition.

Are 1:1 vendor sessions available? None are anticipated.

Will the number of key personnel be reduced to a more manageable number? Recent PWS revisions address key personnel.

Can the cyber-bites conference center be used by the Government for the training/conference piece of the requirement? Yes.

Have you considered any expansions into digital forensics and incident response in cyber services?

No -- this function is provided by another entity within the Marine Corps. PKI provides support when required.