22-R-7701-Govt Response to RFCs-25Aug2022-FINAL (sam.gov).pdf

Marine Corps Systems Command (MARCORSYSCOM)

Program Manager, Marine Corps Cyberspace Operations (PM MCCO)

Cyber Vulnerability Research (CVR)

Questions and Answers

M67854-22-R-7701

25 August 2022

Number Solicitation Section Document/Page/

Paragraph/Line Number

Comment/Question Government Response

1 Attachment 5 TO 1 PWS / Page 5 / 5.2.1

Target and Market Analysis

Currently the catalog is to be submitted 5 days after the end of the month. Given the shifting and rapid pace of the cyber environment will the Government consider making this requirement a continuous delivery activity? For consideration, will the Government require a live portal updated a minimum of daily and within 2 to 4 hours of the release of major

(e.g. front page news) vulnerabilities.

The Government will not consider making this requirement a continuous delivery activity.

The government will not require a live portal updated a minimum of daily and within 2 to 4 hours of the release of major (e.g. front page news) vulnerabilities.

2 Attachment 1 PWS / Page 3 / 1.6.7

Security Requirements

Facilities are normally provided Top Secret (TS) Facility Clearances (FCLs) with the ability to store and process Sensitive Compartmented Information (SCI). Will the Government please revise the requirement to have a TS FCL with the ability to safeguard TS/SCI.

No, the Government will not revise the requirement. This contract will require the contractor to have a NSA accredited Top Secret/Sensitive Compartmented Information

(TS/SCI) facility and will require certain contractors to obtain and maintain classified access eligibility.

3 Attachment 1 and 5 PWS 1.6.8 and TO 1 PWS

5.2.3

The Government references 10 miles at the IDIQ level and 30 miles at the TO level. Will the Government please revise to be consistent at 10 miles for both the IDIQ and TO.

The post award conference shall be held with 10 miles of Fort Meade, MD. The

Contracting Officer, COR, and other Government personnel, as appropriate, may meet periodically with the contractor to review the contractor's performance. The TO1 PWS has been updated to reflect the mileage from the IDIQ PWS.

4 Attachment 1 and 5 PWS 1.6.8.1 and TO 1 PWS

5.2.3

The IDIQ references CDRL B002 which is missing from the TO for the TOPAC. Should this CDRL be required in the TO?

Yes, CDRL B002 has been added to Task Order 0001.

5 Attachment 1 PWS 1.6.10.1.3 The current KP required availability is a 9 hour work day. Will the Government consider revising to have the KPs available a minimum of 8 hours during this 9 hour window of time?

The Government will not revise the hours of operation. For further clarification, the

Government is not requiring one individual to work the full 9 hours each day. The

Government is only requiring the contractor to a have a key personnel available during those hours. The contractor should utilize their discretion to assign and staff this requirement (i.e. assigning one person, rotating personnel, splitting coverage amongst personnel, etc.).

6 Attachment 1 PWS 1.6.10.1.3 Are the times referenced Eastern Standard Time (EST)? Yes, all times are Eastern Time and now reflect in the PWS.

7 Attachment 1 PWS 1.6.10.1.3 As companies are moving to a 9 / 80 work schedule to retain employees will the

Government please consider revising this requirement to allow for 80 hours of support in a two week period?

No, the Government will not consider revising this requirement to allow for 80 hours of support in a two week period.

8 Attachment 5 TO 1 PWS Some of the IDIQ sections are missing (e.g. travel and the rest of 1.6). Will the Government consider adding travel to the TO1 PWS (e.g. Travel to attend the TOPAC) for those supporting this work outside the Ft Meade area?

No, the Government will not add travel to the TO1 PWS.

9 Attachment 5 TO 1 PWS 5.1 This part of the TO 1 PWS references SATOC PWS 5.2.14. Is this the correct reference? It looks like it should be referencing Attachment 1 PWS 5.2.1 Task 1.

Section 5.1 of Task Order 0001 is incorrect and has been updated.

10 Attachment 1 PWS 5.2.14 Should the 5.2.14 deliverables include CDRL B002? Yes, the deliverables should be included in CDRL B002. The PWS has been updated.

11 Attachment 1 PWS 7.3.1 and 7.3.2 Will the Government change the current experience from "preferred" to "minimum required"?

No, Government will not change the current experience from "preferred" to "minimum required".

12 Attachment 1 PWS 7.3.1 and 7.3.2 Will the Government change the verbiage for clarity in regards to the degrees from "B.S. in a technical degree" to "B.S. degree in a technical field of study (STEM)."

No, the Government will not change the verbiage for clarity in regards to the degrees from

"B.S. in a technical degree" to "B.S. degree in a technical field of study (STEM)."

13 Attachment 1 PWS 7.3.1 If the Government changes from "preferred" to "minimum required" will the Government then add some additional bullets on preferred? For example, the following would be good preferred experiences above the minimum required:

- Military, in uniform, Qualified Information Warfare experience

- Prior CNO Operator experience and certification

- Current or Prior Offensive Security certifications

No, the Government will not add additional requirements.

14 Attachment 1 PWS 7.3.1 Will the Government change the requirement for "C Programming" to be "C, C++, or other object oriented programming experience"

No, the Government will not change the requirement for "C Programming" to be "C, C++, or other object oriented programming experience".

15 RFP Volume III / Page 34 Will the Government consider allowing two (2) past performances from First-tier subcontractors?

No, the prime, small business offeror should not submit more than one first-tier subcontractor past performance.

Cyber Vulnerability Research (CVR)

Questions and Answers

M67854-22-R-7701

25 August 2022

Number Solicitation Section Document/Page/

Paragraph/Line Number

Comment/Question Government Response

16 RFP Volume II Staffing and/or

Technical

Will the Government consider adding 4 pages to one of the Sections within Volume II to have Key Personnel resumes submitted for evaluation? We would recommend two pages per resume in a contractor determined format with PII redacted. If so, the evaluation criteria would need to be updated to include a resume review for compliance with the requirements to include minimum required and preferred qualifications.

No, the Government will not revise the page count for Volume II nor will we accept resumes for review. Offerors are not to identify individuals proposed to perform on the contract, either by name or indirect reference, and doing so may render the proposal unacceptable.

17 RFP General Request for

Clarification

Where will the KPs referenced in the IDIQ PWS be funded? The Government seeks to fund Key Personnel labor categories as referenced in the CLIN

0001 and 0002 services descriptions.

18 RFP General Request for

Clarification

Should the Attachment 1 PWS 1.6.10 Key Personnel be required at the TO 1 level or will a separate TO be setup for their support over the life of the IDIQ?

The Government intends to issue a separate task order for program management and research and advisory services over the life of the IDIQ.

19 RFP General Request for

Clarification

If KPs are required to support TO 1 and will be funded as part of the Task Orders will the

Government move the KP requirements to the TO 1 PWS and remove them from the IDIQ

PWS? An additional benefit of moving the KPs to the TO level will be the ability to easily define new KP requirements over the life of the IDIQ, as various efforts may have unique

KP requirements.

No, the Government will not move the Key Personnel to the TO level. The Government requires the Key Personnel identified at the IDIQ level to perform the oversight responsibilities for the overarching IDIQ. The Key Personnel preferred qualifications listed on the IDIQ PWS are to flow down to the subsequent task orders, as defined in the PWS for each task order.

20 RFP General Request for

Clarification

If KPs are moved to the TO level, will the Government add an evaluation for KPs to the

Volume V requirements? We would ask for 4 pages, two pages for each KP resume.

Refer to the answers provided for questions 16 and 19.

21 Attachment 1 PWS 1.6.10 Will the Key Personnel have a commitment to the IDIQ / TOs and is there a requirement to have the KPs available at the time of proposal submission or award? We would recommend considering adding a process for replacement of KPs - vetting by the Government of replacement personnel, meeting or exceeding the 7.3 requirements, and no more than a two week gap between replacement KPs starting on the contract.

The Government will not articulate a requirement to have commitment letters from key personnel and/or have the key personnel available at the time of proposal submission or award. Offerors should provide any information that they deem pertinent in addressing how they will staff the key personnel within their proposal.

22 RRFP Page 2 ITEM NO 0001 Will the Government please consider expanding the scope of this Item 0001 to include

PWS paragraphs 1.6.1, 1.6.2, 1.6.7, 1.6.8, 1.6.12 (CDRL delivery would be a PM function), 1.6.20, and 1.6.22?

No, the Government will not consider expanding the scope of Task Order 0001.

23 Section L Para 1.h and 1.l The Government has specified email submission of the proposal. We anticipate the proposal may include CUI information. Will the Government exchange keys for encrypted

CUI transmission, or is there a preferred approach?

CUI proposals are not authorized.

24 Section L 1.l We are concerned file sizes may exceed 5MB when all Volumes are assembled. Will the

Government accept multiple emails containing each Volume, or reconsider DoD SAFE?

Offerors may submit proposal Volumes in multiple emails if the complete proposal's file exceeds the 5MB limit.

25 Section L Para 3.h Will the Government identify which ECA should be used to encrypt CUI? Refer to the answer provided to question 23.

26 Section L Para 3.h The Government specifies, "Landscape pages shall face right." We interpret this to mean, rotated counter-clockwise from vertical with the top of the page where the binding would be in the event the proposal were printed and bound. Please confirm.

This is acceptable as long as any landscaped pages are consistent throughout the offeror's proposal. Recall that the Government will accept electronic submissions and not paper copies of offerors' proposals.

27 Section L Page 33/44, Volume I.1 Can Offeror's submit a letter from a Teaming Partner with authority to commit the company as evidence of a NSA-accredited SCIF, TS/SCI email, and NSTS?

Yes, Offeror's may submit a letter from a Teaming Partner, at time of proposal submission, with authority to commit the company as evidence of a NSA-accredited SCIF, TS/SCI email, and NSTS.

28 Section L Page 33/44, Volume I.3 We contacted DCSA to verify there is no formal CUI accreditation program at present. Will an attestation that the Offeror has a CUI Standard Practices and Procedures (SPP) following

DCSA requirements, along with NIST-SP 800.171 compliance documented in SPRS satisfy the requirement? If not will the Government specify the desired artifact?

An attestation that the Offeror has a CUI Standard Practices and Procedures (SPP) following DCSA requirements, along with NIST-SP 800.171 compliance documented in

SPRS is acceptable.

29 Section L Page 34/44, Volume II.d We interpret this requirement to mean identifying whether the work location is proposed at

Government Site or Client Site. Can the Government confirm?

Correct. All of the work will be at the contractor site, and offerors need to provide rates for the contractor sites.

30 Section L Page 34/44, Volume III Section L states, "In addition, letters of commitment shall be included for all first-tier subcontractors whose past performance is proposed in this section." Will the Government specify what information beyond that in the Consent Letter is required to satisfy this requirement?

The letters of commitment and consent letters are sufficient forms of documentation.

Cyber Vulnerability Research (CVR)

Questions and Answers

M67854-22-R-7701

25 August 2022

Number Solicitation Section Document/Page/

Paragraph/Line Number

Comment/Question Government Response

31 Section L Page 36/44, Volume IV Will first-tier subcontractors be required to provide a Total Compensation Plan? If any subcontractor to the prime is providing or contributing to the provision of a meaningful number of professional employees, then the subcontractor shall provide a Total

Compensation Plan to the prime or to the Government directly.

32 Section L Page 36/44, Volume IV Will first-tier subcontractors be required to provide a proprietary cost proposal? Subcontractors are required to submit their proprietary cost proposal that shows how the built their cost directly to the Contracting Officer. The Prime total cost should include their sub's pricing proposal they submit.

33 Atch 3 Staffing Matrix The Staffing Matrix contains a field marked "Contractor Site." Per Section L, we plan to staff 100% of the work at Contractor Site. Can the Government clarify what is desired in this field?

Refer to the answer provided to question 29.

34 Atch 4 Pricing Worksheet All tabs of the spreadsheet require subcontractors to fully disclose their DCAA/DCMA approved burdens. These are unlikely to be provided to the Prime. Can the offeror use fully burdened and/or T&M rates in the Pricing Worksheet?

Refer to the answer provided to question 32.

35 PWS Para 1.6.4 The Place of Performance (specified in 1.6.5) is at the contractor's facility unless otherwise stated in a task order, but Para 1.6.4 makes it appear the Government desires personnel at the Government site. Please clarify.

Refer to the answer provided to question 29.

36 PWS Para 1.6.10.1 and sub paras The PWS requires the Contractor to provide a Lead VR/RE and Exploit Procurement SME

(1 each), but Section L is silent on whether those personnel must be identified in the

Proposal. Does the Government desire resumes and Personal Identification Information

(PII) to substantiate Key Personnel meeting the requirements of PWS 1.6.10.1? If so, will they be excluded from page count restrictions?

No, the Government will not accept resumes for review. Offerors are not to identify individuals proposed to perform on the contract, either by name or indirect reference, and doing so may render the proposal unacceptable.

37 PWS Para 1.6.16 Is there an incumbent contractor currently providing these services for the Offeror to work with during Phase In?

No.

38 PWS Part 4, Para 4.2 The PWS requires, "The contractor shall own or lease a NSA accredited SCI Facility from the Defense Security Service…" but Section L Volume I requires a NSA-accredited SCIF and permits the Offeror to use such a facility provided by a Teammate. These two requirements appear in conflict as DSS has no purview over NSA-accredited facilities.

The contractor shall be evaluated on whether the contractor owns, leases, or has a partnering agreement for an NSA accredited SCI Facility. PWS will be updated to reflect consistency.

39 PWS Part 5, Para 5.1.7.2-3 The PWS describes two required functions, "Triggerable" and "Persistence", as required in both the Medium and High Equity implant tiers, but it is not clear how the definition of these requirements varies based upon Equity level. Can the Government clarify?

No additional clarity can be provided.

40 Section B Page 2, CLIN 0001. Also, PWS paragraphs 1.6.1, 1.6.7, 1.6.7.1, 1.6.7.2, 1.6.7.3.1.1, 1.6.7.3.2.1, 1.6.7.4, 1.6.7.6, 1.6.8 and sub-paragraphs; TO 1 PWS

5.2.2, 5.2.4.

In Section B, CLIN 0001, Offerors are instructed to price Program Management in accordance with PWS 1.6.19 and 5.2.14. However, in reviewing the PWS the referenced

PWS paragraphs appear to be program management functions and are not captured in any

CLIN in Section B. Many of these requirements carry instructions to prepare and submit

CDRLs as well. We recommend the Government modify the description of CLIN 0001 to capture the level of effort and associated cost/price associated with these requirements. If that is not acceptable, please advise how to capture the associated costs within the CLIN structure presented.

PWS Sections 1.6.19 and 5.2.14 are for Program Management and are captured under

CLIN 0001. CLIN 0001 will be utilized for program management functions such as preparing and submitting CDRLs deliverables and any other contract oversight functions at the IDIQ or task order level.

41 Section B Page 3, CLIN 0003

Description

CLIN 0003 in Section B directs Offerors to provide cost for 100 CVR activities. Based on the PWS requirements in Para 5.2 and sub paragraphs and the TO 1 PWS, it is clear the

Government contemplates CVRs that may include the acquisition of exploits/tools, the development of exploits/tools, or both. We assume details will be provided in subsequent

TOs. However, the RFP is silent on how many of each type of effort is likely during the 5-year period of performance. Will the Government clarify, or should Offerors provide a set of assumptions?

Task Orders shall provide additional clarity.

Cyber Vulnerability Research (CVR)

Questions and Answers

M67854-22-R-7701

25 August 2022

Number Solicitation Section Document/Page/

Paragraph/Line Number

Comment/Question Government Response

42 Section B Page 4, CLIN 0006

Description, PWS 3.4, 3.5;

TO1 PWS 3.4, 3.5

CLIN 0006 specifies a plug-number for Other Direct Costs (ODC) and states "ODCs must be incidental to the work being performed under this contract." However PWS 1.6.21 states, "Except as otherwise provided in a specific task order, the contractor shall furnish all materials and services necessary to accomplish the work specified therein. These materials shall include consumable items, device repair parts/components, tools and test equipment, and support equipment not otherwise provided by the Government to the contractor." PWS

3.5 goes on to state, "Materials: The Government will not provide materials, unless explicitly stated in a task order." In TO 1, the PWS states the same. How shall the Offeror present the design approach and cost associated with establishing the required development infrastructure to perform the contract? Should this be embedded within CLIN 0003?

The offeror should utilize the "material" tab on the pricing workbook to indicate their proposed solution for services and required hardware/components, under CLIN 0003.

43 PWS Para 1.4, 5.1, 5.2 PWS 1.4 and 5.1 discusses the importance of Cyber Kill Chain integration at length as the mechanism to provide Commanders the ability to disrupt, deny, degrade, or destroy targets in cyberspace. PWS 5.2 specifically states, "The Contractor shall analyze, design, develop and build advanced software and perform vulnerability research through analysis, reverse engineering, design, development, test and building integrated capability modules into an exploitation framework to facilitate the delivery of effects to a target device." In review of

PWS Tasks 1-14, we cannot determine which encompasses kill-chain integration functions.

Does the Government have a preference on which Task (and corresponding Work

Breakdown Structure Element) we use to estimate these requirements?

The Government does not have a preference as long as the tasks in 5.2 are accomplished and as long as the kill chain executes as desired in the PWS. If there are integration functions, the Government will define them in future task orders.

44 PWS PWS 1.6.10 and sub-paragraphs and para 1.6.19

PWS 1.6.10.1.2 states, "The Exploit Procurement subject matter expert shall have full authority to act for the contractor on all contract matters relating to daily operation of this contract. In the event of a conflict between the Lead VR/RE and Exploit Procurement subject matter expert, the decision of the Lead VR/RE shall prevail." However PWS 1.6.19 states, "The contractor shall designate one of the Key Personnel as the primary Point of

Contact (POC) who will be responsible for all program management activities for the IDIQ contract. This designated POC shall plan, organize, manage, schedule, implement, control, analyze, and report on all elements of contract performance." Is the Government directing

Offerors not to assign a fully qualified Program Manager with expertise to "be responsible for assessing requirements changes and implementing approved changes, as authorized by the Contracting Officer?" The requirements and labor category requirements for the Exploit

Procurement SME do not appear congruent with the expertise needed to execute a contract of this size, scope, and complexity successfully.

No, the Government is not directing Offerors to assign a fully qualified Program Manager.

45 Item No - 0006 RFP Section B - Supplies, Services, and Pricing

It's stated that 'ODC's are not to exceed $1825 per year'.

Does the acquisition of a zero-day qualify as an ODC? (A single acquired exploit may cost in the tens of thousands and a zero day could be $100,000 USD or more.)

No, the acquisition of a zero-day is not an ODC. Exploits, implants, and payloads will be further defined in future task orders and should be proposed under CLIN 0003.

46 5.2 Specific Cyber

Vulnerability Tasks and

ITEM NO - 0006

PWS - 5.2 Specific Cyber

Vulnerability Tasks - and

RFP Section B Supplies, Services, and Pricing

(ODCs)

How shall the setup of the development and test environment for this effort be charged?

Due to the nature of always-on Internet, it is not prudent to develop and test exploits on machines connected to the Internet. As such, you need a separate infrastructure that can mimic your target environment. It is not possible to setup this environment and still acquire tools from the commercial market for only $1825 per year.

Exploits, implants, and payloads will be further defined in future task orders and should be proposed under CLIN 0003.

47 N/A RFP, PWS, and TO1 Can we get clarification on the classification of the work environment and of the work product while in development? Can the work be performed in an unclassified environment where mission specific details are classified? Or should the entire work effort and all resulting projects (source code and documentation) be classified?

Work will span all levels of classification.

Cyber Vulnerability Research (CVR)

Questions and Answers

M67854-22-R-7701

25 August 2022

Number Solicitation Section Document/Page/

Paragraph/Line Number

Comment/Question Government Response

48 Volume III- Past

Performance

Proposal

RFP - Volume III Past

Performance Proposal

Can the government clarify that if in the case of a Joint Venture between a large and small company, the large member can only provide 1 past performance and at least 2 have to come from small businesses? (Since this solicitation is TOTAL SMALL BUSINESS if the

Government allows large businesses to provide more than 1 past performance in the case of a joint venture then there will likely be cases that small businesses will be, in essence, competing against large businesses.)

The Government limits submission of subcontractor past performance to one.

49 Volume III- Past

Performance

Proposal

RFP - Volume III Past

Performance Proposal

To minimize risk and ensure that the companies have worked together in the past will the government expect that at least one of the past performances be from the Joint Venture as an entity, or in a prior teaming agreement on a similar project?

No, the Government will not require this.

50 N/A N/A There is no direct mention of operation and maintenance of prior work in the PWS or TO1 PWS. Is this anticipated? Or are all work products to be produced during this time assumed to be brand new?

Yes, all work products produced during this time can be assumed to be brand new.

51 IDIQ PWS 1.6.19 Paragraph 1 Is the Program Manager required to be dual-hatted as one of the technical key personnel

(Lead VR/RE, Exploit Procurement SME) or is the Program Manager a 3rd key personnel?

Offeror's may designate a Program Manager as a 3rd key personnel in their proposal.

52 Section B CLIN Delivery / Task Order

Minimum / Maximum

Quantity and CLIN Order

Value

Section B includes duplicate tables for CLIN Delivery / Task Order Minimum / Maximum

Quantity and CLIN Order Value. The first indicates a maximum value for CLIN 0003 of

$130.6M (which is also stated in Section H) while the second has fill ins for CLIN values including CLIN 0003. Given the price competition evaluated as part of Section M 6.3, is the value of CLIN 0003 intended to be the provided value of $130.6M or a contractor determined value based on IDIQ scope?

No, this is not a Contractor determined value based on IDIQ scope. CLIN 0003 is not to exceed $130.6M.

53 Section I 52.216-19(b) Is the maximum order value of $135M specified in Section I the ceiling of the sum of all combined CLINs proposed in the Section B Maximum Quantity table?

Yes.

54 Section L 1.i, 4.b, and Vol III

Paragraph 1

Please confirm that subcontractor consent and commitment letters are not included in the page count for Volume III - Past Performance.

The consent and commitment letters will not be counted against the page count.

55 Section L Volume IV Paragraph 1 The quantity of services to be provided under CLIN3 is scalable and undefined in the solicitation. Will the Government provide quantity estimates of the anticipated delivered products for pricing purposes? If not, will the Government update the pricing requirements to only price CLINS 1, 2, and 4 while using the USG provided plug values of $130.6M for

CLIN3, $140,875 on CLIN5, and $9,125 for CLIN6?

No, the Government will evaluate the Staffing Plan for all CLINs and will evaluate the cost and price for the proposed labor rates, categories, and mix and materials associated to all

CLINs. The Government intends to define CLIN 0003 deliverables at the task order level.

56 5. Proposal Content -

Volume III – Past

Performance

Proposal

CVR_RFP / Page 34 of 44 /

Will the Government please consider requiring offerors provide at least one example of past performance performed by the prime offeror as a prime contractor? This ensures that prime offerors have the adequate experience to manage CVR’s size, scope, and complexity and are not simply serving as a pass-through to other teammates which presents significant execution risk.

Yes, the intention of Section L Volume III is to require a prime offeror to be a small business with past performance history. The RFP will be amended to clarify this requirement for the prime past performance experience.

57 5. Proposal Content -

Volume III – Past

Performance

Proposal

CVR_RFP / Page 33 of 44 /

Will the Government please require resumes for key personnel along with signed letters of commitment to be submitted as part of the technical volume? This ensures that the

Government obtain the experienced, qualified, and high performing talent required for

CVR mission success.

No, the Government will not accept resumes for review. Offerors are not to identify individuals proposed to perform on the contract, either by name or indirect reference, and doing so may render the proposal unacceptable.

58 Section B - Supplies or Services Prices

CVR_RFP / Page 4 of 44 /

18 – ITEM NO 0005

The Government states: "ODCs are Not-To-Exceed (NTE) $1,825 per ordering year.” Is this a plug number? If so, we do not believe this amount is sufficient for the requirements.

ODCs are meant to support incidentals under CVR that are not covered under the other

CLINs. CLIN 0003 will cover the CVR services requirement.

59 1.6.12 Contractor

Travel

CVR_PWS / Page 13 / 14 Will the Government provide a list of potential OCONUS locations to ensure all travel cost requirements are captured and properly priced?

Hawaii is a potential location as mentioned in PWS 1.6.12.

60 5. Proposal Content -

Volume II – Go/No-

Go Criteria

CVR_RFP / Page 33 of 44 /

8 –

Will the Government please provide a rational of why the SCIF requirements must be NSA vs DOD?

No, the Government will not provide a rationale of why the SCIF requirements must be

NSA vs DOD.

Cyber Vulnerability Research (CVR)

Questions and Answers

M67854-22-R-7701

25 August 2022

Number Solicitation Section Document/Page/

Paragraph/Line Number

Comment/Question Government Response

61 PWS - 1.6.7

Security

Requirements

CVR PWS / Page 3/

Paragraph 1 /Lines 1 to 2

Document states that "contract will require the contractor to have a Top Secret/Sensitive

Compartmented Information (TS/SCI) Facility Clearance". Contractors sites are not issued a SCI Facility Clearance, only up to a Top Secret FCL by DCSA. Can the government clarify that only a Top Secret FCL is required along with an accredited SCIF?

The contractor shall own or lease a National Security Agency (NSA) accredited TS/SCI facility accredited to handle, store, and safeguard TS/SCI Information. Or, the contractor shall have entered into a partnering agreement that authorizes the contractor to utilize a

NSA accredited TS/SCI facility accredited to handle, store, and safeguard TS/SCI

Information.

62 PWS - 1.6.7

Security

Requirements

CVR PWS / Page 3/

Paragraph 1 /Lines 3 to 6

Document states that "contractor will have a valid Top Secret/Sensitive Compartmented

Information Facility Clearance and a Top Secret/Sensitive Compartmented Information

Safeguarding Level prior to classified performance". Please confirm that a Top Secret FCL from DCSA for the company and an accredited Sensitive Compartmented Information

Facility (SCIF) meets this requirement.

Refer to the answer provided to question 61.

63 PWS - 1.6.7

Security

Requirements

CVR PWS/ Page 4/

Paragraph 6 / Line 4 to 5

Document states that "The security requirements are in accordance with the attached

DD254". No DD254 was provided to permit review and confirmation that requirements can be met.

The DD254 will be included in the amendment to the RFP.

64 PWS - 1.6.7

Security

Requirements

CVR PWS/ Page 4/

Paragraph 7 / Line 5 to 8

Can the government acknowledge that Contractor Key Personnel with access to a JWICS email and a VOIP system qualifies to communicate and exchange TS/SCI Information with the Government?

No, the contractor shall own or lease a National Security Agency (NSA) accredited TS/SCI facility accredited to handle, store, and safeguard TS/SCI Information. Or, the contractor shall have entered into a partnering agreement that authorizes the contractor to utilize a

NSA accredited TS/SCI facility accredited to handle, store, and safeguard TS/SCI

Information.

The contractor shall have access to a NSA accredited email system that is accredited to communicate TS/SCI Information.

The contractor shall have access to a NSA accredited phone system that is accredited to communicate TS/SCI Information.

65 22-R-

7701_CVR_RFP -

released copy

(sam.gov)

Page 14 Clause 52.216-19.b.1 states "Any order for a single item in excess of 135,00,000." Please confirm this number should be 135,000,000.

Yes, this number should be 135,000,000. The RFP will be amended to correct this typo.

66 22-R-

7701_CVR_RFP -

released copy

(sam.gov)

Page 2 Section B requires that CLIN 0002 should be addressed in "IAW IDIQ PWS paragraphs

1.6.10.1.1 through 1.6.10.1.3 and subsequent task orders."

Please confirm that Task Order 1 PWS Tasks 5.2.1 – 5.2.4 are part of CLIN 0002.

Yes, task order 1 PWS Tasks 5.2.1 - 5.2.4 are part of CLIN 0002.

67 22-R-

7701_CVR_RFP -

released copy

(sam.gov)

Page 3 Section B refers to CLIN 0004 as "Technology Transfer Services." Attachment 4 Pricing

Worksheet refers to CLIN 0004 as "Transition Services.” Please confirm that "Technology

Transfer Services" is the correct naming convention for CLIN 0004.

Yes, it is meant to refer to Technology Transfer Services. The offerors may relabel this but the Government will also issue an updated Pricing Workbook to match CLIN 0004 nomenclature.

68 22-R-

7701_CVR_RFP -

released copy

(sam.gov)

Page 34 Section L.Vol II.A.2 states that “the Offeror shall explain why the staffing plan they proposed in terms of number of hours, labor categories, complexities such as overlapping labor/multiple responsibilities (e.g., 'dual-hatted' individuals), full time vs. part time, and/or normal work location best suits the performance requirements delineated in the PWS."

The Government’s response to Draft Q&A #70 states that “The Government has budgeted for 30 Low Complexity Exploits and 20 Medium Complexity Exploits, 2 High Complexity

Implants, and 2 Medium Complexity Payloads, per year. Based on funding constraints, one or more task orders may be issued to fulfill the requirements each year of the contract.”

Will the Government please amend the Final RFP to include the budgeting figures outlined in Draft Answer #70 so that all Offerors use similar assumptions to address RFP Section

L.Vol II.A.s?

No. The Government will not amend the RFP to include exploit, implant, and payload

"budgets". The Government's exploits, implants, and payloads requirements will be defined by future task orders.

69 22-R-

7701_CVR_RFP -

released copy

(sam.gov)

Page 36 Section L.Vol III.3.b states “If the formal evaluation is available, it shall be included. If a

CPARS is included, a PPQ is not required. If a formal evaluation is unavailable, submit information using the format contained in the PPQ.”

Please confirm that PPQs are required for all offerors using references that do not have an available formal evaluation, and not for only “New Corporate Entities”.

Yes, this is correct. PPQ is required for all offerors who do not have CPARS record. The

RFP will be amended to clarify this.

Cyber Vulnerability Research (CVR)

Questions and Answers

M67854-22-R-7701

25 August 2022

Number Solicitation Section Document/Page/

Paragraph/Line Number

Comment/Question Government Response

70 22-R-

7701_CVR_RFP -

released copy

(sam.gov)

Page 36 Section L.Vol III.3. references Past Performance Questionnaires (PPQ). The PPQ Template states that copies of Sections I and II shall be provided with an Offeror’s Proposal

Submission. No Due Date and Time is provided for when the Government would like the completed PPQs sent back by the Assessors.

Please provide a Due Date and Time for receipt of the completed PPQs that Offerors can provide Assessors.

PPQ are due back at the same time the offeror's proposals are due. The RFP will be amended to clarify this.

71 22-R-

7701_CVR_RFP -

released copy

(sam.gov)

Page 36 Section L.Vol IV states "Offeror shall utilize Pricing Worksheet (Attachment 4), included with this RFP, in which pricing per CLINs 000X will be filled out by the Offeror and submitted with their proposal."

The Government’s response to Draft Q&A #70 states that “The Government has budgeted for 30 Low Complexity Exploits and 20 Medium Complexity Exploits, 2 High Complexity

Implants, and 2 Medium Complexity Payloads, per year. Based on funding constraints, one or more task orders may be issued to fulfill the requirements each year of the contract.”

Will the Government please amend the Final RFP to include the budgeting figures outlined in Draft Answer #70 so that all Offerors use similar assumptions to price CLINs 000X?

Refer to the answer provided to question 68.

72 22-R-

7701_CVR_RFP

Attachment 3-

Staffing Matrix v1.6

(sam.gov)

Section L.4.b Table 2 shows Volume II Section 1 Staffing Plan having a 10 Page Limit.

Section L.Vol II.A requires the following:

• L.Vol II.A.1 “Using the Staffing Matrix (Attachment 3) where specified provide:…”

• L.Vol II.A.2 “In no more than 10 pages, the Offeror shall explain why the staffing plan they proposed in terms of…”

Please confirm that offeror’s completed Attachment 3 Staffing Matrix is excluded from the

10-page limit outlined in Section L.4.b Table 2.

Yes, that is correct. The staffing matrix will not be counted against the 10 page count limit.

73 22-R-

7701_CVR_RFP

Attachment 3-

Staffing Matrix v1.6

(sam.gov)

Attachment 3 Staffing Matrix, Staff Matrix requires inputs in the IDIQ tab.

The Government’s response to Draft Q&A #70 states that “The Government has budgeted for 30 Low Complexity Exploits and 20 Medium Complexity Exploits, 2 High Complexity

Implants, and 2 Medium Complexity Payloads, per year. Based on funding constraints, one or more task orders may be issued to fulfill the requirements each year of the contract.”

Will the Government please amend the Final RFP to include the budgeting figures outlined in Draft Answer #70 so that all Offerors use similar assumptions in competing the

Attachment 3 Staffing Matrix IDIQ Tab?

Refer to the answer provided to question 68.

74 PWS - 5.2 PWS/28/2/5.2 Due to the sensitivity of this program, it is our understanding materials will need to be purchased in a manner that would be inconsistent with the included DFARs 252.244-7001, Contractor Purchasing System Administration to meet confidentiality requirements. Will the Government remove this clause? Or will the Government provide guidance for the prime contractor to purchase material in this manner?

No, the Government will not remove this clause. Any materials that may need to be purchased under this contract would not be inconsistent with the clause nor would they violate confidentiality requirements.

75 L RFP/36/5/Volume IV -

Cost/Price Proposal

Due to the need driven environment, confidence in ODC estimations would be low. Would the Government consider providing a plug number for ODC purchases by CLIN?

Refer to the answer provided to question 58.

76 PWS - 5.2 PWS/28/3/5.2 Considering the expected need for short-suspense (less than 30 days) needs for either low-equity greenfield development or for code modification of existing solutions, would specific task orders target discrete needs or include broad task orders that enable the agility necessary to meet condensed timelines?

Task Orders shall provide additional clarity.

77 General Will the government consider holding an industry day to further discuss the technical requirements and deliverables?

The Government will not hold an industry day.

78 General Is there an incumbent for this effort? No, this is a new requirement for CVR for the Marine Corps.

79 General Is this contract expected to begin in December 2022? Yes.

80 B RFP/ pg.3/ Item No. 0004 Can the government clarify what quantity 1 refers to? If the Marine Corps decides to do a follow on contract to CVR, CLIN 0004 is to cover the entire transfer of services to the new awardee.

Cyber Vulnerability Research (CVR)

Questions and Answers

M67854-22-R-7701

25 August 2022

Number Solicitation Section Document/Page/

Paragraph/Line Number

Comment/Question Government Response

81 K RFP/ pg.22/ CLAUSES

INCORPORATED BY

FULL TEXT

Can the government clarify which volume the clauses from Section K should be included in?

The offerors should submit section K or any RFP fill ins with Volume V of their proposal.

Offerors should ensure their representations, certifications, and other similar qualifications are current and in good standing in sam.gov.

82 L RFP/ pg.33/ 5. Volume I 3. Given that there is no accreditation for CUI, can the government clarify what offerors shall provide as suitable evidence for an accredited email to communicate Controlled

Unclassified Information (CUI); Will you accept a letter of practices/implementation from the FSO and or IT Department?

Yes, letters of practices and implementation is acceptable. Refer to answer to question 28, for more examples of acceptable documents.

83 L RFP/ pg.34/ 5. Volume II

A.d.

The RFP states "The normal work location(s) for the proposed labor category" Does the resulting contract expect to support remote work?

The Government will not be providing on site facilities for the contractor. Since this is a performance based contract, the contractor is responsible for performance of services under

CVR. The Government will not dictate if the contractor's employees are allowed or not allowed to do remote work. However, since the Government has a requirement to frequently communicate to the contractor and its personnel via TS/SCI means, the contractor is expected to manage its personnel's schedules, availability, and performance based on the needs of the CVR requirement.

84 L RFP/ pg.34/ 5. Volume III The solicitation states "Offerors may utilize the past performance of a first-tier subcontractors, but only for one (1) of the three (3) past performance examples allowed in the Offeror’s Volume III of their proposal submission" but then references "Examples concerning the Offeror shall be provided first, followed by each proposed first-tier subcontractors, in alphabetical order." Can the government clarify as to whether more than one first-tier subcontractor can be used to support past performance requirements so long as each first-tier sub only supplies one past performance?

Yes, the Government can clarify. Refer to the answer provided to question 15.

85 L RFP/ pg.35/ 5. Volume III 3.

a.(i)

To effectively qualify the Past Performance examples of small business offerors, will the government consider removing the potential qualification of past performance as a joint venture as described in Section 3 - New Corporate Entities a.(i)?

No.

86 L RFP/ pg.36/ 5. Volume V "Model Contract. The Offeror shall include a completed, signed copy of the entire solicitation, with all appropriate “fill-in” sections and statements completed." Can the government clarify if they want the entire RFP solicitation submitted (44 pages) or just the

SF33.

The offeror should submit the entire RFP back with the appropriate fill-ins.

87 L RFP/ pg.36/ 5. Volume V d. The solicitation states "Representations and Certifications: Offerors shall provide a copy of their representations, certifications, and acknowledgements for the prime contractor and subcontractors from sam.gov" Can the government clarify if there is specific sub section from SAM.GOV's reps and certs i.e. FAR 52.219-1Small Business Program

Representations that would accommodate this request or do you want the entire FARS &

DFARS report (which can be around 70 pages)?

Offerors should submit the representations and certifications that apply to this solicitation.

88 L RFP/ pg.36/ 5. Volume V d. The solicitation states "Representations and Certifications: Offerors shall provide a copy of their representations, certifications, and acknowledgements for the prime contractor and subcontractors from sam.gov" Will the government consider enforcing this requirements for only the prime contractor and first-tier subcontractors?

This statement applies to the prime contractor, its teaming partners (if any), and subcontractors.

89 Part 5 SOW/ pg.28/ 5. 2. Is each delivery under each CDRL considered a unique deliverable or is an entire tool including all documentation considered 1 deliverable?

Each task will have a unique set of deliverables per the PWS.

http://sam.gov/ http://sam.gov/ http://sam.gov/ http://sam.gov/ http://sam.gov/ http://sam.gov/ http://sam.gov/ http://sam.gov/ http://sam.gov/ http://sam.gov/ http://sam.gov/ http://sam.gov/ http://sam.gov/ http://sam.gov/