M67854-22-R-7701-Govt Response to RFC(2)-31Aug2022-FINAL (sam.gov).pdf

Marine Corps Systems Command

Program Manager, Marine Corps Cyberspace Operations

M67854-22-R-7701

Cyber Vulnerability Research

Questions and Answers II

31 August 2022

Comment

Number

Solicitation Section Documentation/Page/Paragraph/Line

Number

Comment/Question Government Response

1 RFP Section L.5 Volume I, Item

Volume I - Go/No-Go Criteria, Page 9 To meet the Go/No-Go requirements, particularly the documentation to demonstrate possession of a fully-accredited NSA SCIF and evidence of communications methods and classification levels required, much of this documentation is classified U//FOUO or U//CUI by the NSA accrediting authority. Will the Government please provide guidance on how offerors are to submit this information to meet the Go/No-Go requirements?

The Marine Corps Security Office confirms that the required SCIF accreditation documentation is not CUI. An attestation that the Offeror possesses or has access to a fully accredited NSA SCIF (with SCIF ID and address) and communication methods is also acceptable.

2 RFP Section L.5 Volume III, Item 3

Volume III - Past Performance Proposal, Page

Historically, CPARS require one year of performance to justify a rating.

Can the government confirm that past performance examples require a minimum one year of performance to ensure that both CPARS and PPQs are reflective of consistent and successful performance?

The Government will not restrict past performance examples to require a minimum of one year of performance.

3 Attachment 4 Pricing Worksheet Is it allowable to add Program Management hours for TO 1 under CLIN

0001?

Use Tab "TO1-CLIN 0001 and 0002" to show CLIN 0001 hours and build up.

4 Government's response to Q&A

#23

Government's response to Q&A #23 The Government's answer to Q&A #23 expressly prohibits submission of any CUI data.

Section L, Go/No-Go Volume, Item 1 - Requires "Form A6796A, or equivalent documentation" that the facility meets the standards provided.

In order to demonstrate proof of a cleared facility contractors will need to provide information that will associate the government agency, the contractor's facility physical address, and the system capabilities. This association of data is controlled at the CUI level. Therefore, the answer to

Q&A #23 creates an inconsistency with the RFP requirements. Please provide clarification as to how the Government intends offerors to comply with both the requirements of the RFP and the direction under Q&A # 23.

Refer to the answer to Q1.

5 Government's response to Q&A

#16, 36, and 57

Government's response to Q&A #16, 36, and 57 Within the Government's response to Q&A #16, 36, and 57, the

Government states "Offerors are not to identify individuals proposed to perform on the contract, either by name or indirect reference, and doing so may render the proposal unacceptable." In Section L, the Government requires within the Go/No-Go Volume that "Offerors shall submit evidence of a fully adjudicated and active Top-Secret Clearance identified in the

Defense Information Security System (DISS) for all personnel proposed to support Task Order 1, which will be awarded simultaneously with the award of the single source, IDIQ contract pursuant to this solicitation."

Therefore, the answer to Q&A #16, 36, and 57 appears to create an inconsistency with the RFP requirements, as the certification data required to confirm a clearance would directly or indirectly identify individuals.

Please provide clarification, that the prohibition of identifying individuals is only applicable to Volume II - Technical Proposal.

Yes, the prohibition of identifying individuals is applicable to Volume II, Technical Proposal.

6 Government's response to Q&A

#63

Government's response to Q&A #63 Within the Government's response to Q&A #63, the Government states

"The DD254 will be included in the amendment to the RFP." The DD254 was not included in the release Amendment 0001 documents. Please provide the DD254.

The form is now posted on sam.gov.

7 Government's response to Q&A

#23 and 25

Government's response to Q&A #23 and 25 The response to Q23 and Q25 indicates CUI proposals will not be accepted.

However, data regarding NSA-accredited facilities (Accreditation Letters, Locations, SCIF numbers, SSPs, etc.) is classified by NSA as CUI. How are offerors to provide evidence if we cannot submit CUI?

Refer to the answer to Q1.

M67854-22-R-7701

Cyber Vulnerability Research

Questions and Answers II

31 August 2022

Comment

Number

Solicitation Section Documentation/Page/Paragraph/Line

Number

Comment/Question Government Response

8 Government's response to Q&A

#72

22-R-7701_CVR_RFP+-

+released+copy+(sam.gov).pdf

Table 2, Page 32)

Staffing Plan, page 34, para Volume II, Section

1.2

Q72 clarifies that the staffing matrix (ABC-Vol-II-Sect1.xls) does not count against the 10 page count for the Staffing Plan, but does not specify the filename for Staffing Plan. Shall offerors use "ABC-Vol-II-Sect1.pdf" for the Staffing Plan? Or shall the offerors include these 10 additional pages

(for a total of 40) in the "ABC-Vol-II-Sect2.pdf" file?

Offerors are to submit the staffing matrix as a .xls MS Excel sheet and as a separate file. Do not combine with the narrative, and do not convert into a pdf.

9 Attachment 4 Pricing Worksheet Pricing docs in the RFP call for a five year ordering period. However, Amendment I of the RFP added two clauses about options to extend the contract up to 6mths. Does the government expect the offeror to include cost/price for a 6mth ordering period at the end of the 5yr ordering period?

Will the government update 22-R-7701_CVR_RFP_Attachment_4-

Pricing_Worksheet_v1.7.xlsx to include that option?

Offerors should not include pricing for the potential 6 month extension and the pricing worksheet will not be updated. As part of the price evaluation, the Government will evaluate its option to extend services by adding 6 months of the offeror’s ordering period year 5 price to the offeror’s total price. Offerors shall not submit a price for the potential 6 month extension of services period.

10 Government's response to Q&A

#16

22-R-7701_CVR_RFP+-

+released+copy+(sam.gov).pdf page 33, para Volume I.2

In Vol 1 Go-No/Go, the government requires Offerors to "submit evidence of a fully adjudicated and active Top-Secret Clearance identified in the

Defense Information Security System (DISS) for all personnel proposed to support Task Order 1." However, in its response to Question 16 in 22-R-

7701-Govt_Response_to_RFCs-25Aug2022-FINAL_(sam.gov).pdf, the

Government states "Offerors are not to identify individuals proposed to perform on the contract, either by name or indirect reference, and doing so may render the proposal unacceptable." This appears to be contradictory guidance. Can the Government clarify what acceptable evidence is? Please note that any personal identification information cannot be transmitted without submitting CUI, which also appears in violation to the answers to

Q23 and Q25.

Question 16 was referencing the prohibition of identifying individuals is applicable to Volume II, Technical Proposal. The response was not applicable to Volume I, Go/No-Go Criteria.

11 RFP Section L.5 Volume III The amended RFP for Volume III Past

Performance states "recent and relevant past performance examples of Government (DoD and non-DoD) and commercial Contracts or

Orders as the Prime Offeror

If an offeror supplied the PPQ to a Government customer on a program for which they are a subcontractor to provide sufficient time for them to process the PPQ before the amendment was issued, can the Government assure that any completed PPQs that are received in support of a subcontractor past performance will not affect an overall compliance rating so long as the past performance volume narrative does not reflect the subcontractor program?

If offerors want to remove a PPQ that was previously submitted before release of the amendment, please email the Contracting Officer and Contract

Specialist, before the proposal submission deadline as stated on

Amendment 1 of the RFP; and indicate which PPQ to remove from submission. Otherwise, it will be included as part of the offeror's original submission.

12 Government's response to Q&A

#23

Government's response to Q&A #23 Section L, Go/No-Go Volume, Item 1 - Requires "Form A6796A, or equivalent documentation" that the facility meets the standards provided.

In order to demonstrate proof of a cleared facility contractors will need to provide information that will associate the government agency, the contractor's facility physical address, and the system capabilities. This association of data is controlled at the CUI level. Therefore, the answer to

Q&A #23 creates an inconsistency with the RFP requirements. Please provide clarification as to how the Government intends offerors to comply with both the requirements of the RFP and the direction under Q&A # 23.

Refer to the answer to Q1.

M67854-22-R-7701

Cyber Vulnerability Research

Questions and Answers II

31 August 2022

Comment

Number

Solicitation Section Documentation/Page/Paragraph/Line

Number

Comment/Question Government Response

13 Government's response to Q&A

#16, 36, and 57

Government's response to Q&A #16, 36, and 57 The Government states "Offerors are not to identify individuals proposed to perform on the contract, either by name or indirect reference, and doing so may render the proposal unacceptable." In Section L, the Government requires within the Go/No-Go Volume that "Offerors shall submit evidence of a fully adjudicated and active Top-Secret Clearance identified in the

Defense Information Security System (DISS) for all personnel proposed to support Task Order 1, which will be awarded simultaneously with the award of the single source, IDIQ contract pursuant to this solicitation." Therefore, the answer to Q&A #16, 36, and 57 appears to create an inconsistency with the RFP requirements, as the certification data required to confirm a clearance would directly or indirectly identify individuals. Please provide clarification, that the prohibition of identifying individuals is only applicable to Volume II - Technical Proposal.

Refer to the answer to Q5.

14 Government's response to Q&A

#63

Government's response to Q&A #63 Please provide the DD254. Refer to the answer to Q6.