MISB-02-01 Questions and Answers.doc

Questions and Answers This is a Total Small Business Set-aside, GSA or related programs can be used.

Request for quote

Responses are due January 5, 2010 at 3:00 pm EMAIL responses to: vdrammeh@central.unicor.gov

Use your letterhead to respond to this procurement Place of performance: Washington, DC Delivery address: UNICOR, Federal Prison Industries

400 First Street, NW, 5th Floor

Washington, DC 20534

Question: Do any of the places of performance require our on site technician to have a security clearance?

Answer: Yes, provided through BOP

Question: How were the hours calculated?

Answer: Estimated based on previous Certifications and the amount of control testing already completed.

Question: The solicitation says that Travel will be required- to where and how often?

Answer: Place has not been determine and there will be one trip and two locations will be visited.

Question: It seems like the scope of the effort is already estimated in hours. Are there any details which can be shared on how these estimated hours were derived?

Answer: Estimated based on previous Certifications and the amount of control testing already completed.

Question: Is there an incumbent for this opportunity?

Answer: NO Question: Is the start date for this initiative 1/14/2010 as indicated in the document?

Answer: Start date, immediately after award

Question: When do you expect the work to be completed? How many resources are anticipated to perform this work?

Answer: The current GSS CA expires on 16 April 2010 the contracted work should be completed at least 15 days prior to that date.

Question: Are there any security clearance requirements for the technical resources? If so, please specify.

Answer: Yes, provided through BOP (Bureau of Prison) Question: Is there a document or a website where the details of the controls and sub-controls can be reviewed by us?

Answer: The controls are NIST 800-53 latest version go to the Nist Web Site Question: Which specific methodology / approach was used by you in the past? DITSCAP? NIST? etc

Answer: NIST Page 2 – Question and Answers

Question: Is this requirement a recertification and if yes, when was the last certification performed?

Answer: 2007

Question: Have yearly self-assessments been performed?

Answer: Yes

Question: What is the system categorization?

Answer: MOD Question: What would be the required completion date for items 00001 and 00002?

Answer: March 30 2010

Question: The FBO posting cites the place of performance as Washington DC, and Section B of the SF1449 notes that travel may be required for both CLINS. Will the Government confirm that all work is to be performed in the Metropolitan Washington DC area?

Answer: Travel may or may not be required. Unable to specify travel locations Questions: Will the Government identify how offers will be evaluated?

Answer: Price, performance Question: Will the contractor be provided a list of the "tools" the client will expect the vendor to use during the C&A process?

Answer: Yes Question: It appears that only GSS are involved and no MA's, is this observation correct?

Answer: Yes Question: What controls sets will comprise the ST&E (e.g., DoD or NIST controls, industry controls, etc.)

Answer: NIST

Question: The type of system(s), technical environment, system impact level, and system status can influence a the testing approach and methods for the control families cited for the UGSS, Can this information and a description of this system(s) be provided?

Answer: No not to the general public Question: The effort to support the re-certification of the VMIS/TPI Network could vary significantly based on the status of existing documentation, system impact level, the controls to be examined/tested, the technical environment, and the requirements for the C&A package, Can this information and a description of this system(s) be provided?

Answer: No

Question: The solicitation indicates travel may be required, can you specify to what locations? Is the purpose of this travel to gather documentation, conduct the tests, or both?

Answer: Both

Page 3 Question and Answers

Question: The solicitation does not indicate the required schedule for completion, can this be provided?

Answer: UGSS 30 March 2010 Question: Assume the personnel would have to have been cleared for a Public Trust position, is this correct?

Answer: Yes but we only accept DOJ clearance, we would have clear who is ever chosen.

Question: Are there citizenship requirements for personnel working on this effort?

Answer: Yes, Must be a U.S. Citizen Question: Can you please confirm that rates for professional services will be based on vendors' GSA Schedule 70?

Answer: GSA prices will be accepted

Question: Will FPI please explain the basis for the estimated number of hours required for the solicited C&A services?

Answer: Estimated based on previous Certifications and the amount of control testing already completed.

Question: What is the delivery mechanism for evaluation work described in Item 00001? Unlike Item 00002, which requires entry of data and supporting evidence in the C&A Web and delivery of the C&A package and supporting documentation, no delivery mechanism is specified for Item 00001.

Answer: The Same as 00002

Question: Does FPI have specific requirements for the content of the required C&A package and supporting documentation, or will the contractor define this based on NIST standards?

Answer: Instructions, formats will be defined by FPI Question: Please clarify whether the solicitation requires the contractor to conduct ne twork testing (e.g., network scanning) or whether such testing is conducted by others and is to be incorporated in the C&A evaluation.

Answer: No that testing will be conducted by others Question: Will FPI identify the specific sub-controls to be used in the C&A?

Answer: Controls and sub controls identified in C&A Web tool Question: Will FPI provide additional detail about the FPI network including architecture of UGSS and VMIS?

Answer: Yes upon award Question: Please verify that the term "TPI Network" in the first sentence of Item 00002 is a typographical error and the intended term is "FPI Network."

Answer: Should read FPI Question: Please clarify whether the solicitation requires the contractor to develop a Security Test & Evaluation (ST&E) plan, or whether the plan has been developed by others and the solicitation requires only evaluation of test results for tests already identified in the plan.

Answer: Plan created based on test results and generated by the system Page 4 Question and Answers

Question: Will CSAM be pre-populated with all action steps, or will the contractor populate CSAM with some action steps?

Answer: pre-populated Question: Is work to be performed under the guidance of NIST SP800-53 Revision 2 or Revision 3?

Answer: Revision 2

Question: Should pricing be based on the assumption that an on-site work environment will be provided by FPI, e.g., workstation, desk, access to CSAM, etc.?

Answer: Yes

Question: Will FPI explain the meaning of the term "asset works"?

Answer: No meaning should not be included