CSEA_Govt_Response_to_Industry_Questions_4-13-17.pdf

Tracker # Page # Section/

Paragraph Question/Comment Proposed Action/Change Answer

1 Synopsis Synopsis for Presolicitation

Can the period for questions and comments be extended to 29 March 2017? Gov to Extend question submission period to 31 March Questions period from Industry was extended to 31 March 2017.

2 63 SOW 2.11.e

Offerors are required to provide a copy of a properly executed DD 254 form, in order to handle Secret NOFORN materials and obtain access to the Bidder’s Library. The form must have block 10 e. (2) marked "yes" (Non‐SCI Intel Information)

Please correct the DD254. Please extend the due date for accepting questions through March 31 2017 to allow adequate review of Bidder’s Library material which has been delayed due to DD 254 issue

The Government will provide SOW clarifications. No changes are currently needed to the DD254

3 General General Does the government intend to hold an Industry Day? If so, when? Schedule and industry day prior to final RFP release. The Government will not host an industry day.

4 156 3.3.3.1.1 When will the ACB20 SELF‐DEFENSE SYSTEM INTEGRATED COMBAT SYSTEM ENTERPRISE RADAR SUITE (ERS) CONCEPT OF EMPLOYMENT (CONEMP) be made available?

Release GFI with updated draft RFP. The ERS CONEMP is provided in the Bidders Library.

5 156 3.3.3.1.1 When will the SSDS ACB 20 INTEGRATED COMBAT SYSTEM ESSM BLOCK 2 CONCEPT OF EMPLOYMENT (CONEMP) be made available?

Release GFI with updated draft RFP. The ESSM CONEMP is provided in the Bidders Library.

6 156 3.3.3.1.1

When will the ACB 20 SSDS ICS SURFACE EW IMPROVEMENT PROGRAM (SEWIP) CONEMP be made available?

Release GFI with updated draft RFP. The EW CONEMP's will be provided in accordance with the instructions provided as "Step 2" of the Bidders Library Instructions, delivered via DVDs to the vendors.

7 139 3.3.2.3.4 Will the government provide details of the SoS M&S federations as part of the final RFP?

Release GFI with updated draft RFP. A complete list of GFI will be provided in Section J of the RFP to include the M&S Strategy and Plan.

8 General General When will EASR performance and interface characteristics be released to the bidders library?

Release GFI with updated draft RFP. The EASR‐CEC‐SSDS high‐level interface requirements are in the SIRD, with employment information in the EASR

CONEMP.

9 77 3.1.6

The RFP states, "Final system build just prior to the freeze date must have all available Category I (CAT I) security patches applied…" Not all CAT I patches can be applied depending on their impact to the system.

Recommend changing to, "Final system build just prior to the freeze date must have all available Category I (CAT I) security patches applied or mitigated to a CAT II or III…"

The SOW will be updated related to CAT I, II and III security patches. A Navy Cybersecurity Workforce (CSWF) member will review all compensating measures and will be required to endorse the residual severity determination.

10 77 3.1.6 The last paragraph starting with, "The Contractor shall formally notify…" probably belongs in the 3.1.4 section.

Move the paragraph to 3.1.4. The Government will review the concerns provided from Industry and will update the tasking language where it is deemed appropriate for the RFP.

11 83 3.1.6.7

The RFP states, "When new DISA tools are released, the Contractor shall perform a new vulnerability scan." This is not time‐bound. What timeframe is required for a new vulnerability scan?

Recommend adding "within 90 days." The Government will assess the requirement regarding scan timelines and will update the tasking language where it is deemed appropriate for the RFP.

12 83 3.1.6.7

The RFP states, "The system design and the Contractor's business and engineering processes shall meet all of the cybersecurity controls defined during RMF Process Step 2 except for those controls agreed to as "Not Applicable (N/A)" by the Government Authorizing Official (AO). " Not all Applicable controls can be implemented due to risk, cost, schedule, and technical impact. Any Applicable controls that cannot be met should have their risk mitigated to low through an approved risk mitigation process.

Add, "Any control that is applicable but non‐compliant shall have an acceptable risk mitigation in place as approved by the AO."

The Government concurs with the concept presented from industry and will update the tasking language where it is deemed appropriate. Will be addressed in Final RFP.

13 83 3.1.6.7 The RFP states, "...as well as any Navy supplemental guidance." When will the government provide the supplemental guidance?

Release GFI with updated draft RFP. The Government will clarify the SOW language clarifying guidance in the RFP.

14 87 3.1.6.13

Given this is a Navy program, is compliance with SECNAV M‐5239.2 June 2016 also acceptable?

Add, "DoD 8570.01‐M or SECNAV M‐5239.2" The Government does not concur with the Industry comment that SECNAV M‐5239.2 is equivalent to DoD 8570.01‐M.

15 77 3.1.6

RMF requires the tailoring of the security controls. Given the scale and complexity of NIST 800‐53, the contractor can make assumptions during the RFP phase that can be very different from the expectations of the customer. Is it possible to get a draft copy of a tailored control set to base an estimate off of?

Or a list of required functionality that meets 800‐53 (AV, FIC, FW, IDS, etc.)

Without bounding the tailoring process, it can lead to mismatches between response and expectations

Provide a method to bound the tailoring of NIST 800‐53 for the RFP.

The Government is reviewing the SSDS Cybersecurity Controls. If required, updates will be provided in the RFP.

GOVERNMENT RESPONSES TO SSDS CSEA PRE-SOLICITATION #N00024-17-R-5152

- In the event of a conflict between the RFP and the Government responses to the Draft RFP questions, the RFP will govern.

16 75 3.1.4.2 The incident response paragraph is also covered under compliance to DFARS Cyber Clause of 252.204‐7012. Recommend using compliance with DFARS Cyber Clause of 252.204‐7012 instead of this paragraph.

Recommend using compliance with DFARS Cyber Clause of 252.204‐7012 instead of this paragraph.

The Government will retain the tasking in 3.1.4.2. The tasking is not duplicative, nor contradicting.

17 75 3.1.4.2

The RFP gives a 24 hour turn around time for incident reporting. DFARS Cyber Clause of 252.204‐7012 has a requirement of 72 hours.

Change 24 hours to 72 hours. The Government tasking requires 24 hour reporting requirement to IWS 10 SSDS Program Office. This tasking does not impact or change the requirement as written under DFARS 252.204‐7012.

18 2 ‐ 28/212 B

Should CLINs 0030 ‐ 0059 have the same description as CLINs 0010 ‐ 0029 (Software Life‐Cycle Support)? All LOE CLINs 0010 ‐ 0059 are described as being for SSDS ICS Software Engineering and Support for CVN/Amphib.

Revise description for CLINs 0030 ‐ 0059 to Software Life‐ Cycle Support.

The CLIN descriptions are appropriate, aligning to the identified appropriation.

19 28‐Feb B

LOE CLINs 0010 ‐ 0059 are all for the same tasking "Software Life‐Cycle Support" and should not be separated by color of money. Recommend a more streamlined approach to allow for one CLIN each calendar year for Software Life‐ Cycle Support not tied to the color of money. Therefore, informational numeric SLINs should be utilized in accordance with DFARs 204.7104‐1(a) which is the structure utilized on other similar SEA0251 contracts.

Create one CLIN broken out by year for Software Life‐Cycle Support (i.e. 0010 CY18 LOE Software Life‐Cycle Support;

CY19 LOE Software Life‐Cycle Support and so forth).

The Government will not utilized "Information SLINs."

The Government will review if Priced SLINs/Alpha SLINs provide any advantages or efficiencies.

20 37 ‐ 41 B

Completion CLINs 1010, 1020, 1030, 1040, 1050, 1060, 1070, 1080 and 1090 shouldn’t have hours tied to them as they are completion CLINs.

Revise unit from hours to LO and remove hours from quantity.

CLINs 1010, 1020, 1030, 1040, 1050, 1060, 1070, 1080 and 1090 are placeholders of hours, thus identified as LOE.

The Government intends to convert the LOE hours into completion during out‐year execution. This will be fully articulated in a Special H clause to be provided in the RFP.

21 54 CLIN 0010‐0059

"commercial‐off‐the‐shelf (COTS) hardware obsolescence analysis and sustainment tasks" LOE task is not defined anywhere else in the RFP.

Provide additional detail on COST hardware obsolescence tasks.

The Government draft RFP has several references in the SOW to COTS related tasking.

22 130 Section 3.2.2.8 Will the contractor create and maintain the normal routine of GFP maintenance per requirements of FAR 52.245‐1 or will this be the SSDS TECHREP?

Clarify requirements for GFP maintenance The Government draft RFP SOW accurately reflects the activities expected of the Contractor with respect to GFP maintenance.

23 130 Section 3.2.2.8 Will cables be provided with any of the GFE or will the contractor be required to build cables?

Clarify GFE to include bill or materials The Government will provide the complete GFE list as an attachment to the RFP.

24 75

3.1.4.1 System Security

Program Key personnel are identified but requirements for each position have not been specified.

Provide updated draft RFP with remaining sections for industry comment.

The key personnel information will be provided in the

RFP.

25 113 3.2.2.3.2 Software Metrics Please clarify the meaning of continuous and electronic as it applies to software metrics.

Clarify software build plan and terminology. The Government reviewed the questioned wording and is determined to not required. This section will be updated in the RFP.

26 110

3.2.2.3 Software

Engineering

Section indicates that incremental releases are provided every 6 months but there are also references to builds. Assuming builds occur within an increment.

Releases imply delivery for customer level testing and platform deployment.

Please amplify on the relationship between releases and builds and the formality level associated with each

Clarify software build plan and terminology. The Government will definitively define "Build" and "Release" in the RFP.

27 117

3.2.2.3.10 Software

Resource Library

Second paragraph implies the PSEA will be making changes to a version of the source code separate from the Contractors software resource library. How many source code deliveries from the Government to the Contractor are expected post contract award?

Provide clarification of number for GFI deliveries post award.

The final GFI/GFP list will be provided with the Final RFP.

28 126

3.2.2.6.1 Combat System

Test & Evaluation

Are the terms build and release synonymous? First paragraph defines a much more formal level of government engagement in the testing process associated with a completed build.

Clarify software build plan and terminology. See Action 26.

29 General General

Will technical documentation on the HTI‐12 configuration/design/implementation be provided as part of the RFP? Including s/w deployment diagrams, operating systems configurations and files, network configurations and files, COTS installation instructions, computer user manuals, etc

Provide all HTI‐12 documentation in RFP. A complete list of GFI will be provided in Section J of the

RFP.

30 General General

Will technical documentation on the HTI‐12H configuration/design/implementation be provided as part of the RFP? Including s/w deployment diagrams, operating systems configurations and files, network configurations and files, COTS installation instructions, computer user manuals, etc

Provide all HTI‐12H documentation in RFP. A complete list of GFI will be provided in Section J of the

RFP.

31 General General

Will technical documentation on the HTI‐16 configuration/design/implementation be provided as part of the RFP? Including s/w deployment diagrams, operating systems configurations and files, network configurations and files, COTS installation instructions, computer user manuals, etc

Provide all HTI‐16 documentation in RFP. A complete list of GFI will be provided in Section J of the

RFP.

32 General General

Will technical documentation on the HTI‐16R configuration/design/implementation be provided as part of the RFP? Including s/w deployment diagrams, operating systems configurations and files, network configurations and files, COTS installation instructions, computer user manuals, etc

Provide all HTI‐16R documentation in RFP. A complete list of GFI will be provided in Section J of the

RFP.

33 175

3.3.3.13‐01 "CLIN 1001

End State"

Section 3.3.3.13‐01 CLIN 1001 End State specifies “Develop and incorporate adaptation software for Build 12 to execute on HTI‐12 configuration”. Is the Build 9 SSL source code already compliant with the PLA Component Framework defined by the PEO IWS ADD? If so, to what extent?

Provide all Build 9 Software design documentation in updated draft RFP.

Build 9 is not PLA compliant. The final GFI/GFP list will be provided with the RFP.

34 General General Will technical documentation on the Build 9 SSDS software code base be provided as part of the RFP? Including s/w requirements specifications, software interface specifications, SDDs, SYSML/UML models.

Provide all Build 9 Software design documentation in updated draft RFP.

A complete list of GFI will be provided in Section J of the

RFP.

35 General General Will the Build 9 SSDS source code base be provided as part of the RFP? Including source code, directory structure, build scripts, run scripts, configuration files and build documentation.

Provide all Build 9 source code in updated draft RFP. A complete list of GFI will be provided in Section J of the

RFP.

36 General General

"The Contractor shall work closely with PEO IWS to define network infrastructure upgrades (related to the Navy ships multitude of networks supporting and affecting the Combat Systems equipment, including various designs and levels of interoperability, supportability, security, and maintainability) that provide access to information at multiple levels of classification, provide access to networked distributive and collaborative tools, and distribute raw data as required from systems across infrastructure service and resources to multiple security enclaves." What are the required security levels (enclaves) that need to be supported?

Provide network architecture GFI in updated draft RFP. A complete list of GFI will be provided in Section J of the

RFP.

37 104, 123 3.2.2.2.2, 3.2.2.3.18

Is there a starting point/GFE for the Human‐In‐The Loop (HITL) simulation/test environment as needed to meet various rapid/functional prototyping and human computer/graphical user interface development? If so, please describe functionality, implementation approach, inputs/outputs, simulation protocol and interoperability. How/when can contractors gain access to the HITL environment?

Provide more information on HITL environment. A complete list of GFI will be provided in Section J of the

RFP.

38 123, 139 3.2.2.3.18, 3.3.2.3.3 Please provide more details and/or an example of the expected content for CDRL A056: Human Computer Interface (HCI) Prototypes and Storyboards

Provide updated draft RFP with remaining sections for industry comment.

No additional attachments are to be provided prior to the

RFP

39 111, 139 3.2.2.3.1, 3.3.2.3.4 Please provide any additional information on the types of M&S federations anticipated for SSDS SoS analyses

Provide M&S federation information in updated draft RFP. A complete list of GFI will be provided in Section J of the RFP to include the M&S Strategy and Plan.

Notice Details from

FedBizOpps

Synopsis for Presolicitation

FedBizOpps states any questions and comments that are submitted may be publically released. Is there a way to ask proprietary questions that won't be shared?

Provide methodology for proprietary questions. Proprietary questions will be handled as required. The Contractor will be required to defend the assertion that the question is proprietary upon submission. If an answer to the Industry question can be provided without divulging proprietary aspects, answers will be posted to

FBO.

41 124 3.2.2.4 Please provide a detailed list of users and sites, currently it is open ended with the comment "but not limited to".

Remove "but not limited to." This tasking is under the Level of Effort Section of the SOW. The tasking as written will not be amended.

42 55 1.0

CLINs 1010‐1090 are referenced as being completion however, the top of page 55 states "CLINs 1010 ‐ 1090 are currently identified as LOE Placeholder CLINs that will establish the rates for these future capability improvements". This should be removed since CLINs 1010‐1090 are completion.

Remove LOE language at the top of page 55 for CLINs 1010‐ 1090 since they are completion.

Action Item 20

43 37‐39/212 B CLINs 1010 ‐ 1050 should state CPIF completion. Currently they only say CPIF. Add completion to the CLIN description for CLINs 1010 ‐ 1050.

Action item 20

Notice Details from

FedBizOpps

CSEA Attachments

Will the government release an updated draft to include the remainder of the

RFP?

Provide updated draft RFP with remaining sections for industry comment.

The Government does not plan to release any additional draft RFP versions.

45 202

HQ C‐2‐0037

ORGANIZATIONAL

CONFLICT OF INTEREST

(NAVSEA) (JUL 2000)

It is our understanding paragraph ( e) of this clause applies to government support contractors only and not the prime contractor bidding the work. Please clarify intent of paragraph ( e)of this clause?

Recommend removing paragraph ( e) from the clause. The Government will has noted the comment and will review the NAVSEA Clause prior to the RFP.

46 154 3.3.3.1 Several ACB 20 SSDS ICS capability upgrades are listed including Fire Control Loop Modernization. Clarify the scope of the Fire Control Loop Modernization?

Provide a more detailed definition of the Fire Control Loop systems‐of‐systems ACB 20 upgrade.

Fire Control Loop Modernization tasking will be removed from the RFP.

47 154 3.3.3.1

Paragraph one calls for development of ESSM BLK 2, SEWIP Blk 3, and EASR ACB 20 capabilities in Build 12 on the HTI‐16 configuration. In support of Element‐ level FSIT and FQT with Zero new TRs of any Priority. Clarify the expectation of Zero new TRs?

Clarify that the intent of zero new TRs relates only to the newly integrated ESSM BLK 2, SEWIP Blk 3, and EASR processing in Build 12 software resulting from Element‐ level FSIT and FQT.

As stated in the SOW, TRs arising from capability development or capability implementation under the completion CLINs, to include new code or interaction with existing code will not meet the Government end state.

Zero TRs will be accepted at delivery under the completion CLINs.

48 175 3.3.3.2

Paragraph one calls for adaptation of Build 12 to run on HTI‐12 configuration in support of Element‐level FSIT and FQT with Zero TRs of any Priority. Clarify the expectation of Zero TRs?

Clarify the intent of zero TRs relates only to testing of HTI‐ 12 adaptations to Build 12 software resulting from Element‐ level FSIT and FQT.

As stated in the SOW, TRs arising from capability development or capability implementation under the completion CLINs, to include new code or interaction with existing code will not meet the Government end state.

Zero TRs will be accepted at delivery under the completion CLINs.

49 181 3.3.3.3

Paragraph one calls for adaptation of Build 12 to run on HTI‐12H configuration in support of Element‐level FSIT and FQT with Zero TRs of any Priority. Clarify the expectation of Zero TRs?

Clarify the intent of zero TRs relates only to testing of HTI‐ 12H adaptations to Build 12 software resulting from Element‐level FSIT and FQT.

As stated in the SOW, TRs arising from capability development or capability implementation under the completion CLINs, to include new code or interaction with existing code will not meet the Government end state.

Zero TRs will be accepted at delivery under the completion CLINs.

50 187 3.3.3.4

Paragraph one calls for adaptation of Build 12 to run on HTI‐16TR configuration in support of Element‐level FSIT and FQT with Zero TRs of any Priority. Clarify the expectation of Zero TRs?

Clarify the intent of zero TRs relates only to testing of HTI‐ 16TR adaptations to Build 12 software resulting from Element‐level FSIT and FQT.

As stated in the SOW, TRs arising from capability development or capability implementation under the completion CLINs, to include new code or interaction with existing code will not meet the Government end state.

Zero TRs will be accepted at delivery under the completion CLINs.

51 N/A General What are the anticipated dates for: draft RFP containing sections L&M; final RFP; submissions due; contract award?

Please clarify. The Government is not planning to release another version of the Draft RFP. All sections of the contract will be provided in the RPF.

52 N/A Sol, Important note;

TOUA encl 1

The solicitation states classified data will be provided in Bidder's library on NSERC website. TOUA states Classified data will be provided on CD via FedEx.

Please clarify. Is there a classified Bidder's library in addition to the un‐class library?

Classified documentation will be provided via CD/DVD, delivered in accordance with the TOUA. There will not be a Classified NSERC website. The SOW will be amended for the RFP.

53 N/A DD‐254

DD‐254 states Contractor will require access to SIPRNet. Please describe the requirements for electronic proposal submission of classified volumes.

Please clarify. The Government does not see any connection to the SIPRnet requirement in the SOW and Contractor proposal submission.

45 ; 36 ‐

39.

HQ B‐2‐0023

CLINS 1001, 1002, 1003, 1010, 1020, 1030, 1040 are listed as "CPIF Completion" on pg 45. On pages 36 ‐ 39 these CLINs state "CPIF".

Please correct CLINs 1000, 1001, 1002, 1003, 1010 ‐ 1090 shall be considered completion in execution. CLINs 1010, 1020, 1030, 1040, 1050, 1060, 1070, 1080 and 1090 are placeholders for hours, thus identified as LOE. The Government intends to convert the LOE hours into completion during out‐year execution. This will be fully articulated in a Special H clause to be provided in the RFP.

55 90 3.1 To enable the contractor to properly scope the facilities, please explain the governments requirements for baselines under development, sustainment and test at any given time?

Please clarify The Bidder Library provides parametrics needed to establish the facility requirements.

56 100 3.2.1 Will models and simulations currently produced at government expense, be transitioned to a new vendor? Please identify the models and simulations, and their computing requirements.

Please clarify A complete list of GFI will be provided in Section J of the

RFP.

57 100 3.2.1 ‐ 2nd bullet Please describe the modeling and simulation effort required in support of the USN systems engineering for end‐to‐end combat system performance analysis

Please clarify The Contractor will support the IWS 10 M&S WG in accordance with the Technical Instructions of the contract.

58 102 3.2.1 (first bullet on page) Please describe the plan for transitioning completed Builds 9, 10, 11 and any initial work performed on build 12 to the new CSEA contractor?

Please clarify A complete list of GFI will be provided in Section J of the

RFP.

59 119 3.2.2.3.12 Please provide a list of all the GFE that will be provided for use in the facility for development and sustainment of the software

Please clarify A complete list of GFI will be provided in Section J of the

RFP.

60 119 3.2.2.3.12 For all GFE described above, please provide Size, Water and Power requirements for all systems. IF there are any radiation requirements, please provide all emission data

Please clarify A complete list of GFI will be provided in Section J of the

RFP.

61 154 3.3.3 Table 2 specifies required delivery dates for CLINS 1000 to 1003. Would the government please clarify if these dates represent delivery to LBTS, the ship or something else?

Please clarify Deliveries identified in Table 2 are contractual deliverables/CDRLs to be developed and delivered in accordance and as instructed in the DD 1423.

62 N/A General

The draft material released on FedBizOpps only included Sections B, C, and F. Please provide the balance of the draft RFP material, or at a minimum Sections H, I, L, and M, the DD1423 CDRL list in its entirety, and the GFE/GFI schedule, as soon as possible so a complete, comprehensive review of the package can be completed

The Government will not provide additional sections in draft. All sections of the contract will be provided in the

RFP.

63 6 Section B CLIN 0017 identifies a quantity of 3,752 Hours in the header line but 3,517 Man‐ hours later under the Option Year information.

Please advise which quantity is correct. The correct value is 3,752. The error has been noted and the final quantity of hours will be provided in the RFP.

64 36‐37 Section B CLINs 1001, 1002, and 1003 have Period of Performance start dates of 1 January 2021 per Section F. If these start dates are correct, should these be marked as Options in Section B?

Please clarify if CLINs 1001, 1002, and 1003 are Option CLINs.

CLINs 1001 through 1003 are options. The exercise date and period of performance will be provided in the RFP.

65 37‐41 Section B

In Section B, CLINs 1010 through 1040, all of these are noted as "CPIF". For CLINS 1050 through 1090, this changes to "Option ‐ CPIF ‐ Completion".

Please clarify the Government's intent in making this change in definition. The implications are unclear and could result in inaccurate response to the Government's requirements

Clarifications will be provided in the RFP. For additional explanation, see Action 23.

66 63 Section C, 2.11 e.

The DD254 doesn't have the non‐SCI Intel Info box checked (10 e. (2)) but page 63 requires it. Will the Navy provide an updated DD254 to support receipt of the documents requested per Section C, Paragraph 2.11 (e)?

Recommend that Box 10 e. (2) on DD254 be checked and DD254 re‐issued.

The SOW will be amended in the RFP, conforming to the

DD 254.

67 69 Section C, 3.1.1.5

The Section C paragraph states that both the preliminary and final data packages to support presentations or meetings are due five (5) business days before the event. Please clarify which type of data package is due five (5) days before the event

Recommend delivery of a draft data package five (5) days before a planned event is preferred as it allows for updates to the presentation to reflect the most current status.

Documents will be developed and delivered in accordance with the applicable CDRL. Preliminary delivery timeframe will be amended in the RFP.

68 N/A Section C CDRLs A001, A028, and A034 are not listed in any Section C paragraph. Please confirm these CDRLs are intentionally not used. Concur. In the Draft RFP, the numbering of the CDRLs has not been adjusted to remove "reserved CDRLs." Update will be made to the RFP.

69 N/A DD254

The provided DD254 references solicitation number N00024‐16‐NR‐41773, which is neither the solicitation number related to SSDS or a valid number in FedBizOpps.

Please provide an update DD254 referencing solicitation N00024‐17‐R‐5152, which is the number associated with the SSDS effort.

Noted. The DD 254 Solicitation Number is an Internal NAVSEA tracking number.

70 3.2.2.2.3

The FBO announcement for PSEA contract extension (N00024‐14‐R‐5128) indicates that a 12 month transition period to the CSEA Contract awardee is anticipated. Additionally, it tasks the PSEA contractor with actions that may require retention of GFX. Execution of software development under the CSEA contract requires GFX to be available. Please identify the GFX that will be available for transition immediately upon contract award, and identify any GFX that would be delayed or not be available during the anticipated transition i d?

Please clarify The Government is aware of these concerns. A complete list of GFI will be provided in Section J of the RFP.

71 FBO Announcement Is it safe to assume that all PSEA tasking is subsumed into the CSEA contract at the end of the transition period?

Please clarify The CSEA tasking is described in the SOW.

72 3.3.2

Various topics in the Common Tasks for all completion tasks refer performing tasks on SSDS, such as conducting performance analysis (page 133). Guidance is given to refer to the TRM for scope, and the SETR events are listed in CLIN 1000 for EASR, SEWIP, and ESSM BLK2 integration into SSDS. The completion tasks in CLIN 1000 are each very specific to integration of a new combat system element / weapon with SSDS. It is unclear throughout the RFP when the term "SSDS" is actually referring to the Integrated Combat System for the various ship classes.

Clarify where tasks apply to the entire ICS or to just to SSDS. For those areas where the intent is to address ICS engineering tasks via future LOE tasking, recommend creating non‐costed technical questions that allow Offerors to demonstrate the depth of their expertise. For example, the RFP doesn't explicitly state that integration of SEWIP into SSDS involves inter‐element integration with EASR.

The references to SSDS in the RFP will be clarified to either indicate ICS or Element level.

73 L / M How does the Government intend to evaluate a program transition between contractors?

All evaluation criteria will be provided in RFP.

74 Section C, 3.3.3

Table 2. Completion Task Target Dates do not reference CVN79. Will EASR Variant 2 be included in the completion task CLIN 1000 as its development is within the POP of CLIN 1000?

Recommend the Navy add EASR V2 and CVN 79 work to CLIN 1000 to mitigate risk of on time delivery and maximize commonality between EASR V1 and V2 implementations

Government acknowledges your concern. The Table will be updated in the RFP.

Recommend that the Navy establish Option CLINs with scope supporting explicit performance thresholds for cyber survivability (cyber resilience) as a sub component of a survivability KPP. The CSEA should help to establish these thresholds during architecture development, if they don't already exist, and then conduct measurements during DT&E to ensure that acceptable, possibly degraded, levels of performance are maintained when operating in a cyber contested environment. Use of Option CLINs allows the Navy to proceed with these requirements as needs dictate and funding is available.

Recommend adding the following requirements, derived in part from Cyber Resilience for the U.S. Surface Navy (September, 2016) by John’s Hopkins APL, to the draft RFP.

Explicit performance thresholds for cyber survivability should be established during contract execution.

• In addition to basic security hygiene, SSDS electronic systems, including hardware, firmware, software and communications links, shall be made resilient against cyber‐ attacks that leak through boundary controllers and other prevention mechanisms.

• The SSDS shall be capable of surviving cyber‐attacks and completing its mission with an availability and reliability in accordance with the overall SSDS mission availability and reliability.

• The SSDS shall monitor system operational performance, and cyber indications and warnings, in real‐time or near real‐time, and correlate this information to create a real‐ time cyber situational awareness for the purpose of providing commanders informed options to respond to cyber events and continue the mission successfully.

• The SSDS and CSEA shall correlate information from monitoring physical, cyber, and supply chain activities to achieve integrated, organization‐wide situational awareness.

• The Contractor shall conduct a Cyber Vulnerability Assessment (CVA) of SSDS to identify potential threat vectors and system vulnerabilities. The CVA shall include adversarial red‐team testing to levels required by DT/OT&E cyber requirements (Gilmore Memo 2014).

75 Section C, 3.1.6.2

Performance thresholds for cyber survivability are not addressed. Comment Noted. Changes, if required, will be addressed in the RFP.