N00024-17-R-5152_-_CSEA_Offeror_Questions_11-21-17.pdf

Tracker # Page # Section/ Paragraph Question/Comment Proposed Action/Change Answer

Section C, P.88 and Section L. P.309

L.4.3.4

Section C states "the Contractor shall document and implement a cybersecurity program within a Cybersecurity Implementation Plan (an annex of the PPIP)". Section L requires delivery of a draft Program Protection Implementation Plan (PPIP) with no mention of the Cybersecurity Plan. Is the Cybersecurity Implementation Plan annex a required deliverable with the proposal?

The Offeror shall provide a draft cybersecurity program within a Cybersecurity Implementation Plan (an annex of the PPIP) in Section L, paragraph 4.3.4, where application developers, network architects and related elements collaborate to determine the required user and process privileges and network access controls, while enforcing the principle of least privileges. The Offeror's draft Cybersecurity Implementation Plan shall address supply chain integrity to include anti‐tamper measures to be implemented.

Section C, P.144‐145 and Section L. P.298

Section C.3.2.2.9 and Section L.4.1.1.i.b and c.

The Section L paragraphs require, under completion tasking for CLIN 1000:

‐ supporting multiple SSDS Builds, ‐ approach to de‐conflicting site resources, ‐ coordinating site usage and ‐ providing a facility approach to supporting multiple SSDS test strings.

C.3.2.2.9 appears to be the SOW requirements for these types of tasks. This SOW paragraph is under LOE tasking.

As it appears that L.4.1.1.i.b and c are LOE efforts, the recommendation is to move L.4.1.1.i.b and c. to subparagraphs under L.4.1.5.d

The Government has considered the recommendation and has moved L‐4.1.1.i.b and c. to subparagraphs under L.4.1.5.d

3 Section L, P.311 and P.338 Section L.4.3.8; Appendix 4 to Section L

Appendix 4 is labeled "Sample Staffing Plan". It contains columns Labeled "Base Year", "Option Year 1", "Option Year 2", "Award Term Year 1", and "Award Term Year 2". As this effort is not for an award term contract, the contractor assumes these columns are mislabeled.

Please clarify the contents of Appendix 4 by re‐labeling the columns to be consistent with the requirements of Section L.4.3.8

The Government has considered the recommendation and has re‐labeled the columns to be consistent with the requirements of Section L.4.3.8.

4 Section C, P.152 Section C, 3.3.2.4, 2nd paragraph from bottom of page.

The paragraph states: "The Contractor shall deliver the completed software to the Government as iterative releases based on the completion effort as assigned, followed by a final system delivery after successful system level testing efforts."

Please confirm that "System Level Testing" refers to FQT.

The CSEA shall deliver SSDS Element software (CDRL A018) to the Navy as iterative deliveries, followed by a final system delivery after successful testing leading into CST efforts.

5 Section C, P.152 Section C, 3.3.2.4, 2nd paragraph from bottom of page.

The paragraph states: "The Contractor shall deliver the completed software to the Government as iterative releases based on the completion effort as assigned, followed by a final system delivery after successful system level testing efforts. The Contractor shall provide evaluation of test results, investigation of noted discrepancies, and corrective actions to resolve problems. The Contractor shall deliver final SSDS Element software free of Consequence Level 1 and Consequence Level 2 TRs."

1. Consistent with changes made to completion criteria regarding TRs in Section 3.3.3.1, 1), recommend last sentence state "The Contractor shall deliver final SSDS Element software free of new Consequence Level 1 and Consequence Level 2 TRs."

2. This requirement is stated in terms of consequence level, so is not consistent with Section C.3.3.3.1 criteria which are stated in terms of risk assessment level (R1, R2, R3, R4). As stated in C.3.3.2.4, the Consequence level 1 and 2 criteria excludes some R2 TRs and includes some R3 TRs. Would the government clarify how the contractor is to interpret the two sets of criteria?

The Government has considered the recommendation and has revised Section C to remove the term "consequence level" and replaced with "Risk Assessment levels" in the referenced paragraph.

- In the event of a conflict between the RFP and the Government responses to the Draft RFP questions, the RFP will govern.

- Answers to classified questions, if not addressed below, will be included with the release of the RFP

GOVERNMENT RESPONSES TO SSDS CSEA SOLICITATION #N00024-17-R-5152

COMMENTS/QUESTIONS

6 Section C, P.161 Section C, 3.3.2.4.12, 3rd paragraph

The paragraph states: "...The Contractor shall ensure the final 2 builds, including the last deliverable build, pass full 25‐ hour Element‐level endurance testing without any Severity 1 or Severity 2 trouble incidents and meet the requirements of the PEO IWS INST 4731.1 for testing, stress testing, and free play testing."

The term severity is ambiguous. Will the government confirm that severity refers to the risk assessment level, consistent with the definition stated in 3.3.2.4.11: "...Risk Assessment levels for the software shall be identified as R1, R2, R3 or R4, from the most to least severe defects, respectively."?

The Government has considered the recommendation and has revised Section C to remove the term "severity" and replaced with "Risk Assessment levels" in the referenced paragraph.

7 Section C, P.130 and P.161 Section C, 3.2.2.4.8, 2nd paragraph and Section C, 3.3.2.4.12, 3rd paragraph

3.2.2.4.8 paragraph states: "The Contractor shall ensure the CDRL build, passes both a 13 hour stress test and a full 25‐ hour Element‐level endurance testing (these tests identified in PEO IWS INST 4731.1) without any Risk Assessment level TRs."

3.3.2.4.12 paragraph states: "...The Contractor shall ensure the final 2 builds, including the last deliverable build, pass full 25‐hour Element‐level endurance testing without any Severity 1 or Severity 2 trouble incidents and meet the requirements of the PEO IWS INST 4731.1 for testing, stress testing, and free play testing."

Recommend 3.2.2.4.8 use the 3.3.2.4.12 requirement:

"without any Severity 1 or Severity 2 trouble incidents" for consistency.

The Government has revised Section C to elaborate the Risk Assessment levels in Section C, paragraph 3.2.2.4.8 and remove the term "severity" and replaced with "Risk Assessment levels" in Section C, paragraph 3.3.2.4.12.

Bidder Library, CVN‐72 LHD‐

2 LHD‐6 LPD‐23 LHD 3 LHA

6 ‐ future sensor‐weapons configs.xlsx

All Tabs This file does not appear to have the configurations for the ships LPD‐29, CVN‐79 and LHA‐8 required by CLIN 1000

Please provide configurations for the first three ship configurations required by CLIN 1000

The files are in "SSDS ICS Architecture Diagrams (POR and RnO) ‐ 2017 09 14.zip"

Bidder Library, CVN‐72 LHD‐

2 LHD‐6 LPD‐23 LHD 3 LHA

6 ‐ future sensor‐weapons configs.xlsx

LHA‐6 Tab The LHA‐6 tab appears to be empty Please populate the LHA‐6 tab

The file has been replaced with "CVN‐72 LHD‐2 LHD‐6 LPD‐23 LHD‐3 ‐ Elements.xlsx" in the Bidder Library.

Section C, P.170, P.191, P.197

Section C, 3.3.3.1, 3.3.3.2, 3.3.3.3

Software Adaptation from HTI‐16 (CLIN 1000) to HTI‐ 12/12H/16TR (CLIN 1001/2/3) will be heavily impacted by Operating System and other HTI software component differences. The bidder library contains listings and descriptions of HTI hardware components, but not the OS and software that is part of the HTI baseline. Will the government provide details of OS and software components that are included in the HTI‐16, HTI‐12, HTI‐12H, and HTI‐ 16TR baselines?

The HTI‐12 and HTI‐12H are running with Red Hat Linux 5.

HTI‐16 is running with RedHawk Linux 7. The software components are similar to Build 10 provided in the Bidder Library with exceptions to ship specific software components (e.g. DBR related software components are applicable only to

CVN 78).

Bidder Library, ACB20 ICS SEP Rev 0(a), P10

Table 1.5‐1 Applicable Documents

The ACB20 SEP references four Integration Concept Memos:

Integration Concept Memo for Cybersecurity ‐ Draft, Integration Concept Memo for EASR Doctrine/Control ‐ Draft, Integration Concept Memo for ACB20 Integrated Training ‐ Draft, and Integration Concept Memo for SEWIP Blk3 HK/SK Coordination ‐ Draft.

Please provide a copy of the following: Integration Concept Memo for Cybersecurity ‐ Draft, Integration Concept Memo for EASR Doctrine/Control ‐ Draft, Integration Concept Memo for ACB20 Integrated Training ‐ Draft, and Integration Concept Memo for SEWIP Blk3 HK/SK Coordination ‐ Draft.

The Government has provided the files "SSDSICS‐COI‐001 FCLIP Ph2 CIWS Integration COI Rev E 23‐Sep‐2016.docx;

SSDSICS‐COI‐002 FCLIP Ph2 Mk9 MTT COI Rev F 23‐Sep‐ 2016.docx; SSDSICS‐COI‐003 FCLIP Ph2 ESSM 2T Uplink COI Rev G 21‐Sep‐2016.docx; SSDSICS‐COI‐004 FCLIP Ph2 Weapon Scheduler Improvements COI Rev 5.4 22‐Sep‐ 2016.docx; and SSDSICS‐COI‐005 FCLIP Ph2 RAM Blk2A Integration COI Rev G 28‐Oct‐2016.docx" in Bidder Library on 8/16/17.

Section C, P. 132 and J‐08 ‐

GFI

Section C, 3.2.2.4.10, 3rd paragraph

The paragraph states: "The Contractor shall maintain a software resource library based upon the Government delivery of the currently used source code (at contract award), common tool sets, documentation, etc."

The J‐08 GFI list includes only Build 6.

Please modify the GFI to add source code for "currently used source code" (Builds 9, 10 and 11) along with the build and deployment instructions for all of the Builds (6, 9, 10 and 11) at contract award.

The Government will provide incremental VOB releases that include all necessary builds. Build 6 information was originally intended for CLIN 1004.

13 Bidder Library

Risk Management Framework (RMF) profiles PEO IWS Combat System RMF Profile v60.xlsx

Risk Management Framework (RMF) profiles PEO IWS Combat System RMF Profile v60.xlsx was posted on 9/28/2017. We are unable to find this document

Please clarify the instruction.

The Government has provided the file in the Bidder Library.

14 Section C, P.171 Section C, 3.3.3.1 The section refers to FQT, CST and TAAF

Please provide notional durations and number of expected support personnel for each event. Non‐ incumbents are at a disadvantage without such information.

The CSEA shall determine the applicable duration and appropriate support personnel to meet the requirements in solicitation.

8/30/17 Tracker # 46 Response; Section B, Note A, P.46

Section B, Note A

Note A and the Tracker # 46 response both require bidders to fill in the "Price Group" and "Estimated Total Price" blocks for the CDRLs. Section L does not mention nor require delivery of Exhibit A, DD Form 1423 CDRLs.

Please delete Note A or modify Section L to provide instructions for the delivery of the CDRLs with the completed "Price Group" and "Estimated Total Price".

The Government has reviewed the recommendation and has no intentions to make any revisions. For the purposes of the proposal, the Offeror shall complete the "Price Group" and "Estimated Total Price" in accordance with DFARS 215.470 for CLINs 1000, 1001, and 1002

Bidder Library GFI None of the technical manuals in the Bidder's Library are in the S1000D IETM format. It is unclear which documents are to be updated in the S1000D IETM format.

It is requested that the Government provide a list of those manuals and the CDRLs they are to be delivered under.

The solicitation states, "SSDS technical manuals shall be developed in accordance with the SSDS Technical Manual Contract Requirements (TMCR) provided as GFI for each SSDS baseline, S1000D as applicable, and the SSDS Style Guides (e.g., an S1000D IETM Development Style Guide in Table 2.10).

The Contractor shall ensure that upgrades make maximum use of existing manuals."

Various SOW, paragraphs 3.2.2.3.7, 3.2.2.3.8, 3.3.2.3.2, and 3.3.3.x.x (various)

The listed paragraphs detail Contractor tasks regarding updates to existing training materials and technical documentation. The Contractor assumes that any existing training materials and technical documentation will be provided as GFI, in formats agreed to between the Government and the Contractor.

The Contractor recommends adding a new sentence to the listed paragraphs that reads, "The existing products to be updated will be provided as GFI at CLIN or TI award, as applicable."

The Government will provide existing training materials and technical documentation for the CSEA to update.

J‐09 GFP GFP The Government’s response to Amendment 2, question 166 in relation to an EASR emulator, indicates that the J‐09 GFP list is comprehensive. The Offeror is seeking to better understand the functionality of the Enterprise Air Surveillance Radar Simulator referenced in J‐09 – GFP. Does this system have emulator functionality similar to the AN/SPY‐6 EDM Emulator, or it is a simulator tool similar to the AN/SPY‐6 RAMS model?

Please provide definition of the EASR Emulator. EASR has both a hardware Emulator and a software Simulator. The Government is currently only providing the EASR Simulator as software.

Section C, p.132 & 158 Section 3.2.2.4.10 and 3.3.2.4.7

Third paragraph of Section 3.2.2.4.10 states "The Contractor shall maintain a software resource library based upon the Government delivery of the currently used source code (at contract award), common tool sets, documentation, etc.

Subsequent Government deliveries/drops of source code has additional changes (e.g., PSEA developed TR fixes and additional capability already integrated), the Contractor’s responsibility shall be to merge the changes into their software resource library environment.".

Third paragraph of 3.3.2.4.7 states "The Contractor shall develop their version of the software resource library based upon the Government delivery of the currently used source code (at contract award), common tool sets, documentation, etc.

Subsequent Government deliveries/drops of source code has additional changes (e.g., developed TR fixes and more capability already integrated), shall be the Contractor’s responsibility to merge the changes into their software resource library environment." This paragraph suggests we are getting an updated source code delivery at contract award however there is nothing listed in the GFI attachment regarding a source code delivery of an updated Build 10.X or Build 11.X.

Please clarify whether a Build will be provided at contract award. If yes, will Build 10 or Build 11 be provided?

Respectfully request items to be added to the GFI list with anticipated drop dates for subsequent SSDS deliveries.

The Government will provide incremental VOB releases that include all necessary builds.

Section C, p. 84 3.1.4.2 First paragraph of Section 3.1.4.2 states “Contractor Information System (IS)/networks involved in the development or operation of systems shall be configured and operated in accordance with controlling laws, regulations, and DoD policy (e.g., FIPS PUB 140‐2, DoDI 8520.02, SECNAV M‐5510.36, SECNAVINST 5510.36A) and all Cybersecurity Assessment and Authorization (A&A) requirements are applicable to the Contractor's IS/networks that receive, process, display, store, or transmit DoD information". As written, this is an unbounded requirement.

Recommend revising paragraph to "Covered Contractor Information System (IS)/networks involved in the development or operation of systems shall be configured and operated in accordance with DFARS 252.204‐7012."

The Government has reviewed the recommendation and has revised Section C, paragraph 3.1.4.2 to: "The Contractor shall maintain all development, test, and production Information Systems (IS) in accordance with (IAW) DoD 5220.22‐M

NATIONAL INDUSTRIAL SECURITY PROGRAM OPERATING

MANUAL (NISPOM) and DFARS Clause 252‐204‐7012 Safeguarding Covered Defense Information and Cyber Incident Reporting."

J‐09 GFP list J‐09 GFP list The GFP includes a MK29 ENVIRONMENTAL UNIT SIM, GMLS MOD 5 DUAL NATO SIMULATOR. In accordance with the TBD, ESSM Blk 2 requires a GMLS MOD 6 to support full capability.

Add a MK29 ENVIRONMENTAL UNIT SIM, GMLS MOD 6 DUAL NATO SIMULATOR to the GFP.

The Government does not currently have the requested materials. The provided list of GFI and GFP in the Solicitation is comprehensive. No additional GFI or GFP amendments are intended to be provided.

Section C, p. 180 3.3.3.1.2.2.2 (b) We have identified additional GFE required as follows:

1. NSPO‐E, Attachment A, Interface Requirements Specification for the Evolved SEASPARROW Missile Launcher Umbilical, 7 July 2008

2. WS35676 NATO SEASPARROW Surface Missile System (NSSMS) to Evolved SEASPARROW Missile (ESSM) Post Launch Continuous Wave Interface Document (NSPO‐ CW), Rev 3, Feb 2014

3. Radio Frequency Interface Control Document for an In‐ flight ESSM using JUWL Midcourse Guidance, December

Respectfully request these items be added to the J‐08. The Government does not currently have the requested materials. The provided list of GFI and GFP in the Solicitation is comprehensive. No additional GFI or GFP amendments are intended to be provided.

SF33

SF33, Block 9 The Government released additional information to the Bidder Library and provided updated CAP and GFP attachments on 26 October 2017.

Please extend the proposal due date to 22 December 2017 to allow the contractor time to address the changes.

The Government has decided to extend the proposal due date to 14 December 2017.

Appendix 5 to Section L Appendix 5 to Section L, Tab L‐J

Non‐incumbents will have transition costs that are contained in CLIN 1000. Transition management will require senior personnel. The RFP pricing tables require that the CLIN 1000 and 1001 labor mix be used for pricing the subsequent nine completion option CLINs. This methodology compounds the impact of the transition and places non‐incumbents at a price disadvantage across the entire program instead of only the first year during this transition.

The contractor requests that non‐recurring costs associated with transition efforts be excluded from the calculation of CLIN 1010 ‐ 1090 costs by creating a separate CLIN for non‐recurring transition costs.

Please provide no later than 1 December to allow the contractor to deliver the proposal by 22 December.

The Government has reviewed the recommendation and has no intention to revise Section L.

Section C, P. 170 Section C, 3.3.3.1

The Government states in the October 27 responses to Bidder Questions, New Tracking Number 1, that they will provide Build 11 when available. The RFP requires “The Contractor shall develop and incorporate ACB 20 capabilities of ESSM BLK 2, SEWIP BLK 3 and EASR on HTI‐16 configuration leveraging on Build 11.” Build 11 capabilities are not defined, only the incumbent has insight into the software changes. Non‐incumbents are required to provide completion pricing for the development leveraging a software build that is unknown to them. Build 11 is also not in the GFI list. Initial delivery of the Build 12 EASR engineering load is less than one year after contract award.

The lack of information makes the pricing risk for non‐ incumbents very high. The Government’s lack of commitment to provide the date of delivery of Build 11 makes the schedule risk for non‐incumbents very high.

We recommend that the Government restate the requirement to leverage build 10.10.4 which has been provided in th Bidder Library as follows: "The Contractor shall develop and incorporate ACB 20 capabilities of ESSM BLK 2, SEWIP BLK 3 and EASR on HTI‐16 configuration leveraging on Build 10.10.4, inserting these capabilities into the software resource library, and deliver a Build 12 running on HTI‐16."

This will allow non‐incumbents to bid from a known baseline.

Please provide no later than 1 December to allow the contractor to deliver the proposal by 22 December.

The Government has reviewed the recommendation and has no intention to revise Section C. Build 11 will be provided when available.

Section L, Appendix 5 CSEA Cost Table

Section L, Appendix 5 CSEA Cost Table

Does the Government intend for Offerors to provide printouts of "CSEA Cost Table?" This document will be very voluminous.

Please provide direction. Recommend the Government not require printouts of this document due to volume.

The Government has reviewed the recommendation.

Offerors shall only include one (1) print out of the CSEA cost table in the one master version hard copy proposal. Offerors are reminded the soft copy submissions of the CSEA Cost Table shall tie to the Offeror's proposed Section B.