N00024-19-R-5393BiddersQ&ADate07.11.2019.xlsx
XLSX spreadsheet 21 KB Posted
- Solicitation number
- N00024-19-R-5393
About this file
This document contains questions and answers regarding solicitation number N00024-19-R-5393 for MK 41 Vertical Launching System (VLS) Design Agent Engineering Services. The solicitation will result in award of two separate contracts for mechanical and electronic requirements. Key details include clarification that the recency period for past performance is five years; confirmation of labor CLIN hours and addition of missing CLIN 0011; and updates to various sections and tables to correct discrepancies in labor hours and references. Cybersecurity requirements are also addressed. The Navy provided responses to ensure offerors have the necessary information and documentation to submit proposals by the specified due date.
Government responses to bidders' questions.
View the file
Other files
Show all 12
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Sheet1
| Number | Question: | Government Response |
| 1 | Please clarify if that the recency of Past Performance efforts is either five (5) years as stated in Section L of the RFP or three (3) years as stated in Section M? | Sections M 2.3 and 5.3 have been updated in the Solicitation Amendment 00001 to reflect a Past Performance recency requirement of 5 years. |
| 2 | It appears that CLIN 0011 is missing from the list of labor CLINs. Please verify. | Section L 3.5.1 has been updated in the Solicitation Amendment 00001 to include CLIN 0011. |
| 3 | What is the Navy's LSA tool of preference (PowerLog, EAGLE, etc) or is it Contractor preference? | The Government is not considering changing Section C or Section L to include LSA tool preference of this solicitation at this time. |
| 4 | In Section M (page 261 & 268 paragraph 3) the RFP states we will be evaluated on the total cost/price provided by the Navy, which matches the NTE values they provided. However, in Section L, it states that “The Navy’s unburdened estimate for incidental material and travel ODC estimates for the entire performance period is as identified in paragraph 5.5.3 below. The Navy’s unburdened estimate must be correctly burdened and then included in Section B of the offer for all applicable CLINs and applicable/proposed in directs should be clearly identifiable under Section B.” |
| Since we will be burdening their travel estimate, should the Navy’s evaluated price contain the burdens in it? | Sections M 2.4 and 5.4 have been updated in the Solicitation Amendment 00001 to reflect total cost/price evaluation based on the total cost/price provided by the navy and burdened by the offeror. | ||
| 5 | Requirements within Section L outline Page Size and Formatting requirements, specifically a 12 Point Font. Is this requirement applicable to the documents provided by the Navy within the solicitation and to be returned by the Offeror? If yes, does the Navy want the Offeror to amend the Font and size of font on these documents for the purpose of returning the sections within the Offeror's cost volume? | Sections L 2.4 and 5.4 has been updated in the Solicitation Amendment 00001 to clarify that the 12 point font requirement is not applicable to any Government provided documents. | |
| 6 | Section C, Section 3.6, seeks to impose cybersecurity obligations on contractors and their unclassified networks that are inconsistent with DFARS 252.204-7012, SAFEGUARDING COVERED DEFENSE INFORMATION AND CYBER INCIDENT REPORTING (OCT 2016), and shall be collectively referred to herein as the “Enhanced Cyber Requirements.” As part of these ongoing discussions with the Department of Defense (DoD), including the services and various agencies, and the Defense Industry Base (DIB), the industry is awaiting further guidance. Given the active, ongoing, and collaborative discussions with Navy leadership and Industry, the Offeror would request the removal of the inconsistent cyber requirement from the solicitation. In lieu of the complete removal of the requirement, the Offeror agrees to collaboration with NCIS on outreach efforts. | The Government is not considering changing the Section C 3.6 cybersecurity requirements of this solicitation at this time. | |
| 7 | Within Section L, Paragraph 3.5.4, Element 4: Sustaining Cost Information, the Navy is requesting the Offeror "provide a screen-capture (or equivalent) from the employer's payroll system for each current employee, Key and non-Key, named in the Offeror's Staffing Plan". The Offeror is respectfully requesting additional rationale to the applicability of this requirement within the solicitation. |
Within this aspect, the Offeror utilizes an approved estimating system compliant with all applicable rules and regulations imposed by the federal government. The estimating system also provides a framework for the basis and development of consistent, reliable, and auditable cost estimates, which comply with customer requirements, federal regulations, internal policies, and practices.
Supporting this solicitation using labor estimates other than what is included in our proposal is not consistent with our approved estimating system and our policies and procedures. Hence, the reported actual average rates for each category would provide a better source of cost realism than screen shots of employee pay statements.
| In order to remain consistent and compliant with the disclosure statement, our approved estimating system, Complaint Cost and Pricing Data, FAR Part 15.404-1 and 15.404-2, and federal personal privacy regulations, please explain the governments rationale in including the requirement for the Offeror to provide in its cost realism analysis. | The Government is not considering changing the Section L 3.5.4 Element 4 Sustaining Cost Information requirements of this solicitation at this time. | |
| 8 | There appears to be a slight discrepancy between the hours listed in RFP Section B and Section L tables L-1 and L-2. Please verify that the Section L numbers are the ones to bid in a corrected Section B. |
Section B for CLINs 0011, 0111, 0211, 0311, and 0411 have listed 17,300 hours each. In table L-1 for those same CLINs the hours listed is 17,302.
Section B for CLINs 1011, 1111, 1211, 1311, and 1411 have listed 8,900 hours each. In table L-2 for those same CLINs the hours listed is 8,902.
| Section B for CLINs 1020, 1120, 1220, 1320, and 1420 have listed 17,900 hours each. In table L-2 for those same CLINs the hours listed is 17,902. | Section B hours listed for each CLIN have been updated in the Solicitation Amendment 00001 to be consistent with the hours listed for each CLIN in Section L Tables L-1 and L-2. | |
| 9 | Section C Item 0010 Depot Facility Non-Recurring Establishment directs the requirement to establish and staff a VLS depot facility to accomplish the Depot Operations tasks specified in Section C under Electronic Systems Design Agent CLINs 0011, 0111, 0211, 0311 and 0411. However, there is not an equivalent Depot Facility Non-Recurring Establishment CLIN to support the Mechanical Systems Design Agent CLINs to support Depot Operations Services for Canisters & Handling in Section C Items 1011, 1111, 1211, 1311, 1411. |
| Please verify if the Offeror should include Depot Facility Non-Recurring Establishment item in support of Depot Operations Services - Canister & Handling Items 1011, 1111, 1211, 1311, 1411, for the Facility, Government Property Inventory, Government Property Test Equipment & Tools. | CLIN 0010 has been removed throughout Solicitation Amendment 00001. CLINs 0011 and 1011 have increased hours in Sections B and L as well as revised Section C SOW to cover the non-recurring depot establishment. | ||
| 10 | Subsection 5.5.1, paragraph (b) states: "The Government's unburdened estimate must be correctly burdened and then included in Section B of the offer…" This contradicts Section M, Paragraph 5, Section 5.4 (p. 268) (3) Total Evaluated Cost/Price to the Government for Travel which provides the unburdened travel amount of $16,959,953. Please clarify how the USG will calculate the Total Evaluated Cost/Price for Travel. | See response to question in cell C5 above. | |
| 11 | In subsection 3.6.1 (p. 86), the first sentence of this paragraph provides as follows: “The contractor consents to installation by the Naval Criminal Investigative Service (NCIS) of network sensors, owned and maintained by NCIS, on the contractor's CCIS or other information technology assets when intelligence indicates a vulnerability or a potential vulnerability for the duration of the contract performance period.” |
This requirement does not fall within the DFARS 252.204-7012 and NIST SP 800-171R1 set of cybersecurity requirements for defense contractors. The sentence and is vague and subjective with no set of defined adherence requirements. In trying to understand this potentially unbounded requirement, we have the following questions:
1. What would trigger a finding of a “vulnerability or a potential vulnerability”?
2. Who would make the determination that a “vulnerability or a potential vulnerability” exists and what standards would be used to make that determination?
3. Would that determination be shared with the contractor, and would a contractor have the right to object to the determination and prevent installation of sensors on its systems?
4. On what system elements would these sensors be required to be installed? Who and how would that determination be made?
5. Would a contractor have the right to object to either to the use of sensors or the scope of the data such sensors would detect or report, to prevent an unreasonable search of the contractor’s information which may include sensitive, proprietary, or privileged data?
As the provision is currently written, it is ambiguous and unreasonably broad as an unbounded requirement that does not appear related to the performance requirements.
Recommended Change: Recommend the first sentence of 3.6.1 is removed in its entirety from the solicitation and resulting contract. Alternatively, this sentence should be properly bounded and replaced with specific criteria required by and consistent with DFARS 252.204-7012 and NIST SP 800-171R1. 1. What would trigger a finding of a “vulnerability or a potential vulnerability”?
When intelligence from various Government entities gives reasonable indication that a breach or potential breach exists at the Contractor.
2. Who would make the determination that a “vulnerability or a potential vulnerability” exists and what standards would be used to make that determination?
NCIS would make this determination. The determination would be based on intelligence reporting above indicating a threat exists to the specific Contractor.
3. Would that determination be shared with the contractor, and would a contractor have the right to object to the determination and prevent installation of sensors on its systems?
No, the determination evidence will not be shared due to its classification level. By proposing to this contract requirement, the Contractor is consenting to the installation of the sensor if NCIS makes the determination it is required.
4. On what system elements would these sensors be required to be installed? Who and how would that determination be made?
The location of the sensor cannot be shared in a public forum. NCIS makes this determination.
5. Would a contractor have the right to object to either to the use of sensors or the scope of the data such sensors would detect or report, to prevent an unreasonable search of the contractor’s information which may include sensitive, proprietary, or privileged data?
By proposing to this contract requirement, the Contractor is consenting to the installation of the sensor if NCIS makes the determination it is required. Sensitive, proprietary, or privileged data should be segregated from DON CUI data whenever feasible, in accordance with the SOW provision 3.5.1.
12 In subsection 3.6.1 (p. 86), the second sentence of this paragraph provides as follows: “If NCIS determines that the contractor’s own sensor capability is adequate, the contractor consents to cooperation with NCIS on cybersecurity, to include sharing information from its sensor capability and networks.”
This requirement does not fall within the DFARS 252.204-7012 and NIST SP 800-171R1 set of cybersecurity requirements for defense contractors. The sentence and is vague and subjective with no set of defined adherence requirements. In trying to understand this potentially unbounded requirement, we have the following questions:
1. What standards would be applied to determine if a contractor’s own sensor capability is “adequate”?
2. How would this determination be made?
3. Would the determination and the details behind the determination be shared with the contractor, and would a contractor have the right to object or appeal such determination?
4. What does it mean to “consent to cooperation” with NCIS? As an example, what information would be required to be shared? What protections would the Government put in place to ensure it would not require a contractor to share sensitive, proprietary, or privileged data?
Recommended Change: Recommend the second sentence of 3.6.1 is removed in its entirety from the solicitation and resulting contract. Alternatively, this sentence should be replaced with a specific NCIS approved list of sensors, as well as NCIS’ “cooperation” requirements and data sharing requirements, consistent with the requirements in DFARS 252.204-7012 and NIST SP 800-171R1. 1. What standards would be applied to determine if a contractor’s own sensor capability is “adequate”?
The details of this are not at the classification level of this RFP.
2. How would this determination be made?
The determination of adequacy is made by NCIS. See the answer to the question above.
3. Would the determination and the details behind the determination be shared with the contractor, and would a contractor have the right to object or appeal such determination?
The Contractor will be provided the ability to discuss with NCIS prior to a determination being made to install the NCIS sensor.
4. What does it mean to “consent to cooperation” with NCIS? As an example, what information would be required to be shared? What protections would the Government put in place to ensure it would not require a contractor to share sensitive, proprietary, or privileged data?
As part of the cooperation with NCIS, the Contractor can discuss with NCIS regarding what information is needed in order for NCIS to assess cyber vulnerabilities across the Contractor network. Recommended Change: Recommend the second sentence of 3.6.1 is removed in its entirety from the solicitation and resulting contract. Alternatively, this sentence should be replaced with a specific NCIS approved list of sensors, as well as NCIS’ “cooperation” requirements and data sharing requirements, consistent with the requirements in DFARS 252.204-7012 and NIST SP 800-171R1.”
The Government reviewed the comment and will not be removing this requirement at this time.
13 In subsection 3.6.2 (p. 86), the first two sentences of this paragraph provides as follows: “Both routinely and in response to emergent developments, NCIS engages in outreach efforts to the defense contracting community to coordinate cybersecurity efforts. The contractor shall regularly monitor and engage with such efforts to ensure that contractor is aware of the most up-to-date cybersecurity information and strategies.”
This requirement does not appear to fall within the DFARS 252.204-7012 and NIST SP 800-171R1 set of cybersecurity requirements for defense contractors. The requirement for a contractor to “regularly monitor and engage” is subjective; in addition to NCIS, what agency(ies) should the contractor “regularly monitor and engage” with to ensure awareness of the most up-to-date cybersecurity information and strategies?
In subsection 3.6.2 (p. 86), the third sentence of this paragraph provides as follows: “As a part of these efforts, the contractor shall consider implementing all recommendations from NCIS for additional hardening (e.g., more stringent configuration settings) of DON critical programs and technologies.”
What additional hardening implementations does NCIS recommend for more stringent configuration settings of DON critical programs and technologies? In the event that such recommendations are in addition to the requirements of DFARS 252.204-7012 and NIST SP 800-171R1, the contractor reserves its right to assert a contract change for any scope changes resulting from this paragraph.
Recommended Change: Recommend clarification is provided on the government’s expectation of what it means to “regularly monitor and engage” with NCIS and other agency(ies) cybersecurity effort. In addition, provide any available information from NCIS regarding its “additional hardening” recommendations.
This requirement does not appear to fall within the DFARS 252.204-7012 and NIST SP 800-171R1 set of cybersecurity requirements for defense contractors. The requirement for a contractor to “regularly monitor and engage” is subjective; in addition to NCIS, what agency(ies) should the contractor “regularly monitor and engage” with to ensure awareness of the most up-to-date cybersecurity information and strategies?
The requirement is to regularly monitor and engage with NCIS outreach efforts to the Defense Industry Base (DIB). For example, engagement includes participation with the Defense Cyber Crime Center (DC3) DIB web portal. What additional hardening implementations does NCIS recommend for more stringent configuration settings of DON critical programs and technologies? In the event that such recommendations are in addition to the requirements of DFARS 252.204-7012 and NIST SP 800-171R1, the contractor reserves its right to assert a contract change for any scope changes resulting from this paragraph.
The requirement is to consider implementation of all recommendations from NCIS for additional hardening of DON critical programs and technologies.
Recommended Change: Recommend clarification is provided on the government’s expectation of what it means to “regularly monitor and engage” with NCIS and other agency(ies) cybersecurity effort. In addition, provide any available information from NCIS regarding its “additional hardening” recommendations.”
There are currently no additional recommendations from NCIS on additional hardening.
| 14 | Subsection 5.5.3 paragraph a) states the Government requirement for Engineering Services is 174,200 man-hours in the base year and each of the option years; however, the hours in Section B and Table L-2 (p. 239-240) do not equal 174,200 man-hours for each year. Please confirm what hours should be priced. | See response to question in cell C9 above |
| 15 | Subsection 2.1 (p. 214) excludes the following proposal content from page count: Cover letter, Table of contents, Title pages, Index pages, Tabs, Glossary, Cross Refernce Matrix, and Non-Standard or Commercial Licenses Attached to the Commercial Restrictions List; however, Subsection 4.1 (p. 231) does not state these items are excluded. Please confirm whether these items are exluded from page count. | Section L 4.1 has been updated in the Solicitation Amendment 00001 to clarify that "The following proposal content will be exempt from the page count limitations: Cover letter, Table of contents, Title pages, Index pages, Tabs, Glossary, Cross Reference Matrix, and Non-Standard or Commercial Licenses Attached to the Commercial Restrictions List". |
| 16 | Item 1011, and Option Items 1111, 1211, 1311, and 1411 – Depot Operations Services (p. 52) – The Government Property Inventory and Government Property Test Equipment & Tools requirements refer to Attachment 2, which is Government Furnished Property (Electronics). It appears the above mentioned requirements were added to the Mechanical CLINs in error, please confirm. | Section C 2.1.11 has been updated in the Solicitation Amendment 00002 to reflect reference to Attachment 12 rather than Attachment 2. |
| 17 | Table L-2 – Mechanical Systems Design Agent Engineering Services CLINs (p. 96-7) – Table L-2 added 14,502 hours under CLIN 0011. CLIN 0011 is not a Mechanical CLIN and appears to be incorrectly identified in the table, please confirm. | Section L Table L-2 has been updated in the Solicitation Amendment 00002 to reflect reference to CLIN 1011 rather than CLIN 0011. |
| 18 | The government states that the contractor shall receive, inventory, store , contract, preserve and protect the GP in Attachment 2, however there is no Canister Automated Test Set GP listed in Attachment 2 for depot operations. Will GFP be provided to support canister depot operations as described in CLINs (1011, 1111, 1211, 1311, 1411)? | See response to question in cell C18 above |
| 19 | The table, "Mechanical Systems Design Agent Engineering Services CLINs" found in section L, page 241 has been modified in response to offeror questions. Can the Navy please confirm that the addition of the column 0011 is to be included in this table, as it is described in the statement of work as an electrical CLIN? | See response to question in cell C19 above |
| 20 | Subsection 3.1.1 (p. 85) references CDRL A031 (Technical Report - Study/Services, POAM and Systems Security Plan) and subsection 3.5.1 references CDRL A032 (Technical Report - Study/Services, Cyber Incident Report) which were not provided in the CDRL Data Package. Please provide these CDRLs. | CDRL A032 Technical Report - Study/Services, Cyber Incident Report is provided via email to Contractors which have submitted Terms of Use Agreements. |
| 21 | Is the content of Part 1 of the Statement of Work (Section C, p. 73-86) inclusive of both Electrical and Mechanical requirements? The third paragraph under Part 1 states: "The contractor shall serve as the electronic systems and computer programs technical expert…" Paragraph 2.c. (p. 76) states: "The contractor shall collaborate with and support the VLS Mechanical Systems Engineering Agent..." Both of these statements would indicate that these requirements are specific to the Electronics CLINs. | Section C Part 1 paragraphs two and three are replaced with four new paragraphs in the Solicitation Amendment 00002 to separate the mechanical contractor requirements from the electronic contractor requirements. |
| 22 | In subsection 2.b. (p. 76), the solicitation provides as follows: “The contractor shall use the PEO IWS Systems Engineering Operations Manual, PEO TSC Instruction 4810.2, Software Development, Verification and Validation (V&V), Design Reuse, and Metrics Policy, PEO TSC Instruction 4810.3, Guidance for Prime Item Development Specification (PIDS) Document Preparation, and PEO IWS Instruction 5239.1, PEO IWS Surface Navy Combat System Cybersecurity, as applicable for engineering tasks.” Please provide the “PEO IWS Instruction 5239.1, PEO IWS Surface Navy Combat System Cybersecurity” document, to include applicable tasks and requirements for engineering tasks under the resulting Contract. Please provide document no later than Friday, 7 June 2019 to permit adequate time to review requirements prior to the solicitation due date. Recommended Change: No change; request for additional information. | Section C Part 1 reference to PEO IWS Instruction 5239.1, PEO IWS Surface Navy Combat System Cybersecurity was updated to reference 5239.2 in the Solicitation Amendment 00002 and PEO IWS Instruction 5239.2 has been provided via FBO as a part of Solicitation Amendment 00002. |
| 23 | In subsection 3.4.1 (p. 86), the provision provides as follows: “Covered Defense Information (CDI) and Covered Contractor Information Systems (CCIS) are defined within clause 252.204-7012. Information at rest is defined as the state of information when it is not in process or in transit and is located on storage devices as specific components of systems. On all CCISs, the contractor shall encrypt CDI at rest in accordance with NIST 800-171.” |
Within NIST 800-171, requirement 3.1.19 provides that CUI “at rest” shall be encrypted on mobile devices and mobile computing platforms only. Please confirm that the requirement above for encryption of data “at rest” applies to mobile devices and mobile computing platforms.
Recommended Change: Recommend the third sentence is changed to remove “all CCISs,” and replace with “mobile devices and mobile computing platforms,”.
Section C Part 1 paragraph 3.4.1 is edited in the Solicitation Amendment 00002 to align Cybersecurity Encryption Data at Rest requirements with DFARS 252.204-7012.
File details come from the government source that posted it. Updated .