S8. Q&A.pdf

Answer 1 Does the Navy intend to post a Systems Integration contract for the Navy Hub? If so, when? Will it be a separate procurement from the ITS contract?

Not at this time. The Government intends to integrate the software using contractor‐provided training, documentation, and helpdesk support.

2 In reference to the section below regarding CPARS and PPQs. There was no PPQ Attachment No. 6 listed on the SPAWAR e‐commerce site. Can you please provide us a copy of that document? Due to this delay, is there any possibility of extending the proposal due date?

Attachment 6 was added on 10‐28‐19. The proposal due date will be extended in Amendment 0001.

3 Will the Government consider including a CLIN of T&M labor to support unidentified issues that may arise over the course of the contract and to support potential changes needed to the software?

No; a T&M labor CLIN will not be added.

4 Will the Government consider reducing the Technical Volume to a 10 page maximum with more specifics as to what is technically acceptable e.g. the requirements reference ingesting HR data, but they don't say what the UEBA must be capable of doing with that data?

No. There is no expectation (or desire) for offerors to utilize the full maximum page limit. The Page limit was set to give offerors the flexibility to add detail if they feel it is beneficial or necessary to demonstrate the technical acceptability of their proposed solution. This solicitation is lowest‐price, technically acceptable (LPTA), so proposals will not be compared to each other and there will be no benefit from using more pages than necessary to demonstrate technical acceptability.

5 The Government requires listing the number and types of analytics each product has that work on UAM (Forcepoint) data. Will the Government consider providing a quantifiable number as to the minimum number of analytics that are currently available? Also, will the Government specify a number of new analytics that must become available each year of the contract? Being that this is a 5 year contract, the requirement will evolve and change during that time, vendor proposed products need to provide new analytics to keep up with changes to the network and user activity. Will the Government also consider specifying the thresholds associated with analytic performance? E.g. analytics shall be a mix of streaming and batch processing. Streaming analytics shall return results within 15 seconds, batch analytics shall on average return results within 1 hour. Vendors shall provide specifications on the compute environment necessary to support this requirement.

The Government has decided not to specify a minimum number of analytics due to variation of complexity and quality of the possible analytics. Although the Government desires this source selection to be as objective and quantifiable as possible, the wide variation of analytics available will require a subjective evaluation to determine whether the full set of offered analytics is acceptable for the Government’s purpose. Regarding the evolving challenges/environment, the Government has decided not to specify a minimum number of analytics to be added in the future.

This is a one‐year contract with options for 4 additional years. The Government conducts continuous market research, and should it become apparent that the incumbent capability is inferior in terms of value to the Government, the Government may re‐compete the requirement early. Regarding the performance thresholds for analytics, the Government anticipates having to adjust cloud computing resources to meet performance requirements but does not intend to use cloud resource utilization as a source selection criterion. However, the Government intends to update the hardware requirement to include thresholds.

6 Will the Government consider requiring bidders to demonstrate in their technical proposals how many trained employees with more than 2 years of experience using the proposed solution the prime contractor has at time of bid submission? I have seen in personal experience that trained and experienced resources are some of the hardest obstacles to overcome for program success. I have worked with vendors in the past that have been unable to provide cleared, trained resources to facilitate meeting contract deadlines. All too often subcontractors or 3rd party vendors have resources, but they end up being unavailable when called upon. The requirement for the prime to demonstrate and have on staffed experienced resources will significantly mitigate this potential issue. If minimum numbers of trained and experience resources can be established in the RFP I would recommend the Government require the prime bidder to have at least 25 trained resources (if not 50) with more than 2 years of experience with the software. This would help ensure resource availability for contract success, especially in an LPTA environment.

The Government concurs with the challenges expressed in this question and will incorporate some of the recommendations in Amendment 0001.

7 Will the Government include a past performance requirement where the vendors have installed and operated their software in a DoD RMF accredited production environment with a minimum of 5 petabytes of hot data storage?

No; the Government will not revise the past performance requirements.

8 Will the Government consider including a requirement for the UEBA to be able to support multi‐petabyte scale data storage and to meet the retention requirements of policies and guidelines?

Yes, this will be incorporated into Amendment 0001.

9 Will the Government consider changing the evaluation from Lowest Price Technically Acceptable (LPTA) to Best Value? There is a critical importance for national security at the strategic level that Counter Insider Threat capabilities are implemented and are functioning appropriately for the network and endpoints being monitored.

With LPTA solicitation there is potential for vendor submissions to be technically acceptable, but for the capability not provide the necessary functionality to identify and alert in a timely manner.

LPTA is a form of best value, as it is a methodology on the best value continuum. The Government believes the Question intended to state, "Trade‐Off," to which the answer is no.

Question

10 Will the Government consider adding a requirement that the Prime contractor and the COTS provider have existing Top Secret (TS) Facility Clearances (FCLs) at the time of bid submission? This will ensure that contractors can not only provide viable solutions, but that they also have the ability to implement their solutions.

Yes, this will be incorporated into Amendment 0001.

11 Will the Government consider adding a requirement that all proposed solutions have an existing DoD Top Secret level ATO for at least on other DoD Agency? As it is currently written vendors may propose solutions that do not have RMF ATOs. Some vendor solutions may never be able to get accredited for Top Secret networks due to Critical Vulnerabilities that Commercial Companies may not be aware of or may be unable to patch.

Yes, this will be incorporated into Amendment 0001.

12 I noticed that there wasn't a CLIN for pricing and the contract requires documentation on configuration and installation, but doesn't require the contractor to perform configuration or installation. Will the Government consider adding an FFP CLIN for a Service Level Agreement (SLA) around initial installation, on‐going configuration, monthly security patching installs, Risk Management Framework / Information Security support/accreditation, cloud hosting support, configuration of data flows (Forcepoint to UEBA), and etc.?

No; the Government will not be adding a CLIN for configuration and installation. CLIN 0001 should include pricing for the required configuration and installation.

13 Please advise of acceptable methods of electronic RFP response submission. Specifically, may we submit our response via email to contracting officers or via the NAVWAR e‐commerce site?

Responses shall be submitted via the NAVWAR site.

14 Attachment 6 did not contain a PPQ form. We would like to confirm that we can utilize Form NAVFAC / USACE Past Performance Questionnaire (PPQ) Form PPQ ‐0 (9/30/11) found at this URL:

https://imlive.s3.amazonaws.com/Federal%20Government/ID71106821063767284549803538452326405415/NAV FAC_USACE_PPQ.pdf

Attachment 6 was added on 10‐28‐19.

15 RFP Section L‐3.2 Volume II: Technical Proposal, CLIN 0002 states "…One 40‐hour (five days) session of operator training within 25 miles of Suitland, MD…" Would the Government consider changing this requirement to read, "35 miles of Suitland, MD"?

No. The Government is attempting to keep commute times reasonable for local employees that require the training.

16 RFP SF 33, Section 9 reads "03:00 PM local time 13 Sept 2019." Would the Government correct the date to 31 Oct 2019?

Yes; the proposal due date will be corrected in Amendment 0001.

17 RFP SF 33 Section 9 reads, "Sealed offers in original and 1 copy…" Will the Government identify what method (electronic submission or hand carried) they prefer to receive offeror's submission and what address (email address or physical address to email or deliver?

Responses shall be submitted via the NAVWAR site.

18 What is the applicability of Section 4.3 and the governments intent for this section as commercial items are exempt from CAS requirements.

Section 4.3 is required to aid the Government in the determination of contractor responsibility, required by FAR 9.103 and 9.104‐1(a)

19 Are you expecting the contractor to provide their own help desk with SIPRnet access or will the Navy provide access to a government facility with SIPRnet access?

The contractor is expected to provide support out of their own facilities.

20 Is the Navy requiring the helpdesk support to be on the west or east coast time zone? The Government will primarily be operating in the Pacific time zone, but help desk hours during normal business hours in any continental US time zone is acceptable.

21 Is the Navy willing to extend the due date 14 days past the original date of October 31, 2019 The proposal due date will be extended in Amendment 0001.

22 Can you clarify the following statement: (page 51 under “Background” paragraph) The ITS shall ingest the UAM data from an existing UAM system and enrich it with additional government‐provided structured and unstructured data sources such as human resources, travel, law enforcement, and other records to provide a comprehensive risk analysis of individuals in the monitored population.

What are the underlying database applications/source for these systems? Ex: SharePoint, File servers, SAP etc.

Specific formats for enrichment data sources have not been identified, which is why general capability to ingest various structured and unstructured data sources has been specified.

23 How many references are being asked for with submission? What type of references are desired? As stated in L‐3.2.2, two reference information sheets can be submitted. The type of references desired are stated in L‐3.2.2.

24 RFP: Are the AWS systems being referenced here IaaS? Yes, however some Platform As a Service (PAAS) offerings are also available via the Intelligence Community Commercial Cloud Services (C2S).

25 Data Acquisition, #2: STEALTHbits provides industry leading activity monitoring solutions. Is ForcePoint aggregation a solution must or can the aggregation be done through STEALTHbits solutions?

Ingestion of Forcepoint UAM data is a firm requirement for the ITS.

26 Licensing and Support, #17: Solutions data is stored in MS SQL and Postgres. Which 3rd party tools are being referenced here?

No specific third party tool has been identified. The intent of this requirement is to enforce storage of data in standard formats to prevent vendor lock‐in. SQL and Postgres are both acceptable examples.

27 Are clauses applicable to both contractor and subcontractor parties ? Yes 28 L‐3.2.1: What data sources are to be targeted to enrich the activity and threat detection outlined? This information cannot be disclosed. The proposed software shall be able to ingest a range of structured and unstructured data formats.

29 Is it possible to have one week extension? The proposal due date will be extended in Amendment 0001.

30 Is an incumbent contractor currently performing these services, if similar services have been performed in the past, or if this is a new requirement? If there is an incumbent, could you please provide the contract or task order number?

There is no incumbent contractor.