SLDCADA Response to FOPR Questions.xlsx

XLSX spreadsheet 79 KB Posted

Attached to
STANDARD LABOR DATA COLLECTION AND DISTRIBUTION APPLICATION (SLDCADA) REQUEST FOR PROPOSAL
Solicitation number
N0003926R0005
Issued by

About this file

This is a Question and Answer (Q&A) document responding to 142 clarification inquiries submitted by potential offerors regarding the SLDCADA Request for Proposal (RFP). The document provides Government responses that materially clarify solicitation requirements, technical specifications, pricing structures, evaluation criteria, and administrative procedures.

Key Contractual and Administrative Details: The solicitation is a firm-fixed-price task order under the SeaPort-NxG IDIQ multiple-award contract limited to SeaPort-NxG small-business IDIQ holders. Award is anticipated for March 1, 2027, with a one-year base period and four one-year option periods. The final RFP release date is November 6, 2026, and proposals are due December 6, 2026, at 6:00 PM Eastern Time via DoD SAFE. A DoD SAFE drop-off request deadline is December 1, 2026, at 12:00 PM EST. The contract comprises firm-fixed-price CLINs (1001-5001 for sustainment; 1002-5002 for Naval Identity Services implementation) and cost-reimbursement CLINs (1003-5003 for Other Direct Costs with a $60,000 annual not-to-exceed per year). The evaluation will employ four factors: Factor 1 (Approach/Technical), Factor 2 (Cloud Migration and ATO Strategy), Factor 3 (Staffing Plan), and Factor 4 (Price). No scenarios will be included in the final RFP. Proposals must be submitted in PDF format for Volumes 1-2 and Volume 5. Subcontractor cover letters should be included in the prime's Volume 5, each limited to 2 pages maximum.

Technical and Operational Scope: SLDCADA is an unclassified, web-based Government Off-the-Shelf Java and Oracle application providing time-and-attendance and labor-reporting services to approximately 60,000 Navy, Marine Corps, and Executive Office of the President users. The system currently operates on 36 virtual servers across development, test, staging, production, and disaster recovery environments, all hosted in AWS GovCloud managed by CloudCITI (formerly DC2HS). The Authorization to Operate (ATO) expires March 2027, with a formal RMF reauthorization effort expected during option periods aligned with the three-year RMF cycle. The base year focuses exclusively on continuous operations, sustainment, and maintenance within the existing CloudCITI AWS GovCloud environment; no system cutover or data-center migration is expected during the base period. The contractor must support two releases annually, resolve Priority 1 defects within 8 hours, respond to Priority 1 work orders within two hours during off-hours, maintain system availability exceeding 99.5%, and provide helpdesk support. Key deliverables include a 30-day transition plan (submitted during phase-in), cybersecurity compliance documentation, quality assurance evidence, and support for internal and external audits. The contractor must develop a mobile front-end interface for SLDCADA and implement Naval Identity Services (NIS) single sign-on and account provisioning integration, with NIS work required annually across all option years, not as a one-time implementation. Additional Services (cloud migration planning, new user-community implementations, RMF ATO reauthorization) are priced within the sustainment base and will not be procured as separate task orders.

Personnel, Security, and Compliance Requirements: Offerors must propose a staffing plan; the 24-FTE sample team breakout is illustrative only, and offerors may propose different total FTEs or labor mixes if supported by a basis of estimate. Key personnel positions include Task Order Program Manager, Lead Software Engineer, and Lead Database Management Analyst. Proposed personnel must have Tier 5 (T5/SSBI) investigations for all privileged users (including Systems Administrators, Database Administrators, and Senior Cybersecurity Engineer/ISSO positions); Tier 3 (T3) investigations are required for all non-privileged personnel. Personnel requiring T5 investigations may begin performance on interim determination while adjudication is pending. Proposed staff must possess Secret clearance eligibility or higher for elevated/privileged access or SIPRNET terminal access. Cybersecurity personnel must hold DoD 8140 baseline certifications (e.g., CISSP, CISM, CASP+ for Senior Cybersecurity Engineer/ISSO; Security+ CE, CySA+, or SSCP for Cybersecurity Analysts and System Administrators). Compliance with NIST SP 800-171 Revision 2 is required; CMMC Level 2 certification is not required at proposal submission or award. A DD Form 254 is not required. Personnel must be within commuting distance of 1325 10th Street SE, Washington, DC, unless otherwise authorized by the Contracting Officer's Representative. Resumes will be reviewed at contract award but will not be evaluated as part of the RFP proposal. Subcontractors performing software development or testing using only synthetic or approved unclassified test data with no access to Controlled Unclassified Information (CUI) are exempt from NIST 800-171 and CMMC requirements. All offerors, including small businesses without DCAA/DCMA adequacy determinations, must have or demonstrate an adequate accounting system, but this requirement applies only to the prime contractor, not subcontractors performing only FFP work.

Additional Key Clarifications: Incumbent contractor is Innovatus; the Government will not provide the incumbent contract number but will allow a 30-calendar-day transition period. Modernization initiatives referenced in PWS Section 3 (Orion GitLab migration, WebLogic 14c/JDK 17 upgrade, DCPS data-mapping refactoring) are illustrative examples, not defined Government priorities; the Government will not share its current modernization roadmap or backlog. As a total small-business set-aside, the solicitation has no evaluation consideration for small-business subcontracting participation (e.g., SDB, WOSB, SDVOSB, HUBZone). The Government will not consolidate cover-letter instructions, and the page limit for cover letters is three pages (not increased from the original request). Responsibility information may be submitted as a separate file from the cover letter. Offerors are not required to use a Government-provided staffing-plan Excel template but must provide required staffing information in their chosen format. The Government will provide applicable RMF documentation, inherited-control information, and access to authorized personnel after award, subject to access-control and need-to-know requirements. Historical audit findings, control deficiencies, ticket/defect backlogs, and detailed software change request backlogs will not be provided; available transition resources will include technical data packages, source code, build scripts, configuration files, environments, and incumbent knowledge transfer.

View the file

Other files

On GovTribe

Work with this file

  • Download the original file
  • Contacts named in this file
  • Similar government files
  • Ask GovTribe AI about this file

Text version

Responses to Questions

NoQuestionResponse
1Attachment 01 PWS; Attachment 05 L4 Price Workbook. PWS 6.2.1 to 6.2.3; Attachment 05 CLINs. PWS 6.2.1 to 6.2.3 describe Additional Services, but Attachment 05 has no CLIN for them. How should offerors price these services in the proposal?Attachment 5 has been updated to include Additional Services in Sustainment.
2Attachment 01 PWS Appendix D; Attachment 05 L4 Price Workbook. Appendix D 2.2; CLINs 1002, 2002, 3002, 4002, 5002. Appendix D 2.2 treats NIS Implementation as complete once deployed, yet Attachment 05 carries an NIS CLIN with a $1,500,000 NTE in every period. Should offerors price NIS Implementation in the base year only?No. Offerors should price CLINS 1002, 2002, 3002, 4002, 5002 as directed. NIS is required every year. Appendix D2.2 was revised for clarification.
3Attachment 01 PWS. PWS 3 (Work Stream 1), PWS 6.1.5.3, PWS 9.2. PWS 3 states core coverage hours of 0700 to 2000 EST, PWS 6.1.5.3 states help desk hours of 0700 to 1800 ET, and PWS 9.2 states 0600 to 1800 ET. Which hours govern for pricing?The hours have been corrected.
4Attachment 01 PWS. PWS 9.1. PWS 9.1 requires personnel to be within commuting distance of a NAVWAR, CPE WEBS office space but names none. Which office location or locations satisfy this requirement?The RFP will be updated to state: Unless authorized by the COR, when telewroking, contractor personnel shall be within commuting distance1325 10th Street SE, Washington, DC. The contractor must be able to access these sites for routine NMCI updates. Commuting distance is defined as a distance the Contractor is willing to travel voluntarily without reimbursement when they are required to be in the office with little to no notice by the Government.
5Attachment 01 PWS; Solicitation Section J. PWS 9.3(e); Section J List of Attachments. PWS 9.3(e) references an OPSEC attachment to a DD254, but Section J lists no DD 254. What facility clearance level, if any, will the task order require at award?DD254 will not be included.
6Attachment 02 Section L. L-1(j)(4), p.5; Table L-2.1, p.7. L-1(j)(4) requires text files in Word format, while Table L-2.1 requires Volumes 1 and 2 in .pdf format. Which format governs for Volumes 1 and 2?PDF governs Volumes 1 and 2. RFP updates made for clarification.
7Solicitation Section C; Attachment 02 Section L. C-211-HQ001, paragraph b; Table L-2.1, p.7-8. C-211-HQ001 states the Government will review resumes and written agreements as part of the technical proposal, but Table L-2.1 provides no place for them. In which volume, if any, should they be submitted?Resumes will be reviewed at the time of award. Resumes will not be evaluated as part of the RFP.
8Solicitation. General. Is there an incumbent contract number for this requirement, and would the Government share it?The incumbent in Innovatus.
9We would like to know if this is a brand new contract OR if there is (was)an incumbent performing these services.
If not brand new, could you please provide the current / previous contract number?Innovatus is the incumbent. As stated, the Government will not share the incumbent contract number.
10PWS §3 (Work Stream 4, Sample Tasks) lists modernization initiatives — migration to Orion GitLab, WebLogic 14c / JDK 17 upgrade, and DCPS data-mapping refactoring. Are these the Government's defined modernization priorities for the base year, or illustrative examples? Will the Government share the current modernization roadmap/backlog with offerors?The Government is defining as illustrative examples. The Government will not share the current roadmap/backlog.
11As a Total Small Business Set-Aside, does the Government have expectations or evaluation consideration for small business subcontracting participation (e.g., SDB, WOSB, SDVOSB, HUBZone) under this task order?No. The Government does not have expectations or evaluation consideration for small business subcontracting participation.
12PWS §6.1.1.3 requires Tier 5 investigations for privileged-access personnel. Given current T5 adjudication timelines, will the Government support interim privileged access or phased onboarding for key personnel whose investigations are in progress at award?Yes
13I have one question on the draft. Since the draft indicates award through SeaPort-NxG, may a small business that does not hold SeaPort-NxG participate as a subcontractor to a SeaPort-NxG small business prime, and would the program welcome an 8(a) teaming partner in that role?SeaPort-NxG IDIQ holders may team/utilize subcontractors that do not hold SeaPort NxG. Award will be made by utilizing a Best-Value procedure conducted to an Offeror whose proposal would be most advantageous to the Government when technical and price factors are considered.
14could you please clarify whether offerors are required to have CMMC Level 2 certification at the time of proposal submission? We are seeking clarification because the draft RFP’s Performance Work Statement references Controlled Unclassified Information.No. Offerors are not required to have CMMC Level 2 Certification.
15Eligibility. Section L, L-1(a)–(b), and Section M, M-1(2), describe a fair-opportunity task order under the SeaPort IDIQ multiple-award contract (FAR 16.505). The SF 1449 (Blocks 10 and 14) identifies a Request for Proposal with a 100% small business set-aside under NAICS 541519. Is this competition limited to SeaPort-NxG IDIQ holders? If not, may any small business registered in SAM under NAICS 541519 submit a proposal as prime?This competition is limited to SeaPort-NxG IDIQ holders.
16Evaluation factors. L-1(a) refers to two technical factors and price as "Factor 3," while L-2 and M-1(4) list four factors (Factor 3 Staffing Plan, Factor 4 Price). Please confirm the four factors in Section M govern.L-1(a) will be corrected. There are four factors.
17File formats. L-1(j)(4) requires narrative text in Microsoft Word (.doc/.docx), while Table L-2.1 specifies .pdf for Volumes 1 and 2 and the Volume 5 cover letter. Which format governs for each volume?File formats. L-1(j)(4) requires narrative text in Microsoft Word (.doc/.docx), while Table L-2.1 specifies .pdf for Volumes 1 and 2 and the Volume 5 cover letter. Which format governs for each volume?File formats. L-1(j)(4) requires narrative text in Microsoft Word (.doc/.docx), while Table L-2.1 specifies .pdf for Volumes 1 and 2 and the Volume 5 cover letter. Which format governs for each volume?File formats. L-1(j)(4) requires narrative text in Microsoft Word (.doc/.docx), while Table L-2.1 specifies .pdf for Volumes 1 and 2 and the Volume 5 cover letter. Which format governs for each volume?L(1)(j)(4) will be corrected to state PDF. Files shall be submitted as a PDF
18Resumes and key personnel. C-211-HQ001(b) states the Government will review resumes and requires a written commitment from proposed personnel not currently employed by the offeror, and Attachment 06 designates three key personnel. Table L-2.1 has no location for resumes. Should resumes and letters of commitment be submitted? If so, in which volume, and do they count toward page limits?Resumes will be reviewed at the time of award. Resumes will not be evaluated as part of the RFP.
19Cover page and table of contents. Table L-2.1 excludes the cover page, table of contents, and glossary from the Volume 1 and 2 page limits, but the note below the table lists these as additional content that will not be evaluated. May offerors include them?Cover page, table of contents, glossary may be provided to increase clarity of the submission, but these items will not be evaluated for award purposes.
20Server count and ATO. Factor 2 references 35 servers and "PWS 6.2.3 RMF ATO – option (1 Feb 2022 – 31 Jan 2023)." PWS 6.1.3 states 36 servers, and PWS 6.2.1.1 states the current ATO expires April 2023. Please confirm the server count and the current ATO expiration date.ATO Expiration date is March 2027. The server count is 36 servers.
21CLIN mapping. Attachment 05 maps CLINs x001 to "PWS 5.1, 5.2," while the PWS numbers these sections 6.1 and 6.2. Please confirm the FFP Sustainment CLINs cover all of PWS 6.1 and 6.2, including Additional Services (6.2.1, 6.2.2, and 6.2.3).Confirmed. Attachment 5 has been updated to include Additional Services in Sustainment.
22NIS CLINs. CLINs 1002–5002 each carry an NTE of $1,500,000. Is NIS implementation expected to complete in the base year, or is NIS work anticipated in each option year? If it completes in the base year, how should offerors price CLINs 2002–5002?Yes, NI S is expected for each option year . Offerors should price CLINS 1002, 2002, 3002, 4002, 5002 as directed. NIS is required every year.
23Accounting system. L-2(c)(1)(v) and Volume 4 (3)(i) require an adequate accounting system for the cost-type ODC CLINs. For a small business without a DCAA/DCMA adequacy determination, what other evidence will the Government accept?If the DCAA Report is unavailable, other information pertinent to accounting system adequacy may be submitted. Offerors must have an adequate accounting system.
24Section K. Volume 5 (2)(ii)(a) directs attention to DFARS 252.227-7992 and K-227-HQ003, but Section K of the solicitation contains only K-209-HQ001. Please provide the missing provisions or confirm they are not required.DFARS 252.227-7997 is also required.
25Security and CMMC. (a) Will a DD Form 254 or facility clearance be required (PWS 9.3(e) references an OPSEC attachment to the DD254)? (b) What CMMC level, if any, applies under DFARS 252.204-7021, and must it be in place at proposal or at award? (c) May personnel requiring a T5 investigation begin performance on an interim determination?a. a DD254 will not be required, b. No CMMC level must be in place at a ward c. Personnel requiring a T5 can begin
26Telework. PWS 9.1 requires teleworking personnel to be within commuting distance of a NAVWAR / CPE WEBS office. Please identify the qualifying office locations.The RFP will be updated to state: Unless authorized by the COR, when telewroking, contractor personnel shall be within commuting distance1325 10th Street SE, Washington, DC. The contractor must be able to access these sites for routine NMCI updates. Commuting distance is defined as a distance the Contractor is willing to travel voluntarily without reimbursement when they are required to be in the office with little to no notice by the Government.
27Incumbent. Please identify the incumbent contract number and current staffing level.Innovatus is the incumbent. However, the Government did provide a sample staffing plan in the PWS to help offerors determine the appropriate staffing.
28Section F. The period of performance for CLIN 3001 ends "29 Mar 3020." Please confirm the intended end date is 29 Mar 2030.Confirmed. Section F of the RFP will be updated.
29Section B prices CLINs 1003, 2003, 3003, 4003 and 5003, Other Direct Costs, as Cost No Fee, and Section L paragraph (c)(1)(v) requires an adequate accounting system for any Cost CLIN. Because these CLINs carry a Government set ceiling of $60,000 a year for travel and other direct costs, will the Government consider pricing them as a firm fixed price amount at the stated ceiling, so that the accounting system requirement in Section L does not apply?No. Cost CLINs are specifically established because the Government will pay for cost, not a set price. The Accounting System requirement applies all all contractors submitting a proposal.
30If the Cost CLINs remain, Section L paragraph (c)(1)(v) states that "other information pertinent to accounting system adequacy may be submitted." What information will the Government accept to meet this requirement when an offeror does not have a DCAA or DCMA adequacy report?If the DCAA Report is unavailable, other information pertinent to accounting system adequacy may be submitted. Offerors must have an adequate accounting system.
31(Section L-1(a); Section L-2 Table L-2.1; Section M) L-1(a) describes two

technical factors (Factors 1 and 2) and price as Factor 3. Table L-2.1 and Section M list four factors, with Factor 3 as the Staffing Plan and Factor 4 as Price. Please confirm that the final RFP will evaluate four factors as listed in Section M.

Confirmed and updated RFP for consistency.
32(Section M, Factors 1 and 2) Section M titles Factors 1 and 2 as "Scenario"

factors, while Section L asks for an approach narrative with no scenario. Will the final RFP include written scenarios for Factors 1 and 2, and if so, will they be released with the RFP or at a later date?

No, the final RFP will not have scenarios. Section M will be corrected to remove scenarios.
33(Section L-1(j)(4); Table L-2.1) L-1(j)(4) requires all text files in

Microsoft Word (.doc or .docx). Table L-2.1 requires .pdf for Volumes 1, 2 and

5. Please confirm the required format for each volume.

L(1)(j)(4) will be corrected to state PDF. Files shall be submitted as a PDF
34(Table L-2.1, Volume 4) The Volume 4 folder name is shown as "Offeror

Name_4" while the other volumes use "_V#". Please confirm the intended folder name is "Offeror Name_V4".

Confirmed
35(Section L-2(c)(1); Table L-2.1, Volume 5) L-2(c)(1) requires cover letters

from the offeror and all subcontractors. Should subcontractor cover letters be included in the prime's Volume 5, and do they count toward the two-page Volume 5 cover letter limit?

Yes, cover letters should be included in the prime's Volume 5. Each cover letter should be a maximum of 2 pages. Section L has been updated to specify a 2 page limit.
36. (Section L-2, Volume 5 (1)(vii); Section L-1(j)(1)) Volume 5

(1)(vii) contemplates subcontractors that provide proposal information separately from the prime. May a subcontractor request its own DoD SAFE drop-off link to submit proprietary information directly, and does the four-business-day drop-off request deadline apply to subcontractors?

No. The Prime shall submit all information in the proposal. The Subcontractor shall not submit separate information.
37(Section L-2, Volume 5 (1)(vi) and (vii)) These paragraphs refer to "the

Contractor support identified above," but no support contractor is identified earlier in Section L. Please identify the support contractors that will have access to proposals.

Terry Gotter, ASRC Federal
38(Section L-2(5)(2)) The data rights paragraph refers to sustaining "the

Navy ERP system" and to "SAP configurations or modifications."

Please confirm that this paragraph applies to SLDCADA, a Government Off-the-Shelf Java and Oracle application, and will be revised in the final

RFP.

Yes, Section L-2(5)(2) will be updated to state SLDCADA vice Navy ERP
39(Section L-2(d), Factor 2, first bullet; PWS 6.2.1.1(e); PWS 6.2.3) Factor

2 references the RMF ATO "option (1 Feb 2022 to 31 Jan 2023)," PWS 6.2.1.1 is titled for March 2027 to March 2030, and PWS 6.2.1.1(e) states the current ATO expires in April 2023. Please provide the current SLDCADA ATO expiration date and whether a reauthorization is expected during the base year.

ATO expires Mar 2027. A formal, full RMF package submission/reauthorization effort is expected to be executed during the option periods of this contract (specifically aligning with the 3-year RMF cycle).
40(PWS table of contents, 6.2.3 and 6.2.4) The table of contents shows

"6.2.3 ... Error! Bookmark not defined" and a separate 6.2.4 RMF ATO entry, while the body contains 6.2.1.1 and 6.2.3. Please confirm the PWS paragraph numbering that Factor 2 refers to.

The table of contents has been corrected.
41(Section L-2(d), Factor 2; PWS 6.2.1) Factor 2 asks for a cutover strategy

for 35 servers in a DoD Impact Level 5 environment, while PWS

6.2.1 makes migration to an alternate data center or cloud hosting conditional on a Government determination. Is the cutover expected in the base year, and where is SLDCADA hosted today?

No. A system cutover or data center migration is NOT expected to occur during the base year of this contract. The base year is strictly focused on the continuous sustainment, operations, and maintenance of the existing SLDCADA system baseline. SLDCADA is currently hosted in an AWS Government Cloud (GovCloud) environment managed centrally by CloudCITI (formerly known as DC2HS). While the system consists of approximately 35 virtual servers across its development, test, staging, production, and disaster recovery environments, these servers are already fully provisioned and active within the CloudCITI-managed AWS GovCloud. The requirement in Section L-2(d), Factor 2 to outline a "cutover strategy" is an evaluation factor designed to assess the offeror's engineering capability and readiness to execute a complex migration to an alternative hosting environment or enterprise solution if the Government determines such a migration is necessary in future option years (as described in PWS §6.2.1).
42(PWS 6.1.1.2(i), CSWF Report (CDRL A00T); Attachment 06) The PWS cites DoD

8570.01-M, and Attachment 06 requires "8570/8140-compliant" IAT Level III or IASAE Level II (ISSO) and IAT Level II (Cybersecurity Analyst) certifications. DoD 8570.01-M has been replaced by DoD Manual

8140.03. Will the final RFP state the DoD Cyber Workforce Framework work roles and qualification levels for these positions?

The base year is strictly focused on the continuous sustainment, operations, and maintenance of the existing SLDCADA system baseline.
43(PWS 3, Sample Team Breakout; Attachment 06) Attachment 06 defines Senior

Cybersecurity Engineer / ISSO and Cybersecurity Analyst labor categories, but the 24-FTE Sample Team Breakout lists no cybersecurity labor category. Does the historical cybersecurity workload sit within the IT Specialist positions, and how many FTEs perform it today?

The PWS was modified to include Cybersecurity Specialists. Please review the updated PWS.
44(PWS 6.1.3.2(b) (SIPRNET console access); PWS 6.1.1.3 (T5 investigation

for privileged users)) Please state the personnel security clearance level required for cybersecurity personnel, whether a facility clearance is required of the prime or subcontractors, and whether a DD Form 254 will be included in the final RFP.

A DD254 is not required. Compliance with NIST sp 800-171 is required. CMMC is not required.
45(Attachment 06 labor categories; PWS 3) Attachment 06 names three key

positions (Task Order Program Manager, Lead Software Engineer, Lead Database Management Analyst), and its labor category names differ from the Sample Team Breakout. Please confirm the key personnel list, and whether resumes or letters of commitment are required in any volume.

Confirmed. Resumes are required at award. The Government does not evaluate resumes.
46(Attachment 05, L4 Price Workbook, CLINs x002) Each period carries an NIS

Implementation CLIN with an NTE of $1,500,000. Is Appendix D NIS implementation expected to recur in every period, or is it a one-time implementation with the ceiling available in each period? The answer is the dominant cost variable for the staffing basis of estimate.

Yes, NIS is expected for each option year. . Offerors should price CLINS 1002, 2002, 3002, 4002, 5002 as directed. NIS is required every year.
47(Section L-2(c)(1)(v); Section L-2(d), Factor 4 (3)(i)) The only cost

CLINs are the ODC CLINs (x003, NTE $60,000). Does the accounting system adequacy requirement apply to subcontractors that propose no cost CLINs?

(Section L-2(c)(1)(v); Section L-2(d), Factor 4 (3)(i)) The only cost CLINs are the ODC CLINs (x003, NTE $60,000). Does the accounting system adequacy requirement apply to subcontractors that propose no cost CLINs?

The Adequate Accounting System requirement does not apply to subcontractors.
48(Section L-2(d), Factor 3; PWS 3) Will the Government evaluate a Factor 3

staffing plan that departs from the 24-FTE Sample Team Breakout in total FTEs or labor mix, provided the basis of estimate supports it?

Yes, the 24 FTE Sample Team Breakout is an illustrative example that provides guidance. The Government will evaluate a staffing plan that differs.
49(PWS 6.1.1.10, Transition Support) Please provide the incumbent contract

or order number and current period of performance end date, so offerors can plan the 30-day phase-in.

(PWS 6.1.1.10, Transition Support) Please provide the incumbent contract or order number and current period of performance end date, so offerors can plan the 30-day phase-in.

The Government will not provide the incumbent contract number. The Period of Performance ends March 30, 2027.
50(Total small business set-aside; limitation on subcontracting (FAR

52.219-14)) Please confirm that work performed by first-tier subcontractors that are similarly situated entities counts toward the prime's compliance with the limitation on subcontracting for this order.

Confirmed
51(SAM.gov notice) Will the Government post an interested parties list for

this notice to help small businesses form teams before the final RFP?

No, the Government will not post an interested parties list.
521.Contract type and accounting requirements. Please reconcile the PWS’s FFP-only language, except for authorized ODCs, with the solicitation’s FFP-and-Cost structure. Please confirm each CLIN’s contract type and the accounting-system evidence required for award.The PWS language is correct and the contract type is correct as stated in Attachment 5.
53Section L-1(a) describes two technical factors and Price as Factor 3, while Table L-2.1 and Section M identify four factors, with Staffing as Factor 3 and Price as Factor 4. Please confirm the controlling evaluation structure and relative importance, and correct the conflicting language in the final RFP.Section L(1)(a) will be corrected. The four evaluation factors governs.
541.Proposal format - Attachment 02, Section L-1(j)(4) and Table L-2.1: The electronic-submission instructions reference Word format, while Table L-2.1 identifies PDF format for Volumes 1 and 2. Please confirm the required submission format and which instruction governs.PDF governs Volumes 1 and 2.
552.Required proposal attachments - Attachment 02: Please provide the complete final set of offeror templates and attachments, including the required staffing-plan workbook and the referenced organizational conflict-of-interest attachment. Please identify any documents that offerors must develop in their own format.Offerors shalll develop their own format for OCI submission, if applicable.
563.Subcontractor documentation - Attachment 02, cover-letter requirements, and team-member/subcontractor agreements: Please clarify which requirements apply to subcontractors performing only firm-fixed-price work. In particular, are DCAA/DCMA contacts and accounting-system adequacy evidence required for a subcontractor that will not propose or bill any cost-reimbursement CLINs? Please also confirm whether subcontractor cover letters count toward a proposal page limit and whether UEIs replace the DUNS references.If the DCAA Report is unavailable, other information pertinent to accounting system adequacy may be submitted. Offerors must have an adequate accounting system.
574.Personnel qualifications—attachment 06 and PWS security requirements: Please identify which labor categories require a Tier 5 investigation, security clearance, privileged-access authorization, or specific cybersecurity certifications. Please distinguish investigation requirements from clearance eligibility and specify whether each requirement must be satisfied at proposal submission, award, or before personnel receive access.1. Investigation vs. Clearance Eligibility Investigation (Trustworthiness/Suitability): Determines eligibility for IT sensitive positions (IT-I / IT-II). Tier 5 (T5 / SSBI): Required for all privileged users (IT-I), including Systems Administrators, Database Administrators, and the Senior Cybersecurity Engineer / ISSO. Tier 3 (T3): Required for all non-privileged personnel (IT-II), including standard software developers, test engineers, and functional analysts. Clearance Eligibility: All personnel requiring elevated/privileged access or entering spaces with SIPRNET terminals must possess Secret eligibility or higher. 2. Privileged Access & Cybersecurity Certifications (DoD 8140 / 8570) All personnel designated as Privileged Users or assigned to Cybersecurity Workforce (CSWF) roles must hold baseline certifications: Senior Cybersecurity Engineer / ISSO: IAM Level II/III baseline certification (e.g., CISSP, CISM, or CASP+). Cybersecurity Analyst / SysAdmin / DBA: IAT Level II baseline certification (e.g., Security+ CE, CySA+, or SSCP), plus appropriate Computing Environment (CE) training/certification. 3. Timing of Satisfaction (Milestones) Proposal Submission: Offerors must provide staffing matrices and candidate resumes confirming that proposed personnel already possess or meet the required investigation levels, active clearance eligibility, and mandatory certifications. Contract Award: Key personnel must be verified with active DISS/NBIS records and current certifications. Performance / System Access (Day 1): All requirements (favorable adjudication, active clearance, signed Privileged Access Agreements (PAAs), and active certifications) must be fully active and verified in NBIS and DoD Cyber Exchange BEFORE receiving system access.
585.Company security requirements - PWS Section 9.3: Please confirm whether a facility clearance or classified access is required for any portion of this task order. If applicable, please provide the DD Form 254 and identify whether the requirements apply to every subcontractor or only to entities performing the affected work.A DD254 will not be provided. . The requirements only apply to entities performing the work.
596.Cybersecurity obligations: Please identify the task-order-specific NIST SP 800-171, SPRS assessment, and CMMC requirements, including the applicable clauses, required assessment or certification level, and compliance timing. Please clarify their applicability to subcontractors performing development or testing with synthetic or approved unclassified data and without access to CUI.1. Regulatory Clauses & Requirements DFARS 252.204-7012 (Safeguarding Covered Defense Information): , DFARS 252.204-7020, CMMC 2.0 (32 CFR Part 170): . FAR 52.204-21 . 2. Applicability to Subcontractors (The Synthetic Data Exemption) No Access to CUI: If a subcontractor is performing software development or test execution utilizing only synthetic, non-proprietary, or approved publicly available test data, and has no access to live production environments, real PII, or CUI, they are NOT subject to DFARS 252.204-7012/7020 (NIST 800-171 / CMMC Level 2) .
607.Telework and work location - PWS Section 9.1: Please clarify the process and criteria for COR authorization of personnel outside the commuting distance of a NAVWAR/CPE WEBS office. May a defined application-development, integration, or testing work package be performed from Texas using approved systems? Please identify any mandatory onsite activities and expected reporting locations.The RFP will be updated to state: Unless authorized by the COR, when telewroking, contractor personnel shall be within commuting distance1325 10th Street SE, Washington, DC. The contractor must be able to access these sites for routine NMCI updates. Commuting distance is defined as a distance the Contractor is willing to travel voluntarily without reimbursement when they are required to be in the office with little to no notice by the Government.
618.Development and test resources - PWS application and interface requirements: What Government-furnished development/test environments, repositories, tools, documentation, test data, and interface specifications will be available? Please clarify the availability of test access or representative test interfaces for DCPS, GEX, and Navy ICAM, along with expected access-provisioning lead times.The Government provides a robust, pre-configured development and testing ecosystem hosted within the CloudCITI AWS GovCloud environment. The contractor will receive access to the active application source repositories, system documentation, and standard test data baselines. Because SLDCADA exchanges data with critical enterprise systems (DCPS, GEX, Navy ICAM), the Government maintains dedicated staging/test endpoints for these interfaces. Bidders should expect standard Navy account-provisioning lead times to range from 15 to 30 calendar days from the submittal of completed security and SAAR-N paperwork.
629.Current technical baseline: Please identify the authoritative current hosting, authorization-to-operate, and migration baseline. Will the final solicitation update historical dates and legacy references, including the April 2023 ATO expiration reference, and distinguish completed activities from work required under the new task order?The PWS is being updated to correct outdated legacy references, and resolve chronological conflicts (including the legacy April 2023 ATO reference).
6310.Transition and deliverables - PWS Section 6.1.1.10 and deliverables table: Please reconcile the transition-plan submission and approval dates with the requirement to conduct phase-in during the first 30 calendar days. Please also provide the applicable DD Form 1423 CDRLs and identify the governing delivery schedules and acceptance criteria where the PWS, deliverables table, and QASP differ.The Transition Plan shall be developed and submitted during the phase-in period in accordance with the final CDRL schedule. The Government will provide the applicable DD Form 1423 CDRL package, including required delivery dates and acceptance criteria, with the final RFP. Offerors shall use the final CDRL package as the authoritative source for deliverable due dates, format, review, and acceptance requirements.
6411.Pricing structure: The notice describes a firm-fixed-price task order, while Section L references Cost CLINs for other direct costs. Please confirm the intended CLIN types, government-provided not-to-exceed amounts or pricing assumptions, and how offerors should address those items in Attachment 05.The CLIN types in Attachment 5 govern.
6512.Final solicitation and submission schedule: Please confirm whether November 2, 2026, remains the anticipated final RFP release date and whether December 1, 2026, at noon Eastern remains the anticipated proposal deadline. Please also clarify the four-business-day advance request requirement for DoD SAFE submission links, including how the Thanksgiving holiday affects that calculation.November 6th is the final RFP release date and December 6th at 6PM Eastern is the anticipated proposal deadline. The RFP will be amended to have the DOD SAFE request date December 1st at 12 PM EST.
66(PWS §6.1.3.2(e)–(f) and Appendix D, Id 996219 (CAC & PIV Authentication)). PWS §6.1.3.2(e)–(f) and Appendix D requirement Id 996219 (SLDCADA - Enable CAC & PIV Authentication (Modern Auth)) cover CAC/PIV authentication to the SLDCADA application. Does the Government also require CAC/PIV true multi-factor authentication (MFA) at Windows logon on the workstations used to reach SLDCADA, including contractor-furnished workstations under PWS §7.7? If so, is that capability within the scope of this task order, or is it provided by the Government?No. The CAC/PIV authentication requirement applies to access to the SLDCADA application and designated supporting cloud environments. The Government does not require the contractor to implement CAC/PIV-based Windows logon or workstation-level multi-factor authentication for end-user or contractor-furnished workstations under this task order.
672 (PWS §6.1.3.2 (Cybersecurity Management)). Are any Windows workstations or supporting systems used by SLDCADA users, timekeepers, administrators or contractor support personnel offline or standalone, or still accessed with passwords rather than the CAC/PIV credential? If so, is protecting that access with each user's existing issued CAC/PIV credential within the scope of the PWS §6.1.3.2 cybersecurity tasks?No. SLDCADA access is controlled through Common Access Card/Public Key Infrastructure (CAC/PKI) authentication. The Government is not identifying offline or standalone Windows workstations, end-user endpoint configuration, or enterprise workstation authentication as part of the SLDCADA cybersecurity-management scope.
68PWS §9.3 (Security Requirements), comment for the final RFP). For the final RFP, would the Government consider adding a requirement that personnel with privileged access to the SLDCADA environment log on to their Windows workstations with true MFA using their existing issued CAC/PIV credential, with the workstation logging the user off when the card is removed? If so, how would the Government verify it?No
69(PWS §6.1.2.2(c) (Mobile Interface) and §6.1.3.2 (Cybersecurity Management)). Are there any SLDCADA work areas or systems where mobile devices are not permitted, so that SMS or phone-based authentication cannot be used? If so, would the Government expect multi-factor authentication in those areas to use each user's existing issued CAC/PIV credential instead?SLDCADA access is based on Common Access Card/Public Key Infrastructure (CAC/PKI) authentication.
70(PWS §7.6 (Software Licenses) and §7.7 (Contractor Furnished Resources)). PWS §7.6 states the Government will provide software licensing for required products. If additional COTS authentication software is needed, would the Government expect to acquire it through NASA SEWP, GSA, or another vehicle?The Government does not anticipate a requirement for additional COTS authentication software.
71(PWS §6.1.3.2 (Cybersecurity Management) and §7.7 (Contractor Furnished Resources)). Do any SLDCADA environments, such as development, test, continuity-of-operations or disaster-recovery sites, include offline or standalone Windows workstations where the CAC/PIV certificate cannot be validated online? If so, does the Government require that those workstations allow logon only by specific authorized users with their existing issued CAC/PIV credential, verify the certificate locally on the workstation, and let IT add or remove authorized users as needs change? Is that within the scope of this task order?No. All SLDCADA environments, including production, development, test, continuity-of-operations, and disaster-recovery environments, are hosted in the AWS Government Cloud and managed by Cloud CITI, formerly Data Center and Cloud Hosting Services (DC2HS).
72Page 6 of the Performance Work Statement (PWS) identifies a sample team breakout consisting of 24 total FTEs. However, the sum of the FTEs listed by labor category equals 23 FTEs. Can the Government please clarify this discrepancy and provide an updated team breakout or confirm the correct total FTE count?The sample team count has been corrected.
73On Page 6 of the PWS, the sample team breakout includes Program Mgmt. Analyst - Mid and Configuration Manager - Jr labor categories with 0 FTEs assigned. Please clarify the purpose of including these positions in the sample breakout and how the Government intends Offerors to interpret these labor categories when developing their proposed staffing approach.Offerors are intended to use this example to help develop their proposed staffing approach.
74There is a CUI cover page, but no subsequent CUI markings or data that appears to be CUI in nature. Can the government revisit and consider removing the cover page and CUI markings?No
75Is the Government expecting migration activities to be initiated during the base period, and has a target hosting provider, cloud broker, or destination environment already been identified?No. The Government does not expect any migration, decommissioning, or transition activities to be initiated during the base period of this task order. The primary objective of the base period is the continuous, uninterrupted sustainment and maintenance of the existing SLDCADA system baseline.
76What level of incumbent contractor participation and documentation access will be provided during transition-in activities?It is expected there will be a month of transition out activities from the incumbent.
77Has the NIS integration effort been fully implemented, partially implemented, or will additional NIS capabilities be developed under this contract?The NIS integration effort has been fully implemented and is currently in active production. However, if additional NIS capabilities, technical refreshes, and interface modifications are needed, it will be covered and implemented under this contract.
78Can the Government provide current database sizing, transaction volumes, growth rates, and known performance bottlenecks that offerors should consider when proposing database optimization strategies?No
79Are there planned command onboardings, migrations, or user population increases anticipated during the period of performance beyond the existing user base?No
80What RMF documentation, control ownership, and ATO responsibilities remain with Government-managed service providers versus the contractor?The Government-managed service providers, including Cloud CITI and the underlying AWS Government Cloud environment, retain responsibility for inherited hosting and infrastructure controls, including physical security, core cloud infrastructure, and network-level controls. The evidence and inherited-control information applicable to SLDCADA are maintained in the Government’s RMF documentation. The Government retains responsibility for overall RMF governance, control-ownership determinations, maintenance of the System Security Plan and associated authorization artifacts, risk acceptance, and Authority to Operate decision-making. The contractor is responsible for implementing, operating, documenting, monitoring, and providing evidence for contractor-executed application, operating-system, database, configuration, vulnerability-management, logging, STIG, remediation, and continuous-monitoring activities required by the PWS. The contractor shall support preparation and maintenance of RMF artifacts, Plans of Action and Milestones, security assessment evidence, and remediation actions. The Government will provide applicable RMF documentation, inherited-control information, and access to authorized personnel after award, subject to access-control and need-to-know requirements.
81For evaluation purposes, how will the Government balance sustainment experience, audit support experience, cloud migration capability, and modernization expertise when assessing technical merit?The Government's evaluation criteria are outlined in Section M
82The technical evaluation factor references a cutover strategy for 35 servers, while the PWS references 36 total servers supporting Development, Test, Production, High Availability, and Disaster Recovery environments. Please clarify the authoritative server count for proposal assumptions.For proposal-planning purposes, offerors shall use 36 servers as the authoritative server count supporting the SLDCADA Development, Test, Production, High Availability, and Disaster Recovery environments.
83The solicitation references both current operational requirements and modernization initiatives, while also identifying various tools and platforms that may no longer be in line with the current SLDCADA operating environment. If an Offeror references the Government's currently deployed SLDCADA tools, processes, and technologies, or proposes industry-standard modern DevSecOps practices and successor technologies that satisfy all required capabilities, will the Offeror be evaluated negatively or considered non-compliant for not relying upon the legacy tools specifically identified in the solicitation documents, provided the proposed solution fully supports all required functionality, reporting, configuration management, cybersecurity, auditability, and operational requirements?The Government's evaluation criteria are outlined in Section M
84The solicitation includes multiple requirements related to cloud migration, transition to a DoD IL5 environment, coordination with the Navy Cloud Broker, DISA Cloud Access Point (CAP) approvals, and migration of the SLDCADA hosting environment. Can the Government clarify whether these migration-related requirements are primarily being driven by the need to achieve or maintain DoD Impact Level 5 (IL5) compliance, or whether they are also intended to address operational, technical, performance, cost, supportability, or strategic concerns associated with the current hosting environment and/or the current Navy Cloud Broker arrangement? Additionally, are offerors expected to assume that migration from the current hosting environment is a planned program objective during the ordering period?1. Strategic Intent & Drivers for Migration Requirements IL5 Compliance is Already Achieved: SLDCADA is currently hosted in AWS GovCloud managed by CloudCITI (formerly DC2HS), which is an accredited DoD Impact Level 5 (IL5) environment operating under an active ATO with DISA Cloud Access Point (CAP) connections. Therefore, migration requirements are not driven by an urgent need to achieve initial IL5 compliance. Contingency, Modernization, and Supportability: The migration, cloud cutover, and Navy Cloud Broker coordination requirements outlined in the solicitation exist to: Evaluate offerors’ technical capability to support future architectural modernizations, containerization, and cloud-native optimizations. Maintain readiness to transition to an alternate enterprise cloud hosting provider, brokerage model, or future DoD enterprise business system should the Government mandate such a change. Ensure the contractor can coordinate across enterprise stakeholders (Navy Cloud Broker, DISA, CloudCITI) to maintain continuous operational availability, high performance, and cost efficiencies. 2. Baseline Assumptions for the Ordering Period Not a Planned Baseline Objective for the Base Year: Offerors should NOT assume that migration from the current CloudCITI AWS GovCloud hosting environment is an active or planned program objective to be initiated during the base ordering period. Sustainment-First Assumption: Offerors must assume that the base period—and the baseline Firm-Fixed-Price (FFP) CLINs—will be dedicated to continuous operations, maintenance, cybersecurity sustainment, and software change requests (SCRs) within the existing CloudCITI AWS GovCloud environment. Optional Future Scope: Migration activities (under PWS §6.2.1) are conditional and would only be executed if the Government exercises specific optional tasks or issues a contract modification. The evaluation of cutover and migration strategies under Factor 2 is strictly designed to assess offeror competency, risk management, and architectural understanding.
85The reference says "The plan must also include the contractor’s specific approach to each of the 14 items specified in bullet 1 under section 5.1.1. of the PWS." It appears that the reference should be to section 6.1.1 of the PWS. Can the Government provide clarification?Section 6.1.1 is correct. A correction will be made for the final RFP.
86The initial reference says "The files shall be submitted in (1) Microsoft Word for all text in .doc or .docx files in original searchable text format..." However, all text files in Table L-2.1 are specified to be in .pdf format. Can the Government provide clarification?PDF governs
87Table L-2.1 specifies folder names. Can the government clarify whether or not Offerors will need to submit folders via DoD SAFE, or only files?The Offeror shall submit folders via DoD SAFE prior to the solicitation closing time. The Government will not evaluate proposals submitted after the soliciation closing time.
88) Instructions for the cover letter are provided in multiple sections. Could the Government consolidate all cover letter instructions into one section? 2) Should the "Responsibility Information" response details be included in the cover letter or in some separate file? 3) Given the amount of information to be included in the Cover Letter would the Government consider increasing the page limitation to 3 pages?No, the Government will not consolidate. The page limit remains 3 pages. Responsibility Information can be a separate file. The RFP will be amended for responsibility information.
89Is the bullet point that begins with "Describe your specific approach to using Navy ICAM and Enterprise Active Directory..." inadvertently cut off?No
90Can the Government confirm that proposed subcontractors only need to submit their cover letter and Organizational Conflict of Interest documentation, or are there other files that proposed subcontractors must submit?Confirmed
91May the Prime Offeror submit documents on behalf of proposed subcontractors, or must proposed subcontractors submit their documents directly through DoD SAFE?The Prime shall submit all documents on behalf of the subcontractor. The subcontractor does not submit any documents.
92In the paragraphs regarding Volume 5: Task Order Administrative Documents, there is no section (3) included. Can the Government correct as needed?The Government will update and mark 3 as Reserved.
93Regarding Volume 5: Task Order Administrative Documents, part (5) Licenses, Service Level Agreements, and Data/License Rights - 1) should the reference to "competitively sustain the Navy ERP system" instead be to the SLDCADA system? 2) There is no reference in Table L-2.1 to this information. What file name should be used?The reference will be corrected to SLDCADA system.
94Please clarify the intended distinction between the migration and audit-related evaluation criteria in Volume 1, Factor 1 and Volume 2, Factor 2. As currently written, cloud migration planning, system transition activities, RMF/ATO compliance, cybersecurity controls, FIAR support, and FISCAM auditability appear to be interrelated activities that would require largely overlapping responses. What unique evaluation aspects does the Government intend to assess under each factor, and how should Offerors avoid unnecessary duplication of content while remaining fully responsive?Offerors should directly respond to each bullet or item as written. The Government will evaluate each factor in accordance with Section M.
95The PWS indicates there are approximately 60k users of SLDCADA, however the 'System Reliability' graphic provided within the PWS does not show data above 4k (~56k delta). Is the graphic representative of the entire user population, or captured as a "moment in time" snapshot? Please confirm the current number of SLDCADA users.There are approximately 60,000 users.
96Relationship between sustainment and modernization: Please clarify how this procurement fits within the Navy’s long-term timekeeping and attendance modernization strategy. Is the anticipated outcome continued sustainment and incremental enhancement of SLDCADA, preparation for migration to an enterprise solution, or implementation of a broader replacement effort? Please identify any approved roadmap or decision milestones that offerors should use in developing their approaches. Will SLDCADA be migrated to Navy ERP or Navy ERP+?. The anticipated outcome is continued sustainment of SLDCADA. The Navy does not anticipate migrating to ERP.
97Since SLDCADA is accessed through a single entry point, "SLDCADA’s website, https://www.sldcada.dc3n.navy.mil, is a single point of entry to the application," what safeguards are in place to prevent "man-in-the-middle" (MITM) and cross-site scripting (XSS) attacks, and is a DNS proxy used to protect against direct access to the SLDCADA website from unauthorized users?Yes. Extensive network-edge and application-level safeguards are in place to mitigate "man-in-the-middle" (MITM) and cross-site scripting (XSS) attacks . Because SLDCADA is hosted within a secure DoD Impact Level 5 (IL5) AWS GovCloud framework, all incoming public traffic must route through a protective DNS proxy and a Web Application Firewall (WAF) managed at the enterprise boundary . Direct IP-based bypass of the SLDCADA website by unauthorized users is technically blocked at the cloud and network-edge border.
98What tunneling protocol is used to protect data in transit between applications and networks, in accordance with the following architectural reference, "SLDCADA transfers civilian time data to DCPS"? Additionally, what firewall safeguards are in-place to discriminate between valid API calls and unauthorized transactions?In the Department of War (DoW) and wider Department of Defense (DoD) information system architecture, the transit of civilian time and attendance data from the Standard Labor Data Collection and Distribution Application (SLDCADA) to the Defense Civilian Pay System (DCPS) is governed by strict Impact Level 5 (IL5) security controls
99The Government cites "Cloud/Alternate Data Center Hosting Services Migration." Is there a preferred location for the physical server farm to reside (e.g., Northern Virginia), and is this a replacement or a contingency of operations (COOP) site destination in support of, or a replacement to the CITI data center? Will the cloud/alternate site be co-located within the AWS-GOV Cloud West region?SLDCADA currently resides in a fully operational AWS GovCloud West hosting architecture managed centrally by CloudCITI. The Alternate/COOP Location: The primary, pre-approved alternate data center / cloud-broker destination for disaster recovery (DR) and Continuity of Operations (COOP) is AWS GovCloud West

This is the start of the file's text. The full file is on GovTribe.

File details come from the government source that posted it. Updated .