ANSWERS_TO_QUESTIONS_2ND_ROUND.pdf

N00173-17-Q-CP10

ANSWERS TO QUESTIONS 2ND ROUND

1) Are more specifics about CloudWatch utilization available. Specifically, what does # of Units correlate to? Alarms? Resources? etc..

Please provide pricing for all Cloudwatch capabilities. We expect to require a dynamic mix of Cloudwatch capabilities over the life of the contract.

2) With the Import / Export Snowball is the 100 TB Snowball Edge acceptable? How many total days during the year will snowballs be needed?

Pricing for 50TB and 80TB Snowballs is desired for proposal comparison purposes. Please provide base cost, base included onsite usage, and extra onsite day costs.

3) How does NRL expect security to be handled?

NRL will handle all IA concerns.

4) Does NRL expect to have unfettered access to the AWS GovCloud console?

Yes

5) Is the Contractor expected to manage NRL's provisioning of GovCloud user accounts to ensure proper use and upon violations, remediate infringing accounts? In other words, is the Contractor expected to be responsible for monitoring the environment?

No

6) Who holds the ATO?

NRL

7) What constitutes violations of that ATO?

The contractor should not have access to systems or data. Unauthorized access would be a violation of our ATO. There will be a number of additional controls in place on the systems that could cause an ATO violation. For further information, you can refer to the Risk Management Framework (https://rmf.org/) process.

8) What kind of data will there be in this environment? If Contractor has Root, do we need to have a secure facility?

Contractor should not have Root.

9) Under additional requirements, NRL indicates the environment will mimic "C2S capabilities", what is C2S, and what are the capabilities?

AWS GovCloud will mimic C2S to the level necessary to NRL.