Solicitation Questions and Answers.pdf

Solicitation N0018926Q0006 – Questions and Answers

1. Would be possible to update the requirements on the NAICS code (541519) to be inclusive of the ITVAR

ExcepƟon clause which would allow small businesses with under 150 employees to respond as well?

No, this clause is not applicable to the proposed acquisiƟon.

2. Has the U.S. Naval Academy previously received contractor support for Mock CORA, CCRI, or similar cybersecurity inspecƟon-readiness efforts? If so, can the Government share high-level, non-proprietary informaƟon regarding the general scope or duraƟon of prior efforts to assist offerors in calibraƟng staffing and cost assumpƟons?

This is a new requirement with no incumbent.

3. Would the Government consider extending the period of performance to April 30, 2026?

This would be acceptable if all deliverables are complete by that date. However, USNA has strict academic schedules that must be prioriƟzed.

4. The CLIN table references a period of performance described as “2 Days,” while SecƟon 4.0 of the Performance Work Statement requires a two-week (10 business day) on-site assessment followed by reporƟng and final delivery. Can the Government confirm the intended level of effort and whether pricing for CLIN 0001 should reflect the full two-week on-site assessment and all post-inspecƟon reporƟng acƟviƟes described in the PWS?

The Government confirms that all work must be completed on or before April 30, 2026. The CLIN table idenƟfies the period of performance as two (2) days AŌer Date of Contract (ADC) through April 30, 2026.

The two-week (ten business day) on-site assessment, as well as all associated analysis, reporƟng, and final deliverables described in SecƟon 4.0 of the Performance Work Statement, shall be performed within this period of performance. The specific dates for the on-site assessment will be coordinated between the requiring acƟvity and the Contractor aŌer contract award. Pricing for CLIN 0001 shall reflect the full level of effort required to complete the on-site assessment and all post-inspecƟon reporƟng acƟviƟes in accordance with the PWS.

5. Can we request a two week extension through the holidays on the subject solicitaƟon?

The Government does not intend to extend the solicitaƟon due date

6. The solicitaƟon includes DFARS 252.204-7012, 252.204-7019, and 252.204-7020 requirements. Is the contractor required to have a current NIST SP 800-171 DoD Assessment score posted in SPRS at the Ɵme of quote submission, or is this requirement applicable only prior to contract award?

Per DFARS 252.204-7019(b), “Requirement. In order to be considered for award, if the Offeror is required to implement NIST SP 800–171, the Offeror shall have a current assessment ( i.e., not more than 3 years old unless a lesser Ɵme is specified in the solicitaƟon) (see 252.204–7020) for each covered contractor informaƟon system that is relevant to the offer, contract, task order, or delivery order. The Basic, Medium, and High NIST SP 800–171 DoD Assessments are described in the NIST SP 800–171 DoD Assessment Methodology located at hƩps://www.acq.osd.mil/asda/dpc/cp/cyber/docs/safeguarding/NIST-SP-800- 171-Assessment-Methodology-Version-1.2.1-6.24.2020.pdf.”

7. With CMMC Level 2 Self-Assessments, and specifically for SIPRNet environments, are contractors required under DFARS 252.204-7021 and DFARS 252.204-7025 to confirm their CMMC Level 2 self-cerƟficaƟon within the PIEE/SPRS/CMMS system?

This is not a CMMC level 2 assessment, and is an unclassified educaƟonal environment as idenƟfied in the SoW.

8. The local security text describes Privileged, Enhanced, and Authorized IT user access levels with different invesƟgaƟon requirements. What IT access level will contractor personnel require to perform the Mock CORA assessment (Privileged, Enhanced, or Authorized)? Reference: SUPTXT204-9400 - Access to DoD InformaƟon Technology Systems, pg. 47 of solicitaƟon.

CORA Assessments do not require visiƟng contractors to have Privileged, Enhanced, or Authorized Access.

All work is performed by the USNA personnel working with the assessors as observers on USNA’s technology or reviewing USNA guidance.

9. The solicitaƟon notes that onboarding delays do not relieve performance obligaƟons. Will the Government allow the two-week on-site assessment period to begin only aŌer all contractor personnel have been granted required physical and logical access to faciliƟes and systems?

Due to the short Ɵmeframe of the actual impending assessment, Government will not tolerate changes in schedule if contractor is unable to access the command physically. Government personnel will be already dedicated to the Ɵmeframe and Academic schedules deconflicted.

10. Does the Government require conƟnuous on-site presence by all proposed personnel for the full two-week assessment period, or is a hybrid approach (core on-site team with remote analyƟcal and reporƟng support) acceptable?

Assessment is to be performed in the same manner as CORA team, which is an on-site inspecƟon, engaging directly with USNA personnel.

11. Are there any minimum or maximum expectaƟons for the number of on-site personnel during the assessment window?

Based on the scope and breadth of the requested review and previous assessment experiences, 8 to 10 personnel are expected but not limited to.

12. Will ACAS, Trellix ESS, STIGViewer, SCC, CMRS, and related tooling be Government-furnished and accessible to the contractor, or should pricing assume contractor-provided licenses or infrastructure?

13. Will scans be executed directly by contractor personnel, or by Government personnel under contractor direcƟon?

14. Has USNA previously undergone a CORA or Mock CORA assessment of the unclassified educaƟonal environment, and if so, will any prior reports or arƟfacts be made available to the awarded contractor for reference? Are previous CORA assessments, penetraƟon tests, or RMF arƟfacts available for Government release?

USNA has undergone previous assessment via the Command Cyber Readiness InspecƟon (CCRI), however USNA has undergone significant changes and guidance has been modified by the CORA Team. USNA is requesƟng a current assessment.

15. Will system inventories, asset lists, and relevant network documentaƟon be provided at the start of performance, or should pricing assume Ɵme for asset discovery and validaƟon?

USNA expects the contractor to perform appropriate scoping discussions ahead of the engagement. USNA will provide any inventories, asset lists, etc. prior to the engagement. This emulates the CORA engagement, of which we are already providing data six months ahead of the assessment.

16. Will exisƟng scan results or prior vulnerability data be made available to reduce duplicate effort?

USNA is requesƟng an “as-is” inspecƟon.

17. The PWS requires daily communicaƟon of progress and criƟcal findings during the assessment. Does the Government expect daily wriƩen status reports, verbal briefings, or a combinaƟon of both during the on-site period?

To best emulate the CORA methodologies, an email summary report and a hotwash are expected.

18. The PWS requires delivery of a CORA Assessment Report but does not specify a required template. Will the Government provide a preferred CORA report format or template, or should the contractor deliver a report consistent with prior Department of War CORA inspecƟons? Is a single consolidated CORA Assessment Report sufficient to meet the deliverable requirement, or does the Government anƟcipate mulƟple reports segmented by system, enclave, or risk category?

Report should mimic CORA inspecƟon reports including technology, orders, guidance, and policies, and idenƟficaƟon of KIORs.

19. Beyond the final out-brief, are interim briefings or workshops required, or may they be proposed as opƟonal value-added acƟviƟes?

Subsequent engagement, other than administraƟve, are not required.

20. Can the Government confirm standard duty hours for on-site assessment acƟviƟes?

ExpectaƟon is hours will be from 0800 to 1700 daily with the Hotwash NLT 1630.

21. Are there any anƟcipated access constraints (aŌer-hours, weekend work) that offerors should factor into pricing?

No weekend or aŌer hours work are expected or permiƩed, USNA personnel will arrive and depart on Ɵme.

22. If mulƟple quotes are determined technically acceptable, does the Government intend to make award strictly on the basis of lowest price, or will demonstrated CORA and Department of War assessment experience be considered as part of technical acceptability?

EvaluaƟons of quotes shall be made IAW 52.212-2 EVALUATION--COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES (NOV 2021), see pg. 8 of the solicitaƟon

23. How many total systems are in scope for the Mock CORA Assessment?

Every boundary asset and a select group of systems from other technology categories. Total should be approximately 100 network, server, and workstaƟons.

24. How many IP addresses are included (internal and external), and can the Government provide the exact IP ranges?

This will not be provided.

25. What specific applicaƟons or websites (URLs) are in scope, and what is each applicaƟon's purpose?

Same as typical CORA engagement.

26. What is the technology stack for each applicaƟon (e.g., .NET, Java, PHP, Python, Node.js)?

These are typically out scope for a typical CORA engagement.

27. What operaƟng systems and hosƟng environments support the systems (Windows, Linux, cloud, hybrid)?

Windows Server, WorkstaƟon, MacOS, RedHat, Ubuntu. There are no cloud assets within scope.

28. How many acƟve users, privileged users, and system administrators exist in the environment?

Not within scope of the CORA.

29. What databases are used (SQL Server, Oracle, PostgreSQL, MySQL, etc.), and how many instances are in scope?

Instance scope is undetermined and will depend on Ɵming and ensuring all technology is covered. USNA uses MSSQL, Oracle, MySQL.

30. Does the Mock CORA Assessment include a penetraƟon tesƟng component? If yes, what level is required—Black Box, Grey Box, White Box?

31. What layers are in scope for penetraƟon tesƟng (external, internal, web apps, APIs, cloud resources)?

32. Does the system(s) currently have an acƟve ATO, and when does it expire?

Yes, August of 2027

33. Are there any tesƟng constraints such as blackout windows, downƟme restricƟons, or limited hours?

34. Are there required, recommended, or prohibited assessment tools or technologies? Will a test environment be provided, or will tesƟng occur in producƟon?

35. Will Rapid Strategy receive user, privileged, or read-only database accounts for the assessment?

36. Can the Government provide current network diagrams, data flow diagrams, and system architecture documentaƟon?

USNA expects the contractor to perform appropriate scoping discussions ahead of the engagement. USNA

37. Are asset inventories, configuraƟon baselines, or CMDB data available?

USNA expects the contractor to perform appropriate scoping discussions ahead of the engagement. USNA

38. Is onsite work required? If yes, what are the base access procedures, badging requirements, and allowable equipment?

Yes, on site work is required. No, badging is not required. If someone has a CAC that's the ideal and they can drive on. However, if no one on the team has a CAC, USNA will obtain and provide base access credenƟals and parking. That will just be to drive on campus, no other badging required.