Questions and Responses.pdf

ATTACHMENT 2: CYBER PLATFORM RFQ QUESTIONS AND RESPONSES

Question 1: Reference:

• PWS Section 5.c(1) and (2) - Certifications and Learning Support

• Section L, Volume 1 (Technical) - Discussion Items regarding certifications, assessments, and vouchers

Question: PWS Section 5.c(1) requires the contractor to "Provide access to cybersecurity certification preparation content associated with available platform certification pathways and industry recognized cybersecurity certifications, where applicable," and Section 5.c(2) states the contractor shall provide "certification preparation and assessment opportunities for all twenty (20) seats."

To ensure accurate Firm Fixed Price (FFP) estimating and to mitigate risks associated with 3rd-party licensing and content-integration labor, please clarify the following regarding the certification requirements:

• Content Sourcing: Does the Government expect the Contractor to procure and provide the certification preparation content and associated exam vouchers, or does the Government intend to provide its own existing curriculum/content for the Contractor to host and integrate into the proposed COTS platform?

• Required Certifications: If the Contractor is expected to provide the content, does the Government have a specific, mandatory list of required industry certifications (e.g., CompTIA, SANS, etc.), or is the Government simply requesting the native certification pathways currently available within the vendor's existing commercial offering?

• Government-Furnished Content Formats: If the Government intends to provide its own content for platform integration, can the Government please provide the current data formats, technical range requirements, and scoring methodologies for that content so that vendors can accurately price the integration labor?

Response: The Government expects the contractor to procure and provide the certification preparation content and associated exam vouchers. In addition, the Government expects the contractor to provide the content. The Government is simply requesting the native certification pathways currently available within the vendor's existing commercial offering. Refer the Revised Performance Work Statement, Attachment 1.

Question 2: Could you please confirm whether there is an incumbent contractor currently performing this requirement? If yes, please provide the incumbent contractor’s name and contract number.

Response: This is a new requirement.

Question 3: In the solicitation, Section M, 52.212-2(a), General and Volume 1 – Technical, states “Volume 1 –

Technical shall contain the quoter's responses to the discussion items "along with a completed Crosswalk," and separately states "Maximum Number of Pages: Two (2)."

Please confirm:

(1) the cover sheet is excluded from the two-page limit;

(2) whether a table of contents, if provided, is excluded;

(3) whether the completed Crosswalk for Quote (Attachment 02) is counted within the two-page limit or may be submitted as a separate attachment outside the limit;

(4) whether accessibility and security documentation such as a VPAT or SOC 2 Type II report may be submitted as attachments outside the limit; and

(5) whether the Crosswalk for Quote may be submitted in landscape orientation, given its six-column format.

Response: (1) Refer to the General Section under FAR 52.212-2 under Section M

(2) A table of contents is not necessary. If it is necessary, it does not count towards the page limit

(3) The Crosswalk does not count towards the page limit.

(4) Accessibility and Security documentation does not count toward the page limit

(5) The Crosswalk is in landscape format and should be submitted in pdf format.

Question 4: Solicitation, Section A, Notes for this requirement. Please confirm the deadline for submission of quoter questions, the date Government anticipate issues responses, and whether responses will be issued by formal amendment to the RFQ.

Response: Questions after the issuance of Amendment 0002 may not be answered.

Question 5: Solicitation, Section A, Note 1 and Section I FAR 52.2196. This requirement is a 100% small business set-aside for a commercial off-the-shelf SaaS subscription.

Please confirm that a quote from an authorized reseller or distributor of the platform is acceptable, whether the Government requires a manufacturer's letter of supply or authorization letter with the quote, and whether the platform publisher itself must qualify as a small business concern.

Response: A quote from an authorized reseller or distributor of the platform is not acceptable. Based on this, a letter of authorization letter with the quote, the platform publisher itself is not required.

Refer to the revised RFQ.

Question 6: Solicitation, Section M 52.212(a), Volume 2- Price and Section K. Volume 2 instructs quoters to submit completed DFARS 252.204-7014 from Section K. DFARS 252.204-7014 does not appear in Section K; Section K instead contains DFARS 252.204-7017 (beginning on page 14) and DFARS 252.204-7998. Please confirm which provision the Government requires quoters to complete and submit with Volume 2.

Response: That was a typographical error. It should read 252.204-7017, Refer to the revised RFQ.

Question 7 Solicitation, Section M, Volume 2 – Price and Section K FAR 52.219-28, Volume 2 instructs quoters to submit completed FAR 52.219-28 from Section I. Paragraph (g) of that clause applies only where the contractor does not have current representations and certifications in SAM for the applicable NAICS code. Please confirm whether a quoter with current and applicable SAM representations must still complete and submit paragraph (g), or whether incorporation by reference under DFARS 252.204-7998 paragraph (g) is sufficient.

Response: Check the appropriate block.

Reminder: The RFQ may contain provisions/clauses that are not in SAM. If they are not in SAM, then you are required to complete that provision/clause.

Question 8 PWS, Section 5.a(1), (6), (7) and (8), Platform Access and Licensing, The PWS requires a pool of twenty reassignable seats and states that a licensing model limiting the total number of students who may use those seats during the subscription period will not meet the requirement.

Because the number of unique users provisioned over the period affects account administration, support, assessment, and reporting costs, please provide the Government's best estimate of (1) the number of unique authorized Government users expected to be provisioned into the twenty-seat pool during the Base Period and during the Option Period, (2) the expected peak number of concurrently active users, and (3) the expected cohort rotation cadence, for example the number of student rotations per academic term. The Government's estimate will be used for pricing purposes only and is not requested as a limitation on the requirement.

Response: The student body pool is for 55 individuals; we do not know if all 55 individuals will be using the online cyber learning platform nor how many rotations of active users that will entail. Concurrent active users are expected to be the max amount of 20. The requirement to be able to see active use will dictate swapping out of active users. This should be an inherent capability and not cost driven. Refer the Revised Performance Work Statement, Attachment 1.

Question 9: Solicitation / PWS, Section M, Volume 1 - Technical / PWS Section 5.c, Certifications and Learning

Support, The RFQ requires cybersecurity certification preparation and assessment opportunities but does not identify the certifications required. Please identify (1) each specific certification, certificate, or assessment the Government requires the platform to support, whether platform-issued or third-party; (2) the specific learning pathways required; and (3) whether the requirement is intended to support DoD 8140 cyber workforce qualification, and if so, the applicable work roles, qualification areas, and proficiency levels. Please also confirm whether any legacy DoD 8570-aligned certifications remain within scope.

Response: The requirement is not intended to support DoD 8140 cyber workforce qualification directly, users will be allowed to familiarize themselves with basic cyber knowledge and skill and have access to certificates, or assessments within the platform. The learning support and preparation is the primary drive for the cyber learning platform. Refer the Revised Performance Work Statement, Attachment 1.

Question 10: Solicitation / PWS, Section M, Volume 1 - Technical / PWS Sections 5.a(8) and 5.c, Volume 1 requires unlimited vouchers and assessment attempts for contractor-issued certifications and assessments during each twelve-month subscription period, while PWS Section 5.a(8) permits unlimited rotation of users through the twenty-seat pool.

To establish a defined basis for firm-fixed-price pricing, please confirm whether the required certification and assessment benefit applies to (1) the twenty seats collectively, (2) each unique user provisioned during the subscription period, or (3) each unique user without limit. If the Government will not establish a quantity, please confirm that a quoter may price the benefit against the Government's estimate of unique users provided in response to the seat-volume question above.

Response: Each unique user without limit. Refer the Revised Performance Work Statement, Attachment 1.

Question 11: PWS, Section 5.e(1), Training and Administrative Support, The PWS requires administrative orientation and/or train-the-trainer support sessions if requested by the Government.

For pricing purposes, please provide the maximum number of sessions the Government may request during the Base Period and the Option Period, the expected duration of each session, the expected number of attendees, and whether sessions are to be delivered virtually or on site at Fort Lesley J. McNair.

Response: One session for the base period, and one for the option period. Sessions should last at least an hour, for approximately five attendees. Refer the Revised Performance Work Statement, Attachment 1.

Question 12: PWS, Section 7, Government Data and Privacy Requirements, PWS Section 7 imposes terms including Government title to Government Data, a prohibition on using Government Data to train a commercial artificial-intelligence model, return of data within thirty calendar days, secure deletion within sixty calendar days, and a written deletion certification. Commercial SaaS platforms are generally offered under standard published terms of service that do not address these provisions in the same terms.

Please confirm (1) whether the Government will accept the platform publisher's standard commercial terms of service or end user license agreement as an attachment to the quote, (2) how any conflict between those terms and PWS Section 7 will be resolved, and (3) whether a quoter should identify such conflicts as exceptions in the Crosswalk for Quote.

Response: The Government will accept the platform publisher's standard commercial terms of service or end user license agreement as an attachment to the quote. Conflict between those terms and PWS Section 7 will be resolved by the government accepting difference in standard or requirement if equal or higher than given. Quoter should identify such conflicts as exceptions in the Crosswalk for Quote. Refer the Revised Performance Work Statement, Attachment 1.

Question 13: PWS, Section 6, Security Requirements, PWS Section 6 states that the applicable security baseline and documentation will be determined by the Contracting Officer in coordination with NDU security, privacy, and information-technology officials.

To allow quoters to confirm compliance before award, please identify (1) whether a FedRAMP authorization at any impact level is required or will be required during performance, (2) whether a current SOC 2 Type II report is sufficient in the absence of FedRAMP authorization, (3) the information categorization and impact level authorized for processing on the platform, and (4) whether an Authority to Operate, DoD Cloud Computing SRG alignment, or NDU-specific security review is a condition of award or of platform activation.

Response: A FedRAMP authorization at any impact level is not required during performance. A current SOC

2 Type II report is sufficient in the absence of FedRAMP authorization. No information categorization and impact level authorized for processing on the platform is required. No Authority to Operate, DoD Cloud Computing SRG alignment, or NDU-specific security review is conditions of award or of platform activation. Refer the Revised Performance Work Statement, Attachment 1.

Question 14: PWS, Section 5.d(2), (3) and (4), Technical Support and Maintenance, PWS Section 5.d requires monthly service availability of at least 99.5 percent, seventy-two hours advance notice of scheduled maintenance, and Severity 1 acknowledgement within one hour with restoration or workaround within four hours. Commercial platform publishers typically offer these commitments only in a published service level agreement or at enterprise licensing tiers.

Please confirm whether the Government will accept the publisher's published service level agreement in satisfaction of these requirements, and whether any difference between the published SLA and the PWS targets should be identified as an exception in the Crosswalk for Quote or will be evaluated as noncompliance.

Response: Any difference between the published SLA and the PWS targets should be identified as an exception in the Crosswalk for Quote or will be evaluated as noncompliance. Refer the Revised

Question 15: PWS, Sections 5.b(9) and 13.e-f, Dashboard and Acceptance Criteria, PWS Section 5.b(9) requires a dashboard that reports user login and logout times, session duration, and last activity, refreshed within five minutes of a user activity event, and PWS Section 13.f makes the five-minute refresh an acceptance test criterion.

Please confirm (1) whether discrete login and logout timestamps are mandatory or whether session start time with a last-activity timestamp and computed session duration is acceptable; (2) whether the five-minute refresh will be evaluated as a pass or fail criterion at acceptance testing;

and (3) whether native platform reporting supplemented by CSV or XLSX export satisfies the requirement where a single dashboard view does not present every listed data element.

Response: Session start with a last-activity timestamp and computed session duration is acceptable. The five-minute refresh will not be evaluated as a pass or fail criterion at acceptance testing but will be referenced as baseline for the dashboard. A native platform reporting supplemented by CSV or XLSX export does satisfy the requirement if visually and logically intuitive. Refer the Revised

Question 16: PWS, Section 3.1, Salient Characteristics, closing sentence, PWS Section 3.1 states that the

Government may request a product demonstration, trial access, technical documentation, or other information.

Please confirm whether the Government intends to request a demonstration or trial access before award, and if so, the anticipated timeframe, format, duration, and number of trial accounts required, so that quoters can arrange publisher support.

Response: The Government does not intend to request a demonstration or trial access before award. Refer the Revised Performance Work Statement, Attachment 1.

Question 17: PWS / Solicitation, PWS Section 9, Period of Performance / Section B and Section F, PWS Section 9 states that the period of performance consists of one twelve-month base period and one twelve-month option period, but the following sentence refers to services being provided "throughout the twelve-month period" in the singular. Section B contains CLIN 0001 and Option Line Item 0002, each for one unit.

Please confirm that quoters shall price a full twelve-month subscription for each of CLIN 0001 and Option Line Item 0002, and that all requirements of the PWS apply in full to the option period.

Response: Yes.

Question 18: Solicitation, Section B, Supplies or Services and Prices or Costs, Section B provides a single firm-fixed-price line item for each period.

Please confirm that all costs, including licensing, hosting, support, certification vouchers and assessment attempts, onboarding, and any orientation or train-the-trainer sessions, are to be consolidated into the unit price for CLIN 0001 and Option Line Item 0002, and that quoters may not add separate line items or CLINs to Section B.

Response: Yes, all costs are to be included in the fixed price.

Correct, quoters may not add separate line items or CLINS to Section B.

Question 19: PWS, Section 13, Acceptance Criteria, PWS Section 13 contains two separate lists of acceptance criteria: an initial list at subparagraphs a. through k. addressing the acceptance test, followed by a second list at subparagraphs a. through e. addressing platform access, training modules, dashboard function, support, and deliverable timeliness.

Please confirm which list governs acceptance, or confirm that both apply, and identify the period within which the Government will conduct the acceptance test after platform activation.

Response: Both apply and identify the period which the Government will conduct the acceptance test for 5 business days after delivery. Refer the Revised Performance Work Statement, Attachment 1.

Question 20: Solicitation, Section A, Notes for this requirement, please confirm whether this is a new requirement or a follow-on to an existing contract. If a follow-on, please identify the incumbent contractor, the incumbent contract number, and the commercial platform currently in use.

Response: Refer to Response #2.

Question 21: Please confirm whether a small-business prime may provide the required commercial SaaS platform through an OEM or subcontractor that is not itself a small business, provided the prime remains responsible for the contract and the proposed solution satisfies all solicitation requirements?

Response: No. The Cyber Platform must be provided by a prime contractor, who is considered a small business under the RFQ NAICS code. Subcontractor arrangements are not acceptable.

Question 22: Volume II instructs quoters to complete DFARS 252.204-7014 in Section K, but Section K of the

RFQ appears to include 252.204-7017 instead. Please confirm which provision you would like submitted with the quote.

Response : See Response # 6 above.

Question 23: The PWS states that certification tracks must be available on platform. Which certifications tracks specifically does the program expect represented?

Response: The certification tracks are from an academic perspective, not direct towards a CISSP or SEC+.

The training shall be relevant, and for there to be capabilities within the environment for the certifications they offer. Refer the Revised Performance Work Statement, Attachment 1.

Question 24: The PWS states that a capture the flag must be available on the platform; given the rolling nature of 20 users it is assumed that a Flag event will be held cyclically. Would you please provide a course, user enrollment, and capture the flag event battle rhythm explanation. i.e. can the platform expect an every 8-week enrollment with a one day capture the flag at the end of that enrollment for the 20 users?

Response: Capture the Flag was removed from the requirement. Refer the Revised Performance Work

Statement, Attachment 1.

Question 25 Is there any chance of getting an extension on the RFQ submission deadline to Friday, Sep. 18th?

Response: Refer to the closing date and time in Amendment 0002.

Question 26: Our company is interested in participating in the Solicitation no. N0018926QD213 titled “Cyber

Platform”. We have reviewed SAM.gov and noted that the submission due date is Sep 14, 2026, 12:00 pm EDT. Could you please confirm if this date is correct and if there have been any updates or amendments that may not have been posted yet?

Question 27 We noticed that under the current NAICS code, our company is not eligible for the revenue size std. Name of company is asking if there is any chance you would accept a different NAICs code for this if we were the LPTA

Response: No.

Queston 28 Please confirm whether the SaaS platform offered under this solicitation is expected to be provided subject to the software manufacturer’s or platform provider’s standard commercial license and/or platform use terms, such as Terms of Use, Terms of Service, an End User License Agreement, or equivalent terms. If so, please confirm whether the applicable terms should be submitted with the quotation and whether they will be incorporated into the resulting contract.

Response: Please refer to revised Performance Work Statement in Amendment 0002.

Question 29 Is a foreign company eligible to bid?

Response: Foreign companies are ineligible to submit a quote under this RFQ, which is a 100% total small business set aside.

Question 30 Would you consider the extension of the submission deadline for additional 1 week?

Question 31 We are reviewing RFQ N0018926QD213 (Cyber Platform, NAICS 611420). The solicitation

Is a 100% Total Small Business Set-Aside under FAR 52.219-6.

1. Given 13 CFR 121.105's requirement that an eligible small business concern have a place of business located in the United States, can our company be eligible for award as the prime on this set-aside?

2. Is there any restriction in this requirement on foreign ownership, control, or influence (FOCI) beyond the small business set-aside itself, given the DFARS export-control and security clauses incorporated in the RFQ?

Response: Foreign companies are ineligible to submit a quote under this RFQ, which is a 100% total small business set aside.