ComputerQuestionsAnswersAmend4.pdf

N02-CO-82402-92

“Computer and Statistical Support Services at the NCI-Frederick”

Additional Questions & Answers

1. Pg 61 SOW, section 4- Schedule: Do we need to have a project schedule for the RFP? I don't think we do. The RFP says "they shall be treated as desired or recommended schedules" unless the RFP stipulates them as mandatory.

A project schedule is not required in response to the RFP.

2. Pg 63-64 Information Security section 6 FISMA- the answer is essentially just a compliance statement? Pg 65-66 section G Draft ISSP - on hold until further notice? Pg 65 section F NIST Self Assessment Questionnaire- on hold until further notice? Pg 64-65 section C Employee Requiring Suitability Investigation -on hold until further notice?

As stated in a prior Amendment, the requirement for a Self Assessment Questionnaire and Information Security Plan will not apply for the base proposal as work to be conducted under the base proposal will be performed at the Government’s facility.

However, if an offeror proposes an alternate proposal and the alternate proposal includes work to be conducted at a contractor’s and/or subcontractor’s facility, the Self Assessment Questionnaire and Information Security Plan will be required as part of the alternate proposal.

3. The attachment 11 has an Excel spreadsheet for pricing. We should use the format provided “Base Business Pricing Sheet" in the solicitation, not the one in attachment 11?

The pricing sheets are provided for guidance with pricing the base proposal. The spreadsheet provided in Attachment 11 could be used as a basis for structuring pricing for an alternate proposal.

Format on the business proposals are not specified, but offerors must be sure to include all information that is requested in the Business Proposal Instructions of the RFP.

4. The SOW states: “The Contractor shall provide a help-desk which will be the contact point for all routine and emergency work requests.” However there is no information about whether there is an existing help desk that the contractor will take over or if a help desk must be created including purchase of a help desk software platform. If there is an existing help desk, which software platform is being used and how many personnel are staffing the current help desk?

There is an existing Help Desk. The incumbent uses an in-house software platform. There are 12 people staffing the help desk, including a manager.

5. Does off-site processing of administrative contract information not including any confidential or proprietary information from NCI-Frederick trigger the requirements for a Self-Assessment Questionnaire and ISSP?

For example, accepting email messages regarding NCI work into the contractor’s email system might be considered “work… conducted at a contractor’s and/or subcontractor’s facility”. Or are the security requirements only triggered by contract work physically performed at a contractor or sub-contractor site?

The security requirements are triggered by contract work physically performed at contractor or subcontractor site.

6. Does the government or the incumbent contractor have an MS SharePoint server and/or SharePoint services on site?

Yes, there are SharePoint services on site.

7. Does the government or the incumbent contractor have a document management/work product storage repository that is accessible to the contractor technical support staff?

There is not a work product storage repository per se, but the contractor has access to whatever information they need and transfer of historical information would be part of the transition plan.

8. Does the RFP include contractor asset management/reporting requirements? If yes, will the contractor have access to the OTS system for the purpose of inventory?

The reporting requirements are outlined in Section C of the RFP.

The Computer Property Listing is also included in the RFP and the contractor has access to this for the purposes of inventory.

9. Are there work functions that must be sustained by the contractor in the event of a natural disaster or other catastrophic event?

Yes. This is part of internal risk management and mitigation, including contingency planning, continuity of operations, and service recovery. The specific work functions may include maintaining specific IT functions and infrastructure, especially related to maintaining scientific data and documentation, payroll, acquisitions, and logistics. The contractor, in collaboration with the Operations and Technical Support contractor is also responsible for maintaining telework support. Altogether, this includes maintaining:

connections to off site locations and for teleworkers, power to operate internal IT and telecommunications equipment, and desk top support and training to teleworkers. The NCI-F web site needs to be maintained as this is where information and emergency communications are posted. These guidelines are reviewed and discussed on a regular basis in the venue of a campus wide Emergency Preparedness Committee and in conjunction with the NIH Center for Information Technology.